npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (972) hide show

package/dist/esm/external-providers/services/external-providers-registry.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"external-providers-registry.backend.service.js","sourceRoot":"","sources":["../../../../../src/external-providers/services/external-providers-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAIH,8BAA8B,EAC9B,iCAAiC,EACjC,wCAAwC,GAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACH,sCAAsC,EAEtC,wBAAwB,EACxB,uCAAuC,EACvC,+BAA+B,EAC/B,uBAAuB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAGpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIpG,OAAO,EACH,4BAA4B,EAC5B,0CAA0C,EAC1C,gDAAgD,EAChD,qCAAqC,EACrC,8BAA8B,EAC9B,0CAA0C,EAC1C,wBAAwB,GAG3B,MAAM,sCAAsC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,8CAA8C,GAA6C;IAC7F,aAAa,EAAE,wBAAwB,CAAC,eAAe;CAC1D,CAAC;AAuBF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACH,sCAAsC,EACtC,uCAAuC,GAE1C,MAAM,yGAAyG,CAAC;AAwCjH,MAAM,6BAA6B,GAAG;IAClC,uBAAuB,CAAC,WAAW;IACnC,uBAAuB,CAAC,OAAO;IAC/B,uBAAuB,CAAC,UAAU;CACrC,CAAC;AAEF,SAAS,6BAA6B,CAAC,WAAmB;IACtD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,OAAO,UAAU,KAAK,WAAW;WAC1B,UAAU,KAAK,qBAAqB;WACpC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,2CAA2C,GAA6C;IAC1F,YAAY,EAAE,wBAAwB,CAAC,aAAa;IACpD,UAAU,EAAE,wBAAwB,CAAC,WAAW;IAChD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,kBAAkB,EAAE,wBAAwB,CAAC,mBAAmB;IAChE,gBAAgB,EAAE,wBAAwB,CAAC,iBAAiB;IAC5D,8EAA8E;IAC9E,sEAAsE;CACzE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kDAAkD,GAAoD;IACxG,UAAU,EAAE,+BAA+B,CAAC,WAAW;CAC1D,CAAC;AAEF;;;;GAIG;AACH,MAAM,2DAA2D,GAA4D;IACzH,mBAAmB,EAAE,uCAAuC,CAAC,qBAAqB;CACrF,CAAC;AAeK,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAOU;IACU;IACG;IACW;IATxE,QAAQ,CAA+D;IACvE,QAAQ,GAAuC,IAAI,CAAC;IAEpD,aAAa,GAAG,KAAK,CAAC;IAEhC,YAC0D,MAAqB,EACX,aAAsC,EACnC,YAAwC,EAC7B,uBAA8D;QAHtF,WAAM,GAAN,MAAM,CAAe;QACX,kBAAa,GAAb,aAAa,CAAyB;QACnC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE5I,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAElF,IAAI,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,mCAAmC;IACnC,wBAAwB;IACxB,mCAAmC;IAEnC;;;OAGG;IACI,KAAK,CAAC,UAAU;QACnB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YACvD,OAAO;QACX,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;QAEhE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,uEAAuE,EAAE;YACnF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;SAC/C,CAAC,CAAC;IACP,CAAC;IAEO,uCAAuC;QAC3C,MAAM,QAAQ,GAAgC,EAAE,CAAC;QACjD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,oBAAoB;iBACnD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,wCAAwC,CAAC,UAAU,CAAC,CAAC;iBACzE,MAAM,CAAC,CAAC,UAAU,EAAkC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAEjF,QAAQ,CAAC,WAAW,CAAC,GAAG;gBACpB,WAAW;gBACX,SAAS;gBACT,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACpD,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,sCAAsC,CAAC,UAAU,CAAC,IAAI,SAAS;aACrG,CAAC;QACN,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,mCAAmC;IACnC,iBAAiB;IACjB,mCAAmC;IAE5B,4BAA4B;QAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC;IAC1B,CAAC;IAEM,gBAAgB;QACnB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACI,OAAO;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAEM,+BAA+B,CAAC,UAA4B;QAC/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,CAAC;YAC9E,IAAI,UAAU,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC/B,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,iBAAiB,GAAG,YAAY,EAAE,SAAS;YAC7C,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE;YAC1D,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAS,CAAC;aACnD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;aACtE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;aACvC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;YACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,SAAS,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;YACzD,OAAO,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;mBAClC,CAAC,SAAS,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEP,sEAAsE;QACtE,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,wDAAwD;QACxD,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,sBAAsB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC;eACrE,YAAY,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,iCAAiC,CAAC,UAAU,CAAC,KAAK,8BAA8B,CAAC,OAAO;YACrG,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,sBAAsB,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;iBAClE,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACvE,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3G,OAAO,CAAC,GAAG,iBAAiB,EAAE,GAAG,aAAa,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3C,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,cAAc,GAAG,eAAe,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,qCAAqC,CAAC,UAA4B;QACrE,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;OAWG;IACI,oCAAoC,CAAC,UAA4B;QACpE,IAAI,iCAAiC,CAAC,UAAU,CAAC,KAAK,8BAA8B,CAAC,OAAO,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IAEM,2BAA2B,CAAC,UAA4B;QAC3D,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;OAWG;IACI,yBAAyB,CAAC,UAA4B;QACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACxF,CAAC;IAED;;;;;;;;;;OAUG;IACI,sCAAsC;QACzC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACvE,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAuB,EAAE,CAAC;YACtE,IACI,WAAW,CAAC,UAAU,CAAC,EAAE,QAAQ,KAAK,IAAI;mBACvC,IAAI,CAAC,oCAAoC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EACvE,CAAC;gBACC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7B,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,+BAA+B,CAAgF;IAC/G,yCAAyC,GAAG,KAAK,CAAC;IACzC,mCAAmC,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE3E,4BAA4B,CAChC,UAA4B;QAE5B,IAAI,IAAI,CAAC,+BAA+B,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;oBAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjE,IAAI,CAAC,+BAA+B,GAAG,MAAsF,CAAC;oBAClI,CAAC;yBAAM,CAAC;wBACJ,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;wBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;oBAC1D,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE;wBAC3F,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBACpC,CAAC,CAAC;oBACH,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;oBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;gBAC1D,CAAC;YACL,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAClE,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IACI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;eACjC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;eAC7B,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,CACpC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;mBAC/B,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAClG,CAAC,EACJ,CAAC;YACC,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACI,sCAAsC,CAAC,UAA4B;QACtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QACvF,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,iBAAiB,GAAG,IAAI,CAAC,yCAAyC,IAAI,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrI,OAAO,MAAM,CAAC,MAAM,CAAC;YACjB,aAAa,EAAE,oBAAoB;gBAC/B,CAAC,CAAC,sCAAsC,CAAC,oBAAoB;gBAC7D,CAAC,CAAC,gBAAgB;oBACd,CAAC,CAAC,sCAAsC,CAAC,4BAA4B;oBACrE,CAAC,CAAC,sCAAsC,CAAC,kBAAkB;YACnE,cAAc,EAAE,iBAAiB;gBAC7B,CAAC,CAAC,uCAAuC,CAAC,SAAS;gBACnD,CAAC,CAAC,oBAAoB;oBAClB,CAAC,CAAC,uCAAuC,CAAC,OAAO;oBACjD,CAAC,CAAC,uCAAuC,CAAC,MAAM;YACxD,6BAA6B,EAAE,gBAAgB,EAAE,OAAO,IAAI,IAAI;YAChE,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;YACxF,6BAA6B,EAAE,oBAAoB,EAAE,OAAO,IAAI,IAAI;YACpE,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5F,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,0CAA0C,EAAE;SAC3F,CAAC,CAAC;IACP,CAAC;IAEO,6BAA6B;QACjC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAG,OAAQ,IAAI,CAAC,aAA0C,CAAC,WAAW,KAAK,QAAQ;YAChG,CAAC,CAAE,IAAI,CAAC,aAA0C,CAAC,WAAY;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,SAAS,IAAI,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,SAAiC,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,CAAC,OAA2C,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACI,wBAAwB,CAC3B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5C,MAAM,eAAe,GAAG,SAAS,CAAC,sBAAsB,IAAI,EAAE,CAAC;YAE/D,MAAM,aAAa,GAAG,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACtF,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAClE,IAAI,YAAY,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,yCAAyC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBACtF,OAAO,IAAI,CAAC,0BAA0B,CAClC,aAAa,EACb,YAA6C,CAChD,CAAC;YACN,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,mCAAmC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,aAAa,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,4DAA4D;YAC5D,qEAAqE;YACrE,6DAA6D;YAC7D,6DAA6D;YAC7D,2DAA2D;YAC3D,4DAA4D;YAC5D,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE;gBAC3E,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;IAEO,0BAA0B,CAC9B,aAAwD,EACxD,YAA2C;QAE3C,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC;QACxB,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,uDAAuD;QACvD,+DAA+D;QAC/D,wDAAwD;QACxD,2DAA2D;QAC3D,6DAA6D;QAC7D,EAAE;QACF,6DAA6D;QAC7D,4DAA4D;QAC5D,2DAA2D;QAC3D,6DAA6D;QAC7D,6DAA6D;QAC7D,yDAAyD;QACzD,6DAA6D;QAC7D,6DAA6D;QAC7D,SAAS;QACT,MAAM,WAAW,GAAG,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC;QACxD,MAAM,UAAU,GAAG,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC;QACtD,IAAI,WAAW,IAAI,UAAU,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,OAAO,EAAE,kGAAkG;oBAC3G,WAAW;oBACX,UAAU;iBACb;aACJ,CACJ,CAAC;QACN,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,eAAe,CAC9C,aAAa,CAAC,eAAsD,EACpE,YAAY,CAAC,eAAsD,CACtE,CAAC;QAEF,OAAO;YACH,GAAG,aAAa;YAChB,GAAG,YAAY;YACf,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,kEAAkE;YAClE,oEAAoE;YACpE,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,YAAY,CAAC,iBAAiB;gBACjE,CAAC,CAAC;oBACE,iBAAiB,EAAE;wBACf,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,EAAE,CAAC;wBAC1C,GAAG,CAAC,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC;qBAC5C;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;YACT,UAAU,EAAE,IAAI,CAAC,eAAe,CAC5B,aAAa,CAAC,UAAU,EACxB,YAAY,CAAC,UAAU,CACqB;YAChD,kFAAkF;YAClF,8EAA8E;YAC9E,6EAA6E;YAC7E,oCAAoC;YACpC,eAAe,EAAE,qBAAoE;SACxF,CAAC;IACN,CAAC;IAEO,eAAe,CACnB,YAAqB,EACrB,WAAoB;QAEpB,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACpD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACnF,OAAO,WAAkD,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,OAAO,YAAuC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAA4B;YACpC,GAAI,YAAwC;SAC/C,CAAC;QACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpD,SAAS;YACb,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ;mBACf,OAAO,QAAQ,KAAK,QAAQ;mBAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;mBACxB,KAAK;mBACL,OAAO,KAAK,KAAK,QAAQ;mBACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;gBACvC,CAAC,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAGM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC;IACrF,CAAC;IAEM,2BAA2B,CAAC,WAAmB;QAClD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,YAAY,CACtD,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACI,kCAAkC,CAAC,WAAmB;QACzD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,mBAAmB,CAC7D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kDAAkD,CAAC,SAAS,CAAC,CAAC;aACjF,MAAM,CAAC,CAAC,SAAS,EAAgD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACtG,CAAC;IAGD;;;;;;OAMG;IACI,0CAA0C,CAAC,WAAmB;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,4BAA4B,CACtE,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2DAA2D,CAAC,SAAS,CAAC,CAAC;aAC1F,MAAM,CAAC,CAAC,SAAS,EAAwD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC9G,CAAC;IAGM,mCAAmC,CAAC,WAAmB;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CACxC,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QACF,OAAO,MAAuD,CAAC;IACnE,CAAC;IAEM,6BAA6B,CAAC,WAAmB;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,eAAe,GAAG;YACpB,GAAG,CAAC,eAAe,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;QACF,OAAO;YACH,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,SAAS,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACjD,sBAAsB,EAAE,eAAe,CAAC,UAAU;iBAC7C,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8CAA8C,CAAC,SAAS,CAAC,CAAC;iBAC7E,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;YAC1F,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YAC9C,yBAAyB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,yBAAyB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,GAAG,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,GAAG,CAAC,eAAe,CAAC,mDAAmD;gBACnE,CAAC,CAAC,EAAE,mDAAmD,EAAE,eAAe,CAAC,mDAAmD,EAAE;gBAC9H,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACI,sCAAsC,CACzC,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,aAAa,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,aAAa,EAAE,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,yBAAyB,mBAAmB,kBAAkB,WAAW,EAAE,CAAC,CAAC;YAC3F,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC;YACD,OAAO,0CAA0C,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,WAAW;oBACX,mBAAmB;oBACnB,OAAO,EAAE,qFAAqF;oBAC9F,eAAe,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAC9C;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAEM,4CAA4C,CAC/C,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,sCAAsC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACvG,IACI,CAAC,gBAAgB;eACd,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;eACnF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;YACC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB;YACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5F,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAEO,uBAAuB,CAAC,UAA6B;QACzD,OAAO,UAAU;aACZ,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2CAA2C,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;aACvF,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,CAC1D,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,SAAqC,CAAC,CAC1F,CAAC,CAAC;IACX,CAAC;IAEO,+BAA+B,CACnC,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAEnG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,+BAA+B,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAC5E,OAAO,SAAS,CAAC;YACrB,CAAC;YAGD,IAAI,eAAe,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;gBACnD,MAAM,0BAA0B,GAAG,SAAS,CAAC;gBAC7C,MAAM,wBAAwB,GAAG,OAAO,CACpC,eAAe,CAAC,SAAS;uBACtB,eAAe,CAAC,gBAAgB;uBAChC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CACpE,CAAC;gBACF,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,0BAA0B;oBAC1B,iBAAiB,EAAE;wBACf,CAAC,0BAA0B,CAAC,EAAE;4BAC1B,UAAU,EAAE,8BAA8B,CAAC,kBAAkB;4BAC7D,OAAO,EAAE,eAAe,CAAC,YAAY;4BACrC,IAAI,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;4BAC5C,6BAA6B,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;4BACzF,QAAQ,EAAE,wBAAwB;gCAC9B,CAAC,CAAC,4BAA4B,CAAC,wBAAwB;gCACvD,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;oCAChD,CAAC,CAAC,4BAA4B,CAAC,YAAY;oCAC3C,CAAC,CAAC,4BAA4B,CAAC,IAAI;4BAC3C,GAAG,CAAC,wBAAwB;gCACxB,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,EAAE;gCAC9F,CAAC,CAAC,EAAE,CAAC;4BACT,6DAA6D;4BAC7D,wDAAwD;4BACxD,yDAAyD;4BACzD,6DAA6D;4BAC7D,4DAA4D;4BAC5D,2BAA2B;4BAC3B,8BAA8B,EAAE,CAAC,uBAAuB,CAAC,WAAW,CAAC;4BACrE,sBAAsB,EAAE,0CAA0C,CAAC,cAAc;4BACjF,2DAA2D;4BAC3D,6DAA6D;4BAC7D,8BAA8B;4BAC9B,iBAAiB,EAAE,qCAAqC,CAAC,aAAa;4BACtE,4BAA4B,EAAE,gDAAgD,CAAC,kBAAkB;4BACjG,GAAG,CAAC,eAAe,CAAC,qBAAqB;gCACrC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE;gCAClE,CAAC,CAAC,EAAE,CAAC;yBACZ;qBACJ;oBACD,eAAe;iBAClB,CAAC;YACN,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,2BAA2B,CAAC,eAAe,CAAC,CAAC;YACpE,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS;oBACT,CAAC,CAAC;wBACE,UAAU,EAAE;4BACR,QAAQ,EAAE,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC;4BAC1D,SAAS;yBACZ;qBACJ;oBACD,CAAC,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,eAAe,CAAC,IAAI,KAAK,oBAAoB;oBAC7C,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE;oBAC5D,CAAC,CAAC,EAAE,CAAC;gBACT,eAAe;aAClB,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,wDAAwD;YACxD,2DAA2D;YAC3D,mDAAmD;YACnD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE;gBAC1D,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,2BAA2B,CAAC,eAAgD;QAChF,QAAQ,eAAe,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,OAAO;gBACR,wDAAwD;gBACxD,yDAAyD;gBACzD,wDAAwD;gBACxD,2DAA2D;gBAC3D,2DAA2D;gBAC3D,OAAO,eAAe,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7F,KAAK,KAAK;gBACN,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,OAAO;gBACR,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,YAAY;gBACb,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,qBAAqB;gBACtB,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,YAAY;gBACb,OAAO,eAAe,CAAC,eAAe,CAAC;YAC3C,KAAK,SAAS,CAAC;YACf,KAAK,oBAAoB;gBACrB,OAAO,eAAe,CAAC,SAAS,CAAC;YACrC,KAAK,KAAK;gBACN,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YAC1C,KAAK,MAAM;gBACP,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,uBAAuB;gBACxB,yDAAyD;gBACzD,+DAA+D;gBAC/D,uDAAuD;gBACvD,OAAO,eAAe,CAAC,SAAS,CAAC;YACrC,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,eAAe,GAAU,eAAe,CAAC;gBAC/C,OAAO,eAAe,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,0BAA0B,CAC9B,eAAgD;QAEhD,QAAQ,eAAe,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,KAAK,CAAC;YACX,KAAK,OAAO,CAAC;YACb,KAAK,YAAY,CAAC;YAClB,qFAAqF;YACrF,mFAAmF;YACnF,gFAAgF;YAChF,KAAK,qBAAqB,CAAC;YAC3B,KAAK,OAAO,CAAC;YACb,KAAK,KAAK,CAAC;YACX,KAAK,SAAS,CAAC;YACf,sFAAsF;YACtF,gFAAgF;YAChF,KAAK,MAAM;gBACP,OAAO,0BAA0B,CAAC,OAAO,CAAC;YAC9C,KAAK,oBAAoB;gBACrB,OAAO,0BAA0B,CAAC,cAAc,CAAC;YACrD,KAAK,YAAY;gBACb,OAAO,0BAA0B,CAAC,MAAM,CAAC;YAC7C,KAAK,uBAAuB;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;oBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;oBACpG,OAAO,EAAE;wBACL,OAAO,EAAE,mGAAmG;8BACtG,oEAAoE;qBAC7E;iBACJ,CACJ,CAAC;YACN,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,eAAe,GAAU,eAAe,CAAC;gBAC/C,OAAO,eAAe,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,qBAAqB,CACzB,eAAyF;QAEzF,OAAO,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,GAAG,QAAQ;YACX,eAAe,EAAE;gBACb,GAAG,QAAQ,CAAC,eAAe;gBAC3B,UAAU,EAAE,eAAe,CAAC,mBAAmB;aAClD;YACD,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC;SACvC,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,iBAAiB,CACpB,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC1F,MAAM,kBAAkB,GAAG,UAAU,IAAI,SAAS,CAAC;YAEnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACpD,OAAO,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,2BAA2B,CAC/B,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;YAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;YAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;uBAChF,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAC7C,CAAC;oBACC,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,CAAC;YACL,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAChF,IAAI,cAAc,EAAE,UAAU,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/C,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAEM,8BAA8B,CACjC,WAAmB,EACnB,YAAoD;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;IACzC,CAAC;IAIM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,qCAAqC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAClF,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,UAAU,SAAS,kBAAkB,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE;gBAC5C,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,OAAO,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;gBACnD,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,eAAe,GAA2B,EAAE,CAAC;YACnD,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAChF,MAAM,iBAAiB,GAAG,cAAc,EAAE,UAAU,EAAE,SAAS,CAAC;YAChE,IAAI,iBAAiB,EAAE,CAAC;gBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBACzF,IAAI,WAAW,EAAE,CAAC;oBACd,eAAe,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC;gBACrD,CAAC;YACL,CAAC;YAED,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;gBAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;gBAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;oBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;2BAChF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;oBAClG,IAAI,WAAW,EAAE,CAAC;wBACd,eAAe,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;oBAC9D,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,iBAAiB;QAC1B,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;YAEhE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAE1B,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;gBACjF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;aAC/C,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACpD,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBACpC;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,uBAAuB;IACvB,mCAAmC;IAEzB,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;aACvG,CACJ,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AArnCY,uCAAuC;IADnD,UAAU,EAAE;IAQJ,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;yDADuB,0BAA0B;GATtG,uCAAuC,CAqnCnD","sourcesContent":["/*\n External Providers Registry Backend Service\n \n Provides runtime access to the backend provider registry and\n * their protocol configurations, secrets, and operations.\n /\n\nimport { injectable, inject } from 'inversify';\nimport {\n External_Providers_Registry,\n External_Providers_RegistryItem,\n EngineCapability,\n EngineCapabilityResolutionMode,\n getEngineCapabilityResolutionMode,\n PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY,\n} from '@wildo-ai/saas-models';\nimport {\n ExternalProvider_ExchangeProtocol_Kind,\n ExternalProvider_ExchangeProtocol_Configuration_Base,\n LLMProvider_OperationKey,\n DocumentExtractionProvider_OperationKey,\n EmbeddingsProvider_OperationKey,\n APPLICATION_ENVIRONMENT,\n} from '@wildo-ai/external-connectors-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError } from '@wildo-ai/saas-models';\nimport type { BackendProviderRegistryBackendService } from './backend-provider-registry.backend.service';\nimport type { ProviderProtocolRuntimeContract } from '@wildo-ai/external-connectors-private/backend';\nimport type { Hook_Endpoint } from '@wildo-ai/external-connectors-models';\nimport {\n AgentClientProtocol_AuthMode,\n AgentClientProtocol_ExecutionProfileSchema,\n AgentClientProtocol_HostConfigurationInheritance,\n AgentClientProtocol_PermissionCeiling,\n AgentClientProtocol_RunnerHost,\n AgentClientProtocol_WorkingDirectoryPolicy,\n CodingAgent_OperationKey,\n type AgentClientProtocol_Configuration,\n type AgentClientProtocol_ExecutionProfile,\n} from '@wildo-ai/external-connectors-models';\n\n/\n Provider-contract operation literal → the semantic coding operation key. The\n * contract package uses short literals so it need not depend on the operation\n * family that consumes it; this map is the single translation.