npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.12 → 1.1.13 - Mend

@wildo-ai/saas-backend-lib 1.1.12 → 1.1.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (226) hide show

package/dist/esm/external-providers/services/external-providers-registry.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"external-providers-registry.backend.service.js","sourceRoot":"","sources":["../../../../src/external-providers/services/external-providers-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,EAAE,sCAAsC,EAAE,MAAM,gDAAgD,CAAC;AAExG,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrG,OAAO,EACH,+BAA+B,EAC/B,+BAA+B,GAElC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACH,gCAAgC,EAChC,qCAAqC,GAGxC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAGH,gBAAgB,EAChB,8BAA8B,EAC9B,qDAAqD,EACrD,iCAAiC,EACjC,6CAA6C,EAC7C,wCAAwC,EACxC,yBAAyB,EACzB,wCAAwC,GAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAc1E,OAAO,EACL,sCAAsC,EAEtC,wBAAwB,EACxB,kCAAkC,EAClC,uCAAuC,EACvC,+BAA+B,EAC/B,uBAAuB,EACvB,2BAA2B,EAC3B,4BAA4B,EAC5B,2CAA2C,EAC3C,wCAAwC,EACxC,oCAAoC,EACpC,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAOpF,OAAO,EAAE,2BAA2B,EAAoC,MAAM,uFAAuF,CAAC;AACtK,OAAO,EACH,4BAA4B,EAC5B,0CAA0C,EAC1C,sCAAsC,GAEzC,MAAM,4FAA4F,CAAC;AAEpG,OAAO,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAA2B,MAAM,uBAAuB,CAAC;AAC7H,OAAO,EAAE,wCAAwC,EAAE,MAAM,0EAA0E,CAAC;AASpI,OAAO,EACH,2CAA2C,EAC3C,iCAAiC,EACjC,mCAAmC,GACtC,MAAM,uDAAuD,CAAC;AAC/D,gJAAgJ;AAChJ,yIAAyI;AACzI,oIAAoI;AACpI,0CAA0C;AAC1C,OAAO,EACH,oCAAoC,EACpC,iCAAiC,GAEpC,MAAM,kDAAkD,CAAC;AAE1D,OAAO,EACH,4BAA4B,EAC5B,0CAA0C,EAC1C,gDAAgD,EAChD,qCAAqC,EACrC,8BAA8B,EAC9B,0CAA0C,EAC1C,wBAAwB,GAG3B,MAAM,sCAAsC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,8CAA8C,GAA6C;IAC7F,aAAa,EAAE,wBAAwB,CAAC,eAAe;CAC1D,CAAC;AAgEF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACH,sCAAsC,EACtC,uCAAuC,GAE1C,MAAM,yGAAyG,CAAC;AAwCjH,MAAM,6BAA6B,GAAG;IAClC,uBAAuB,CAAC,WAAW;IACnC,uBAAuB,CAAC,OAAO;IAC/B,uBAAuB,CAAC,UAAU;CACrC,CAAC;AAEF,SAAS,6BAA6B,CAAC,WAAmB;IACtD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,OAAO,UAAU,KAAK,WAAW;WAC1B,UAAU,KAAK,qBAAqB;WACpC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,2CAA2C,GAA6C;IAC1F,YAAY,EAAE,wBAAwB,CAAC,aAAa;IACpD,UAAU,EAAE,wBAAwB,CAAC,WAAW;IAChD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,kBAAkB,EAAE,wBAAwB,CAAC,mBAAmB;IAChE,gBAAgB,EAAE,wBAAwB,CAAC,iBAAiB;IAC5D,8EAA8E;IAC9E,sEAAsE;CACzE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kDAAkD,GAAoD;IACxG,UAAU,EAAE,+BAA+B,CAAC,WAAW;CAC1D,CAAC;AAEF;;;;GAIG;AACH,MAAM,2DAA2D,GAA4D;IACzH,mBAAmB,EAAE,uCAAuC,CAAC,qBAAqB;CACrF,CAAC;AAEF,iHAAiH;AACjH,MAAM,sDAAsD,GAAuD;IAC/G,qBAAqB,EAAE,kCAAkC,CAAC,uBAAuB;IACjF,cAAc,EAAE,kCAAkC,CAAC,eAAe;CACrE,CAAC;AAYF,uGAAuG;AACvG,SAAS,sBAAsB,CAAC,YAAoD;IAChF,OAAQ,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAgE;SACrH,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,sCAAsC,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,CAAC;AAC3F,CAAC;AA6ED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC3D,OAAO,uCAAuC,UAAU,0EAA0E;UAC5H,mEAAmE,CAAC;AAC9E,CAAC;AAGM,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAOU;IACU;IACG;IACW;IAgC1B;IAzC9C,QAAQ,CAA+D;IACvE,QAAQ,GAAuC,IAAI,CAAC;IAEpD,aAAa,GAAG,KAAK,CAAC;IAEhC,YAC0D,MAAqB,EACX,aAAsC,EACnC,YAAwC,EAC7B,uBAA8D,EAgCxF,SAAqB;QAnCnB,WAAM,GAAN,MAAM,CAAe;QACX,kBAAa,GAAb,aAAa,CAAyB;QACnC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAgCxF,cAAS,GAAT,SAAS,CAAY;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAElF,IAAI,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,mCAAmC;IACnC,wBAAwB;IACxB,mCAAmC;IAEnC;;;OAGG;IACI,KAAK,CAAC,UAAU;QACnB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YACvD,OAAO;QACX,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;QAEhE,IAAI,CAAC,iCAAiC,EAAE,CAAC;QAEzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC;YACD,IAAI,CAAC,+BAA+B,EAAE,CAAC;YACvC,IAAI,CAAC,+BAA+B,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,qGAAqG;YACrG,iDAAiD;YACjD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,uEAAuE,EAAE;YACnF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;SAC/C,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACK,iCAAiC;QACrC,MAAM,SAAS,GAAG;YACd,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5G,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE;SAC3F,CAAC,MAAM,CAAC,CAAC,QAAQ,EAA2B,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnE,KAAK,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,+BAA+B,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;YACrJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;gBACrF,WAAW;gBACX,eAAe;gBACf,MAAM,EAAE,sGAAsG;sBACxG,uGAAuG;aAChH,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,2EAA2E;IAEnE,uCAAuC;QAC3C,MAAM,QAAQ,GAAgC,EAAE,CAAC;QACjD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,oBAAoB;iBACnD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,wCAAwC,CAAC,UAAU,CAAC,CAAC;iBACzE,MAAM,CAAC,CAAC,UAAU,EAAkC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAEjF,QAAQ,CAAC,WAAW,CAAC,GAAG;gBACpB,WAAW;gBACX,SAAS;gBACT,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACpD,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,sCAAsC,CAAC,UAAU,CAAC,IAAI,SAAS;aACrG,CAAC;QACN,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,mCAAmC;IACnC,iBAAiB;IACjB,mCAAmC;IAE5B,4BAA4B;QAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC;IAC1B,CAAC;IAEM,gBAAgB;QACnB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACI,OAAO;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACI,+BAA+B,CAAC,UAA4B;QAC/D,OAAO,iCAAiC,CAAC,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;IACvF,CAAC;IAED;;;;;;OAMG;IACI,uCAAuC,CAAC,UAA4B,EAAE,qBAAwC;QACjH,OAAO,oCAAoC,CAAC,EAAE,GAAG,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACxH,CAAC;IAED;;;;;;OAMG;IACI,4BAA4B,CAAC,UAA4B;QAC5D,IAAI,CAAC,wCAAwC,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QACrE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,0GAA0G;IAClG,uBAAuB,CAAC,UAA4B;QACxD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC;QACxE,OAAO;YACH,UAAU;YACV,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAC9J,GAAG,CAAC,UAAU;gBACV,CAAC,CAAC;oBACE,aAAa,EAAE;wBACX,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,UAAU,CAAC;wBACtG,YAAY,EAAE,IAAI,CAAC,6BAA6B,EAAE;wBAClD,sBAAsB,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC;6BAC9F,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;qBAC1G;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACN,CAAC;IAEM,qCAAqC,CAAC,UAA4B;QACrE,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,oCAAoC,CAAC,UAA4B;QACpE,MAAM,IAAI,GAAG,iCAAiC,CAAC,UAAU,CAAC,CAAC;QAC3D,QAAQ,IAAI,EAAE,CAAC;YACX,KAAK,8BAA8B,CAAC,OAAO;gBACvC,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;YAC5D,KAAK,8BAA8B,CAAC,iBAAiB;gBACjD,wGAAwG;gBACxG,uGAAuG;gBACvG,uEAAuE;gBACvE,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;YAC5D,KAAK,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC,CAAC;gBACvE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,CAAC;YACD;gBACI,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;IAEM,2BAA2B,CAAC,UAA4B;QAC3D,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;OAWG;IACI,yBAAyB,CAAC,UAA4B;QACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,0GAA0G;YAC1G,OAAO,yBAAyB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;IAC/F,CAAC;IAED;;;;;;;;;;OAUG;IACI,sCAAsC,CACzC,UAA0C,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAEtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,mFAAmF;YACnF,mFAAmF;YACnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,OAAO,EAAE,mFAAmF;0BACtF,qDAAqD;iBAC9D;aACJ,CAAC,CAAC;QACP,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACvE,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,2BAA2B;QAC3B,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,qBAAqB,GAAG,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAC;YAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,kBAAkB;mBAC5C,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC;mBAClD,qDAAqD,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7E,IACI,CAAC,qBAAqB,IAAI,gBAAgB,CAAC;mBACxC,IAAI,CAAC,oCAAoC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EACvE,CAAC;gBACC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7B,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAwC;QACzE,MAAM,2BAA2B,GAAG,IAAI,CAAC,sCAAsC,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,2BAA2B,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EACH,6DAA6D,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