\n /\nconst RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION: Record<string, CodingAgent_OperationKey> = {\n runCodingTask: CodingAgent_OperationKey.RUN_CODING_TASK,\n};\n\n/\n The runtime projection of an ACP provider's transport capability.\n \n Far smaller than a request/response protocol's, because ACP agents advertise\n * their own capabilities, modes and commands during `initialize` /\n * `session/new`. Re-declaring any of that in authored configuration would\n * create a second source of truth that drifts the first time the agent is\n * upgraded — so what remains is only what the HOST must know before it opens a\n * connection.\n /\nexport type RuntimeAgentClientProtocolProfile = {\n /* How the provider says to START its agent — the authority an application inherits. /\n agentCommand: string;\n agentArgs: string[];\n supportedOperationKeys: CodingAgent_OperationKey[];\n supportedModels: string[];\n supportedProtocolVersions: number[];\n sessionMetaExtensions?: Record<string, unknown>;\n /* How this agent expresses each isolation posture; an absent posture is refused, never substituted. /\n sessionMetaExtensionsByHostConfigurationInheritance?: Partial<Record<string, Record<string, unknown>>>;\n};\nimport { ExternalProvider_Auth_Kind } from '@wildo-ai/external-connectors-models';\nimport {\n ExternalProviderSelectionAuthorityKind,\n ExternalProviderSelectionOverrideStatus,\n type ExternalProviderSelectionResolutionEvidence,\n} from '~wildo-backend-lib/external-providers/models/provider-selection-resolution-evidence.backend.definitions';\n\n/\n F-6 (2026-05-06) — runtime-side projection of a resolved provider\n * configuration. The base schema (`ExternalProvider_ExchangeProtocol_Configuration_Base`)\n * lives in `external-connectors-models` (which can't import the\n * backend-only discriminated union); we extend it here at the consumer\n * boundary so callers narrow on `runtimeContract.kind` instead of\n * casting through `as any`.\n \n Optional fields beyond the base also appear on this projection:\n \n - `defaultExecutionProfileRef` / `executionProfiles` — set by\n * `getDefaultProviderConfiguration` for `kind: 'agent-client-protocol'`\n * contracts, consumed by `getAgentClientProtocolProfile` and the ACP runner.\n * - `endpoints` — set for `kind: 'webhook-originator'`.\n \n They stay typed as `unknown` here because their canonical schemas\n * live in `external-connectors-models`'s `AgentClientProtocol_Configuration` /\n * webhook surfaces and are narrowed at consumer sites already.\n /\nexport type ResolvedProviderConfiguration =\n & ExternalProvider_ExchangeProtocol_Configuration_Base\n & {\n runtimeContract?: ProviderProtocolRuntimeContract;\n defaultExecutionProfileRef?: string;\n executionProfiles?: Record<string, unknown>;\n /\n Webhook-originator endpoint descriptors emitted by\n * `buildWebhookEndpoints` 2026-05-06: now matches the canonical\n * `Hook_Endpoint` shape (with the optional `displayName` field).\n * The dead extras (`providerRef`, `path`, `secretBinding`) that\n * previously polluted the emit have been removed; their values\n * were redundant with information already carried by other\n * fields (controller loop key, route convention, `authConfig.secretRef`).\n /\n endpoints?: ReadonlyArray<Hook_Endpoint>;\n };\n\n\nconst DEFAULT_IDENTITY_ENVIRONMENTS = [\n APPLICATION_ENVIRONMENT.DEVELOPMENT,\n APPLICATION_ENVIRONMENT.STAGING,\n APPLICATION_ENVIRONMENT.PRODUCTION,\n];\n\nfunction isCompanionRuntimeServiceName(serviceName: string): boolean {\n const normalized = serviceName.trim().toLowerCase();\n return normalized === 'companion'\n \|\| normalized === 'wildo-dev-companion'\n \|\| normalized.endsWith('-companion');\n}\n\nconst RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION: Record<string, LLMProvider_OperationKey> = {\n generateText: LLMProvider_OperationKey.GENERATE_TEXT,\n streamText: LLMProvider_OperationKey.STREAM_TEXT,\n chatCompletion: LLMProvider_OperationKey.CHAT_COMPLETION,\n chatMultimodal: LLMProvider_OperationKey.CHAT_MULTIMODAL,\n generateStructured: LLMProvider_OperationKey.GENERATE_STRUCTURED,\n streamStructured: LLMProvider_OperationKey.STREAM_STRUCTURED,\n // The `Thinking` runtime operation names were RETIRED 2026-07-17 — reasoning\n // depth is the `reasoningEffort` PARAMETER, not a separate operation.\n};\n\n/*\n The embeddings protocol's OWN runtime-op → semantic-key map (RAG plan DL2/H4 surface 1):\n * embeddings operations never enter {@link RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION}, whose\n * `toSemanticOperationKeys` filter would silently DROP any key outside `LLMProvider_OperationKey`\n * — the exact fall-through a sixth LLM operation key would have died in. Disjoint kind, disjoint map.\n /\nconst RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION: Record<string, EmbeddingsProvider_OperationKey> = {\n embedTexts: EmbeddingsProvider_OperationKey.EMBED_TEXTS,\n};\n\n/\n The document-extraction protocol's OWN runtime-op → semantic-key map, for the same reason its\n * embeddings sibling above has one: each protocol kind owns a disjoint operation vocabulary, so a\n * key never falls through a foreign filter and silently disappears.\n /\nconst RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION: Record<string, DocumentExtractionProvider_OperationKey> = {\n extractDocumentText: DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT,\n};\n\ninterface RuntimeProviderScopeSelection {\n engineCapabilities?: EngineCapability[];\n}\n\ninterface RuntimeProviderScope {\n providers?: Record<string, RuntimeProviderScopeSelection \| undefined>;\n selection?: Partial<Record<EngineCapability, {\n primary: string;\n fallbacks?: string[];\n }>>;\n}\n\n@injectable()\nexport class ExternalProvidersRegistryBackendService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n protected registry: External_Providers_Registry \| null = null;\n\n protected isInitialized = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) protected readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) protected readonly configService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) protected readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) protected readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n ) {\n this.logDebug = this.logger.debugByType('ExternalProvidersRegistryBackendService');\n this.logger.setDebugTypeLogging('ExternalProvidersRegistryBackendService', false);\n\n this.logDebug('External providers registry service created (not yet initialized)');\n }\n\n // ================================\n // Initialization Method\n // ================================\n\n /\n Initialize by projecting first-class backend provider modules into the\n * runtime registry facade used by existing callers.\n /\n public async initialize(): Promise<void> {\n if (this.isInitialized) {\n this.logDebug('Service already initialized, skipping');\n return;\n }\n\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.registry = registry;\n\n this.isInitialized = true;\n this.logDebug('External providers registry initialized from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n }\n\n private buildRuntimeRegistryFromProviderModules(): External_Providers_Registry {\n const registry: External_Providers_Registry = {};\n for (const provider of this.backendProviderRegistry.getRegistry().modules.values()) {\n const providerRef = provider.metadata.ref;\n const protocols = this.backendProviderRegistry.getProtocolKinds(providerRef);\n const engineCapabilities = provider.providerCapabilities\n .map((capability) => PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability])\n .filter((capability): capability is EngineCapability => Boolean(capability));\n\n registry[providerRef] = {\n providerRef,\n protocols,\n engineCapabilities: [...new Set(engineCapabilities)],\n supportsOAuth2: protocols.includes(ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2) \|\| undefined,\n };\n }\n return registry;\n }\n\n // ================================\n // Access Methods\n // ================================\n\n public getExternalProvidersRegistry(): External_Providers_Registry {\n this.ensureInitialized();\n return this.registry!;\n }\n\n public getProviderTypes(): string[] {\n this.ensureInitialized();\n return Object.keys(this.registry!);\n }\n\n public getProvider(providerRef: string): External_Providers_RegistryItem \| undefined {\n this.ensureInitialized();\n return this.registry![providerRef];\n }\n\n public hasProvider(providerRef: string): boolean {\n this.ensureInitialized();\n return providerRef in (this.registry \|\| {});\n }\n\n /\n Public, NON-throwing readiness probe — whether `initialize()` has run.\n * Lets lazy consumers (e.g. `CompositeAuditLogSink`) distinguish the expected\n * pre-startup window (skip silently, retry later) from a genuine post-init\n * resolution fault (which must be surfaced, not swallowed) — without tripping\n * the `ensureInitialized()` throw just to probe.\n /\n public isReady(): boolean {\n return this.isInitialized;\n }\n\n public getProvidersForEngineCapability(capability: EngineCapability): string[] {\n this.ensureInitialized();\n if (this.configService.isInitialized()) {\n const activation = this.configService.config.engineCapabilities?.[capability];\n if (activation?.enabled !== true) {\n return [];\n }\n }\n\n const runtimeScope = this.getActiveRuntimeProviderScope();\n if (this.configService.isInitialized() && !runtimeScope) {\n return [];\n }\n\n const scopeProviderRefs = runtimeScope?.providers\n ? new Set(Object.keys(runtimeScope.providers))\n : undefined;\n const configuredProviders = this.configService.isInitialized()\n ? (this.configService.config.providerConfigurations ?? {})\n : {};\n\n const availableProviders = Object.values(this.registry!)\n .filter((provider) => provider.engineCapabilities.includes(capability))\n .map((provider) => provider.providerRef)\n .filter((providerRef) => {\n if (!scopeProviderRefs) {\n return true;\n }\n\n const selection = runtimeScope?.providers?.[providerRef];\n return scopeProviderRefs.has(providerRef)\n && (selection?.engineCapabilities ?? []).includes(capability);\n });\n\n // A FAN_OUT capability ignores any `selection` policy: every declared\n // provider is active, so primary/fallback ordering is meaningless (and the\n // config validator rejects authoring one). Guarding here is defense-in-\n // depth — a stray selection on a fan-out cap from a legacy/hand-authored\n // artifact never reorders or truncates the fan-out set.\n // Per-environment selection override (WILDO_PROVIDER_SELECTION_OVERRIDES,\n // authored in `wildo.infra.<env>.config.ts > providerSelection`) wins over\n // the app-wide `wildo.saas.config.ts` selection for a SELECT_ONE capability.\n // It only REORDERS — the availability/enabled filtering above is unchanged,\n // so an override naming an undeclared or capability-disabled provider\n // resolves to nothing (fail-closed), exactly like an equivalent SaaS-side\n // selection. FAN_OUT ignores it (same rule as the SaaS-side selection).\n const selectionForCapability = this.getProviderSelectionOverride(capability)\n ?? runtimeScope?.selection?.[capability];\n const policy = getEngineCapabilityResolutionMode(capability) === EngineCapabilityResolutionMode.FAN_OUT\n ? undefined\n : selectionForCapability;\n if (policy) {\n const orderedPolicyRefs = [policy.primary, ...(policy.fallbacks ?? [])]\n .filter((providerRef) => availableProviders.includes(providerRef));\n const remainingRefs = availableProviders.filter((providerRef) => !orderedPolicyRefs.includes(providerRef));\n return [...orderedPolicyRefs, ...remainingRefs];\n }\n\n return availableProviders.sort((left, right) => {\n const leftConfigured = configuredProviders[left] ? 0 : 1;\n const rightConfigured = configuredProviders[right] ? 0 : 1;\n return leftConfigured - rightConfigured \|\| left.localeCompare(right);\n });\n }\n\n public getPrimaryProviderForEngineCapability(capability: EngineCapability): string \| undefined {\n return this.getProvidersForEngineCapability(capability)[0];\n }\n\n /\n Resolve the provider ref(s) that should be ACTIVE for a capability,\n * honouring its declared `EngineCapabilityResolutionMode`:\n * - `SELECT_ONE` (the default — billing, email, observability, …): the\n * single primary (fallbacks tried on failure), as a 0- or 1-element list.\n * - `FAN_OUT` (e.g. `COMPLIANCE_AUDIT_TRAIL`): EVERY declared + available\n * provider — all active simultaneously (no primary, no failover).\n \n The single entry point a fan-out consumer (the `CompositeAuditLogSink`)\n * uses, so the resolution mode is honoured centrally rather than each\n * consumer choosing `getPrimary…` vs `getProviders…` by convention.\n /\n public getResolvedProviderRefsForCapability(capability: EngineCapability): string[] {\n if (getEngineCapabilityResolutionMode(capability) === EngineCapabilityResolutionMode.FAN_OUT) {\n return this.getProvidersForEngineCapability(capability);\n }\n const primary = this.getPrimaryProviderForEngineCapability(capability);\n return primary ? [primary] : [];\n }\n\n public isEngineCapabilityAvailable(capability: EngineCapability): boolean {\n return this.getProvidersForEngineCapability(capability).length > 0;\n }\n\n /\n G4 (audit Phase 5) — fail-open reconcile support. Whether a capability is\n * switched ON in `engineCapabilities` config (`activation.enabled === true`),\n * INDEPENDENT of whether any provider resolves to serve it. Distinct from:\n * - `isEngineCapabilityAvailable` — a provider is DECLARED (says nothing about\n * the operator's config intent), and\n * - `getRequiredCapabilitiesWithoutProvider` — a HARD requirement is unmet\n * (throws at boot; F5).\n * The G4 warn pairs this (\"the operator turned audit on\") with a zero-resolved-\n * provider check (\"but nothing is delivering it\") to flag a SILENT Layer-2\n * fan-out — a warn, never a throw.\n /\n public isEngineCapabilityEnabled(capability: EngineCapability): boolean {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n return false;\n }\n return this.configService.config.engineCapabilities?.[capability]?.enabled === true;\n }\n\n /\n F5 (audit Phase 5) — boot-guard support. Returns every capability the app\n * marked `activation.required === true` that resolves to ZERO active providers\n * (respecting the capability's resolution mode — SELECT_ONE needs a primary,\n * FAN_OUT needs ≥1 declared; a `required` capability left `enabled: false`\n * resolves to none and is therefore also caught). A non-empty result means a\n * misconfigured deployment — a HARD requirement with nothing to serve it — and\n * `StartApplicationBackendService.initialize()` throws CONFIGURATION on any.\n * Audit (`COMPLIANCE_AUDIT_TRAIL`, when marked required) is the FIRST user, not\n * a special case: this generalizes the coherence to EVERY capability.\n /\n public getRequiredCapabilitiesWithoutProvider(): EngineCapability[] {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n return [];\n }\n const activations = this.configService.config.engineCapabilities ?? {};\n const missing: EngineCapability[] = [];\n for (const capability of Object.keys(activations) as EngineCapability[]) {\n if (\n activations[capability]?.required === true\n && this.getResolvedProviderRefsForCapability(capability).length === 0\n ) {\n missing.push(capability);\n }\n }\n return missing;\n }\n\n /\n Per-environment external-provider selection override, read once from\n * `process.env.WILDO_PROVIDER_SELECTION_OVERRIDES` (a JSON map of\n * `EngineCapability -> { primary, fallbacks? }`). Projected by the Wildo\n * CLI's `env-vars-builder` from `wildo.infra.<env>.config.ts > providerSelection`.\n * Read as a string literal (not via a `platform-config-lib` import) to\n * preserve the engine → platform dependency direction — mirrors how\n * `LoggerService` reads `LOG_LEVEL` and `otel-preload` reads `OTEL_ENABLED`.\n \n Memoized on first read: env vars are fixed for a process lifetime, and\n * `getProvidersForEngineCapability` is a hot path. A malformed value is\n * tolerated (logged + ignored) so a bad override degrades to the SaaS-config\n * selection rather than breaking provider resolution.\n /\n private providerSelectionOverridesCache?: Partial<Record<EngineCapability, { primary: string; fallbacks?: string[] }>>;\n private providerSelectionOverridePayloadMalformed = false;\n private readonly malformedProviderSelectionOverrides = new Set<EngineCapability>();\n\n private getProviderSelectionOverride(\n capability: EngineCapability,\n ): { primary: string; fallbacks?: string[] } \| undefined {\n if (this.providerSelectionOverridesCache === undefined) {\n const raw = process.env.WILDO_PROVIDER_SELECTION_OVERRIDES;\n if (!raw) {\n this.providerSelectionOverridesCache = {};\n } else {\n try {\n const parsed = JSON.parse(raw) as unknown;\n if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n this.providerSelectionOverridesCache = parsed as Partial<Record<EngineCapability, { primary: string; fallbacks?: string[] }>>;\n } else {\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n } catch (error) {\n this.logDebug('Failed to parse WILDO_PROVIDER_SELECTION_OVERRIDES; ignoring per-env override', {\n error: describeCaughtError(error),\n });\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n }\n }\n const override = this.providerSelectionOverridesCache[capability];\n // Guard the shape defensively — a hand-crafted env var could carry a\n // non-conforming entry that upstream Zod validation never saw.\n if (override === undefined) return undefined;\n if (\n typeof override.primary !== 'string'\n \|\| override.primary.length === 0\n \|\| (override.fallbacks !== undefined && (\n !Array.isArray(override.fallbacks)\n \|\| !override.fallbacks.every((fallback) => typeof fallback === 'string' && fallback.length > 0)\n ))\n ) {\n this.malformedProviderSelectionOverrides.add(capability);\n return undefined;\n }\n return override;\n }\n\n /\n Sanitized provenance for the effective provider selection. This exposes\n * neither environment bytes nor provider configuration; it only preserves\n * which authority won and the generated artifact identities behind it.\n /\n public getProviderSelectionResolutionEvidence(capability: EngineCapability): ExternalProviderSelectionResolutionEvidence {\n this.ensureInitialized();\n const runtimeSelection = this.getActiveRuntimeProviderScope()?.selection?.[capability];\n const environmentSelection = this.getProviderSelectionOverride(capability);\n const overrideMalformed = this.providerSelectionOverridePayloadMalformed \|\| this.malformedProviderSelectionOverrides.has(capability);\n return Object.freeze({\n authorityKind: environmentSelection\n ? ExternalProviderSelectionAuthorityKind.ENVIRONMENT_OVERRIDE\n : runtimeSelection\n ? ExternalProviderSelectionAuthorityKind.APPLICATION_RUNTIME_ARTIFACT\n : ExternalProviderSelectionAuthorityKind.DEFAULT_RESOLUTION,\n overrideStatus: overrideMalformed\n ? ExternalProviderSelectionOverrideStatus.MALFORMED\n : environmentSelection\n ? ExternalProviderSelectionOverrideStatus.APPLIED\n : ExternalProviderSelectionOverrideStatus.ABSENT,\n applicationPrimaryProviderRef: runtimeSelection?.primary ?? null,\n applicationFallbackProviderRefs: Object.freeze([...(runtimeSelection?.fallbacks ?? [])]),\n environmentPrimaryProviderRef: environmentSelection?.primary ?? null,\n environmentFallbackProviderRefs: Object.freeze([...(environmentSelection?.fallbacks ?? [])]),\n providerRuntimeArtifact: this.configService.getProviderRuntimeArtifactEvidenceMetadata(),\n });\n }\n\n private getActiveRuntimeProviderScope(): RuntimeProviderScope \| undefined {\n if (!this.configService.isInitialized()) {\n return undefined;\n }\n\n const scopes = this.configService.config.providers?.scopes;\n if (!scopes) {\n return undefined;\n }\n\n const serviceName = typeof (this.configService as { serviceName?: string }).serviceName === 'string'\n ? (this.configService as { serviceName?: string }).serviceName!\n : '';\n if (scopes.companion && isCompanionRuntimeServiceName(serviceName)) {\n return scopes.companion as RuntimeProviderScope;\n }\n\n return scopes.backend as RuntimeProviderScope \| undefined;\n }\n\n /\n Get provider configuration for a specific protocol.\n * Falls back to default configuration from cached provider definitions if not overridden.\n /\n public getProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n this.ensureInitialized();\n try {\n if (!this.configService.isInitialized()) {\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n const appConfig = this.configService.config;\n const providerConfigs = appConfig.providerConfigurations \|\| {};\n\n const defaultConfig = this.getDefaultProviderConfiguration(providerRef, protocolKind);\n const customConfig = providerConfigs[providerRef]?.[protocolKind];\n if (customConfig) {\n this.logDebug(`Using merged custom configuration for ${providerRef}.${protocolKind}`);\n return this.mergeProviderConfiguration(\n defaultConfig,\n customConfig as ResolvedProviderConfiguration,\n );\n }\n\n if (defaultConfig) {\n this.logDebug(`Using default configuration for ${providerRef}.${protocolKind}`);\n }\n return defaultConfig;\n } catch (error) {\n // Programmer-error / contract-violation paths (cross-`kind`\n // merge guard, authKind misuse on `agent-client-protocol`) throw via\n // `errorBuilder.buildError`, producing `WildoError_Backend`.\n // Those MUST surface — they signal projection drift that the\n // silent fallback would mask. Only network/runtime hiccups\n // (the original intent of this catch) fall back to default.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting provider configuration, falling back to default', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n }\n\n private mergeProviderConfiguration(\n defaultConfig: ResolvedProviderConfiguration \| undefined,\n customConfig: ResolvedProviderConfiguration\n ): ResolvedProviderConfiguration {\n if (!defaultConfig) {\n return customConfig;\n }\n\n // Fail-closed cross-`kind` guard. Both inputs are looked up by\n // the same `(providerRef, protocolKind)` pair upstream, so the\n // discriminated-union `kind` MUST match if both contracts are\n // present. A mismatch here would silently corrupt the merged\n // result into a type-broken union member; we throw via\n // `errorBuilder.buildError` so the WildoError_Backend instance\n // is detected by `getProviderConfiguration`'s catch and\n // re-thrown past the default-fallback path (the catch only\n // swallows generic runtime errors, not contract violations).