;sBACtG,oGAAoG;sBACpG,2FAA2F;sBAC3F,qFAAqF;gBAC3F,2BAA2B;aAC9B;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,+BAA+B,CAAsF;IACrH,yCAAyC,GAAG,KAAK,CAAC;IACzC,mCAAmC,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE3E,4BAA4B,CAChC,UAA4B;QAE5B,IAAI,IAAI,CAAC,+BAA+B,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;oBAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjE,IAAI,CAAC,+BAA+B,GAAG,MAA4F,CAAC;oBACxI,CAAC;yBAAM,CAAC;wBACJ,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;wBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;oBAC1D,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE;wBAC3F,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBACpC,CAAC,CAAC;oBACH,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;oBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;gBAC1D,CAAC;YACL,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAClE,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IACI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;eACjC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;eAC7B,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS,IAAI,CAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;mBACrC,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAC9G,CAAC,EACJ,CAAC;YACC,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACI,sCAAsC,CAAC,UAA4B;QACtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QACvF,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,iBAAiB,GAAG,IAAI,CAAC,yCAAyC,IAAI,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrI,OAAO,MAAM,CAAC,MAAM,CAAC;YACjB,aAAa,EAAE,oBAAoB;gBAC/B,CAAC,CAAC,sCAAsC,CAAC,oBAAoB;gBAC7D,CAAC,CAAC,gBAAgB;oBACd,CAAC,CAAC,sCAAsC,CAAC,4BAA4B;oBACrE,CAAC,CAAC,sCAAsC,CAAC,kBAAkB;YACnE,cAAc,EAAE,iBAAiB;gBAC7B,CAAC,CAAC,uCAAuC,CAAC,SAAS;gBACnD,CAAC,CAAC,oBAAoB;oBAClB,CAAC,CAAC,uCAAuC,CAAC,OAAO;oBACjD,CAAC,CAAC,uCAAuC,CAAC,MAAM;YACxD,6BAA6B,EAAE,gBAAgB,EAAE,OAAO,IAAI,IAAI;YAChE,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YAChG,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;YACvF,6BAA6B,EAAE,oBAAoB,EAAE,OAAO,IAAI,IAAI;YACpE,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YACpG,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,0CAA0C,EAAE;SAC3F,CAAC,CAAC;IACP,CAAC;IAEO,6BAA6B;QACjC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAG,OAAQ,IAAI,CAAC,aAA0C,CAAC,WAAW,KAAK,QAAQ;YAChG,CAAC,CAAE,IAAI,CAAC,aAA0C,CAAC,WAAY;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,SAAS,IAAI,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,SAAiC,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,CAAC,OAA2C,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACI,wBAAwB,CAC3B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5C,MAAM,eAAe,GAAG,SAAS,CAAC,sBAAsB,IAAI,EAAE,CAAC;YAE/D,MAAM,aAAa,GAAG,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACtF,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAClE,IAAI,CAAC,kCAAkC,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,sCAAsC,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YACrF,IAAI,YAAY,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,yCAAyC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBACtF,OAAO,IAAI,CAAC,0BAA0B,CAClC,aAAa,EACb,YAA6C,CAChD,CAAC;YACN,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,mCAAmC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,aAAa,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,4DAA4D;YAC5D,qEAAqE;YACrE,6DAA6D;YAC7D,6DAA6D;YAC7D,2DAA2D;YAC3D,4DAA4D;YAC5D,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE;gBAC3E,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,kCAAkC,CAAC,WAAmB,EAAE,YAAoB,EAAE,YAAqB;QACvG,MAAM,CAAC,OAAO,CAAC,GAAG,wCAAwC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAChH,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,sLAAsL;QACtL,0KAA0K;QAC1K,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACI,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,2CAA2C,CAAC,OAAO,CAAC;gBAC7D,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,GAAG,EAAE,OAAO,CAAC,GAAG;aACnB;SACJ,CACJ,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACI,+BAA+B,CAAC,WAAmB,EAAE,WAAmB,EAAE,QAAiB;QAC9F,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,SAAS;YAAE,OAAO;QACtH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACI,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,0BAA0B,WAAW,IAAI,WAAW,gCAAgC,MAAM,CAAC,QAAQ,CAAC,YAAY,WAAW,GAAG;sBACjI,kHAAkH;sBAClH,gCAAgC,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,+BAA+B;gBAClH,WAAW;gBACX,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC;aAC9B;SACJ,CACJ,CAAC;IACN,CAAC;IAED;;;;;;;;OAQG;IACI,gCAAgC;QACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE;YAAE,OAAO;QAChD,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5G,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,SAAS;gBAAE,SAAS;YAClF,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC,EAAE,CAAC;gBAC5F,IAAI,CAAC,sCAAsC,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,sCAAsC,CAAC,WAAmB,EAAE,WAAmB,EAAE,GAAY;QACjG,KAAK,MAAM,OAAO,IAAI,yCAAyC,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;YAChF,QAAQ,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpB,KAAK,oCAAoC,CAAC,eAAe;oBACrD,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC9E,MAAM;gBACV,KAAK,oCAAoC,CAAC,qCAAqC;oBAC3E,IAAI,CAAC,8CAA8C,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,mBAAmB,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;oBAChI,MAAM;gBACV,KAAK,oCAAoC,CAAC,uCAAuC;oBAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC/B,IAAI,CAAC,qDAAqD,CACtD,WAAW,EACX,0BAA0B,WAAW,IAAI,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,EACtE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC3E,CAAC;oBACN,CAAC;oBACD,MAAM;gBACV,OAAO,CAAC,CAAC,CAAC;oBACN,MAAM,UAAU,GAAU,OAAO,CAAC,KAAK,CAAC;oBACxC,OAAO,UAAU,CAAC;gBACtB,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,8CAA8C,CAAC,WAAmB,EAAE,WAAmB,EAAE,mBAA2B,EAAE,KAAc;QACxI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QACtG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,0BAA0B,WAAW,IAAI,WAAW,sBAAsB,mBAAmB,0BAA0B;sBAC1H,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,WAAW,gFAAgF;sBACxH,0CAA0C,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,+BAA+B;gBAC5H,WAAW;gBACX,YAAY,EAAE,WAAW;gBACzB,mBAAmB;gBACnB,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC;aAClC;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACI,qDAAqD,CAAC,WAAmB,EAAE,MAAc,EAAE,KAAwB;QACtH,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,GAAG,MAAM,UAAU,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,GAAG;sBACjI,gHAAgH;sBAChH,mHAAmH;gBACzH,WAAW;gBACX,MAAM;gBACN,cAAc,EAAE,KAAK;aACxB;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACK,gDAAgD,CAAC,IAAY;QACjE,IAAI,yBAAyB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/E,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5G,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,mBAAmB,CAAC,WAAmB;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,IAAI,EAAE,CAAC;QAC9F,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,KAAK,EAAE,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE;gBAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjF,CAAC;IAED,6HAA6H;IACrH,+BAA+B,CAAC,WAAmB,EAAE,IAAY;QACrE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAChF,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED,wFAAwF;IAChF,2BAA2B,CAAC,WAAmB;QACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACxI,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,0BAA0B,CAC9B,aAAwD,EACxD,YAA2C;QAE3C,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC;QACxB,CAAC;QAED,OAAO;YACH,GAAG,aAAa;YAChB,GAAG,YAAY;YACf,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,kEAAkE;YAClE,oEAAoE;YACpE,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,YAAY,CAAC,iBAAiB;gBACjE,CAAC,CAAC;oBACE,iBAAiB,EAAE;wBACf,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,EAAE,CAAC;wBAC1C,GAAG,CAAC,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC;qBAC5C;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;YACT,UAAU,EAAE,IAAI,CAAC,eAAe,CAC5B,aAAa,CAAC,UAAU,EACxB,YAAY,CAAC,UAAU,CACqB;YAChD,kDAAkD;YAClD,eAAe,EAAE,aAAa,CAAC,eAAe;YAC9C,SAAS,EAAE,aAAa,CAAC,SAAS;SACrC,CAAC;IACN,CAAC;IAEO,eAAe,CACnB,YAAqB,EACrB,WAAoB;QAEpB,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACpD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACnF,OAAO,WAAkD,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,OAAO,YAAuC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAA4B;YACpC,GAAI,YAAwC;SAC/C,CAAC;QACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpD,SAAS;YACb,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ;mBACf,OAAO,QAAQ,KAAK,QAAQ;mBAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;mBACxB,KAAK;mBACL,OAAO,KAAK,KAAK,QAAQ;mBACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;gBACvC,CAAC,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAGD;;;;;OAKG;IACI,iCAAiC;QACpC,OAAO,wCAAwC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH;;;;;;;;;;;;;;OAcG;IACI,sBAAsB,CAAC,WAAmB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QACxF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI;YACJ,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,IAAI,CAAC;YACrD,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,yGAAyG;YACzG,yGAAyG;YACzG,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;SAC9H,CAAC,CAAC,CAAC;IACR,CAAC;IAEM,sBAAsB,CACzB,WAAmB,EACnB,SAAiB;QAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC;QACvB,CAAC;QAED,0FAA0F;QAC1F,wFAAwF;QACxF,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,aAAa,GAAG,KAAK,EAAE,UAAU,IAAI,SAAS,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,iBAAiB,GAAG,MAAM,KAAK,SAAS;eACvC,CAAC,MAAM,CAAC,iBAAiB,KAAK,aAAa,IAAI,MAAM,CAAC,qBAAqB,KAAK,aAAa,CAAC,CAAC;QAEtG,OAAO,iBAAiB;YACpB,CAAC,CAAC,4BAA4B,CAAC,YAAY;YAC3C,CAAC,CAAC,4BAA4B,CAAC,UAAU,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QACxF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;;OAQG;IACK,uBAAuB,CAAC,WAAmB,EAAE,SAAiB;QAClE,2FAA2F;QAC3F,6FAA6F;QAC7F,6FAA6F;QAC7F,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QAC3F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,kGAAkG;QAClG,+FAA+F;QAC/F,oGAAoG;QACpG,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5D,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACI,uBAAuB,CAAC,WAAmB,EAAE,SAAiB;QACjE,OAAO,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACI,8BAA8B,CAAC,WAAmB;QACrD,OAAO,4BAA4B,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,WAAmB;QAC7C,OAAO,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACI,6BAA6B,CAAC,WAAmB;QAIpD,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,YAAY,GAAG,MAAM,EAAE,kBAAkB,CAAC;QAChD,OAAO,MAAM,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IACrG,CAAC;IAED;;;OAGG;IACI,0BAA0B,CAAC,WAAmB;QACjD,OAAO,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACI,2BAA2B,CAAC,WAAmB;QAClD,OAAO,+BAA+B,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACK,yBAAyB;QAC7B,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QACnH,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,WAAmB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,QAAQ,EAAE,aAAa,IAAI,WAAW,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;QACjH,IAAI,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3G,OAAO;YACH,aAAa;YACb,WAAW;YACX,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY,EAAE,QAAQ;YACtB,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,KAAK,IAAI;SACxD,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,yBAAyB,CAAC,WAAmB;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QACnF,MAAM,OAAO,GAAoC,EAAE,CAAC;QACpD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YAC7G,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/J,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;YACtD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;gBACjG,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,uBAAuB,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YAC5J,CAAC;QACL,CAAC;QACD,OAAO,qCAAqC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED;;;;OAIG;IACI,mCAAmC,CAAC,WAAmB,EAAE,WAAmB;QAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,oBAAoB,IAAI,EAAE,CAAC;QACrG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,WAAW;eAC5F,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACI,gCAAgC,CAAC,WAAmB,EAAE,WAAmB,EAAE,aAAgC;QAC9G,MAAM,OAAO,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,UAAU,GAAG,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC5E,OAAO;YACH,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW;YACX,WAAW;YACX,iBAAiB,EAAE,UAAU,CAAC,WAAW;YACzC,0BAA0B,EAAE,UAAU,CAAC,oBAAoB;YAC3D,mBAAmB,EAAE,UAAU,CAAC,aAAa;SAChD,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACI,wCAAwC,CAAC,MAAsC;QAMlF,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;YACnE,OAAO;gBACH,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,qBAAqB;gBACtC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;oBACjD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACtH,YAAY,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;oBACzD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE,qBAAqB,CAAC;aAC7H,CAAC;QACN,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,UAAU,CAAC,CAAC;QACxH,IAAI,MAAM,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QACvE,MAAM,qBAAqB,GAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,aAAa,CAClG,EAAE,CAAC,sCAAsC,CAAC,UAAU,CAAwH,CAAC;QACjL,MAAM,QAAQ,GAAG,qBAAqB,EAAE,UAAU,EAAE,QAAQ;eACrD,qBAAqB,EAAE,QAAQ;eAC/B,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAuB,CAAC,CAAC;QAClJ,oGAAoG;QACpG,qHAAqH;QACrH,MAAM,eAAe,GAAG,qBAAqB,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,CAAC,eAAe,CAAC;QAC/F,OAAO;YACH,WAAW,EAAE,0BAA0B,MAAM,CAAC,aAAa,IAAI,sCAAsC,CAAC,UAAU,WAAW;YAC3H,eAAe;YACf,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,UAAU,EAAE,eAAe,CAAC;SACjI,CAAC;IACN,CAAC;IAED;;;;;;;;;;;OAWG;IACK,+BAA+B;QACnC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACzF,4GAA4G;YAC5G,mDAAmD;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YACvH,OAAO,CAAC,IAAI,CAAC,GAAG,2CAA2C,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACrJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,8EAA8E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE;SACtI,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACK,+BAA+B;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACrD,IAAI,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/E,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YACvG,OAAO,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,+BAA+B,CAAC;YAC5C,WAAW;YACX,2BAA2B,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;YACzF,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,SAAS;YAC9E,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACnC,OAAO;oBACH,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACtE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;iBACjJ,CAAC;YACN,CAAC;YACD,wBAAwB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ;YAC7G,mBAAmB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC7B,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,sCAAsC,CAAC,UAAU,CAAC,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU;SACnJ,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,2DAA2D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC1F,OAAO;aACV;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;OAOG;IACI,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;QAClE,OAAO;YACH,aAAa,EAAE,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC;YAC/D,UAAU,EAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC;SACnE,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,4BAA4B,CAAC,WAAmB,EAAE,gBAAwB;QAC7E,IAAI,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACzE,OAAO,4BAA4B,CAAC,qBAAqB,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,gBAAgB,CAAC,KAAK,gBAAgB;YACnF,CAAC,CAAC,4BAA4B,CAAC,OAAO;YACtC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,6BAA6B,CAAC,WAAmB,EAAE,UAAkB;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,CAAC,wBAAwB,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,UAAU,CAAC,KAAK,4BAA4B,CAAC,UAAU,EAAE,CAAC;YACnG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,CAAC,4BAA4B,EAAE,CAAC;QACzG,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC;IACrF,CAAC;IAEM,2BAA2B,CAAC,WAAmB;QAClD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,YAAY,CACtD,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,GAAG,EAAE,CAAC;YAC5D,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACI,kCAAkC,CAAC,WAAmB;QACzD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,mBAAmB,CAC7D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU,EAAE,CAAC;YACnE,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kDAAkD,CAAC,SAAS,CAAC,CAAC;aACjF,MAAM,CAAC,CAAC,SAAS,EAAgD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACtG,CAAC;IAGD;;;;;;OAMG;IACI,0CAA0C,CAAC,WAAmB;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,4BAA4B,CACtE,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,mBAAmB,EAAE,CAAC;YAC5E,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2DAA2D,CAAC,SAAS,CAAC,CAAC;aAC1F,MAAM,CAAC,CAAC,SAAS,EAAwD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC9G,CAAC;IAGD;;;;OAIG;IACI,qCAAqC,CAAC,WAAmB;QAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,uBAAuB,CAAC,CAAC;QACrI,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,cAAc;YAAE,OAAO,EAAE,CAAC;QACpF,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,sDAAsD,CAAC,SAAS,CAAC,CAAC;aACrF,MAAM,CAAC,CAAC,SAAS,EAAmD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACzG,CAAC;IAGM,mCAAmC,CAAC,WAAmB;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CACxC,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QACF,OAAO,MAAuD,CAAC;IACnE,CAAC;IAEM,6BAA6B,CAAC,WAAmB;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;YAC9E,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,eAAe,GAAG;YACpB,GAAG,CAAC,eAAe,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;QACF,OAAO;YACH,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,SAAS,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACjD,sBAAsB,EAAE,eAAe,CAAC,UAAU;iBAC7C,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8CAA8C,CAAC,SAAS,CAAC,CAAC;iBAC7E,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;YAC1F,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YAC9C,yBAAyB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,yBAAyB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,GAAG,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,GAAG,CAAC,eAAe,CAAC,mDAAmD;gBACnE,CAAC,CAAC,EAAE,mDAAmD,EAAE,eAAe,CAAC,mDAAmD,EAAE;gBAC9H,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,eAAe,CAAC,iBAAiB;gBACjC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,GAAG,eAAe,CAAC,iBAAiB,EAAE,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,6BAA6B;gBAC7C,CAAC,CAAC,EAAE,6BAA6B,EAAE,CAAC,GAAG,eAAe,CAAC,6BAA6B,CAAC,EAAE;gBACvF,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,mEAAmE;YACnE,oEAAoE;YACpE,0DAA0D;YAC1D,kBAAkB,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpF,GAAG,CAAC,eAAe,CAAC,iCAAiC;gBACjD,CAAC,CAAC;oBACE,iCAAiC,EAAE,MAAM,CAAC,WAAW,CACjD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAC,GAAG,CACjE,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAC1D,CACJ;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACI,sCAAsC,CACzC,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,aAAa,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,aAAa,EAAE,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,yBAAyB,mBAAmB,kBAAkB,WAAW,EAAE,CAAC,CAAC;YAC3F,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC;YACD,OAAO,0CAA0C,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,WAAW;oBACX,mBAAmB;oBACnB,OAAO,EAAE,qFAAqF;oBAC9F,eAAe,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAC9C;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAEM,4CAA4C,CAC/C,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,sCAAsC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACvG,IACI,CAAC,gBAAgB;eACd,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;eACnF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;YACC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB;YACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5F,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAEO,uBAAuB,CAAC,UAA6B;QACzD,OAAO,UAAU;aACZ,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2CAA2C,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;aACvF,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,CAC1D,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,SAAqC,CAAC,CAC1F,CAAC,CAAC;IACX,CAAC;IAEO,+BAA+B,CACnC,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAEnG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,+BAA+B,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAC5E,OAAO,SAAS,CAAC;YACrB,CAAC;YAGD,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;gBAC7E,MAAM,0BAA0B,GAAG,SAAS,CAAC;gBAC7C,MAAM,wBAAwB,GAAG,OAAO,CACpC,eAAe,CAAC,SAAS;uBACtB,eAAe,CAAC,gBAAgB;uBAChC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CACpE,CAAC;gBACF,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,0BAA0B;oBAC1B,iBAAiB,EAAE;wBACf,CAAC,0BAA0B,CAAC,EAAE;4BAC1B,UAAU,EAAE,8BAA8B,CAAC,kBAAkB;4BAC7D,OAAO,EAAE,eAAe,CAAC,YAAY;4BACrC,IAAI,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;4BAC5C,6BAA6B,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;4BACzF,QAAQ,EAAE,wBAAwB;gCAC9B,CAAC,CAAC,4BAA4B,CAAC,wBAAwB;gCACvD,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;oCAChD,CAAC,CAAC,4BAA4B,CAAC,YAAY;oCAC3C,CAAC,CAAC,4BAA4B,CAAC,IAAI;4BAC3C,GAAG,CAAC,wBAAwB;gCACxB,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,EAAE;gCAC9F,CAAC,CAAC,EAAE,CAAC;4BACT,6DAA6D;4BAC7D,wDAAwD;4BACxD,yDAAyD;4BACzD,6DAA6D;4BAC7D,4DAA4D;4BAC5D,2BAA2B;4BAC3B,8BAA8B,EAAE,CAAC,uBAAuB,CAAC,WAAW,CAAC;4BACrE,sBAAsB,EAAE,0CAA0C,CAAC,cAAc;4BACjF,2DAA2D;4BAC3D,6DAA6D;4BAC7D,8BAA8B;4BAC9B,iBAAiB,EAAE,qCAAqC,CAAC,aAAa;4BACtE,4BAA4B,EAAE,gDAAgD,CAAC,kBAAkB;4BACjG,GAAG,CAAC,eAAe,CAAC,qBAAqB;gCACrC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE;gCAClE,CAAC,CAAC,EAAE,CAAC;yBACZ;qBACJ;oBACD,eAAe;iBAClB,CAAC;YACN,CAAC;YAED,oGAAoG;YACpG,8DAA8D;YAC9D,MAAM,SAAS,GAAG,iCAAiC,CAAC,eAAe,CAAC,CAAC;YACrE,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS;oBACT,CAAC,CAAC;wBACE,UAAU,EAAE;4BACR,QAAQ,EAAE,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC;4BAC1D,SAAS;yBACZ;qBACJ;oBACD,CAAC,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,kBAAkB;oBACvE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE;oBAC5D,CAAC,CAAC,EAAE,CAAC;gBACT,eAAe;aAClB,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,wDAAwD;YACxD,2DAA2D;YAC3D,mDAAmD;YACnD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE;gBAC1D,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,0BAA0B,CAC9B,eAAgD;QAEhD,QAAQ,eAAe,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,KAAK,2BAA2B,CAAC,KAAK,CAAC;YACvC,KAAK,2BAA2B,CAAC,UAAU,CAAC;YAC5C,qFAAqF;YACrF,mFAAmF;YACnF,gFAAgF;YAChF,KAAK,2BAA2B,CAAC,mBAAmB,CAAC;YACrD,mGAAmG;YACnG,KAAK,2BAA2B,CAAC,cAAc,CAAC;YAChD,0GAA0G;YAC1G,KAAK,2BAA2B,CAAC,oBAAoB,CAAC;YACtD,KAAK,2BAA2B,CAAC,KAAK,CAAC;YACvC,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,8FAA8F;YAC9F,KAAK,2BAA2B,CAAC,aAAa,CAAC;YAC/C,KAAK,2BAA2B,CAAC,OAAO,CAAC;YACzC,sFAAsF;YACtF,gFAAgF;YAChF,KAAK,2BAA2B,CAAC,IAAI;gBACjC,OAAO,0BAA0B,CAAC,OAAO,CAAC;YAC9C,KAAK,2BAA2B,CAAC,kBAAkB;gBAC/C,OAAO,0BAA0B,CAAC,cAAc,CAAC;YACrD,KAAK,2BAA2B,CAAC,UAAU;gBACvC,OAAO,0BAA0B,CAAC,MAAM,CAAC;YAC7C,KAAK,2BAA2B,CAAC,qBAAqB;gBAClD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;oBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;oBACpG,OAAO,EAAE;wBACL,OAAO,EAAE,mGAAmG;8BACtG,oEAAoE;qBAC7E;iBACJ,CACJ,CAAC;YACN,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,eAAe,GAAU,eAAe,CAAC;gBAC/C,OAAO,eAAe,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,qBAAqB,CACzB,eAA0H;QAE1H,OAAO,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACxE,GAAG,QAAQ;YACX,4FAA4F;YAC5F,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrC,eAAe,EAAE,EAAE,GAAG,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC,mBAAmB,EAAE;aAC3F,CAAC;YACF,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC;SACvC,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH;;;;;OAKG;IACI,4CAA4C,CAAC,WAAmB,EAAE,KAAa;QAClF,OAAO,8BAA8B,CAAC;YAClC,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,iBAAiB;YACjF,gBAAgB,EAAE,IAAI,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,WAAW,CAAC;YACvF,KAAK;SACR,CAAC,CAAC;IACP,CAAC;IAEM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC1F,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,QAAQ,CAAC,WAAW,SAAS,qBAAqB,WAAW,6BAA6B,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;gBAChI,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC5C,OAAO,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,0GAA0G;YAC1G,qEAAqE;YACrE,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,2BAA2B,CAC/B,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;YAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;YAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;uBAChF,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAC7C,CAAC;oBACC,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,CAAC;YACL,CAAC;QACL,CAAC;QAED,mHAAmH;QACnH,0GAA0G;QAC1G,8GAA8G;QAC9G,uCAAuC;QACvC,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAChF,IAAI,cAAc,EAAE,UAAU,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAChC,WAAmB,EACnB,YAAoD;QAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjI,OAAO,UAAU;YACb,CAAC,CAAC,gBAAgB,UAAU,KAAK,WAAW,KAAK,YAAY,MAAM,4BAA4B,CAAC,UAAU,CAAC,EAAE;YAC7G,CAAC,CAAC,GAAG,WAAW,4BAA4B,YAAY,qCAAqC,CAAC;IACtG,CAAC;IAEM,8BAA8B,CACjC,WAAmB,EACnB,YAAoD;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;IACzC,CAAC;IAIM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,qCAAqC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAClF,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,UAAU,SAAS,kBAAkB,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,8GAA8G;YAC9G,kFAAkF;YAClF,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE;gBAC5C,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACI,gCAAgC,CAAC,WAAmB;QACvD,iGAAiG;QACjG,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QAE7G,OAAO,IAAI,CAAC,mCAAmC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;OAQG;IACI,yCAAyC,CAAC,WAAmB;QAChE,OAAO,mCAAmC,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,mCAAmC,CACvC,WAAmB,EACnB,SAAsD;QAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC;QAC9F,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAC7C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAClG,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACI,KAAK,CAAC,8BAA8B,CACvC,MAAyC,EACzC,WAAmB,EACnB,YAAoD,EACpD,SAAiB;IACjB;;;;;OAKG;IACH,OAQC;QAgBD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,4FAA4F;QAC5F,2FAA2F;QAC3F,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,4FAA4F;QAC5F,0EAA0E;QAC1E,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;eACrE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,uCAAuC,MAAM,CAAC,eAAe,uDAAuD;kBAClH,oHAAoH;kBACpH,6BAA6B,CAClC,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACpE,sFAAsF;YACtF,yFAAyF;YACzF,sFAAsF;YACtF,yDAAyD;YACzD,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,yFAAyF;sBACvF,0DAA0D,CAC/D,CAAC;YACN,CAAC;YACD,iGAAiG;YACjG,uFAAuF;YACvF,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC/H,+FAA+F;YAC/F,6FAA6F;YAC7F,kFAAkF;YAClF,MAAM,eAAe,GAAG,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,KAAK,4BAA4B,CAAC,OAAO,CAAC;YAChI,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,qBAAqB,CAAC;gBACvF,MAAM,EAAE,MAAM,CAAC,OAAQ;gBACvB,WAAW;gBACX,aAAa,EAAE,iBAAiB;gBAChC,UAAU,EAAE,cAAc;gBAC1B,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC1E,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;aACxG,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,sCAAsC,CAAC,IAAI,EAAE,GAAG,EAAE,CACpK,YAAY,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;gBACpH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,EAAE,CACvG,YAAY,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC9G,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,mBAAmB;sBACjB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;wBACxB,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,wBAAwB,SAAS,KAAK;wBAC/D,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,4BAA4B,SAAS,mDAAmD;8BAC3G,GAAG,0CAA0C,CAAC,YAAY,CAAC,GAAG,CAAC;sBACvE,iHAAiH;sBACjH,kFAAkF,CACvF,CAAC;YACN,CAAC;YACD,OAAO;gBACH,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,MAAM,EAAE,kCAAkC,CAAC,eAAe;gBAC1D,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,GAAG,CAAC,WAAW,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC;gBACtG,GAAG,CAAC,WAAW,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC;gBAChG,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;aACxE,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7F,CAAC;QAED,qFAAqF;QACrF,0FAA0F;QAC1F,kFAAkF;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,iGAAiG;kBAC/F,0DAA0D,CAC/D,CAAC;QACN,CAAC;QACD,6FAA6F;QAC7F,MAAM,EAAE,aAAa,EAAE,yBAAyB,EAAE,UAAU,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC/I,8EAA8E;QAC9E,MAAM,uBAAuB,GAAG,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,sBAAsB,CAAC,KAAK,4BAA4B,CAAC,OAAO,CAAC;QAChJ,MAAM,KAAK,GAAG,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,6BAA6B,CAAC;YAC7F,cAAc,EAAE,MAAM,CAAC,OAAQ;YAC/B,WAAW;YACX,aAAa,EAAE,yBAAyB;YACxC,UAAU,EAAE,sBAAsB;YAClC,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1E,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;SACxG,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,YAAY,EAAE,GAAG,EAAE,CAC5L,QAAQ,CAAC,qBAAqB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;YAChI,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAC/G,QAAQ,CAAC,qBAAqB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAClH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,mBAAmB;kBACjB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;oBACxB,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,4BAA4B,SAAS,KAAK;oBAC3E,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,4BAA4B,SAAS,mDAAmD;0BACnH,GAAG,0CAA0C,CAAC,YAAY,CAAC,GAAG,CAAC;kBACvE,gHAAgH;kBAChH,iDAAiD,CACtD,CAAC;QACN,CAAC;QACD,OAAO;YACH,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,kCAAkC,CAAC,uBAAuB;YAClE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YACxF,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1F,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5D,CAAC;IACN,CAAC;IACD,4FAA4F;IAE5F;;;OAGG;IACK,KAAK,CAAC,6BAA6B,CACvC,WAAmB,EACnB,YAAoD,EACpD,SAAiB,EACjB,OAAoI;QASpI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvG,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,sDAAsD,OAAO,CAAC,QAAQ,CAAC,EAAE,2CAA2C;kBAClH,sHAAsH,CAC3H,CAAC;QACN,CAAC;QACD,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACrF,IAAI,eAAe,EAAE,CAAC;YAClB,oFAAoF;YACpF,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,kCAAkC,CAAC,sBAAsB,EAAE,IAAI,EAAE,2BAA2B,CAAC,MAAM,EAAE,CAAC;QACnJ,CAAC;QACD,MAAM,uBAAuB,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;QACpH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,yCAAyC,SAAS,yBAAyB,uBAAuB,iCAAiC;cACjI,CAAC,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,KAAK,SAAS;gBACxD,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,4GAA4G,CAAC,CACtH,CAAC;IACN,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,6BAA6B,CACtC,WAAmB,EACnB,YAAoD,EACpD,SAAiB,EACjB,OAAyH;QASzH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAChF,MAAM,mBAAmB,GAAG,IAAI,CAAC,oCAAoC,EAAE,CAAC;QACxE,IAAI,mBAAmB,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC5F,qGAAqG;QACrG,IAAI,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,UAAU,CAAC,KAAK,4BAA4B,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC1H,MAAM,mBAAmB,GAAG,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,4BAA4B,CAAC;YAClE,WAAW;YACX,aAAa;YACb,UAAU;YACV,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1E,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;SACxG,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/D,MAAM,uBAAuB,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;YACpH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,8EAA8E,aAAa,yBAAyB;kBAClH,0BAA0B,uBAAuB,oCAAoC,uBAAuB,OAAO;kBACnH,2FAA2F,CAChG,CAAC;QACN,CAAC;QACD,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,kCAAkC,CAAC,sBAAsB;YACjE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;YACtF,IAAI,EAAE,MAAM,CAAC,IAAI;SACpB,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,KAAK,CAAC,gCAAgC,CACzC,MAAyC,EACzC,WAAmB,EACnB,UAAqI,EACrI,OAAyD;QAEzD,iGAAiG;QACjG,sGAAsG;QACtG,8FAA8F;QAC9F,uGAAuG;QACvG,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1F,0GAA0G;QAC1G,yEAAyE;QACzE,MAAM,aAAa,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;QACvE,yGAAyG;QACzG,MAAM,mBAAmB,GAAG,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;eACrE,UAAU,CAAC,MAAM,KAAK,kCAAkC,CAAC,sBAAsB;eAC/E,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,yGAAyG;YACzG,MAAM,IAAI,CAAC,oCAAoC,EAAE,EAAE,mBAAmB,CAAC;gBACnE,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,gGAAgG;YAChG,sFAAsF;YACtF,yDAAyD;YACzD,OAAO;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACpE,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,yFAAyF;YACzF,yFAAyF;YACzF,sFAAsF;YACtF,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY;gBAAE,OAAO;YACtD,MAAM,YAAY,CAAC,mBAAmB,CAAC;gBACnC,MAAM,EAAE,MAAM,CAAC,OAAO;gBACtB,WAAW;gBACX,aAAa;gBACb,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;gBACrE,UAAU,EAAE,gBAAgB;gBAC5B,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;YAAE,OAAO;QAEtF,MAAM,QAAQ,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,0FAA0F;QAC1F,6FAA6F;QAC7F,4FAA4F;QAC5F,wDAAwD;QACxD,MAAM,QAAQ,CAAC,mBAAmB,CAAC;YAC/B,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,WAAW;YACX,aAAa;YACb,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;YACrE,UAAU,EAAE,gBAAgB;YAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;YAC3F,GAAG,CAAC,UAAU,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACtH,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAChD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACK,0BAA0B,CAC9B,WAAmB;IACnB,yFAAyF;IACzF,kBAAsC,EACtC,UAAkD,EAClD,qBAAuD;QAEvD,OAAO,sCAAsC,CAAC;YAC1C,QAAQ,EAAE,IAAI;YACd,WAAW;YACX,kBAAkB;YAClB,qBAAqB;YACrB,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kFAAkF,EAAE;gBAC7H,WAAW;gBACX,UAAU;gBACV,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC;SACL,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,8BAA8B,CACxC,WAAmB,EACnB,aAAqB,EACrB,qBAAuD;QAEvD,IAAI,aAAa,KAAK,WAAW;YAAE,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iCAAiC,WAAW,gDAAgD;kBACxH,IAAI,aAAa,4EAA4E,aAAa,KAAK,CAAC;QAC1H,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAAC,WAAmB,EAAE,MAAc;QAC9D,OAAO,IAAI,sCAAsC,CAAC,aAAa,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,6FAA6F;IAC7F,4CAA4C;IAC5C,EAAE;IACF,4EAA4E;IAC5E,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,2DAA2D;IAC3D,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,EAAE;IACF,kDAAkD;IAClD,EAAE;IACF,yCAAyC;IACzC,wDAAwD;IACxD,uBAAuB;IACvB,EAAE;IACF,uFAAuF;IACvF,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,wFAAwF;IACxF,mCAAmC;IACnC,EAAE;IACF,6FAA6F;IAC7F,wDAAwD;IACxD,6FAA6F;IAE7F;;;;;;;OAOG;IACO,qCAAqC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1G,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACrB,kBAAkB,CAAC,sCAAsC,CAC5D,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACH;;;OAGG;IACO,oCAAoC;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,qCAAqC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzG,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IACnI,CAAC;IAES,6BAA6B;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC;YAAE,OAAO,SAAS,CAAC;QAClG,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACrB,kBAAkB,CAAC,8BAA8B,CACpD,CAAC;IACN,CAAC;IAGD;;;;;;;;;;;;;;;;;;;OAmBG;IACI,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,IAAI,YAAY,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;gBACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvD,OAAO,KAAK,CAAC;gBACjB,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,OAAO,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,8GAA8G;YAC9G,4GAA4G;YAC5G,gGAAgG;YAChG,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;gBACnD,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,eAAe,GAA2B,EAAE,CAAC;YACnD,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAChF,MAAM,iBAAiB,GAAG,cAAc,EAAE,UAAU,EAAE,SAAS,CAAC;YAChE,IAAI,iBAAiB,EAAE,CAAC;gBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBACzF,IAAI,WAAW,EAAE,CAAC;oBACd,eAAe,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC;gBACrD,CAAC;YACL,CAAC;YAED,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;gBAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;gBAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;oBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;2BAChF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;oBAClG,IAAI,WAAW,EAAE,CAAC;wBACd,eAAe,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;oBAC9D,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,qGAAqG;YACrG,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,iBAAiB;QAC1B,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;YAEhE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAE1B,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;gBACjF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;aAC/C,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACpD,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBACpC;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,uBAAuB;IACvB,mCAAmC;IAEzB,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;aACvG,CACJ,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AAzrFY,uCAAuC;IADnD,UAAU,EAAE;IAQJ,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAgCzD,WAAA,MAAM,CAAC,WAAW,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;yDAjCiD,0BAA0B;GATtG,uCAAuC,CAyrFnD;;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAI,IAAoC,EAAE,SAAwB;IACzF,OAAO,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAW;IAC1C,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC","sourcesContent":["/*\n External Providers Registry Backend Service\n \n Provides runtime access to the backend provider registry and\n * their protocol configurations, secrets, and operations.\n /\n\nimport { ExternalProviderConnectionRefusedError } from './external-provider-connection-refusal.backend';\nimport type { ProviderConnectionFacts, ProviderCredentialAddress, ProviderSharedConnections } from '@wildo-ai/saas-models';\nimport { modelIdProcessingRegionRefusal, resolveProviderConnectionRef } from '@wildo-ai/saas-models';\nimport {\n findSharedConnectionBootDefects,\n resolveDeclaredSharedConnection,\n type ResolvedProviderSharedConnection,\n} from './provider-shared-connection.backend';\nimport {\n classifyProviderConnectionScopes,\n computeProviderConnectionScopeCeiling,\n type ProviderConnectionScopeCeiling,\n type ProviderConnectionScopeSource,\n} from './provider-connection-scope-ceiling.backend';\nimport type { ProviderScopeReauthorizationOffer } from '@wildo-ai/saas-models';\nimport { createRequire } from 'node:module';\nimport { findMissingProviderRuntimePeers } from './provider-runtime-peers.backend';\nimport { join } from 'node:path';\nimport { injectable, inject, optional } from 'inversify';\nimport type { Container } from 'inversify';\nimport {\n External_Providers_Registry,\n External_Providers_RegistryItem,\n EngineCapability,\n EngineCapabilityResolutionMode,\n ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED,\n getEngineCapabilityResolutionMode,\n engineCapabilityResolutionModeTakesASelection,\n engineCapabilityPerformsCallTimeFailover,\n isEngineCapabilityEnabled,\n PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY,\n} from '@wildo-ai/saas-models';\nimport { isRuntimeSecretEnvVarName } from '@wildo-ai/platform-config-lib';\n\n/\n How the required-capability floor is evaluated on the calling host.\n \n `includeEngineFloor` — whether ENABLED members of\n * `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` count as required. True on a host\n * expected to SERVE those slots (the application backend, the platform services); false on a\n * scope-filtered host such as a minion, whose registry legitimately resolves none of them.\n * The application's own `required` flags are honoured on every host regardless.\n /\nexport interface RequiredCapabilityFloorOptions {\n includeEngineFloor: boolean;\n}\nimport {\n ExternalProvider_ExchangeProtocol_Kind,\n ExternalProvider_ExchangeProtocol_Configuration_Base,\n LLMProvider_OperationKey,\n ContentSafetyProvider_OperationKey,\n DocumentExtractionProvider_OperationKey,\n EmbeddingsProvider_OperationKey,\n APPLICATION_ENVIRONMENT,\n ProviderProtocolRuntimeKind,\n ExternalProvider_SecretScope,\n describeModuleOwnedProviderConfigurationKey,\n findModuleOwnedProviderConfigurationKeys,\n ProviderConfigurationCredentialField,\n readProviderConfigurationCredentialFields,\n} from '@wildo-ai/external-connectors-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { OrganizationProviderCredentialResolverPort } from '~wildo-backend-lib/security/connected-accounts/organization-provider-credential-resolver.port';\nimport type {\n UserProviderCredentialResolverPort,\n} from '~wildo-backend-lib/security/connected-accounts/user-provider-credential-resolver.port';\nimport type { ApplicationProviderCredentialResolverPort } from '~wildo-backend-lib/security/connected-accounts/application-provider-credential-resolver.port';\nimport type { ProviderOAuth2RefreshAudience } from '~wildo-backend-lib/security/connected-accounts/provider-oauth2-refresher.port';\nimport { ProviderSpentCredentialForm, type ProviderRefusedTokenRenewal } from '~wildo-backend-lib/security/connected-accounts/provider-spent-credential-form.backend';\nimport {\n StoredCredentialSlotStanding,\n describeCredentialsStoredUnderRetiredSlots,\n findCredentialsStoredUnderRetiredSlots,\n requireCredentialsStoredUnderRetiredSlots,\n} from '~wildo-backend-lib/security/connected-accounts/utils/retired-credential-slot.backend.utils';\nimport type { StorableCredentialSlot } from '~wildo-backend-lib/security/connected-accounts/utils/retired-credential-slot.backend.utils';\nimport { ProviderCredentialResolutionSource, ProviderCredentialSlotWriteRefusal } from '@wildo-ai/saas-models';\nimport {\n ExternalProvider_Connection_DelegationMode,\n ExternalProvider_Connection_OwnerScope,\n} from '@wildo-ai/external-connectors-models';\nimport type {\n ExternalProvider_ConnectionShape,\n ExternalProvider_ConnectionTarget,\n} from '@wildo-ai/external-connectors-models';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError, type RuntimeEnvironment } from '@wildo-ai/saas-models';\nimport { readDeclaredOutboundAdmissionEnvironment } from '~wildo-backend-lib/security/ssrf/outbound-target-admission.backend.utils';\nimport type { BackendProviderRegistryBackendService } from './backend-provider-registry.backend.service';\nimport type { ProviderProtocolRuntimeContract,\n SecretsContractEntry,\n CodingAgentHostLoginContract,\n BackendProviderModule,\n ProviderVendorRegistration,\n ProviderChatCommandFormContract,\n} from '@wildo-ai/external-connectors-private/backend';\nimport {\n describeProviderModuleAuthenticationDefects,\n describeProviderProtocolSecretRef,\n providerModuleAdmissibleConnections,\n} from '@wildo-ai/external-connectors-private/backend-runtime';\n// entrypoint-closure-waiver: `engine-capability-provider-order.backend.utils` is published only by `./assurance-derivations` (#2846 review B1).