\n //\n // Note on scope: this guard fires against cross-`kind` drift\n // between `getDefaultProviderConfiguration`'s emit (carries\n // `runtimeContract`) and any caller-provided override that\n // ALSO carries `runtimeContract`. App-developer authoring of\n // `providerConfigurations.<providerRef>.<protocolKind>` does\n // not include `runtimeContract` (the backend module owns\n // that), so today the guard primarily defends against future\n // refactors of the merge call site rather than user-authored\n // input.\n const defaultKind = defaultConfig.runtimeContract?.kind;\n const customKind = customConfig.runtimeContract?.kind;\n if (defaultKind && customKind && defaultKind !== customKind) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message: `[external-providers-registry] mergeProviderConfiguration received contracts with mismatched kind`,\n defaultKind,\n customKind,\n },\n },\n );\n }\n\n const mergedRuntimeContract = this.deepMergeRecord(\n defaultConfig.runtimeContract as Record<string, unknown> \| undefined,\n customConfig.runtimeContract as Record<string, unknown> \| undefined,\n );\n\n return {\n ...defaultConfig,\n ...customConfig,\n // `executionProfiles` is a MAP OF NAMED PROFILES, so the top-level\n // spread above would drop every profile the provider synthesized\n // (including `default`, which existing consumers still resolve) as\n // soon as an application authors one profile of its own. Merge by\n // ref instead — and replace a same-named profile WHOLE rather than\n // deep-merging it: a deep merge would let an override inherit\n // `secretRef`/`secretEnvVarName` from the synthesized default and\n // silently turn a host-managed profile into a secret-injecting one.\n ...(defaultConfig.executionProfiles \|\| customConfig.executionProfiles\n ? {\n executionProfiles: {\n ...(defaultConfig.executionProfiles ?? {}),\n ...(customConfig.executionProfiles ?? {}),\n },\n }\n : {}),\n authConfig: this.deepMergeRecord(\n defaultConfig.authConfig,\n customConfig.authConfig,\n ) as ResolvedProviderConfiguration['authConfig'],\n // The deep-merge result is loosely typed (`Record<string, unknown> \| undefined`).\n // Cast back through `ProviderProtocolRuntimeContract`: the cross-`kind` guard\n // above ensures both inputs share the same `kind`, so the merged result is a\n // valid discriminated-union member.\n runtimeContract: mergedRuntimeContract as ProviderProtocolRuntimeContract \| undefined,\n };\n }\n\n private deepMergeRecord(\n defaultValue: unknown,\n customValue: unknown\n ): Record<string, unknown> \| undefined {\n if (!defaultValue && !customValue) return undefined;\n if (!defaultValue \|\| typeof defaultValue !== 'object' \|\| Array.isArray(defaultValue)) {\n return customValue as Record<string, unknown> \| undefined;\n }\n if (!customValue \|\| typeof customValue !== 'object' \|\| Array.isArray(customValue)) {\n return defaultValue as Record<string, unknown>;\n }\n\n const merged: Record<string, unknown> = {\n ...(defaultValue as Record<string, unknown>),\n };\n for (const [key, value] of Object.entries(customValue as Record<string, unknown>)) {\n const previous = merged[key];\n if (Array.isArray(previous) && Array.isArray(value)) {\n merged[key] = [...new Set([...previous, ...value])];\n continue;\n }\n merged[key] = previous\n && typeof previous === 'object'\n && !Array.isArray(previous)\n && value\n && typeof value === 'object'\n && !Array.isArray(value)\n ? this.deepMergeRecord(previous, value)\n : value;\n }\n return merged;\n }\n\n\n public getProviderRuntimeContract(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): ProviderProtocolRuntimeContract \| undefined {\n return this.getProviderConfiguration(providerRef, protocolKind)?.runtimeContract;\n }\n\n public getLLMSemanticOperationKeys(providerRef: string): LLMProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n );\n\n if (runtimeContract?.kind !== 'llm') {\n return [];\n }\n\n return this.toSemanticOperationKeys(runtimeContract.operations);\n }\n\n /\n The semantic embeddings operations a provider's `EMBEDDINGS_PROVIDER` contract declares.\n * Consumer: `EmbeddingsBackendService`, which refuses to invoke a provider whose contract\n * does not declare {@link EmbeddingsProvider_OperationKey.EMBED_TEXTS} (fail-closed, named —\n * never an undefined-method throw inside an SDK call).\n /\n public getEmbeddingsSemanticOperationKeys(providerRef: string): EmbeddingsProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n );\n\n if (runtimeContract?.kind !== 'embeddings') {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is EmbeddingsProvider_OperationKey => operation !== undefined);\n }\n\n\n /\n The semantic extraction operations a provider's `DOCUMENT_EXTRACTION_PROVIDER` contract\n * declares. Consumer: `DocumentExtractionBackendService`, which refuses to invoke a provider\n * whose contract does not declare\n * {@link DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT} — fail-closed and\n * named, rather than a 404 from a route the provider never claimed to serve.\n /\n public getDocumentExtractionSemanticOperationKeys(providerRef: string): DocumentExtractionProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n );\n\n if (runtimeContract?.kind !== 'document-extraction') {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is DocumentExtractionProvider_OperationKey => operation !== undefined);\n }\n\n\n public getAgentClientProtocolConfiguration(providerRef: string): AgentClientProtocol_Configuration \| undefined {\n const config = this.getProviderConfiguration(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n return config as AgentClientProtocol_Configuration \| undefined;\n }\n\n public getAgentClientProtocolProfile(providerRef: string): RuntimeAgentClientProtocolProfile \| undefined {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n\n if (runtimeContract?.kind !== 'agent-client-protocol') {\n return undefined;\n }\n\n const supportedModels = [\n ...(runtimeContract.models ?? []),\n ...(runtimeContract.defaultModel ? [runtimeContract.defaultModel] : []),\n ];\n return {\n agentCommand: runtimeContract.agentCommand,\n agentArgs: [...(runtimeContract.agentArgs ?? [])],\n supportedOperationKeys: runtimeContract.operations\n .map((operation) => RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is CodingAgent_OperationKey => operation !== undefined),\n supportedModels: [...new Set(supportedModels)],\n supportedProtocolVersions: [...(runtimeContract.supportedProtocolVersions ?? [1])],\n ...(runtimeContract.sessionMetaExtensions ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions } : {}),\n ...(runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance\n ? { sessionMetaExtensionsByHostConfigurationInheritance: runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance }\n : {}),\n };\n }\n\n /\n Resolve one named ACP execution profile, PARSED rather than trusted.\n \n Application-authored `providerConfigurations` are typed `unknown` all the\n * way to here, so an authored profile would otherwise reach the runner\n * unvalidated — and for this transport the unvalidated fields include the\n * environment gate and the permission ceiling. Parsing here makes the\n * profile fail closed BEFORE any agent is spawned, and applies the schema\n * defaults the authoring contract promises.\n /\n public getAgentClientProtocolExecutionProfile(\n providerRef: string,\n executionProfileRef: string,\n ): AgentClientProtocol_ExecutionProfile \| undefined {\n this.ensureInitialized();\n\n const configuration = this.getAgentClientProtocolConfiguration(providerRef);\n const executionProfile = configuration?.executionProfiles?.[executionProfileRef];\n\n if (!executionProfile) {\n this.logDebug(`ACP execution profile ${executionProfileRef} not found for ${providerRef}`);\n return undefined;\n }\n\n try {\n return AgentClientProtocol_ExecutionProfileSchema.parse(executionProfile);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n providerRef,\n executionProfileRef,\n message: '[external-providers-registry] ACP execution profile is not a valid authored profile',\n validationError: describeCaughtError(error),\n },\n },\n );\n }\n }\n\n public getAgentClientProtocolExecutionProfileSecret(\n providerRef: string,\n executionProfileRef: string,\n ): string \| undefined {\n this.ensureInitialized();\n\n const executionProfile = this.getAgentClientProtocolExecutionProfile(providerRef, executionProfileRef);\n if (\n !executionProfile\n \|\| executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n return undefined;\n }\n\n const runtimeSecret = executionProfile.secretEnvVarName\n ? process.env[executionProfile.secretEnvVarName]\n : undefined;\n if (runtimeSecret && runtimeSecret.length > 0) {\n this.logDebug('Resolved ACP secret from process env', { providerRef, executionProfileRef });\n return runtimeSecret;\n }\n\n return undefined;\n }\n\n private toSemanticOperationKeys(operations: readonly string[]): LLMProvider_OperationKey[] {\n return operations\n .map((operation) => RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION[operation] ?? operation)\n .filter((operation): operation is LLMProvider_OperationKey => (\n Object.values(LLMProvider_OperationKey).includes(operation as LLMProvider_OperationKey)\n ));\n }\n\n private getDefaultProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n try {\n const runtimeContract = this.backendProviderRegistry.getRuntimeContract(providerRef, protocolKind);\n\n if (!runtimeContract) {\n this.logDebug(`Runtime contract not found: ${providerRef}:${protocolKind}`);\n return undefined;\n }\n\n\n if (runtimeContract.kind === 'agent-client-protocol') {\n const defaultExecutionProfileRef = 'default';\n const hasExplicitSecretBinding = Boolean(\n runtimeContract.secretRef\n && runtimeContract.secretEnvVarName\n && runtimeContract.authModes.includes('secret-ref-env-injection'),\n );\n return {\n enabled: true,\n defaultExecutionProfileRef,\n executionProfiles: {\n [defaultExecutionProfileRef]: {\n runnerHost: AgentClientProtocol_RunnerHost.BACKEND_SUBPROCESS,\n command: runtimeContract.agentCommand,\n args: [...(runtimeContract.agentArgs ?? [])],\n inheritedEnvironmentVariables: [...(runtimeContract.inheritedEnvironmentVariables ?? [])],\n authMode: hasExplicitSecretBinding\n ? AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n : runtimeContract.authModes.includes('host-managed')\n ? AgentClientProtocol_AuthMode.HOST_MANAGED\n : AgentClientProtocol_AuthMode.NONE,\n ...(hasExplicitSecretBinding\n ? { secretRef: runtimeContract.secretRef, secretEnvVarName: runtimeContract.secretEnvVarName }\n : {}),\n // DEVELOPMENT only, and deliberately NARROWER than any other\n // synthesized default. Nobody authored this profile and\n // nobody reviewed it, and what it authorises is an agent\n // that edits a workspace. An application that wants a coding\n // agent anywhere else must say so in its own profile, where\n // the decision is visible.\n allowedApplicationEnvironments: [APPLICATION_ENVIRONMENT.DEVELOPMENT],\n workingDirectoryPolicy: AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_ROOT,\n // Both safety postures stated rather than left to a schema\n // default, so reading this profile tells you what it permits\n // without resolving anything.\n permissionCeiling: AgentClientProtocol_PermissionCeiling.PROMPT_ALWAYS,\n hostConfigurationInheritance: AgentClientProtocol_HostConfigurationInheritance.APPLICATION_SCOPED,\n ...(runtimeContract.sessionMetaExtensions\n ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions }\n : {}),\n },\n },\n runtimeContract,\n };\n }\n\n const secretRef = this.secretRefForRuntimeContract(runtimeContract);\n return {\n enabled: true,\n ...(secretRef\n ? {\n authConfig: {\n authKind: this.authKindForRuntimeContract(runtimeContract),\n secretRef,\n },\n }\n : {}),\n ...(runtimeContract.kind === 'webhook-originator'\n ? { endpoints: this.buildWebhookEndpoints(runtimeContract) }\n : {}),\n runtimeContract,\n };\n } catch (error) {\n // Same pattern as `getProviderConfiguration` — contract\n // violations (`authKindForRuntimeContract` misuse) throw a\n // `WildoError_Backend` instance that MUST surface.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting default provider configuration', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n private secretRefForRuntimeContract(runtimeContract: ProviderProtocolRuntimeContract): string \| undefined {\n switch (runtimeContract.kind) {\n case 'email':\n // A `delivery: 'log'` email contract (the dev `preview`\n // provider) has NO endpoint and NO apiKey — it renders +\n // logs instead of sending. No secretRef to resolve; the\n // caller emits no `authConfig` and the email service skips\n // the API-key requirement. Contract-driven, not ref-keyed.\n return runtimeContract.delivery === 'log' ? undefined : runtimeContract.apiKey.secretRef;\n case 'llm':\n return runtimeContract.apiKey.secretRef;\n case 'image':\n return runtimeContract.apiKey.secretRef;\n case 'embeddings':\n return runtimeContract.apiKey.secretRef;\n case 'document-extraction':\n return runtimeContract.apiKey.secretRef;\n case 'oauth2-sso':\n return runtimeContract.clientSecretRef;\n case 'billing':\n case 'webhook-originator':\n return runtimeContract.secretRef;\n case 'sms':\n return runtimeContract.auth.secretRef;\n case 'rest':\n return runtimeContract.apiKey.secretRef;\n case 'agent-client-protocol':\n // An ACP agent that needs a credential carries it on the\n // contract; a host-managed one (the default for a coding agent\n // running under an operator's own login) carries none.\n return runtimeContract.secretRef;\n default: {\n const exhaustiveCheck: never = runtimeContract;\n return exhaustiveCheck;\n }\n }\n }\n\n /\n Map a runtime contract's `kind` to the canonical\n * `ExternalProvider_Auth_Kind` for the `authConfig` projection.\n * Used by `getDefaultProviderConfiguration` so the emitted\n * `authConfig: { authKind, secretRef }` satisfies the schema's\n * required-`authKind` invariant (was previously `{ secretRef }`\n * with no `authKind`, masked by `as unknown as` casts).\n \n Mapping rationale:\n \n - `llm` / `email` / `sms` / `billing` — providers authenticate\n * with an opaque API key supplied via env var.\n * - `webhook-originator` — provider signs payloads with HMAC; the\n * `secretRef` is the HMAC signing key.\n * - `oauth2-sso` — kind `OAUTH2`; the `secretRef` is the OAuth2\n * client secret.\n * - `agent-client-protocol` — auth is encoded on the executionProfile,\n * not `authConfig`; this method is not called for that kind\n * because that arm returns from the dedicated branch in\n * `getDefaultProviderConfiguration` BEFORE reaching this\n * mapping. A misuse throws via `errorBuilder` so the\n * `WildoError_Backend` instance bypasses the\n * `getProviderConfiguration` fallback catch.\n /\n private authKindForRuntimeContract(\n runtimeContract: ProviderProtocolRuntimeContract,\n ): ExternalProvider_Auth_Kind {\n switch (runtimeContract.kind) {\n case 'llm':\n case 'image':\n case 'embeddings':\n // Document extraction authenticates with an opaque API key in a request header, like\n // its siblings above; the header SHAPE (name/prefix) stays on the contract because\n // this family builds its own HTTPS request rather than handing a key to an SDK.\n case 'document-extraction':\n case 'email':\n case 'sms':\n case 'billing':\n // `rest` authenticates with an opaque API key supplied via env var, like its siblings\n // above; the header SHAPE (name/prefix) stays on the contract for its consumer.\n case 'rest':\n return ExternalProvider_Auth_Kind.API_KEY;\n case 'webhook-originator':\n return ExternalProvider_Auth_Kind.HMAC_SIGNATURE;\n case 'oauth2-sso':\n return ExternalProvider_Auth_Kind.OAUTH2;\n case 'agent-client-protocol':\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message: '[external-providers-registry] authKindForRuntimeContract called with kind=agent-client-protocol; '\n + 'ACP auth lives on executionProfiles[].authMode, not on authConfig.',\n },\n },\n );\n default: {\n const exhaustiveCheck: never = runtimeContract;\n return exhaustiveCheck;\n }\n }\n }\n\n /\n Project the provider-authored `runtimeContract.endpoints` into\n * the canonical `Hook_Endpoint` shape consumed by the framework\n * webhook controller. Provider-agnostic: each endpoint descriptor\n * is owned by the provider module (see Stripe's `endpoints` array\n * on `stripe.backend.module.ts`); the only field this projection\n * adds is `signatureConfig.headerName`, sourced from the contract's\n * top-level `signatureHeaderName` so providers don't repeat it on\n * every endpoint.\n \n Previously branched on a Stripe-only provider literal\n * with the entire endpoint shape (event types, polymorphic\n * variants, `lookupField`) hardcoded inside this consumer site —\n * the same anti-pattern Step 7 was supposed to eliminate. Moved\n * to the provider module 2026-05-06 to close the gap; the CI\n * guard regex (`no-provider-ref-branches.guard.test.ts`) now\n * also catches the `runtimeContract.provider` literal pattern.\n \n Per-endpoint secret overrides (if a future provider needs them)\n * still flow through `HookInitiatorProvider_Configuration.endpointSecrets`,\n * not through this projection.\n /\n private buildWebhookEndpoints(\n runtimeContract: Extract<ProviderProtocolRuntimeContract, { kind: 'webhook-originator' }>,\n ): ReadonlyArray<Hook_Endpoint> {\n return runtimeContract.endpoints.map((endpoint) => ({\n ...endpoint,\n signatureConfig: {\n ...endpoint.signatureConfig,\n headerName: runtimeContract.signatureHeaderName,\n },\n eventTypes: [...endpoint.eventTypes],\n }));\n }\n\n /\n Get provider secrets for a specific protocol and secret reference.\n * Provider secrets are runtime-delivered via env/K8s materialization.\n * The secret binding contract is still declared by the provider protocol\n * configuration, but the secret value source is `process.env`.\n \n The `envVarName ?? secretRef` fallback covers the case where the\n * resolver doesn't find an explicit env-var-name mapping for the\n * requested secretRef. Today every engine provider authors\n * `secretsContract.<slug>.envVarName === <secretRef value>` (verified\n * across 17 modules), so this fallback is exactly equivalent to a\n * direct `process.env[secretRef]` lookup. If a future provider's\n * `secretsContract.envVarName` diverges from its `secretRef`, the\n * load-bearing path becomes `protocolConfig.authConfig.secretRef`\n * (returned by `getProviderSecretEnvVarName`), and the fallback\n * stays a defensive last-chance match.\n /\n public getProviderSecret(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const envVarName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef);\n const resolvedEnvVarName = envVarName ?? secretRef;\n\n const secretValue = process.env[resolvedEnvVarName];\n return secretValue && secretValue.length > 0 ? secretValue : undefined;\n } catch {\n return undefined;\n }\n }\n\n private getProviderSecretEnvVarName(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n ): string \| undefined {\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n && executionProfile.secretRef === secretRef\n ) {\n return executionProfile.secretEnvVarName;\n }\n }\n }\n\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n if (protocolConfig?.authConfig?.secretRef === secretRef) {\n return protocolConfig.authConfig.secretRef;\n }\n\n return undefined;\n }\n\n public getConfiguredProviderSecretRef(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n return config?.authConfig?.secretRef;\n }\n\n\n\n public getProviderApiKey(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n if (!secretRef) {\n this.logDebug(`No authConfig.secretRef found for ${providerRef}.${protocolKind}`);\n return undefined;\n }\n\n const apiKey = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (!apiKey) {\n this.logDebug(`Secret ${secretRef} not found for ${providerRef}.${protocolKind}`);\n }\n return apiKey;\n } catch (error) {\n this.logDebug('Error getting provider API key', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n public isProviderEnabled(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): boolean {\n this.ensureInitialized();\n try {\n if (!this.hasProvider(providerRef)) {\n return false;\n }\n\n const provider = this.getProvider(providerRef);\n if (!provider \|\| !provider.protocols.includes(protocolKind)) {\n return false;\n }\n\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n if (!config) {\n return true;\n }\n\n return config.enabled !== false;\n } catch (error) {\n this.logDebug('Error checking if provider is enabled', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return false;\n }\n }\n\n public getProviderProtocolSecrets(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): Record<string, string> \| undefined {\n this.ensureInitialized();\n try {\n const resolvedSecrets: Record<string, string> = {};\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n const protocolSecretRef = protocolConfig?.authConfig?.secretRef;\n if (protocolSecretRef) {\n const secretValue = this.getProviderSecret(providerRef, protocolKind, protocolSecretRef);\n if (secretValue) {\n resolvedSecrets[protocolSecretRef] = secretValue;\n }\n }\n\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n continue;\n }\n\n const secretValue = this.getProviderSecret(providerRef, protocolKind, executionProfile.secretRef);\n if (secretValue) {\n resolvedSecrets[executionProfile.secretRef] = secretValue;\n }\n }\n }\n\n return Object.keys(resolvedSecrets).length > 0 ? resolvedSecrets : undefined;\n } catch {\n return undefined;\n }\n }\n\n /\n Refresh the runtime registry facade from first-class backend provider modules.\n \n This mirrors `initialize()` and intentionally no longer depends on the\n * deleted capability-bindings service.\n */\n public async refreshFromConfig(): Promise<void> {\n try {\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.registry = registry;\n this.isInitialized = true;\n\n this.logDebug('External providers registry refreshed from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n } catch (error) {\n this.logDebug('Failed to refresh registry from config', {\n error: describeCaughtError(error)\n });\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n error: describeCaughtError(error),\n },\n }\n );\n }\n }\n\n // ================================\n // Initialization Utils\n // ================================\n\n protected ensureInitialized(): void {\n if (!this.isInitialized \|\| !this.registry) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED\n }\n );\n }\n }\n}\n"]}