\n// It declares two functions and three interfaces, no enum, class or brand, so nothing nominal can cross; and no public signature of this\n// service names any of them (`getProvidersForEngineCapability` and `getFailoverProvidersForEngineCapability` return `string[]`; the\n// input type is only a private method's).\nimport {\n failoverProvidersForEngineCapability,\n orderProvidersForEngineCapability,\n type EngineCapabilityProviderOrderInput,\n} from './engine-capability-provider-order.backend.utils';\nimport type { Hook_Endpoint, ProviderRestOAuth2 } from '@wildo-ai/external-connectors-models';\nimport {\n AgentClientProtocol_AuthMode,\n AgentClientProtocol_ExecutionProfileSchema,\n AgentClientProtocol_HostConfigurationInheritance,\n AgentClientProtocol_PermissionCeiling,\n AgentClientProtocol_RunnerHost,\n AgentClientProtocol_WorkingDirectoryPolicy,\n CodingAgent_OperationKey,\n type AgentClientProtocol_Configuration,\n type AgentClientProtocol_ExecutionProfile,\n} from '@wildo-ai/external-connectors-models';\n\n/\n Provider-contract operation literal → the semantic coding operation key. The\n * contract package uses short literals so it need not depend on the operation\n * family that consumes it; this map is the single translation.\n /\nconst RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION: Record<string, CodingAgent_OperationKey> = {\n runCodingTask: CodingAgent_OperationKey.RUN_CODING_TASK,\n};\n\n/\n The runtime projection of an ACP provider's transport capability.\n \n Far smaller than a request/response protocol's, because ACP agents advertise\n * their own capabilities, modes and commands during `initialize` /\n * `session/new`. Re-declaring any of that in authored configuration would\n * create a second source of truth that drifts the first time the agent is\n * upgraded — so what remains is only what the HOST must know before it opens a\n * connection.\n /\nexport type RuntimeAgentClientProtocolProfile = {\n /* How the provider says to START its agent — the authority an application inherits. /\n agentCommand: string;\n agentArgs: string[];\n supportedOperationKeys: CodingAgent_OperationKey[];\n supportedModels: string[];\n supportedProtocolVersions: number[];\n sessionMetaExtensions?: Record<string, unknown>;\n /* How this agent expresses each isolation posture; an absent posture is refused, never substituted. /\n sessionMetaExtensionsByHostConfigurationInheritance?: Partial<Record<string, Record<string, unknown>>>;\n /\n How the selected model reaches this agent. Absent means the provider\n * declared none, and a run that selected a model is refused rather than\n * started with the choice silently dropped.\n /\n modelDelivery?:\n \| { channel: 'environment-variable'; environmentVariableName: string }\n \| { channel: 'session-config-option'; configId: string };\n /\n Semantic model id → this agent's own spelling, where the two differ.\n \n Absent, or absent for a given model, means the semantic id is sent\n * unchanged — correct for every agent whose vocabulary already is Wildo's.\n /\n modelTransportIds?: Record<string, string>;\n /* Agent-vocabulary session-mode ids to prefer per ceiling; an optimisation, never the guarantee. /\n sessionModeIdsByPermissionCeiling?: Partial<Record<string, string[]>>;\n /\n The auth modes the PROVIDER declares its agent can actually use.\n \n Carried so an application-authored profile can be validated against it.\n * The contract's list previously reached only the synthesized `default`\n * profile, so an authored profile could declare any mode and nothing checked\n * whether the agent supports it.\n /\n supportedAuthModes?: string[];\n /\n Host environment variables the AGENT ITSELF needs, declared by its provider.\n \n Distinct from the execution profile's list, which is application policy.\n * This one is provider knowledge — which variable an agent reads to find its\n * own credentials is not something an application can be expected to know —\n * and it is UNIONED with the profile's rather than replaced by it.\n /\n inheritedEnvironmentVariables?: string[];\n /\n How to ask the host whether this agent's operator is signed in, without a model call — the\n * provider's declaration, carried so a runtime can refuse a dispatch to a signed-out agent before\n * spawning it rather than discover the login on the first prompt (#1637).\n /\n hostLogin?: CodingAgentHostLoginContract;\n};\nimport { ExternalProvider_Auth_Kind } from '@wildo-ai/external-connectors-models';\nimport {\n ExternalProviderSelectionAuthorityKind,\n ExternalProviderSelectionOverrideStatus,\n type ExternalProviderSelectionResolutionEvidence,\n} from '~wildo-backend-lib/external-providers/models/provider-selection-resolution-evidence.backend.definitions';\n\n/\n F-6 (2026-05-06) — runtime-side projection of a resolved provider\n * configuration. The base schema (`ExternalProvider_ExchangeProtocol_Configuration_Base`)\n * lives in `external-connectors-models` (which can't import the\n * backend-only discriminated union); we extend it here at the consumer\n * boundary so callers narrow on `runtimeContract.kind` instead of\n * casting through `as any`.\n \n Optional fields beyond the base also appear on this projection:\n \n - `defaultExecutionProfileRef` / `executionProfiles` — set by\n * `getDefaultProviderConfiguration` for `kind: ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL`\n * contracts, consumed by `getAgentClientProtocolProfile` and the ACP runner.\n * - `endpoints` — set for `kind: ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR`.\n \n They stay typed as `unknown` here because their canonical schemas\n * live in `external-connectors-models`'s `AgentClientProtocol_Configuration` /\n * webhook surfaces and are narrowed at consumer sites already.\n /\nexport type ResolvedProviderConfiguration =\n & ExternalProvider_ExchangeProtocol_Configuration_Base\n & {\n runtimeContract?: ProviderProtocolRuntimeContract;\n defaultExecutionProfileRef?: string;\n executionProfiles?: Record<string, unknown>;\n /\n Webhook-originator endpoint descriptors emitted by\n * `buildWebhookEndpoints` 2026-05-06: now matches the canonical\n * `Hook_Endpoint` shape (with the optional `displayName` field).\n * The dead extras (`providerRef`, `path`, `secretBinding`) that\n * previously polluted the emit have been removed; their values\n * were redundant with information already carried by other\n * fields (controller loop key, route convention, `authConfig.secretRef`).\n /\n endpoints?: ReadonlyArray<Hook_Endpoint>;\n };\n\n\nconst DEFAULT_IDENTITY_ENVIRONMENTS = [\n APPLICATION_ENVIRONMENT.DEVELOPMENT,\n APPLICATION_ENVIRONMENT.STAGING,\n APPLICATION_ENVIRONMENT.PRODUCTION,\n];\n\nfunction isCompanionRuntimeServiceName(serviceName: string): boolean {\n const normalized = serviceName.trim().toLowerCase();\n return normalized === 'companion'\n \|\| normalized === 'wildo-dev-companion'\n \|\| normalized.endsWith('-companion');\n}\n\nconst RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION: Record<string, LLMProvider_OperationKey> = {\n generateText: LLMProvider_OperationKey.GENERATE_TEXT,\n streamText: LLMProvider_OperationKey.STREAM_TEXT,\n chatCompletion: LLMProvider_OperationKey.CHAT_COMPLETION,\n chatMultimodal: LLMProvider_OperationKey.CHAT_MULTIMODAL,\n generateStructured: LLMProvider_OperationKey.GENERATE_STRUCTURED,\n streamStructured: LLMProvider_OperationKey.STREAM_STRUCTURED,\n // The `Thinking` runtime operation names were RETIRED 2026-07-17 — reasoning\n // depth is the `reasoningEffort` PARAMETER, not a separate operation.