1	+ {"version":3,"file":"external-providers-registry.backend.service.js","sourceRoot":"","sources":["../../../../../src/external-providers/services/external-providers-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAGH,gBAAgB,EAChB,8BAA8B,EAC9B,qDAAqD,EACrD,iCAAiC,EACjC,wCAAwC,GAC3C,MAAM,uBAAuB,CAAC;AAc/B,OAAO,EACL,sCAAsC,EAEtC,wBAAwB,EACxB,uCAAuC,EACvC,+BAA+B,EAC/B,uBAAuB,EACvB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAKpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAMpG,OAAO,EACH,4BAA4B,EAC5B,0CAA0C,EAC1C,gDAAgD,EAChD,qCAAqC,EACrC,8BAA8B,EAC9B,0CAA0C,EAC1C,wBAAwB,GAG3B,MAAM,sCAAsC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,8CAA8C,GAA6C;IAC7F,aAAa,EAAE,wBAAwB,CAAC,eAAe;CAC1D,CAAC;AA0DF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACH,sCAAsC,EACtC,uCAAuC,GAE1C,MAAM,yGAAyG,CAAC;AAwCjH,MAAM,6BAA6B,GAAG;IAClC,uBAAuB,CAAC,WAAW;IACnC,uBAAuB,CAAC,OAAO;IAC/B,uBAAuB,CAAC,UAAU;CACrC,CAAC;AAEF,SAAS,6BAA6B,CAAC,WAAmB;IACtD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,OAAO,UAAU,KAAK,WAAW;WAC1B,UAAU,KAAK,qBAAqB;WACpC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,2CAA2C,GAA6C;IAC1F,YAAY,EAAE,wBAAwB,CAAC,aAAa;IACpD,UAAU,EAAE,wBAAwB,CAAC,WAAW;IAChD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,kBAAkB,EAAE,wBAAwB,CAAC,mBAAmB;IAChE,gBAAgB,EAAE,wBAAwB,CAAC,iBAAiB;IAC5D,8EAA8E;IAC9E,sEAAsE;CACzE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kDAAkD,GAAoD;IACxG,UAAU,EAAE,+BAA+B,CAAC,WAAW;CAC1D,CAAC;AAEF;;;;GAIG;AACH,MAAM,2DAA2D,GAA4D;IACzH,mBAAmB,EAAE,uCAAuC,CAAC,qBAAqB;CACrF,CAAC;AAeF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,wCAAwC,GAAgD;IAC1F,EAAE,UAAU,EAAE,sCAAsC,CAAC,WAAW,EAAE,UAAU,EAAE,0CAA0C,CAAC,OAAO,EAAE;CACrI,CAAC;AAGK,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAOU;IACU;IACG;IACW;IAgC1B;IAzC9C,QAAQ,CAA+D;IACvE,QAAQ,GAAuC,IAAI,CAAC;IAEpD,aAAa,GAAG,KAAK,CAAC;IAEhC,YAC0D,MAAqB,EACX,aAAsC,EACnC,YAAwC,EAC7B,uBAA8D,EAgCxF,SAAqB;QAnCnB,WAAM,GAAN,MAAM,CAAe;QACX,kBAAa,GAAb,aAAa,CAAyB;QACnC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAgCxF,cAAS,GAAT,SAAS,CAAY;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAElF,IAAI,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,mCAAmC;IACnC,wBAAwB;IACxB,mCAAmC;IAEnC;;;OAGG;IACI,KAAK,CAAC,UAAU;QACnB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YACvD,OAAO;QACX,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;QAEhE,IAAI,CAAC,iCAAiC,EAAE,CAAC;QAEzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,uEAAuE,EAAE;YACnF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;SAC/C,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,iCAAiC;QACrC,MAAM,SAAS,GAAG;YACd,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5G,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE;SAC3F,CAAC,MAAM,CAAC,CAAC,QAAQ,EAA2B,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnE,MAAM,YAAY,GAAG,CAAC,WAAmB,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC/E,IAAI,CAAC;gBACD,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC9B,OAAO,IAAI,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,SAAS;YACb,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;gBACrF,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG;gBAClC,eAAe,EAAE,OAAO;gBACxB,MAAM,EAAE,sGAAsG;sBACxG,uGAAuG;aAChH,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAEO,uCAAuC;QAC3C,MAAM,QAAQ,GAAgC,EAAE,CAAC;QACjD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,oBAAoB;iBACnD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,wCAAwC,CAAC,UAAU,CAAC,CAAC;iBACzE,MAAM,CAAC,CAAC,UAAU,EAAkC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAEjF,QAAQ,CAAC,WAAW,CAAC,GAAG;gBACpB,WAAW;gBACX,SAAS;gBACT,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACpD,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,sCAAsC,CAAC,UAAU,CAAC,IAAI,SAAS;aACrG,CAAC;QACN,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,mCAAmC;IACnC,iBAAiB;IACjB,mCAAmC;IAE5B,4BAA4B;QAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC;IAC1B,CAAC;IAEM,gBAAgB;QACnB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACI,OAAO;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAEM,+BAA+B,CAAC,UAA4B;QAC/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,CAAC;YAC9E,IAAI,UAAU,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC/B,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,iBAAiB,GAAG,YAAY,EAAE,SAAS;YAC7C,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE;YAC1D,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAS,CAAC;aACnD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;aACtE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;aACvC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;YACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,SAAS,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;YACzD,OAAO,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;mBAClC,CAAC,SAAS,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEP,sEAAsE;QACtE,6EAA6E;QAC7E,wEAAwE;QACxE,yEAAyE;QACzE,wDAAwD;QACxD,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,sBAAsB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC;eACrE,YAAY,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,iCAAiC,CAAC,UAAU,CAAC,KAAK,8BAA8B,CAAC,OAAO;YACrG,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,sBAAsB,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;iBACxE,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACvE,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3G,OAAO,CAAC,GAAG,iBAAiB,EAAE,GAAG,aAAa,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3C,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,cAAc,GAAG,eAAe,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,qCAAqC,CAAC,UAA4B;QACrE,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,oCAAoC,CAAC,UAA4B;QACpE,IAAI,iCAAiC,CAAC,UAAU,CAAC,KAAK,8BAA8B,CAAC,OAAO,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IAEM,2BAA2B,CAAC,UAA4B;QAC3D,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;OAWG;IACI,yBAAyB,CAAC,UAA4B;QACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACxF,CAAC;IAED;;;;;;;;;;OAUG;IACI,sCAAsC,CACzC,UAA0C,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAEtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,mFAAmF;YACnF,mFAAmF;YACnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,OAAO,EAAE,mFAAmF;0BACtF,qDAAqD;iBAC9D;aACJ,CAAC,CAAC;QACP,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACvE,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,2BAA2B;QAC3B,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,qBAAqB,GAAG,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAC;YAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,kBAAkB;mBAC5C,UAAU,EAAE,OAAO,KAAK,IAAI;mBAC5B,qDAAqD,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7E,IACI,CAAC,qBAAqB,IAAI,gBAAgB,CAAC;mBACxC,IAAI,CAAC,oCAAoC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EACvE,CAAC;gBACC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7B,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAwC;QACzE,MAAM,2BAA2B,GAAG,IAAI,CAAC,sCAAsC,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,2BAA2B,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EACH,6DAA6D,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;sBACtG,oGAAoG;sBACpG,2FAA2F;sBAC3F,qFAAqF;gBAC3F,2BAA2B;aAC9B;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,+BAA+B,CAAsF;IACrH,yCAAyC,GAAG,KAAK,CAAC;IACzC,mCAAmC,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE3E,4BAA4B,CAChC,UAA4B;QAE5B,IAAI,IAAI,CAAC,+BAA+B,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;oBAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjE,IAAI,CAAC,+BAA+B,GAAG,MAA4F,CAAC;oBACxI,CAAC;yBAAM,CAAC;wBACJ,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;wBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;oBAC1D,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE;wBAC3F,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBACpC,CAAC,CAAC;oBACH,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;oBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;gBAC1D,CAAC;YACL,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAClE,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IACI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;eACjC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;eAC7B,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS,IAAI,CAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;mBACrC,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAC9G,CAAC,EACJ,CAAC;YACC,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACI,sCAAsC,CAAC,UAA4B;QACtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QACvF,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,iBAAiB,GAAG,IAAI,CAAC,yCAAyC,IAAI,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrI,OAAO,MAAM,CAAC,MAAM,CAAC;YACjB,aAAa,EAAE,oBAAoB;gBAC/B,CAAC,CAAC,sCAAsC,CAAC,oBAAoB;gBAC7D,CAAC,CAAC,gBAAgB;oBACd,CAAC,CAAC,sCAAsC,CAAC,4BAA4B;oBACrE,CAAC,CAAC,sCAAsC,CAAC,kBAAkB;YACnE,cAAc,EAAE,iBAAiB;gBAC7B,CAAC,CAAC,uCAAuC,CAAC,SAAS;gBACnD,CAAC,CAAC,oBAAoB;oBAClB,CAAC,CAAC,uCAAuC,CAAC,OAAO;oBACjD,CAAC,CAAC,uCAAuC,CAAC,MAAM;YACxD,6BAA6B,EAAE,gBAAgB,EAAE,OAAO,IAAI,IAAI;YAChE,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YAChG,6BAA6B,EAAE,oBAAoB,EAAE,OAAO,IAAI,IAAI;YACpE,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YACpG,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,0CAA0C,EAAE;SAC3F,CAAC,CAAC;IACP,CAAC;IAEO,6BAA6B;QACjC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAG,OAAQ,IAAI,CAAC,aAA0C,CAAC,WAAW,KAAK,QAAQ;YAChG,CAAC,CAAE,IAAI,CAAC,aAA0C,CAAC,WAAY;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,SAAS,IAAI,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,SAAiC,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,CAAC,OAA2C,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACI,wBAAwB,CAC3B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5C,MAAM,eAAe,GAAG,SAAS,CAAC,sBAAsB,IAAI,EAAE,CAAC;YAE/D,MAAM,aAAa,GAAG,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACtF,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAClE,IAAI,YAAY,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,yCAAyC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBACtF,OAAO,IAAI,CAAC,0BAA0B,CAClC,aAAa,EACb,YAA6C,CAChD,CAAC;YACN,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,mCAAmC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,aAAa,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,4DAA4D;YAC5D,qEAAqE;YACrE,6DAA6D;YAC7D,6DAA6D;YAC7D,2DAA2D;YAC3D,4DAA4D;YAC5D,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE;gBAC3E,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;IAEO,0BAA0B,CAC9B,aAAwD,EACxD,YAA2C;QAE3C,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC;QACxB,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,uDAAuD;QACvD,+DAA+D;QAC/D,wDAAwD;QACxD,2DAA2D;QAC3D,6DAA6D;QAC7D,EAAE;QACF,6DAA6D;QAC7D,4DAA4D;QAC5D,2DAA2D;QAC3D,6DAA6D;QAC7D,6DAA6D;QAC7D,yDAAyD;QACzD,6DAA6D;QAC7D,6DAA6D;QAC7D,SAAS;QACT,MAAM,WAAW,GAAG,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC;QACxD,MAAM,UAAU,GAAG,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC;QACtD,IAAI,WAAW,IAAI,UAAU,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,OAAO,EAAE,kGAAkG;oBAC3G,WAAW;oBACX,UAAU;iBACb;aACJ,CACJ,CAAC;QACN,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,eAAe,CAC9C,aAAa,CAAC,eAAsD,EACpE,YAAY,CAAC,eAAsD,CACtE,CAAC;QAEF,OAAO;YACH,GAAG,aAAa;YAChB,GAAG,YAAY;YACf,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,kEAAkE;YAClE,oEAAoE;YACpE,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,YAAY,CAAC,iBAAiB;gBACjE,CAAC,CAAC;oBACE,iBAAiB,EAAE;wBACf,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,EAAE,CAAC;wBAC1C,GAAG,CAAC,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC;qBAC5C;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;YACT,UAAU,EAAE,IAAI,CAAC,eAAe,CAC5B,aAAa,CAAC,UAAU,EACxB,YAAY,CAAC,UAAU,CACqB;YAChD,kFAAkF;YAClF,8EAA8E;YAC9E,6EAA6E;YAC7E,oCAAoC;YACpC,eAAe,EAAE,qBAAoE;SACxF,CAAC;IACN,CAAC;IAEO,eAAe,CACnB,YAAqB,EACrB,WAAoB;QAEpB,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACpD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACnF,OAAO,WAAkD,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,OAAO,YAAuC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAA4B;YACpC,GAAI,YAAwC;SAC/C,CAAC;QACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpD,SAAS;YACb,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ;mBACf,OAAO,QAAQ,KAAK,QAAQ;mBAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;mBACxB,KAAK;mBACL,OAAO,KAAK,KAAK,QAAQ;mBACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;gBACvC,CAAC,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAGD;;;;;;;;;;;;;;;;;OAiBG;IACI,sBAAsB,CACzB,WAAmB,EACnB,SAAiB;QAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC;QACvB,CAAC;QAED,0FAA0F;QAC1F,wFAAwF;QACxF,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,aAAa,GAAG,KAAK,EAAE,UAAU,IAAI,SAAS,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,iBAAiB,GAAG,MAAM,KAAK,SAAS;eACvC,CAAC,MAAM,CAAC,iBAAiB,KAAK,aAAa,IAAI,MAAM,CAAC,qBAAqB,KAAK,aAAa,CAAC,CAAC;QAEtG,OAAO,iBAAiB;YACpB,CAAC,CAAC,4BAA4B,CAAC,YAAY;YAC3C,CAAC,CAAC,4BAA4B,CAAC,UAAU,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QACxF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;IACnF,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC;IACrF,CAAC;IAEM,2BAA2B,CAAC,WAAmB;QAClD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,YAAY,CACtD,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,GAAG,EAAE,CAAC;YAC5D,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACI,kCAAkC,CAAC,WAAmB;QACzD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,mBAAmB,CAC7D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU,EAAE,CAAC;YACnE,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kDAAkD,CAAC,SAAS,CAAC,CAAC;aACjF,MAAM,CAAC,CAAC,SAAS,EAAgD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACtG,CAAC;IAGD;;;;;;OAMG;IACI,0CAA0C,CAAC,WAAmB;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,4BAA4B,CACtE,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,mBAAmB,EAAE,CAAC;YAC5E,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2DAA2D,CAAC,SAAS,CAAC,CAAC;aAC1F,MAAM,CAAC,CAAC,SAAS,EAAwD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC9G,CAAC;IAGM,mCAAmC,CAAC,WAAmB;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CACxC,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QACF,OAAO,MAAuD,CAAC;IACnE,CAAC;IAEM,6BAA6B,CAAC,WAAmB;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;YAC9E,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,eAAe,GAAG;YACpB,GAAG,CAAC,eAAe,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;QACF,OAAO;YACH,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,SAAS,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACjD,sBAAsB,EAAE,eAAe,CAAC,UAAU;iBAC7C,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8CAA8C,CAAC,SAAS,CAAC,CAAC;iBAC7E,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;YAC1F,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YAC9C,yBAAyB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,yBAAyB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,GAAG,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,GAAG,CAAC,eAAe,CAAC,mDAAmD;gBACnE,CAAC,CAAC,EAAE,mDAAmD,EAAE,eAAe,CAAC,mDAAmD,EAAE;gBAC9H,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,eAAe,CAAC,iBAAiB;gBACjC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,GAAG,eAAe,CAAC,iBAAiB,EAAE,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,6BAA6B;gBAC7C,CAAC,CAAC,EAAE,6BAA6B,EAAE,CAAC,GAAG,eAAe,CAAC,6BAA6B,CAAC,EAAE;gBACvF,CAAC,CAAC,EAAE,CAAC;YACT,mEAAmE;YACnE,oEAAoE;YACpE,0DAA0D;YAC1D,kBAAkB,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpF,GAAG,CAAC,eAAe,CAAC,iCAAiC;gBACjD,CAAC,CAAC;oBACE,iCAAiC,EAAE,MAAM,CAAC,WAAW,CACjD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAC,GAAG,CACjE,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAC1D,CACJ;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACI,sCAAsC,CACzC,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,aAAa,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,aAAa,EAAE,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,yBAAyB,mBAAmB,kBAAkB,WAAW,EAAE,CAAC,CAAC;YAC3F,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC;YACD,OAAO,0CAA0C,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,WAAW;oBACX,mBAAmB;oBACnB,OAAO,EAAE,qFAAqF;oBAC9F,eAAe,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAC9C;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAEM,4CAA4C,CAC/C,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,sCAAsC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACvG,IACI,CAAC,gBAAgB;eACd,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;eACnF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;YACC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB;YACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5F,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAEO,uBAAuB,CAAC,UAA6B;QACzD,OAAO,UAAU;aACZ,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2CAA2C,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;aACvF,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,CAC1D,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,SAAqC,CAAC,CAC1F,CAAC,CAAC;IACX,CAAC;IAEO,+BAA+B,CACnC,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAEnG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,+BAA+B,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAC5E,OAAO,SAAS,CAAC;YACrB,CAAC;YAGD,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;gBAC7E,MAAM,0BAA0B,GAAG,SAAS,CAAC;gBAC7C,MAAM,wBAAwB,GAAG,OAAO,CACpC,eAAe,CAAC,SAAS;uBACtB,eAAe,CAAC,gBAAgB;uBAChC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CACpE,CAAC;gBACF,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,0BAA0B;oBAC1B,iBAAiB,EAAE;wBACf,CAAC,0BAA0B,CAAC,EAAE;4BAC1B,UAAU,EAAE,8BAA8B,CAAC,kBAAkB;4BAC7D,OAAO,EAAE,eAAe,CAAC,YAAY;4BACrC,IAAI,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;4BAC5C,6BAA6B,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;4BACzF,QAAQ,EAAE,wBAAwB;gCAC9B,CAAC,CAAC,4BAA4B,CAAC,wBAAwB;gCACvD,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;oCAChD,CAAC,CAAC,4BAA4B,CAAC,YAAY;oCAC3C,CAAC,CAAC,4BAA4B,CAAC,IAAI;4BAC3C,GAAG,CAAC,wBAAwB;gCACxB,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,EAAE;gCAC9F,CAAC,CAAC,EAAE,CAAC;4BACT,6DAA6D;4BAC7D,wDAAwD;4BACxD,yDAAyD;4BACzD,6DAA6D;4BAC7D,4DAA4D;4BAC5D,2BAA2B;4BAC3B,8BAA8B,EAAE,CAAC,uBAAuB,CAAC,WAAW,CAAC;4BACrE,sBAAsB,EAAE,0CAA0C,CAAC,cAAc;4BACjF,2DAA2D;4BAC3D,6DAA6D;4BAC7D,8BAA8B;4BAC9B,iBAAiB,EAAE,qCAAqC,CAAC,aAAa;4BACtE,4BAA4B,EAAE,gDAAgD,CAAC,kBAAkB;4BACjG,GAAG,CAAC,eAAe,CAAC,qBAAqB;gCACrC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE;gCAClE,CAAC,CAAC,EAAE,CAAC;yBACZ;qBACJ;oBACD,eAAe;iBAClB,CAAC;YACN,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,2BAA2B,CAAC,eAAe,CAAC,CAAC;YACpE,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS;oBACT,CAAC,CAAC;wBACE,UAAU,EAAE;4BACR,QAAQ,EAAE,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC;4BAC1D,SAAS;yBACZ;qBACJ;oBACD,CAAC,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,kBAAkB;oBACvE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE;oBAC5D,CAAC,CAAC,EAAE,CAAC;gBACT,eAAe;aAClB,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,wDAAwD;YACxD,2DAA2D;YAC3D,mDAAmD;YACnD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE;gBAC1D,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,2BAA2B,CAAC,eAAgD;QAChF,QAAQ,eAAe,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,2BAA2B,CAAC,KAAK;gBAClC,wDAAwD;gBACxD,yDAAyD;gBACzD,wDAAwD;gBACxD,2DAA2D;gBAC3D,2DAA2D;gBAC3D,OAAO,eAAe,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7F,KAAK,2BAA2B,CAAC,GAAG;gBAChC,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,2BAA2B,CAAC,KAAK;gBAClC,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,2BAA2B,CAAC,UAAU;gBACvC,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,2BAA2B,CAAC,mBAAmB;gBAChD,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,2BAA2B,CAAC,UAAU;gBACvC,OAAO,eAAe,CAAC,eAAe,CAAC;YAC3C,KAAK,2BAA2B,CAAC,OAAO,CAAC;YACzC,KAAK,2BAA2B,CAAC,kBAAkB;gBAC/C,OAAO,eAAe,CAAC,SAAS,CAAC;YACrC,KAAK,2BAA2B,CAAC,GAAG;gBAChC,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YAC1C,KAAK,2BAA2B,CAAC,IAAI;gBACjC,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,2BAA2B,CAAC,qBAAqB;gBAClD,yDAAyD;gBACzD,+DAA+D;gBAC/D,uDAAuD;gBACvD,OAAO,eAAe,CAAC,SAAS,CAAC;YACrC,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,eAAe,GAAU,eAAe,CAAC;gBAC/C,OAAO,eAAe,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,0BAA0B,CAC9B,eAAgD;QAEhD,QAAQ,eAAe,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,KAAK,2BAA2B,CAAC,KAAK,CAAC;YACvC,KAAK,2BAA2B,CAAC,UAAU,CAAC;YAC5C,qFAAqF;YACrF,mFAAmF;YACnF,gFAAgF;YAChF,KAAK,2BAA2B,CAAC,mBAAmB,CAAC;YACrD,KAAK,2BAA2B,CAAC,KAAK,CAAC;YACvC,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,KAAK,2BAA2B,CAAC,OAAO,CAAC;YACzC,sFAAsF;YACtF,gFAAgF;YAChF,KAAK,2BAA2B,CAAC,IAAI;gBACjC,OAAO,0BAA0B,CAAC,OAAO,CAAC;YAC9C,KAAK,2BAA2B,CAAC,kBAAkB;gBAC/C,OAAO,0BAA0B,CAAC,cAAc,CAAC;YACrD,KAAK,2BAA2B,CAAC,UAAU;gBACvC,OAAO,0BAA0B,CAAC,MAAM,CAAC;YAC7C,KAAK,2BAA2B,CAAC,qBAAqB;gBAClD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;oBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;oBACpG,OAAO,EAAE;wBACL,OAAO,EAAE,mGAAmG;8BACtG,oEAAoE;qBAC7E;iBACJ,CACJ,CAAC;YACN,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,eAAe,GAAU,eAAe,CAAC;gBAC/C,OAAO,eAAe,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,qBAAqB,CACzB,eAA0H;QAE1H,OAAO,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,GAAG,QAAQ;YACX,eAAe,EAAE;gBACb,GAAG,QAAQ,CAAC,eAAe;gBAC3B,UAAU,EAAE,eAAe,CAAC,mBAAmB;aAClD;YACD,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC;SACvC,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,iBAAiB,CACpB,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC1F,MAAM,kBAAkB,GAAG,UAAU,IAAI,SAAS,CAAC;YAEnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACpD,OAAO,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,2BAA2B,CAC/B,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;YAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;YAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;uBAChF,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAC7C,CAAC;oBACC,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,CAAC;YACL,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAChF,IAAI,cAAc,EAAE,UAAU,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/C,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAEM,8BAA8B,CACjC,WAAmB,EACnB,YAAoD;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;IACzC,CAAC;IAIM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,qCAAqC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAClF,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,UAAU,SAAS,kBAAkB,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE;gBAC5C,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACI,gCAAgC,CAAC,WAAmB;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;QAC9F,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC7D,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,QAAQ,CAAC;QAEf,OAAO,IAAI,CAAC,mCAAmC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;OAQG;IACI,yCAAyC,CAAC,WAAmB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;QAC9F,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAClD,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,QAAQ,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,mCAAmC,CACvC,WAAmB,EACnB,SAAsD;QAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC;QAC9F,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAC7C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAClG,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACI,KAAK,CAAC,8BAA8B,CACvC,MAAyC,EACzC,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,6BAA6B,MAAM,CAAC,eAAe,0EAA0E;kBAC3H,+EAA+E,CACpF,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACpE,sFAAsF;YACtF,yFAAyF;YACzF,sFAAsF;YACtF,yDAAyD;YACzD,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,yFAAyF;sBACvF,0DAA0D,CAC/D,CAAC;YACN,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC;gBACzD,MAAM,EAAE,MAAM,CAAC,OAAQ;gBACvB,WAAW;gBACX,UAAU,EAAE,SAAS;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,SAAS,MAAM,CAAC,OAAO,wBAAwB,SAAS,oCAAoC;sBAC1F,4FAA4F;sBAC5F,wEAAwE,CAC7E,CAAC;YACN,CAAC;YACD,OAAO;gBACH,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,MAAM,EAAE,kCAAkC,CAAC,eAAe;gBAC1D,YAAY,EAAE,WAAW,CAAC,YAAY;aACzC,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,EAAE,CAAC;YAC3E,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACrF,IAAI,eAAe,EAAE,CAAC;gBAClB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,kCAAkC,CAAC,sBAAsB,EAAE,CAAC;YACzG,CAAC;YACD,MAAM,uBAAuB,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;YACpH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,yCAAyC,SAAS,yBAAyB,uBAAuB,kCAAkC,CACvI,CAAC;QACN,CAAC;QAED,qFAAqF;QACrF,0FAA0F;QAC1F,kFAAkF;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,iGAAiG;kBAC/F,0DAA0D,CAC/D,CAAC;QACN,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,6BAA6B,CAAC;YACvD,cAAc,EAAE,MAAM,CAAC,OAAQ;YAC/B,WAAW;YACX,UAAU,EAAE,SAAS;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,iBAAiB,MAAM,CAAC,OAAO,4BAA4B,SAAS,kDAAkD;kBACpH,kHAAkH,CACvH,CAAC;QACN,CAAC;QACD,OAAO;YACH,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,kCAAkC,CAAC,uBAAuB;YAClE,YAAY,EAAE,KAAK,CAAC,YAAY;SACnC,CAAC;IACN,CAAC;IAED,iGAAiG;IACzF,sBAAsB,CAAC,WAAmB,EAAE,MAAc;QAC9D,OAAO,IAAI,KAAK,CAAC,aAAa,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,6FAA6F;IAC7F,4CAA4C;IAC5C,EAAE;IACF,4EAA4E;IAC5E,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,2DAA2D;IAC3D,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,EAAE;IACF,kDAAkD;IAClD,EAAE;IACF,yCAAyC;IACzC,wDAAwD;IACxD,uBAAuB;IACvB,EAAE;IACF,uFAAuF;IACvF,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,wFAAwF;IACxF,mCAAmC;IACnC,EAAE;IACF,6FAA6F;IAC7F,wDAAwD;IACxD,6FAA6F;IAE7F;;;;;;;OAOG;IACO,qCAAqC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1G,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACrB,kBAAkB,CAAC,sCAAsC,CAC5D,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACO,6BAA6B;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC;YAAE,OAAO,SAAS,CAAC;QAClG,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACrB,kBAAkB,CAAC,8BAA8B,CACpD,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,oCAAoC,CAC7C,cAAsB,EACtB,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,2FAA2F;QAC3F,EAAE;QACF,uFAAuF;QACvF,sFAAsF;QACtF,4FAA4F;QAC5F,2FAA2F;QAC3F,kBAAkB;QAClB,MAAM,8BAA8B,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC;QACpF,IAAI,8BAA8B,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,6BAA6B,CAAC;gBAC7E,cAAc;gBACd,WAAW;gBACX,UAAU,EAAE,SAAS;aACxB,CAAC,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACR,OAAO;oBACH,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,kCAAkC,CAAC,uBAAuB;oBAClE,YAAY,EAAE,KAAK,CAAC,YAAY;iBACnC,CAAC;YACN,CAAC;QACL,CAAC;QAED,2FAA2F;QAC3F,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACrF,IAAI,eAAe,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,kCAAkC,CAAC,sBAAsB,EAAE,CAAC;QACzG,CAAC;QAED,2FAA2F;QAC3F,MAAM,uBAAuB,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;QACpH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;YACpG,OAAO,EAAE;gBACL,OAAO,EACH,wCAAwC,WAAW,gBAAgB,YAAY,cAAc,SAAS,KAAK;sBACzG,8BAA8B,cAAc,qDAAqD;sBACjG,iGAAiG;sBACjG,IAAI,uBAAuB,qEAAqE;sBAChG,uFAAuF;gBAC7F,WAAW;gBACX,YAAY;gBACZ,SAAS;gBACT,cAAc;gBACd,uBAAuB;aAC1B;SACJ,CACJ,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,oCAAoC,CAC7C,cAAsB,EACtB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,OAAO,EACH,aAAa,WAAW,oDAAoD,YAAY,cAAc;0BACpG,6CAA6C,cAAc,2CAA2C;0BACtG,0FAA0F;oBAChG,WAAW;oBACX,YAAY;oBACZ,cAAc;iBACjB;aACJ,CACJ,CAAC;QACN,CAAC;QAED,OAAO,IAAI,CAAC,oCAAoC,CAAC,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC3G,CAAC;IAEM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,OAAO,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;gBACnD,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,eAAe,GAA2B,EAAE,CAAC;YACnD,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAChF,MAAM,iBAAiB,GAAG,cAAc,EAAE,UAAU,EAAE,SAAS,CAAC;YAChE,IAAI,iBAAiB,EAAE,CAAC;gBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBACzF,IAAI,WAAW,EAAE,CAAC;oBACd,eAAe,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC;gBACrD,CAAC;YACL,CAAC;YAED,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;gBAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;gBAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;oBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;2BAChF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;oBAClG,IAAI,WAAW,EAAE,CAAC;wBACd,eAAe,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;oBAC9D,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,iBAAiB;QAC1B,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;YAEhE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAE1B,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;gBACjF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;aAC/C,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACpD,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBACpC;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,uBAAuB;IACvB,mCAAmC;IAEzB,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;aACvG,CACJ,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AA9qDY,uCAAuC;IADnD,UAAU,EAAE;IAQJ,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAgCzD,WAAA,MAAM,CAAC,WAAW,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;yDAjCiD,0BAA0B;GATtG,uCAAuC,CA8qDnD","sourcesContent":["/*\n External Providers Registry Backend Service\n \n Provides runtime access to the backend provider registry and\n * their protocol configurations, secrets, and operations.\n /\n\nimport { createRequire } from 'node:module';\nimport { join } from 'node:path';\nimport { injectable, inject, optional } from 'inversify';\nimport type { Container } from 'inversify';\nimport {\n External_Providers_Registry,\n External_Providers_RegistryItem,\n EngineCapability,\n EngineCapabilityResolutionMode,\n ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED,\n getEngineCapabilityResolutionMode,\n PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY,\n} from '@wildo-ai/saas-models';\n\n/\n How the required-capability floor is evaluated on the calling host.\n \n `includeEngineFloor` — whether ENABLED members of\n * `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` count as required. True on a host\n * expected to SERVE those slots (the application backend, the platform services); false on a\n * scope-filtered host such as a minion, whose registry legitimately resolves none of them.\n * The application's own `required` flags are honoured on every host regardless.\n /\nexport interface RequiredCapabilityFloorOptions {\n includeEngineFloor: boolean;\n}\nimport {\n ExternalProvider_ExchangeProtocol_Kind,\n ExternalProvider_ExchangeProtocol_Configuration_Base,\n LLMProvider_OperationKey,\n DocumentExtractionProvider_OperationKey,\n EmbeddingsProvider_OperationKey,\n APPLICATION_ENVIRONMENT,\n ProviderProtocolRuntimeKind,\n ExternalProvider_SecretScope,\n} from '@wildo-ai/external-connectors-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { OrganizationProviderCredentialResolverPort } from '~wildo-backend-lib/security/connected-accounts/organization-provider-credential-resolver.port';\nimport type {\n UserProviderCredentialResolverPort,\n} from '~wildo-backend-lib/security/connected-accounts/user-provider-credential-resolver.port';\nimport { ProviderCredentialResolutionSource } from '@wildo-ai/saas-models';\nimport {\n ExternalProvider_Connection_DelegationMode,\n ExternalProvider_Connection_OwnerScope,\n} from '@wildo-ai/external-connectors-models';\nimport type {\n ExternalProvider_ConnectionShape,\n ExternalProvider_ConnectionTarget,\n} from '@wildo-ai/external-connectors-models';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError } from '@wildo-ai/saas-models';\nimport type { BackendProviderRegistryBackendService } from './backend-provider-registry.backend.service';\nimport type { ProviderProtocolRuntimeContract,\n SecretsContractEntry,\n} from '@wildo-ai/external-connectors-private/backend';\nimport type { Hook_Endpoint } from '@wildo-ai/external-connectors-models';\nimport {\n AgentClientProtocol_AuthMode,\n AgentClientProtocol_ExecutionProfileSchema,\n AgentClientProtocol_HostConfigurationInheritance,\n AgentClientProtocol_PermissionCeiling,\n AgentClientProtocol_RunnerHost,\n AgentClientProtocol_WorkingDirectoryPolicy,\n CodingAgent_OperationKey,\n type AgentClientProtocol_Configuration,\n type AgentClientProtocol_ExecutionProfile,\n} from '@wildo-ai/external-connectors-models';\n\n/\n Provider-contract operation literal → the semantic coding operation key. The\n * contract package uses short literals so it need not depend on the operation\n * family that consumes it; this map is the single translation.\n /\nconst RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION: Record<string, CodingAgent_OperationKey> = {\n runCodingTask: CodingAgent_OperationKey.RUN_CODING_TASK,\n};\n\n/\n The runtime projection of an ACP provider's transport capability.\n \n Far smaller than a request/response protocol's, because ACP agents advertise\n * their own capabilities, modes and commands during `initialize` /\n * `session/new`. Re-declaring any of that in authored configuration would\n * create a second source of truth that drifts the first time the agent is\n * upgraded — so what remains is only what the HOST must know before it opens a\n * connection.\n /\nexport type RuntimeAgentClientProtocolProfile = {\n /* How the provider says to START its agent — the authority an application inherits. /\n agentCommand: string;\n agentArgs: string[];\n supportedOperationKeys: CodingAgent_OperationKey[];\n supportedModels: string[];\n supportedProtocolVersions: number[];\n sessionMetaExtensions?: Record<string, unknown>;\n /* How this agent expresses each isolation posture; an absent posture is refused, never substituted. /\n sessionMetaExtensionsByHostConfigurationInheritance?: Partial<Record<string, Record<string, unknown>>>;\n /\n How the selected model reaches this agent. Absent means the provider\n * declared none, and a run that selected a model is refused rather than\n * started with the choice silently dropped.\n /\n modelDelivery?:\n \| { channel: 'environment-variable'; environmentVariableName: string }\n \| { channel: 'session-config-option'; configId: string };\n /\n Semantic model id → this agent's own spelling, where the two differ.\n \n Absent, or absent for a given model, means the semantic id is sent\n * unchanged — correct for every agent whose vocabulary already is Wildo's.\n /\n modelTransportIds?: Record<string, string>;\n /* Agent-vocabulary session-mode ids to prefer per ceiling; an optimisation, never the guarantee. /\n sessionModeIdsByPermissionCeiling?: Partial<Record<string, string[]>>;\n /\n The auth modes the PROVIDER declares its agent can actually use.\n \n Carried so an application-authored profile can be validated against it.\n * The contract's list previously reached only the synthesized `default`\n * profile, so an authored profile could declare any mode and nothing checked\n * whether the agent supports it.\n /\n supportedAuthModes?: string[];\n /\n Host environment variables the AGENT ITSELF needs, declared by its provider.\n \n Distinct from the execution profile's list, which is application policy.\n * This one is provider knowledge — which variable an agent reads to find its\n * own credentials is not something an application can be expected to know —\n * and it is UNIONED with the profile's rather than replaced by it.\n /\n inheritedEnvironmentVariables?: string[];\n};\nimport { ExternalProvider_Auth_Kind } from '@wildo-ai/external-connectors-models';\nimport {\n ExternalProviderSelectionAuthorityKind,\n ExternalProviderSelectionOverrideStatus,\n type ExternalProviderSelectionResolutionEvidence,\n} from '~wildo-backend-lib/external-providers/models/provider-selection-resolution-evidence.backend.definitions';\n\n/\n F-6 (2026-05-06) — runtime-side projection of a resolved provider\n * configuration. The base schema (`ExternalProvider_ExchangeProtocol_Configuration_Base`)\n * lives in `external-connectors-models` (which can't import the\n * backend-only discriminated union); we extend it here at the consumer\n * boundary so callers narrow on `runtimeContract.kind` instead of\n * casting through `as any`.\n \n Optional fields beyond the base also appear on this projection:\n \n - `defaultExecutionProfileRef` / `executionProfiles` — set by\n * `getDefaultProviderConfiguration` for `kind: ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL`\n * contracts, consumed by `getAgentClientProtocolProfile` and the ACP runner.\n * - `endpoints` — set for `kind: ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR`.\n \n They stay typed as `unknown` here because their canonical schemas\n * live in `external-connectors-models`'s `AgentClientProtocol_Configuration` /\n * webhook surfaces and are narrowed at consumer sites already.\n /\nexport type ResolvedProviderConfiguration =\n & ExternalProvider_ExchangeProtocol_Configuration_Base\n & {\n runtimeContract?: ProviderProtocolRuntimeContract;\n defaultExecutionProfileRef?: string;\n executionProfiles?: Record<string, unknown>;\n /\n Webhook-originator endpoint descriptors emitted by\n * `buildWebhookEndpoints` 2026-05-06: now matches the canonical\n * `Hook_Endpoint` shape (with the optional `displayName` field).\n * The dead extras (`providerRef`, `path`, `secretBinding`) that\n * previously polluted the emit have been removed; their values\n * were redundant with information already carried by other\n * fields (controller loop key, route convention, `authConfig.secretRef`).\n /\n endpoints?: ReadonlyArray<Hook_Endpoint>;\n };\n\n\nconst DEFAULT_IDENTITY_ENVIRONMENTS = [\n APPLICATION_ENVIRONMENT.DEVELOPMENT,\n APPLICATION_ENVIRONMENT.STAGING,\n APPLICATION_ENVIRONMENT.PRODUCTION,\n];\n\nfunction isCompanionRuntimeServiceName(serviceName: string): boolean {\n const normalized = serviceName.trim().toLowerCase();\n return normalized === 'companion'\n \|\| normalized === 'wildo-dev-companion'\n \|\| normalized.endsWith('-companion');\n}\n\nconst RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION: Record<string, LLMProvider_OperationKey> = {\n generateText: LLMProvider_OperationKey.GENERATE_TEXT,\n streamText: LLMProvider_OperationKey.STREAM_TEXT,\n chatCompletion: LLMProvider_OperationKey.CHAT_COMPLETION,\n chatMultimodal: LLMProvider_OperationKey.CHAT_MULTIMODAL,\n generateStructured: LLMProvider_OperationKey.GENERATE_STRUCTURED,\n streamStructured: LLMProvider_OperationKey.STREAM_STRUCTURED,\n // The `Thinking` runtime operation names were RETIRED 2026-07-17 — reasoning\n // depth is the `reasoningEffort` PARAMETER, not a separate operation.\n};\n\n/*\n The embeddings protocol's OWN runtime-op → semantic-key map (RAG plan DL2/H4 surface 1):\n * embeddings operations never enter {@link RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION}, whose\n * `toSemanticOperationKeys` filter would silently DROP any key outside `LLMProvider_OperationKey`\n * — the exact fall-through a sixth LLM operation key would have died in. Disjoint kind, disjoint map.\n /\nconst RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION: Record<string, EmbeddingsProvider_OperationKey> = {\n embedTexts: EmbeddingsProvider_OperationKey.EMBED_TEXTS,\n};\n\n/\n The document-extraction protocol's OWN runtime-op → semantic-key map, for the same reason its\n * embeddings sibling above has one: each protocol kind owns a disjoint operation vocabulary, so a\n * key never falls through a foreign filter and silently disappears.\n /\nconst RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION: Record<string, DocumentExtractionProvider_OperationKey> = {\n extractDocumentText: DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT,\n};\n\ninterface RuntimeProviderScopeSelection {\n engineCapabilities?: EngineCapability[];\n}\n\ninterface RuntimeProviderScope {\n providers?: Record<string, RuntimeProviderScopeSelection \| undefined>;\n selection?: Partial<Record<EngineCapability, {\n primary: string;\n whenUnavailable?: string[];\n }>>;\n}\n\n\n/\n What a provider admits when NOBODY HAS JUDGED IT — the SAFETY NET, not the answer.\n \n Named and stated once because it was previously an anonymous literal inlined at two call sites,\n * and a value that applies to most of the catalogue should be readable as the decision it is.\n \n ONE row, and it is the conservative end deliberately. APPLICATION x SERVICE is the deployment's\n * own credential, authored in the environment by the operator — the only claim that needs no\n * knowledge of the vendor whatsoever.\n \n It was briefly widened to include ORGANIZATION x SERVICE, with a careful argument that a tenant\n * bringing its own key is a fact about Wildo's tenancy model rather than about any vendor. The\n * argument holds and the change was still wrong: it made a blanket rule decide for 688 vendors at\n * once, which is precisely the per-vendor judgement this framework refuses to shortcut. A default\n * that carries the whole catalogue is not a fallback — it is mass management with a justification\n * attached, and the justification is what makes it hard to notice.\n \n So a provider earns every row beyond this one by somebody ANALYSING it and recording why, as\n * `providers/catalogue-record/decisions/slack.json` does. The population that needs that judgement\n * is far smaller than the catalogue: 99 of the 689 transposed vendors declare an OAuth2 contract,\n * and only those have a connection flow to admit anybody to.\n /\nconst UNJUDGED_PROVIDER_ADMISSIBLE_CONNECTIONS: readonly ExternalProvider_ConnectionShape[] = [\n { ownerScope: ExternalProvider_Connection_OwnerScope.APPLICATION, delegation: ExternalProvider_Connection_DelegationMode.SERVICE },\n];\n\n@injectable()\nexport class ExternalProvidersRegistryBackendService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n protected registry: External_Providers_Registry \| null = null;\n\n protected isInitialized = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) protected readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) protected readonly configService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) protected readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) protected readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n /\n The container, used ONLY to resolve the per-organization credential store on demand\n * ({@link resolveOrganizationCredentialResolver}). OPTIONAL, and appended LAST so no\n * existing parameter position moves.\n \n *Deliberately NOT a constructor injection of\n {@link OrganizationProviderCredentialResolverPort}.** `@optional()` tolerates an ABSENT\n * BINDING; it does not defer construction. So injecting the port directly made this\n * configuration-tier registry construct the entire resource stack that stands behind the\n * store — and that stack closes a cycle straight back here:\n \n ```\n * SaaS.AuditLogSink → CompositeAuditLogSink → ExternalProvidersRegistryService\n * → OrganizationProviderCredentialResolver (the store)\n * → SystemAccessService / AuditLogsService → SaaS.AuditLogSink\n * ```\n \n which InversifyJS reports as `Circular dependency found: (No dependency trace)` +\n * `RangeError: Maximum call stack size exceeded` at BOOT — every platform service and every\n * application backend, since `AuditLogsBackendService` injects the sink. The same edge\n * poisons `LlmObservabilityAgentCallTraceSink`, which depends on this registry too.\n \n Resolving on demand is also what the port's own contract already assumed: this service is\n * constructed at configuration tier, BEFORE repositories exist, while a tenant credential is\n * only ever needed once a request is being served. Lazy-container is the pattern\n * `AuthorizationsBackendService` and `WebSocketService` use to break their own cycles.\n \n When the container is absent (a unit harness) or the store is unbound (a minion resolving\n * an LLM key), no tenant has its own credential here and resolution falls through to the\n * deployment environment — the behaviour every caller had before the store existed.\n /\n @inject('Container') @optional() protected readonly container?: Container,\n ) {\n this.logDebug = this.logger.debugByType('ExternalProvidersRegistryBackendService');\n this.logger.setDebugTypeLogging('ExternalProvidersRegistryBackendService', false);\n\n this.logDebug('External providers registry service created (not yet initialized)');\n }\n\n // ================================\n // Initialization Method\n // ================================\n\n /\n Initialize by projecting first-class backend provider modules into the\n * runtime registry facade used by existing callers.\n /\n public async initialize(): Promise<void> {\n if (this.isInitialized) {\n this.logDebug('Service already initialized, skipping');\n return;\n }\n\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.reportMissingProviderRuntimePeers();\n\n this.registry = registry;\n\n this.isInitialized = true;\n this.logDebug('External providers registry initialized from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n }\n\n /\n Report a registered provider whose optional runtime peer is not installed (#438).\n \n `requiredPackages` declares the npm packages a provider LAZY-LOADS — a vendor SDK that is\n * never an engine or application dependency, installed only in a runtime that enables the\n * provider. Two providers declare it (immudb -> `immudb-node`, posthog -> `posthog-node`), and\n * until 2026-09-08 the field had NO READER anywhere: no start-up check, no installation step,\n * no diagnostic. A provider could be registered with its SDK absent and the first sign was the\n * feature quietly not working.\n \n A REPORT, never a refusal, and the asymmetry is deliberate: a declared provider may\n * legitimately never be reached (a fan-out audit sink in an environment that emits nothing),\n * so an absent optional peer is information rather than a misconfiguration. The capability\n * DISAGREEMENT check in `define-saas-config` refuses, because a wrong declaration is wrong\n * whatever happens next.\n \n Resolution is attempted from the RUNNING APPLICATION first and from this module second. The\n * peer is installed in the application's own `backend-api`, not in the engine package, so\n * resolving only from here would report a false absence — and a diagnostic that cries wolf is\n * worse than the silence it replaces.\n /\n private reportMissingProviderRuntimePeers(): void {\n const resolvers = [\n (() => { try { return createRequire(join(process.cwd(), 'package.json')); } catch { return undefined; } })(),\n (() => { try { return createRequire(import.meta.url); } catch { return undefined; } })(),\n ].filter((resolver): resolver is NodeRequire => Boolean(resolver));\n\n const isResolvable = (packageName: string): boolean => resolvers.some((resolver) => {\n try {\n resolver.resolve(packageName);\n return true;\n } catch {\n return false;\n }\n });\n\n for (const provider of this.backendProviderRegistry.getRegistry().modules.values()) {\n const declaredPackages = provider.requiredPackages ?? [];\n const missing = declaredPackages.filter((packageName) => !isResolvable(packageName));\n if (missing.length === 0) {\n continue;\n }\n this.logger.warn('Provider is registered without its declared optional runtime peer(s)', {\n providerRef: provider.metadata.ref,\n missingPackages: missing,\n detail: 'The provider lazy-loads these and degrades without them, so the capability it serves will not work. '\n + 'Install them in the runtime that enables this provider, or stop declaring the provider in that scope.',\n });\n }\n }\n\n private buildRuntimeRegistryFromProviderModules(): External_Providers_Registry {\n const registry: External_Providers_Registry = {};\n for (const provider of this.backendProviderRegistry.getRegistry().modules.values()) {\n const providerRef = provider.metadata.ref;\n const protocols = this.backendProviderRegistry.getProtocolKinds(providerRef);\n const engineCapabilities = provider.providerCapabilities\n .map((capability) => PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability])\n .filter((capability): capability is EngineCapability => Boolean(capability));\n\n registry[providerRef] = {\n providerRef,\n protocols,\n engineCapabilities: [...new Set(engineCapabilities)],\n supportsOAuth2: protocols.includes(ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2) \|\| undefined,\n };\n }\n return registry;\n }\n\n // ================================\n // Access Methods\n // ================================\n\n public getExternalProvidersRegistry(): External_Providers_Registry {\n this.ensureInitialized();\n return this.registry!;\n }\n\n public getProviderTypes(): string[] {\n this.ensureInitialized();\n return Object.keys(this.registry!);\n }\n\n public getProvider(providerRef: string): External_Providers_RegistryItem \| undefined {\n this.ensureInitialized();\n return this.registry![providerRef];\n }\n\n public hasProvider(providerRef: string): boolean {\n this.ensureInitialized();\n return providerRef in (this.registry \|\| {});\n }\n\n /\n Public, NON-throwing readiness probe — whether `initialize()` has run.\n * Lets lazy consumers (e.g. `CompositeAuditLogSink`) distinguish the expected\n * pre-startup window (skip silently, retry later) from a genuine post-init\n * resolution fault (which must be surfaced, not swallowed) — without tripping\n * the `ensureInitialized()` throw just to probe.\n /\n public isReady(): boolean {\n return this.isInitialized;\n }\n\n public getProvidersForEngineCapability(capability: EngineCapability): string[] {\n this.ensureInitialized();\n if (this.configService.isInitialized()) {\n const activation = this.configService.config.engineCapabilities?.[capability];\n if (activation?.enabled !== true) {\n return [];\n }\n }\n\n const runtimeScope = this.getActiveRuntimeProviderScope();\n if (this.configService.isInitialized() && !runtimeScope) {\n return [];\n }\n\n const scopeProviderRefs = runtimeScope?.providers\n ? new Set(Object.keys(runtimeScope.providers))\n : undefined;\n const configuredProviders = this.configService.isInitialized()\n ? (this.configService.config.providerConfigurations ?? {})\n : {};\n\n const availableProviders = Object.values(this.registry!)\n .filter((provider) => provider.engineCapabilities.includes(capability))\n .map((provider) => provider.providerRef)\n .filter((providerRef) => {\n if (!scopeProviderRefs) {\n return true;\n }\n\n const selection = runtimeScope?.providers?.[providerRef];\n return scopeProviderRefs.has(providerRef)\n && (selection?.engineCapabilities ?? []).includes(capability);\n });\n\n // A FAN_OUT capability ignores any `selection` policy: every declared\n // provider is active, so primary/substitute ordering is meaningless (and the\n // config validator rejects authoring one). Guarding here is defense-in-\n // depth — a stray selection on a fan-out cap from a legacy/hand-authored\n // artifact never reorders or truncates the fan-out set.\n // Per-environment selection override (WILDO_PROVIDER_SELECTION_OVERRIDES,\n // authored in `wildo.infra.<env>.config.ts > providerSelection`) wins over\n // the app-wide `wildo.saas.config.ts` selection for a SELECT_ONE capability.\n // It only REORDERS — the availability/enabled filtering above is unchanged,\n // so an override naming an undeclared or capability-disabled provider\n // resolves to nothing (fail-closed), exactly like an equivalent SaaS-side\n // selection. FAN_OUT ignores it (same rule as the SaaS-side selection).\n const selectionForCapability = this.getProviderSelectionOverride(capability)\n ?? runtimeScope?.selection?.[capability];\n const policy = getEngineCapabilityResolutionMode(capability) === EngineCapabilityResolutionMode.FAN_OUT\n ? undefined\n : selectionForCapability;\n if (policy) {\n const orderedPolicyRefs = [policy.primary, ...(policy.whenUnavailable ?? [])]\n .filter((providerRef) => availableProviders.includes(providerRef));\n const remainingRefs = availableProviders.filter((providerRef) => !orderedPolicyRefs.includes(providerRef));\n return [...orderedPolicyRefs, ...remainingRefs];\n }\n\n return availableProviders.sort((left, right) => {\n const leftConfigured = configuredProviders[left] ? 0 : 1;\n const rightConfigured = configuredProviders[right] ? 0 : 1;\n return leftConfigured - rightConfigured \|\| left.localeCompare(right);\n });\n }\n\n public getPrimaryProviderForEngineCapability(capability: EngineCapability): string \| undefined {\n return this.getProvidersForEngineCapability(capability)[0];\n }\n\n /\n Resolve the provider ref(s) that should be ACTIVE for a capability,\n * honouring its declared `EngineCapabilityResolutionMode`:\n * - `SELECT_ONE` (the default — billing, email, observability, …): the\n * single primary, as a 0- or 1-element list. A declared `whenUnavailable` entry\n * only orders the candidate list ahead of this call — it substitutes for a\n * primary that is not AVAILABLE, and nothing tries a second provider when a\n * call to the first one FAILS.\n * - `FAN_OUT` (e.g. `COMPLIANCE_AUDIT_TRAIL`): EVERY declared + available\n * provider — all active simultaneously (no primary, no failover).\n \n The single entry point a fan-out consumer (the `CompositeAuditLogSink`)\n * uses, so the resolution mode is honoured centrally rather than each\n * consumer choosing `getPrimary…` vs `getProviders…` by convention.\n /\n public getResolvedProviderRefsForCapability(capability: EngineCapability): string[] {\n if (getEngineCapabilityResolutionMode(capability) === EngineCapabilityResolutionMode.FAN_OUT) {\n return this.getProvidersForEngineCapability(capability);\n }\n const primary = this.getPrimaryProviderForEngineCapability(capability);\n return primary ? [primary] : [];\n }\n\n public isEngineCapabilityAvailable(capability: EngineCapability): boolean {\n return this.getProvidersForEngineCapability(capability).length > 0;\n }\n\n /\n G4 (audit Phase 5) — fail-open reconcile support. Whether a capability is\n * switched ON in `engineCapabilities` config (`activation.enabled === true`),\n * INDEPENDENT of whether any provider resolves to serve it. Distinct from:\n * - `isEngineCapabilityAvailable` — a provider is DECLARED (says nothing about\n * the operator's config intent), and\n * - `getRequiredCapabilitiesWithoutProvider` — a HARD requirement is unmet\n * (throws at boot; F5).\n * The G4 warn pairs this (\"the operator turned audit on\") with a zero-resolved-\n * provider check (\"but nothing is delivering it\") to flag a SILENT Layer-2\n * fan-out — a warn, never a throw.\n /\n public isEngineCapabilityEnabled(capability: EngineCapability): boolean {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n return false;\n }\n return this.configService.config.engineCapabilities?.[capability]?.enabled === true;\n }\n\n /\n F5 (audit Phase 5) — boot-guard support. Returns every capability the app\n * marked `activation.required === true` that resolves to ZERO active providers\n * (respecting the capability's resolution mode — SELECT_ONE needs a primary,\n * FAN_OUT needs ≥1 declared; a `required` capability left `enabled: false`\n * resolves to none and is therefore also caught). A non-empty result means a\n * misconfigured deployment — a HARD requirement with nothing to serve it — and\n * `StartApplicationBackendService.initialize()` throws CONFIGURATION on any.\n * Audit (`COMPLIANCE_AUDIT_TRAIL`, when marked required) is the FIRST user, not\n * a special case: this generalizes the coherence to EVERY capability.\n /\n public getRequiredCapabilitiesWithoutProvider(\n options: RequiredCapabilityFloorOptions = { includeEngineFloor: true },\n ): EngineCapability[] {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n // Used to answer `[]` here, which read as \"nothing missing\" on a host whose config\n // had never loaded — a floor that cannot see its inputs must refuse, not reassure.\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'The required-capability floor was evaluated before the application configuration '\n + 'was initialized; it cannot decide what is required.',\n },\n });\n }\n const activations = this.configService.config.engineCapabilities ?? {};\n const missing: EngineCapability[] = [];\n // Swept over the ENUM, not over the authored keys (#328), so the population and its order\n // are the engine's. Requiredness itself always needs an activation entry — an absent key is\n // neither `enabled` nor `required` — so this is about which list is authoritative, not about\n // catching an omitted key.\n for (const capability of Object.values(EngineCapability)) {\n const activation = activations[capability];\n const requiredByApplication = activation?.required === true;\n const requiredByEngine = options.includeEngineFloor\n && activation?.enabled === true\n && ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED.has(capability);\n if (\n (requiredByApplication \|\| requiredByEngine)\n && this.getResolvedProviderRefsForCapability(capability).length === 0\n ) {\n missing.push(capability);\n }\n }\n return missing;\n }\n\n /\n The floor as a single fail-closed door (#328): every host that serves the application\n * calls this after its registry is ready — the application backend, and the platform\n * services after `refreshFromConfig()` — so \"required with nothing serving it\" cannot pass\n * one host's boot because the check happened to live on another's branch.\n /\n public assertRequiredCapabilityFloor(options?: RequiredCapabilityFloorOptions): void {\n const missingRequiredCapabilities = this.getRequiredCapabilitiesWithoutProvider(options);\n if (missingRequiredCapabilities.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Required engine capabilities resolve no active provider: [${missingRequiredCapabilities.join(', ')}]. `\n + 'Each is either marked `required` in engineCapabilities or is an engine flow that needs a provider '\n + 'the moment it is enabled (EMAIL_TRANSACTIONAL, BILLING, SMS) — declare a provider for it '\n + '(SELECT_ONE needs a primary; FAN_OUT needs ≥1 declared), or disable the capability.',\n missingRequiredCapabilities,\n },\n });\n }\n\n /\n Per-environment external-provider selection override, read once from\n * `process.env.WILDO_PROVIDER_SELECTION_OVERRIDES` (a JSON map of\n * `EngineCapability -> { primary, whenUnavailable? }`). Projected by the Wildo\n * CLI's `env-vars-builder` from `wildo.infra.<env>.config.ts > providerSelection`.\n * Read as a string literal (not via a `platform-config-lib` import) to\n * preserve the engine → platform dependency direction — mirrors how\n * `LoggerService` reads `LOG_LEVEL` and `otel-preload` reads `OTEL_ENABLED`.\n \n Memoized on first read: env vars are fixed for a process lifetime, and\n * `getProvidersForEngineCapability` is a hot path. A malformed value is\n * tolerated (logged + ignored) so a bad override degrades to the SaaS-config\n * selection rather than breaking provider resolution.\n /\n private providerSelectionOverridesCache?: Partial<Record<EngineCapability, { primary: string; whenUnavailable?: string[] }>>;\n private providerSelectionOverridePayloadMalformed = false;\n private readonly malformedProviderSelectionOverrides = new Set<EngineCapability>();\n\n private getProviderSelectionOverride(\n capability: EngineCapability,\n ): { primary: string; whenUnavailable?: string[] } \| undefined {\n if (this.providerSelectionOverridesCache === undefined) {\n const raw = process.env.WILDO_PROVIDER_SELECTION_OVERRIDES;\n if (!raw) {\n this.providerSelectionOverridesCache = {};\n } else {\n try {\n const parsed = JSON.parse(raw) as unknown;\n if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n this.providerSelectionOverridesCache = parsed as Partial<Record<EngineCapability, { primary: string; whenUnavailable?: string[] }>>;\n } else {\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n } catch (error) {\n this.logDebug('Failed to parse WILDO_PROVIDER_SELECTION_OVERRIDES; ignoring per-env override', {\n error: describeCaughtError(error),\n });\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n }\n }\n const override = this.providerSelectionOverridesCache[capability];\n // Guard the shape defensively — a hand-crafted env var could carry a\n // non-conforming entry that upstream Zod validation never saw.\n if (override === undefined) return undefined;\n if (\n typeof override.primary !== 'string'\n \|\| override.primary.length === 0\n \|\| (override.whenUnavailable !== undefined && (\n !Array.isArray(override.whenUnavailable)\n \|\| !override.whenUnavailable.every((substitute) => typeof substitute === 'string' && substitute.length > 0)\n ))\n ) {\n this.malformedProviderSelectionOverrides.add(capability);\n return undefined;\n }\n return override;\n }\n\n /\n Sanitized provenance for the effective provider selection. This exposes\n * neither environment bytes nor provider configuration; it only preserves\n * which authority won and the generated artifact identities behind it.\n /\n public getProviderSelectionResolutionEvidence(capability: EngineCapability): ExternalProviderSelectionResolutionEvidence {\n this.ensureInitialized();\n const runtimeSelection = this.getActiveRuntimeProviderScope()?.selection?.[capability];\n const environmentSelection = this.getProviderSelectionOverride(capability);\n const overrideMalformed = this.providerSelectionOverridePayloadMalformed \|\| this.malformedProviderSelectionOverrides.has(capability);\n return Object.freeze({\n authorityKind: environmentSelection\n ? ExternalProviderSelectionAuthorityKind.ENVIRONMENT_OVERRIDE\n : runtimeSelection\n ? ExternalProviderSelectionAuthorityKind.APPLICATION_RUNTIME_ARTIFACT\n : ExternalProviderSelectionAuthorityKind.DEFAULT_RESOLUTION,\n overrideStatus: overrideMalformed\n ? ExternalProviderSelectionOverrideStatus.MALFORMED\n : environmentSelection\n ? ExternalProviderSelectionOverrideStatus.APPLIED\n : ExternalProviderSelectionOverrideStatus.ABSENT,\n applicationPrimaryProviderRef: runtimeSelection?.primary ?? null,\n applicationSubstituteProviderRefs: Object.freeze([...(runtimeSelection?.whenUnavailable ?? [])]),\n environmentPrimaryProviderRef: environmentSelection?.primary ?? null,\n environmentSubstituteProviderRefs: Object.freeze([...(environmentSelection?.whenUnavailable ?? [])]),\n providerRuntimeArtifact: this.configService.getProviderRuntimeArtifactEvidenceMetadata(),\n });\n }\n\n private getActiveRuntimeProviderScope(): RuntimeProviderScope \| undefined {\n if (!this.configService.isInitialized()) {\n return undefined;\n }\n\n const scopes = this.configService.config.providers?.scopes;\n if (!scopes) {\n return undefined;\n }\n\n const serviceName = typeof (this.configService as { serviceName?: string }).serviceName === 'string'\n ? (this.configService as { serviceName?: string }).serviceName!\n : '';\n if (scopes.companion && isCompanionRuntimeServiceName(serviceName)) {\n return scopes.companion as RuntimeProviderScope;\n }\n\n return scopes.backend as RuntimeProviderScope \| undefined;\n }\n\n /\n Get provider configuration for a specific protocol.\n * Falls back to default configuration from cached provider definitions if not overridden.\n /\n public getProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n this.ensureInitialized();\n try {\n if (!this.configService.isInitialized()) {\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n const appConfig = this.configService.config;\n const providerConfigs = appConfig.providerConfigurations \|\| {};\n\n const defaultConfig = this.getDefaultProviderConfiguration(providerRef, protocolKind);\n const customConfig = providerConfigs[providerRef]?.[protocolKind];\n if (customConfig) {\n this.logDebug(`Using merged custom configuration for ${providerRef}.${protocolKind}`);\n return this.mergeProviderConfiguration(\n defaultConfig,\n customConfig as ResolvedProviderConfiguration,\n );\n }\n\n if (defaultConfig) {\n this.logDebug(`Using default configuration for ${providerRef}.${protocolKind}`);\n }\n return defaultConfig;\n } catch (error) {\n // Programmer-error / contract-violation paths (cross-`kind`\n // merge guard, authKind misuse on `agent-client-protocol`) throw via\n // `errorBuilder.buildError`, producing `WildoError_Backend`.\n // Those MUST surface — they signal projection drift that the\n // silent fallback would mask. Only network/runtime hiccups\n // (the original intent of this catch) fall back to default.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting provider configuration, falling back to default', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n }\n\n private mergeProviderConfiguration(\n defaultConfig: ResolvedProviderConfiguration \| undefined,\n customConfig: ResolvedProviderConfiguration\n ): ResolvedProviderConfiguration {\n if (!defaultConfig) {\n return customConfig;\n }\n\n // Fail-closed cross-`kind` guard. Both inputs are looked up by\n // the same `(providerRef, protocolKind)` pair upstream, so the\n // discriminated-union `kind` MUST match if both contracts are\n // present. A mismatch here would silently corrupt the merged\n // result into a type-broken union member; we throw via\n // `errorBuilder.buildError` so the WildoError_Backend instance\n // is detected by `getProviderConfiguration`'s catch and\n // re-thrown past the default-fallback path (the catch only\n // swallows generic runtime errors, not contract violations).\n //\n // Note on scope: this guard fires against cross-`kind` drift\n // between `getDefaultProviderConfiguration`'s emit (carries\n // `runtimeContract`) and any caller-provided override that\n // ALSO carries `runtimeContract`. App-developer authoring of\n // `providerConfigurations.<providerRef>.<protocolKind>` does\n // not include `runtimeContract` (the backend module owns\n // that), so today the guard primarily defends against future\n // refactors of the merge call site rather than user-authored\n // input.\n const defaultKind = defaultConfig.runtimeContract?.kind;\n const customKind = customConfig.runtimeContract?.kind;\n if (defaultKind && customKind && defaultKind !== customKind) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message: `[external-providers-registry] mergeProviderConfiguration received contracts with mismatched kind`,\n defaultKind,\n customKind,\n },\n },\n );\n }\n\n const mergedRuntimeContract = this.deepMergeRecord(\n defaultConfig.runtimeContract as Record<string, unknown> \| undefined,\n customConfig.runtimeContract as Record<string, unknown> \| undefined,\n );\n\n return {\n ...defaultConfig,\n ...customConfig,\n // `executionProfiles` is a MAP OF NAMED PROFILES, so the top-level\n // spread above would drop every profile the provider synthesized\n // (including `default`, which existing consumers still resolve) as\n // soon as an application authors one profile of its own. Merge by\n // ref instead — and replace a same-named profile WHOLE rather than\n // deep-merging it: a deep merge would let an override inherit\n // `secretRef`/`secretEnvVarName` from the synthesized default and\n // silently turn a host-managed profile into a secret-injecting one.\n ...(defaultConfig.executionProfiles \|\| customConfig.executionProfiles\n ? {\n executionProfiles: {\n ...(defaultConfig.executionProfiles ?? {}),\n ...(customConfig.executionProfiles ?? {}),\n },\n }\n : {}),\n authConfig: this.deepMergeRecord(\n defaultConfig.authConfig,\n customConfig.authConfig,\n ) as ResolvedProviderConfiguration['authConfig'],\n // The deep-merge result is loosely typed (`Record<string, unknown> \| undefined`).\n // Cast back through `ProviderProtocolRuntimeContract`: the cross-`kind` guard\n // above ensures both inputs share the same `kind`, so the merged result is a\n // valid discriminated-union member.\n runtimeContract: mergedRuntimeContract as ProviderProtocolRuntimeContract \| undefined,\n };\n }\n\n private deepMergeRecord(\n defaultValue: unknown,\n customValue: unknown\n ): Record<string, unknown> \| undefined {\n if (!defaultValue && !customValue) return undefined;\n if (!defaultValue \|\| typeof defaultValue !== 'object' \|\| Array.isArray(defaultValue)) {\n return customValue as Record<string, unknown> \| undefined;\n }\n if (!customValue \|\| typeof customValue !== 'object' \|\| Array.isArray(customValue)) {\n return defaultValue as Record<string, unknown>;\n }\n\n const merged: Record<string, unknown> = {\n ...(defaultValue as Record<string, unknown>),\n };\n for (const [key, value] of Object.entries(customValue as Record<string, unknown>)) {\n const previous = merged[key];\n if (Array.isArray(previous) && Array.isArray(value)) {\n merged[key] = [...new Set([...previous, ...value])];\n continue;\n }\n merged[key] = previous\n && typeof previous === 'object'\n && !Array.isArray(previous)\n && value\n && typeof value === 'object'\n && !Array.isArray(value)\n ? this.deepMergeRecord(previous, value)\n : value;\n }\n return merged;\n }\n\n\n /\n WHAT a declared secret identifies — the integration, or an account.\n \n DECLARED wins; otherwise DERIVED, and the derivation is deliberately narrow. A ref the REST\n * runtime contract names as the OAuth2 client id or client secret is a REGISTRATION. Everything\n * else answers CREDENTIAL.\n \n The fallback exists because the field arrived after 689 provider packages had been emitted,\n * from catalogues that live outside this repository — a mark that only worked once every package\n * had been re-emitted would enforce nothing until then, which for a guard is the same as not\n * existing.\n \n It is a FLOOR, not a complete answer, and the direction of its error matters. Deriving\n * CREDENTIAL for a registration secret the contract does not name in those two slots is the\n * permissive mistake: such a secret would still be storable as a tenant's own. That is exactly\n * the case a provider must declare explicitly, and it is why `scope` is authorable at all rather\n * than purely computed.\n /\n public getProviderSecretScope(\n providerRef: string,\n secretRef: string,\n ): ExternalProvider_SecretScope {\n const entry = this.findSecretsContractEntry(providerRef, secretRef);\n if (entry?.scope !== undefined) {\n return entry.scope;\n }\n\n // Compare on the ENV-VAR NAME, not on the ref as supplied. A ref may arrive as either the\n // authoring slug (`accessToken`) or the env-var name (`SLACK_API_KEY`), while a runtime\n // contract only ever references the latter — so deriving from the raw ref answered CREDENTIAL\n // for `clientSecret` and REGISTRATION for `SLACK_CLIENT_SECRET`, two names for one secret.\n const comparableRef = entry?.envVarName ?? secretRef;\n const contract = this.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n const oauth2 = contract?.kind === ProviderProtocolRuntimeKind.REST ? contract.oauth2 : undefined;\n const namesRegistration = oauth2 !== undefined\n && (oauth2.clientIdSecretRef === comparableRef \|\| oauth2.clientSecretSecretRef === comparableRef);\n\n return namesRegistration\n ? ExternalProvider_SecretScope.REGISTRATION\n : ExternalProvider_SecretScope.CREDENTIAL;\n }\n\n /\n The contract entry for a ref, found by ENV-VAR NAME or by SLUG.\n \n Both are real addresses for the same thing and callers use both: the map key is the authoring\n * slug (`accessToken`), while runtime contracts reference the env-var name (`SLACK_API_KEY`).\n * Matching only one would leave half the callers unable to find an entry that is plainly there.\n /\n private findSecretsContractEntry(providerRef: string, secretRef: string): SecretsContractEntry \| undefined {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract;\n if (contract === undefined) {\n return undefined;\n }\n const bySlug = contract[secretRef];\n if (bySlug !== undefined) {\n return bySlug;\n }\n return Object.values(contract).find((entry) => entry.envVarName === secretRef);\n }\n\n public getProviderRuntimeContract(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): ProviderProtocolRuntimeContract \| undefined {\n return this.getProviderConfiguration(providerRef, protocolKind)?.runtimeContract;\n }\n\n public getLLMSemanticOperationKeys(providerRef: string): LLMProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.LLM) {\n return [];\n }\n\n return this.toSemanticOperationKeys(runtimeContract.operations);\n }\n\n /\n The semantic embeddings operations a provider's `EMBEDDINGS_PROVIDER` contract declares.\n * Consumer: `EmbeddingsBackendService`, which refuses to invoke a provider whose contract\n * does not declare {@link EmbeddingsProvider_OperationKey.EMBED_TEXTS} (fail-closed, named —\n * never an undefined-method throw inside an SDK call).\n /\n public getEmbeddingsSemanticOperationKeys(providerRef: string): EmbeddingsProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.EMBEDDINGS) {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is EmbeddingsProvider_OperationKey => operation !== undefined);\n }\n\n\n /\n The semantic extraction operations a provider's `DOCUMENT_EXTRACTION_PROVIDER` contract\n * declares. Consumer: `DocumentExtractionBackendService`, which refuses to invoke a provider\n * whose contract does not declare\n * {@link DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT} — fail-closed and\n * named, rather than a 404 from a route the provider never claimed to serve.\n /\n public getDocumentExtractionSemanticOperationKeys(providerRef: string): DocumentExtractionProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION) {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is DocumentExtractionProvider_OperationKey => operation !== undefined);\n }\n\n\n public getAgentClientProtocolConfiguration(providerRef: string): AgentClientProtocol_Configuration \| undefined {\n const config = this.getProviderConfiguration(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n return config as AgentClientProtocol_Configuration \| undefined;\n }\n\n public getAgentClientProtocolProfile(providerRef: string): RuntimeAgentClientProtocolProfile \| undefined {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL) {\n return undefined;\n }\n\n const supportedModels = [\n ...(runtimeContract.models ?? []),\n ...(runtimeContract.defaultModel ? [runtimeContract.defaultModel] : []),\n ];\n return {\n agentCommand: runtimeContract.agentCommand,\n agentArgs: [...(runtimeContract.agentArgs ?? [])],\n supportedOperationKeys: runtimeContract.operations\n .map((operation) => RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is CodingAgent_OperationKey => operation !== undefined),\n supportedModels: [...new Set(supportedModels)],\n supportedProtocolVersions: [...(runtimeContract.supportedProtocolVersions ?? [1])],\n ...(runtimeContract.sessionMetaExtensions ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions } : {}),\n ...(runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance\n ? { sessionMetaExtensionsByHostConfigurationInheritance: runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance }\n : {}),\n ...(runtimeContract.modelDelivery ? { modelDelivery: runtimeContract.modelDelivery } : {}),\n ...(runtimeContract.modelTransportIds\n ? { modelTransportIds: { ...runtimeContract.modelTransportIds } }\n : {}),\n ...(runtimeContract.inheritedEnvironmentVariables\n ? { inheritedEnvironmentVariables: [...runtimeContract.inheritedEnvironmentVariables] }\n : {}),\n // Normalised to the AUTHORED vocabulary: the contract spells these\n // with hyphens and the profile enum with underscores, and comparing\n // the two spellings directly is a guard that never fires.\n supportedAuthModes: runtimeContract.authModes.map((mode) => mode.replace(/-/g, '_')),\n ...(runtimeContract.sessionModeIdsByPermissionCeiling\n ? {\n sessionModeIdsByPermissionCeiling: Object.fromEntries(\n Object.entries(runtimeContract.sessionModeIdsByPermissionCeiling).map(\n ([ceiling, modeIds]) => [ceiling, [...(modeIds ?? [])]],\n ),\n ),\n }\n : {}),\n };\n }\n\n /\n Resolve one named ACP execution profile, PARSED rather than trusted.\n \n Application-authored `providerConfigurations` are typed `unknown` all the\n * way to here, so an authored profile would otherwise reach the runner\n * unvalidated — and for this transport the unvalidated fields include the\n * environment gate and the permission ceiling. Parsing here makes the\n * profile fail closed BEFORE any agent is spawned, and applies the schema\n * defaults the authoring contract promises.\n /\n public getAgentClientProtocolExecutionProfile(\n providerRef: string,\n executionProfileRef: string,\n ): AgentClientProtocol_ExecutionProfile \| undefined {\n this.ensureInitialized();\n\n const configuration = this.getAgentClientProtocolConfiguration(providerRef);\n const executionProfile = configuration?.executionProfiles?.[executionProfileRef];\n\n if (!executionProfile) {\n this.logDebug(`ACP execution profile ${executionProfileRef} not found for ${providerRef}`);\n return undefined;\n }\n\n try {\n return AgentClientProtocol_ExecutionProfileSchema.parse(executionProfile);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n providerRef,\n executionProfileRef,\n message: '[external-providers-registry] ACP execution profile is not a valid authored profile',\n validationError: describeCaughtError(error),\n },\n },\n );\n }\n }\n\n public getAgentClientProtocolExecutionProfileSecret(\n providerRef: string,\n executionProfileRef: string,\n ): string \| undefined {\n this.ensureInitialized();\n\n const executionProfile = this.getAgentClientProtocolExecutionProfile(providerRef, executionProfileRef);\n if (\n !executionProfile\n \|\| executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n return undefined;\n }\n\n const runtimeSecret = executionProfile.secretEnvVarName\n ? process.env[executionProfile.secretEnvVarName]\n : undefined;\n if (runtimeSecret && runtimeSecret.length > 0) {\n this.logDebug('Resolved ACP secret from process env', { providerRef, executionProfileRef });\n return runtimeSecret;\n }\n\n return undefined;\n }\n\n private toSemanticOperationKeys(operations: readonly string[]): LLMProvider_OperationKey[] {\n return operations\n .map((operation) => RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION[operation] ?? operation)\n .filter((operation): operation is LLMProvider_OperationKey => (\n Object.values(LLMProvider_OperationKey).includes(operation as LLMProvider_OperationKey)\n ));\n }\n\n private getDefaultProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n try {\n const runtimeContract = this.backendProviderRegistry.getRuntimeContract(providerRef, protocolKind);\n\n if (!runtimeContract) {\n this.logDebug(`Runtime contract not found: ${providerRef}:${protocolKind}`);\n return undefined;\n }\n\n\n if (runtimeContract.kind === ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL) {\n const defaultExecutionProfileRef = 'default';\n const hasExplicitSecretBinding = Boolean(\n runtimeContract.secretRef\n && runtimeContract.secretEnvVarName\n && runtimeContract.authModes.includes('secret-ref-env-injection'),\n );\n return {\n enabled: true,\n defaultExecutionProfileRef,\n executionProfiles: {\n [defaultExecutionProfileRef]: {\n runnerHost: AgentClientProtocol_RunnerHost.BACKEND_SUBPROCESS,\n command: runtimeContract.agentCommand,\n args: [...(runtimeContract.agentArgs ?? [])],\n inheritedEnvironmentVariables: [...(runtimeContract.inheritedEnvironmentVariables ?? [])],\n authMode: hasExplicitSecretBinding\n ? AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n : runtimeContract.authModes.includes('host-managed')\n ? AgentClientProtocol_AuthMode.HOST_MANAGED\n : AgentClientProtocol_AuthMode.NONE,\n ...(hasExplicitSecretBinding\n ? { secretRef: runtimeContract.secretRef, secretEnvVarName: runtimeContract.secretEnvVarName }\n : {}),\n // DEVELOPMENT only, and deliberately NARROWER than any other\n // synthesized default. Nobody authored this profile and\n // nobody reviewed it, and what it authorises is an agent\n // that edits a workspace. An application that wants a coding\n // agent anywhere else must say so in its own profile, where\n // the decision is visible.\n allowedApplicationEnvironments: [APPLICATION_ENVIRONMENT.DEVELOPMENT],\n workingDirectoryPolicy: AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_ROOT,\n // Both safety postures stated rather than left to a schema\n // default, so reading this profile tells you what it permits\n // without resolving anything.\n permissionCeiling: AgentClientProtocol_PermissionCeiling.PROMPT_ALWAYS,\n hostConfigurationInheritance: AgentClientProtocol_HostConfigurationInheritance.APPLICATION_SCOPED,\n ...(runtimeContract.sessionMetaExtensions\n ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions }\n : {}),\n },\n },\n runtimeContract,\n };\n }\n\n const secretRef = this.secretRefForRuntimeContract(runtimeContract);\n return {\n enabled: true,\n ...(secretRef\n ? {\n authConfig: {\n authKind: this.authKindForRuntimeContract(runtimeContract),\n secretRef,\n },\n }\n : {}),\n ...(runtimeContract.kind === ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR\n ? { endpoints: this.buildWebhookEndpoints(runtimeContract) }\n : {}),\n runtimeContract,\n };\n } catch (error) {\n // Same pattern as `getProviderConfiguration` — contract\n // violations (`authKindForRuntimeContract` misuse) throw a\n // `WildoError_Backend` instance that MUST surface.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting default provider configuration', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n private secretRefForRuntimeContract(runtimeContract: ProviderProtocolRuntimeContract): string \| undefined {\n switch (runtimeContract.kind) {\n case ProviderProtocolRuntimeKind.EMAIL:\n // A `delivery: 'log'` email contract (the dev `preview`\n // provider) has NO endpoint and NO apiKey — it renders +\n // logs instead of sending. No secretRef to resolve; the\n // caller emits no `authConfig` and the email service skips\n // the API-key requirement. Contract-driven, not ref-keyed.\n return runtimeContract.delivery === 'log' ? undefined : runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.LLM:\n return runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.IMAGE:\n return runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.EMBEDDINGS:\n return runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION:\n return runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.OAUTH2_SSO:\n return runtimeContract.clientSecretRef;\n case ProviderProtocolRuntimeKind.BILLING:\n case ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR:\n return runtimeContract.secretRef;\n case ProviderProtocolRuntimeKind.SMS:\n return runtimeContract.auth.secretRef;\n case ProviderProtocolRuntimeKind.REST:\n return runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL:\n // An ACP agent that needs a credential carries it on the\n // contract; a host-managed one (the default for a coding agent\n // running under an operator's own login) carries none.\n return runtimeContract.secretRef;\n default: {\n const exhaustiveCheck: never = runtimeContract;\n return exhaustiveCheck;\n }\n }\n }\n\n /\n Map a runtime contract's `kind` to the canonical\n * `ExternalProvider_Auth_Kind` for the `authConfig` projection.\n * Used by `getDefaultProviderConfiguration` so the emitted\n * `authConfig: { authKind, secretRef }` satisfies the schema's\n * required-`authKind` invariant (was previously `{ secretRef }`\n * with no `authKind`, masked by `as unknown as` casts).\n \n Mapping rationale:\n \n - `llm` / `email` / `sms` / `billing` — providers authenticate\n * with an opaque API key supplied via env var.\n * - `webhook-originator` — provider signs payloads with HMAC; the\n * `secretRef` is the HMAC signing key.\n * - `oauth2-sso` — kind `OAUTH2`; the `secretRef` is the OAuth2\n * client secret.\n * - `agent-client-protocol` — auth is encoded on the executionProfile,\n * not `authConfig`; this method is not called for that kind\n * because that arm returns from the dedicated branch in\n * `getDefaultProviderConfiguration` BEFORE reaching this\n * mapping. A misuse throws via `errorBuilder` so the\n * `WildoError_Backend` instance bypasses the\n * `getProviderConfiguration` fallback catch.\n /\n private authKindForRuntimeContract(\n runtimeContract: ProviderProtocolRuntimeContract,\n ): ExternalProvider_Auth_Kind {\n switch (runtimeContract.kind) {\n case ProviderProtocolRuntimeKind.LLM:\n case ProviderProtocolRuntimeKind.IMAGE:\n case ProviderProtocolRuntimeKind.EMBEDDINGS:\n // Document extraction authenticates with an opaque API key in a request header, like\n // its siblings above; the header SHAPE (name/prefix) stays on the contract because\n // this family builds its own HTTPS request rather than handing a key to an SDK.\n case ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION:\n case ProviderProtocolRuntimeKind.EMAIL:\n case ProviderProtocolRuntimeKind.SMS:\n case ProviderProtocolRuntimeKind.BILLING:\n // `rest` authenticates with an opaque API key supplied via env var, like its siblings\n // above; the header SHAPE (name/prefix) stays on the contract for its consumer.\n case ProviderProtocolRuntimeKind.REST:\n return ExternalProvider_Auth_Kind.API_KEY;\n case ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR:\n return ExternalProvider_Auth_Kind.HMAC_SIGNATURE;\n case ProviderProtocolRuntimeKind.OAUTH2_SSO:\n return ExternalProvider_Auth_Kind.OAUTH2;\n case ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL:\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message: '[external-providers-registry] authKindForRuntimeContract called with kind=agent-client-protocol; '\n + 'ACP auth lives on executionProfiles[].authMode, not on authConfig.',\n },\n },\n );\n default: {\n const exhaustiveCheck: never = runtimeContract;\n return exhaustiveCheck;\n }\n }\n }\n\n /\n Project the provider-authored `runtimeContract.endpoints` into\n * the canonical `Hook_Endpoint` shape consumed by the framework\n * webhook controller. Provider-agnostic: each endpoint descriptor\n * is owned by the provider module (see Stripe's `endpoints` array\n * on `stripe.backend.module.ts`); the only field this projection\n * adds is `signatureConfig.headerName`, sourced from the contract's\n * top-level `signatureHeaderName` so providers don't repeat it on\n * every endpoint.\n \n Previously branched on a Stripe-only provider literal\n * with the entire endpoint shape (event types, polymorphic\n * variants, `lookupField`) hardcoded inside this consumer site —\n * the same anti-pattern Step 7 was supposed to eliminate. Moved\n * to the provider module 2026-05-06 to close the gap; the CI\n * guard regex (`no-provider-ref-branches.guard.test.ts`) now\n * also catches the `runtimeContract.provider` literal pattern.\n \n Per-endpoint secret overrides (if a future provider needs them)\n * still flow through `HookInitiatorProvider_Configuration.endpointSecrets`,\n * not through this projection.\n /\n private buildWebhookEndpoints(\n runtimeContract: Extract<ProviderProtocolRuntimeContract, { kind: typeof ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR }>,\n ): ReadonlyArray<Hook_Endpoint> {\n return runtimeContract.endpoints.map((endpoint) => ({\n ...endpoint,\n signatureConfig: {\n ...endpoint.signatureConfig,\n headerName: runtimeContract.signatureHeaderName,\n },\n eventTypes: [...endpoint.eventTypes],\n }));\n }\n\n /\n Get provider secrets for a specific protocol and secret reference.\n * Provider secrets are runtime-delivered via env/K8s materialization.\n * The secret binding contract is still declared by the provider protocol\n * configuration, but the secret value source is `process.env`.\n \n The `envVarName ?? secretRef` fallback covers the case where the\n * resolver doesn't find an explicit env-var-name mapping for the\n * requested secretRef. Today every engine provider authors\n * `secretsContract.<slug>.envVarName === <secretRef value>` (verified\n * across 17 modules), so this fallback is exactly equivalent to a\n * direct `process.env[secretRef]` lookup. If a future provider's\n * `secretsContract.envVarName` diverges from its `secretRef`, the\n * load-bearing path becomes `protocolConfig.authConfig.secretRef`\n * (returned by `getProviderSecretEnvVarName`), and the fallback\n * stays a defensive last-chance match.\n /\n public getProviderSecret(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const envVarName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef);\n const resolvedEnvVarName = envVarName ?? secretRef;\n\n const secretValue = process.env[resolvedEnvVarName];\n return secretValue && secretValue.length > 0 ? secretValue : undefined;\n } catch {\n return undefined;\n }\n }\n\n private getProviderSecretEnvVarName(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n ): string \| undefined {\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n && executionProfile.secretRef === secretRef\n ) {\n return executionProfile.secretEnvVarName;\n }\n }\n }\n\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n if (protocolConfig?.authConfig?.secretRef === secretRef) {\n return protocolConfig.authConfig.secretRef;\n }\n\n return undefined;\n }\n\n public getConfiguredProviderSecretRef(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n return config?.authConfig?.secretRef;\n }\n\n\n\n public getProviderApiKey(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n if (!secretRef) {\n this.logDebug(`No authConfig.secretRef found for ${providerRef}.${protocolKind}`);\n return undefined;\n }\n\n const apiKey = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (!apiKey) {\n this.logDebug(`Secret ${secretRef} not found for ${providerRef}.${protocolKind}`);\n }\n return apiKey;\n } catch (error) {\n this.logDebug('Error getting provider API key', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n /\n WHICH connections this provider admits — the recorded decision, or the FLOOR.\n \n The floor is an APPLICATION-owned, undelegated connection and nothing else, and it is what a\n * provider that has recorded no decision gets. It is not a permissive default: it is the one\n * answer always available (an operator can author an environment variable) and the one that\n * cannot produce a cross-tenant mistake (it has exactly one instance).\n \n Never derived here from a provider's auth shape. Whether a vendor can be connected per tenant\n * is a fact about that vendor's product and about what somebody verified — see the catalogue\n * record for a generated provider, or the module itself for a hand-authored one.\n /\n public getProviderAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[] {\n const declared = this.backendProviderRegistry.getProvider(providerRef)?.admissibleConnections;\n const catalogue = declared === undefined \|\| declared.length === 0\n ? UNJUDGED_PROVIDER_ADMISSIBLE_CONNECTIONS\n : declared;\n\n return this.narrowToApplicationConnectionPolicy(providerRef, catalogue);\n }\n\n /\n What the VENDOR admits, before this application's policy narrows it.\n \n Exists so a refusal can name the right cause. Once a policy can subtract, \"this provider does\n * not admit that connection\" has two meanings — nobody recorded the vendor's capability, or this\n * application switched it off — and they are repaired in different files by different people.\n * A diagnostic that always blamed the catalogue would send an operator to edit a decision record\n * that is already correct.\n /\n public getProviderCatalogueAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[] {\n const declared = this.backendProviderRegistry.getProvider(providerRef)?.admissibleConnections;\n return declared === undefined \|\| declared.length === 0\n ? UNJUDGED_PROVIDER_ADMISSIBLE_CONNECTIONS\n : declared;\n }\n\n /\n Intersect what the VENDOR admits with what THIS application permits.\n \n Two layers answering different questions, and the intersection is what makes them composable:\n * the catalogue record says an organization-owned Slack connection is possible because Slack is\n * installed per workspace, while `providers.connections.slack` says whether this product offers\n * one. A vendor opening a capability and a product deciding to use it are different events, and\n * a single list would make them look identical.\n \n NARROWING ONLY, and that direction is the guarantee rather than a convention. An application\n * cannot declare a connection the vendor does not support into existence — the connect leg would\n * build an authorize URL the vendor rejects, or store a grant nothing can spend — so a policy\n * entry naming an unadmitted shape contributes nothing instead of granting it.\n \n An ABSENT policy means \"everything the catalogue admits\", never \"nothing\". Most applications\n * will never author one, and reading their silence as a refusal would switch off the whole\n * connect surface for every product that has not yet thought about it.\n \n An intersection that empties is a legitimate outcome, not a misconfiguration: it is how an\n * application switches a provider's connect surface off without removing the provider, which it\n * may still need for its own application-scope credential.\n /\n private narrowToApplicationConnectionPolicy(\n providerRef: string,\n catalogue: readonly ExternalProvider_ConnectionShape[],\n ): readonly ExternalProvider_ConnectionShape[] {\n const permitted = this.configService.config.providers?.connections?.[providerRef]?.admissible;\n if (permitted === undefined) {\n return catalogue;\n }\n return catalogue.filter((shape) => permitted.some(\n (allowed) => allowed.ownerScope === shape.ownerScope && allowed.delegation === shape.delegation,\n ));\n }\n\n /\n One provider secret for ONE connection target — strictly, with no substitution.\n \n ## Why this exists beside `resolveProviderSecretForOrganization` rather than extending it\n \n That method FALLS BACK: an organization with no credential of its own silently spends the\n * deployment's. This one does not, and the difference is not a tightening of the same idea —\n * it is the opposite policy. A fallback means the vendor sees the application's identity while\n * the application believes it acted as the tenant, so every artifact the call leaves behind —\n * a message, a record, a line in the vendor's own audit log — is attributed to the wrong party,\n * and nothing downstream can detect it.\n \n An application that wants \"the tenant's key when they have connected one, otherwise ours\"\n * still has it: it names an APPLICATION target for that usage, in its own code, where the\n * choice is visible. What is removed is the engine performing the swap underneath a call that\n * asked for a tenant.\n \n `resolveProviderSecretForOrganization` is superseded and is removed once its remaining\n * consumers move; it is left standing only because its test currently carries another session's\n * uncommitted work.\n /\n public async resolveProviderSecretForTarget(\n target: ExternalProvider_ConnectionTarget,\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n ): Promise<{ value: string; source: ProviderCredentialResolutionSource; credentialId?: string }> {\n this.ensureInitialized();\n\n if (target.delegation === ExternalProvider_Connection_DelegationMode.USER) {\n throw this.buildConnectionRefusal(\n providerRef,\n `a call delegated to user '${target.actingForUserId}' cannot be resolved: no outbound per-principal token store exists yet. `\n + 'Declare an undelegated target, or build the delegated-token subsystem (#333).',\n );\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n // An envelope failure is NOT caught here, deliberately, for the organization branch's\n // reason: a person who HAS a credential which cannot be opened must refuse loudly rather\n // than be treated as a person who has none. The two are indistinguishable to a caller\n // and only one of them is a safe thing to continue from.\n const userResolver = this.resolveUserCredentialResolver();\n if (!userResolver) {\n throw this.buildConnectionRefusal(\n providerRef,\n 'no user credential store is bound, so a person-owned connection cannot be read at all. '\n + 'This is a wiring fault rather than a missing credential.',\n );\n }\n const ownedByUser = await userResolver.resolveUserCredential({\n userId: target.ownerId!,\n providerRef,\n secretSlug: secretRef,\n });\n if (!ownedByUser) {\n throw this.buildConnectionRefusal(\n providerRef,\n `user '${target.ownerId}' has not connected '${secretRef}'. It is not substituted with the `\n + \"deployment's or their organization's: the call asked to act as this person, and acting as \"\n + 'anyone else would put the wrong name on the record the provider keeps.',\n );\n }\n return {\n value: ownedByUser.value,\n source: ProviderCredentialResolutionSource.USER_CREDENTIAL,\n credentialId: ownedByUser.credentialId,\n };\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION) {\n const fromEnvironment = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (fromEnvironment) {\n return { value: fromEnvironment, source: ProviderCredentialResolutionSource.DEPLOYMENT_ENVIRONMENT };\n }\n const environmentVariableName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef;\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own credential for '${secretRef}' is not set. Author '${environmentVariableName}' in the deployment environment.`,\n );\n }\n\n // ORGANIZATION. An envelope failure is NOT caught, deliberately: a tenant that HAS a\n // credential which cannot be opened must refuse loudly rather than be treated as a tenant\n // that has none — the two are indistinguishable to a caller and only one is safe.\n const resolver = this.resolveOrganizationCredentialResolver();\n if (!resolver) {\n throw this.buildConnectionRefusal(\n providerRef,\n 'no organization credential store is bound, so a tenant-owned connection cannot be read at all. '\n + 'This is a wiring fault rather than a missing credential.',\n );\n }\n const owned = await resolver.resolveOrganizationCredential({\n organizationId: target.ownerId!,\n providerRef,\n secretSlug: secretRef,\n });\n if (!owned) {\n throw this.buildConnectionRefusal(\n providerRef,\n `organization '${target.ownerId}' has no credential for '${secretRef}'. It is not substituted with the deployment's: `\n + 'the call asked to act as this tenant, and acting as someone else instead would be attributed to the wrong party.',\n );\n }\n return {\n value: owned.value,\n source: ProviderCredentialResolutionSource.ORGANIZATION_CREDENTIAL,\n credentialId: owned.credentialId,\n };\n }\n\n /* One shape for every connection refusal, so an operator reads the same sentence everywhere. /\n private buildConnectionRefusal(providerRef: string, detail: string): Error {\n return new Error(`Provider '${providerRef}': ${detail}`);\n }\n\n // ══════════════════════════════════════════════════════════════════════════════════════════\n // PER-ORGANIZATION SECRET RESOLUTION (#357)\n //\n // ## Why these are separate methods and not a change to `getProviderSecret`\n //\n // `getProviderSecret` is synchronous, and six consumers across four other workstreams' files\n // call it that way. A per-organization credential lives in the database, so resolving one is\n // necessarily asynchronous — making the existing method async would reshape every one of those\n // call sites at once, in files this slice may not touch. So the environment path stays exactly\n // as it was, and the tenant-aware path is added beside it.\n //\n // This is a seam, not a duplication: the async path CALLS `getProviderSecret` for its second\n // step, so there remains exactly one implementation of \"what does the environment say\".\n //\n // ## The ORDER, and why the third step is a throw\n //\n // 1. the organization's OWN credential\n // 2. the deployment's env-projected `SecretsContract`\n // 3. refuse, BY NAME\n //\n // Step 3 is the one that matters. Before this existed, an unresolvable secret returned\n // `undefined`, and every caller then decided for itself what that meant — several of them by\n // passing it onward, so a vendor received an empty Authorization header and answered 401. A 401\n // from a vendor is indistinguishable from a revoked credential, so the real fault (nobody ever\n // configured one) was invisible. Naming both places that were checked turns that into a\n // sentence an operator can act on.\n //\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — resolving which principal this\n // application acts as toward a third party, per tenant.\n // ══════════════════════════════════════════════════════════════════════════════════════════\n\n /\n Lazy getter for the per-organization credential store — see the `container` constructor\n * param's JSDoc for why this cannot be a constructor injection.\n \n `isBound` is what preserves the old `@optional()` semantics: a host that binds no store\n * (a minion, a unit harness) resolves nothing here and falls through to the deployment\n * environment, exactly as it did before the store existed.\n /\n protected resolveOrganizationCredentialResolver(): OrganizationProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver)) return undefined;\n return this.container.get<OrganizationProviderCredentialResolverPort>(\n SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver,\n );\n }\n\n /\n Lazy getter for the per-user credential store — same mechanics as the organization one above,\n * and the OPPOSITE meaning when it resolves nothing.\n \n An unbound organization store falls through to the deployment environment, because a tenant\n * legitimately may not have its own credential. An unbound USER store REFUSES, because there is\n * nothing a person's credential could fall through to: spending the deployment's shared\n * principal on someone's behalf would attribute the act to the wrong party at the vendor. So a\n * host that forgot to bind this gets a refusal naming the wiring fault, never a silent\n * substitution.\n /\n protected resolveUserCredentialResolver(): UserProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.UserProviderCredentialResolver)) return undefined;\n return this.container.get<UserProviderCredentialResolverPort>(\n SAAS_SERVICE_TYPES.UserProviderCredentialResolver,\n );\n }\n\n /\n Resolve one provider secret FOR A TENANT, or refuse naming what is missing.\n \n @param organizationId the tenant on whose behalf the call will be made. Must come from a\n * trusted execution scope — this method cannot verify it, and the envelope binding is what\n * keeps a mistake here from becoming a cross-tenant disclosure.\n /\n public async resolveProviderSecretForOrganization(\n organizationId: string,\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n ): Promise<{ value: string; source: ProviderCredentialResolutionSource; credentialId?: string }> {\n this.ensureInitialized();\n\n // ── 1. the organization's own credential ────────────────────────────────────────────────\n //\n // An envelope failure is deliberately NOT caught. A tenant that HAS a credential which\n // cannot be opened must not quietly fall through to the deployment's shared one: that\n // substitution is exactly the silent cross-principal action this resource exists to remove,\n // and it would present to the operator as \"the integration works\" while the wrong identity\n // is on the wire.\n const organizationCredentialResolver = this.resolveOrganizationCredentialResolver();\n if (organizationCredentialResolver) {\n const owned = await organizationCredentialResolver.resolveOrganizationCredential({\n organizationId,\n providerRef,\n secretSlug: secretRef,\n });\n if (owned) {\n return {\n value: owned.value,\n source: ProviderCredentialResolutionSource.ORGANIZATION_CREDENTIAL,\n credentialId: owned.credentialId,\n };\n }\n }\n\n // ── 2. the deployment environment ───────────────────────────────────────────────────────\n const fromEnvironment = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (fromEnvironment) {\n return { value: fromEnvironment, source: ProviderCredentialResolutionSource.DEPLOYMENT_ENVIRONMENT };\n }\n\n // ── 3. refuse, by name ──────────────────────────────────────────────────────────────────\n const environmentVariableName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef;\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message:\n `No credential resolves for provider '${providerRef}' (protocol '${protocolKind}', secret '${secretRef}') `\n + `on behalf of organization '${organizationId}'. Two places were checked and both are empty: the `\n + `organization has no provider credential for this slug, and the deployment environment variable `\n + `'${environmentVariableName}' is not set. Either the organization's administrator sets its own `\n + `credential, or the operator sets that environment variable for every tenant to share.`,\n providerRef,\n protocolKind,\n secretRef,\n organizationId,\n environmentVariableName,\n },\n },\n );\n }\n\n /\n The tenant-aware sibling of `getProviderApiKey` — the provider's configured `authConfig`\n * secret, resolved for one organization.\n \n Refuses rather than returning `undefined` when the provider declares NO `authConfig.secretRef`\n * at all, because that is a different fault from an unset value and an operator fixing it edits\n * a different file: the provider module, not the environment.\n /\n public async resolveProviderApiKeyForOrganization(\n organizationId: string,\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): Promise<{ value: string; source: ProviderCredentialResolutionSource; credentialId?: string }> {\n this.ensureInitialized();\n\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n if (!secretRef) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message:\n `Provider '${providerRef}' declares no authConfig.secretRef for protocol '${protocolKind}', so there `\n + `is no secret to resolve for organization '${organizationId}'. This is a provider-module defect, not `\n + 'a deployment one — the module must declare which secret its protocol authenticates with.',\n providerRef,\n protocolKind,\n organizationId,\n },\n },\n );\n }\n\n return this.resolveProviderSecretForOrganization(organizationId, providerRef, protocolKind, secretRef);\n }\n\n public isProviderEnabled(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): boolean {\n this.ensureInitialized();\n try {\n if (!this.hasProvider(providerRef)) {\n return false;\n }\n\n const provider = this.getProvider(providerRef);\n if (!provider \|\| !provider.protocols.includes(protocolKind)) {\n return false;\n }\n\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n if (!config) {\n return true;\n }\n\n return config.enabled !== false;\n } catch (error) {\n this.logDebug('Error checking if provider is enabled', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return false;\n }\n }\n\n public getProviderProtocolSecrets(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): Record<string, string> \| undefined {\n this.ensureInitialized();\n try {\n const resolvedSecrets: Record<string, string> = {};\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n const protocolSecretRef = protocolConfig?.authConfig?.secretRef;\n if (protocolSecretRef) {\n const secretValue = this.getProviderSecret(providerRef, protocolKind, protocolSecretRef);\n if (secretValue) {\n resolvedSecrets[protocolSecretRef] = secretValue;\n }\n }\n\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n continue;\n }\n\n const secretValue = this.getProviderSecret(providerRef, protocolKind, executionProfile.secretRef);\n if (secretValue) {\n resolvedSecrets[executionProfile.secretRef] = secretValue;\n }\n }\n }\n\n return Object.keys(resolvedSecrets).length > 0 ? resolvedSecrets : undefined;\n } catch {\n return undefined;\n }\n }\n\n /\n Refresh the runtime registry facade from first-class backend provider modules.\n \n This mirrors `initialize()` and intentionally no longer depends on the\n * deleted capability-bindings service.\n */\n public async refreshFromConfig(): Promise<void> {\n try {\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.registry = registry;\n this.isInitialized = true;\n\n this.logDebug('External providers registry refreshed from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n } catch (error) {\n this.logDebug('Failed to refresh registry from config', {\n error: describeCaughtError(error)\n });\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n error: describeCaughtError(error),\n },\n }\n );\n }\n }\n\n // ================================\n // Initialization Utils\n // ================================\n\n protected ensureInitialized(): void {\n if (!this.isInitialized \|\| !this.registry) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED\n }\n );\n }\n }\n}\n"]}

package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"frontend-bootstrap.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/external-providers/services/frontend-bootstrap.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,eAAe,~~EAGf~~,KAAK,2BAA2B,EAGjC,MAAM,uBAAuB,CAAC;~~AAc~~/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAW/B,MAAM,WAAW,+BAA+B;IAC9C;;;;;;OAMG;IACH,YAAY,CAAC,IAAI,EAAE;QACjB,YAAY,EAAE,eAAe,CAAC;QAC9B,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC1C;AAED,qBACa,sCACX,YAAW,+BAA+B;IAIxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAFZ,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,0BAA0B;IAGrD,YAAY,CAAC,IAAI,EAAE;QACvB,YAAY,EAAE,eAAe,CAAC;QAC9B,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAMxC,OAAO,CAAC,2BAA2B;IAoCnC,OAAO,CAAC,oBAAoB;~~IA6B5B~~,OAAO,CAAC,eAAe;CAgBxB"}
1	+ {"version":3,"file":"frontend-bootstrap.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/external-providers/services/frontend-bootstrap.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,eAAe,EAIf,KAAK,2BAA2B,EAGjC,MAAM,uBAAuB,CAAC;AAe/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAW/B,MAAM,WAAW,+BAA+B;IAC9C;;;;;;OAMG;IACH,YAAY,CAAC,IAAI,EAAE;QACjB,YAAY,EAAE,eAAe,CAAC;QAC9B,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC1C;AAED,qBACa,sCACX,YAAW,+BAA+B;IAIxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAFZ,gBAAgB,EAAE,uBAAuB,EAEzC,YAAY,EAAE,0BAA0B;IAGrD,YAAY,CAAC,IAAI,EAAE;QACvB,YAAY,EAAE,eAAe,CAAC;QAC9B,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAMxC,OAAO,CAAC,2BAA2B;IAoCnC,OAAO,CAAC,oBAAoB;IAoD5B,OAAO,CAAC,eAAe;CAgBxB"}

package/dist/esm/external-providers/services/frontend-bootstrap.backend.service.js CHANGED Viewed

@@ -25,8 +25,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { inject, injectable } from 'inversify';
-import { AppFrontendType, ErrorCustomMessageReference, ErrorType, } from '@wildo-ai/saas-models';
-import { EngineFrontendAppProviderRegistry, } from '@wildo-ai/external-connectors-public/app';
+import { AppFrontendType, ErrorCustomMessageReference, ErrorType, normalizeProviderFrontendCspFootprint, } from '@wildo-ai/saas-models';
+import { EngineFrontendAppProviderRegistry, projectFrontendComponentDescriptors, } from '@wildo-ai/external-connectors-public/app';
 import { EngineFrontendTechdocProviderRegistry, } from '@wildo-ai/external-connectors-public/techdoc';
 import { EngineFrontendWebsiteProviderRegistry, } from '@wildo-ai/external-connectors-public/website';
 import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
@@ -84,6 +84,29 @@ let DefaultFrontendBootstrapBackendService = class DefaultFrontendBootstrapBacke
             providerCapabilities: [...provider.providerCapabilities],
             protocols: [...provider.protocols],
             publicConfig: provider.publicConfig,
+            // The DATA half of the frontend surface (#332, #380). This is the SECOND
+            // site that projects a module into an entry —
+            // `projectFrontendProviderContribution` in
+            // `external-connectors-public/companion-exports.ts` is the first, and it
+            // feeds the generated artifact this method is the fallback for. Omitting
+            // any of these fields here would make a provider's CSP footprint, SDK
+            // descriptor or component declarations depend on whether a sync had run,
+            // which is a difference no consumer can see and only production can
+            // punish.
+            //
+            // `components` was added second and briefly landed on the first site only,
+            // which is the shape this comment already warned about — hence the shared
+            // projection below rather than a second spread here.
+            // A module AUTHORS a partial footprint — name the buckets you reach — and
+            // the wire carries all of them, so the CSP composer never branches on
+            // absence and the hydration join has two comparable shapes. Normalized
+            // through the one shared function rather than spread here, because a
+            // second opinion about whether an unnamed bucket is `[]` or absent is
+            // read by that join as a stale artifact.
+            csp: provider.csp === undefined ? undefined : normalizeProviderFrontendCspFootprint(provider.csp),
+            scripts: provider.scripts === undefined ? undefined : [...provider.scripts],
+            sdk: provider.sdk?.descriptor,
+            components: projectFrontendComponentDescriptors(provider.components),
         };
     }
     resolveRegistry(frontendType) {