\n};\n\n/*\n The embeddings protocol's OWN runtime-op → semantic-key map (RAG plan DL2/H4 surface 1):\n * embeddings operations never enter {@link RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION}, whose\n * `toSemanticOperationKeys` filter would silently DROP any key outside `LLMProvider_OperationKey`\n * — the exact fall-through a sixth LLM operation key would have died in. Disjoint kind, disjoint map.\n /\nconst RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION: Record<string, EmbeddingsProvider_OperationKey> = {\n embedTexts: EmbeddingsProvider_OperationKey.EMBED_TEXTS,\n};\n\n/\n The document-extraction protocol's OWN runtime-op → semantic-key map, for the same reason its\n * embeddings sibling above has one: each protocol kind owns a disjoint operation vocabulary, so a\n * key never falls through a foreign filter and silently disappears.\n /\nconst RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION: Record<string, DocumentExtractionProvider_OperationKey> = {\n extractDocumentText: DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT,\n};\n\n/* The content-safety protocol's own runtime-op → semantic-key map (#2292), disjoint like its siblings above. /\nconst RUNTIME_CONTENT_SAFETY_OPERATION_TO_SEMANTIC_OPERATION: Record<string, ContentSafetyProvider_OperationKey> = {\n screenPromptInjection: ContentSafetyProvider_OperationKey.SCREEN_PROMPT_INJECTION,\n moderateOutput: ContentSafetyProvider_OperationKey.MODERATE_OUTPUT,\n};\n\ninterface RuntimeProviderScopeSelection {\n engineCapabilities?: EngineCapability[];\n /\n The protocols this runtime uses the provider through, as authored: `BUILTIN_PROVIDER_PROTOCOL` keys, which are the\n * MEMBER NAMES of `ExternalProvider_ExchangeProtocol_Kind` (`AGENT_CLIENT_PROTOCOL`, not `agent_client_protocol`).\n * The gate of {@link ExternalProvidersRegistryBackendService.isProviderEnabled} (#2805).\n /\n protocols?: string[];\n}\n\n/* The authored key of a protocol kind: its enum member NAME, which is how a scope entry spells it. /\nfunction scopeKeyOfProtocolKind(protocolKind: ExternalProvider_ExchangeProtocol_Kind): string \| undefined {\n return (Object.keys(ExternalProvider_ExchangeProtocol_Kind) as Array<keyof typeof ExternalProvider_ExchangeProtocol_Kind>)\n .find((member) => ExternalProvider_ExchangeProtocol_Kind[member] === protocolKind);\n}\n\ninterface RuntimeProviderScope {\n providers?: Record<string, RuntimeProviderScopeSelection \| undefined>;\n selection?: Partial<Record<EngineCapability, {\n primary: string;\n whenUnavailable?: string[];\n failover?: string[];\n }>>;\n}\n\n\n/\n * `PROVIDER_ADMISSIBLE_CONNECTIONS_FLOOR` (external-connectors-private, read through `providerModuleAdmissibleConnections`):\n * what a provider admits when NOBODY HAS JUDGED IT — the SAFETY NET, not the answer.\n \n Named and stated once because it was previously an anonymous literal inlined at two call sites, and since #3398\n * it lives beside the module checks so they and this registry read one default,\n * and a value that applies to most of the catalogue should be readable as the decision it is.\n \n ONE row, and it is the conservative end deliberately. APPLICATION x SERVICE is the deployment's\n * own credential, authored in the environment by the operator — the only claim that needs no\n * knowledge of the vendor whatsoever.\n \n It was briefly widened to include ORGANIZATION x SERVICE, with a careful argument that a tenant\n * bringing its own key is a fact about Wildo's tenancy model rather than about any vendor. The\n * argument holds and the change was still wrong: it made a blanket rule decide for 688 vendors at\n * once, which is precisely the per-vendor judgement this framework refuses to shortcut. A default\n * that carries the whole catalogue is not a fallback — it is mass management with a justification\n * attached, and the justification is what makes it hard to notice.\n \n So a provider earns every row beyond this one by somebody ANALYSING it and recording why, as a registry\n * provider's own `admissibleConnections` does (`providers-registry/asana/`), and as the archived catalogue's\n * `_code_archive/providers/catalogue-record/decisions/slack.json` did. The population that needs that judgement\n * is far smaller than the catalogue: 99 of the 689 transposed vendors declare an OAuth2 contract,\n * and only those have a connection flow to admit anybody to.\n /\n\n/\n One declared secret slot of a provider, as a SCREEN needs it.\n \n Carries the slug so a form can name the field without anybody typing it, the environment variable\n * so an operator knows exactly what to set, and `configured` so a missing one can be reported rather\n * than discovered by pressing a button. It carries no VALUE, and there is no field for one.\n /\n/\n The OAuth client a connect, refresh or revocation must use — see\n * `ExternalProvidersRegistryBackendService.getConnectionOAuth2Client` (#1725).\n /\nexport interface ProviderConnectionOAuth2Client {\n /* The connection's identity: the declared base, or the ref itself when undeclared. /\n readonly connectionRef: string;\n /* The ref the flow came through. Recorded and audited; never the client's owner for a member. /\n readonly providerRef: string;\n /* The OWNER's REST OAuth2 block — endpoints, scopes, allowances, audiences. /\n readonly oauth2: ProviderRestOAuth2;\n /* The owner's REST contract, for the deployment base URL and the deployment-configured hosts. /\n readonly restContract: Extract<ProviderProtocolRuntimeContract, { kind: typeof ProviderProtocolRuntimeKind.REST }>;\n /* The client is the owner's sign-in registration (`sharedWithSignIn`) rather than its connected-account one. /\n readonly sharedWithSignIn: boolean;\n}\n\nexport interface ProviderSecretSlot {\n readonly slug: string;\n readonly envVarName: string;\n readonly required: boolean;\n readonly description: string;\n readonly scope: ExternalProvider_SecretScope;\n /* Whether the deployment environment supplies it. Never the value itself. /\n readonly configured: boolean;\n /* Present when the contract marks the slot as holding a deployment host (see `SecretsContractEntry.holdsDeploymentHost`). /\n readonly holdsDeploymentHost?: true;\n /* Present when the contract marks the slot as holding a vendor value made for browsers (see `SecretsContractEntry.holdsBrowserPublicValue`). /\n readonly holdsBrowserPublicValue?: true;\n}\n\n\n/\n How an operator provides an application-owned provider secret (#1637) — one wording for every refusal\n * that reaches a person because a key is missing, so each names the same door: `wildo secrets set`, or\n * the workbench's Secrets section, which runs it.\n /\nexport function describeProviderSecretRemedy(envVarName: string): string {\n return `Provide it with \\`wildo secrets set ${envVarName}\\` (add \\`--env <environment>\\` for a remote one) or in the workbench's `\n + 'Secrets section; the runtimes that read it restart to pick it up.';\n}\n\n@injectable()\nexport class ExternalProvidersRegistryBackendService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n protected registry: External_Providers_Registry \| null = null;\n\n protected isInitialized = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) protected readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) protected readonly configService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) protected readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) protected readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n /\n The container, used ONLY to resolve the per-organization credential store on demand\n * ({@link resolveOrganizationCredentialResolver}). OPTIONAL, and appended LAST so no\n * existing parameter position moves.\n \n *Deliberately NOT a constructor injection of\n {@link OrganizationProviderCredentialResolverPort}.** `@optional()` tolerates an ABSENT\n * BINDING; it does not defer construction. So injecting the port directly made this\n * configuration-tier registry construct the entire resource stack that stands behind the\n * store — and that stack closes a cycle straight back here:\n \n ```\n * SaaS.AuditLogSink → CompositeAuditLogSink → ExternalProvidersRegistryService\n * → OrganizationProviderCredentialResolver (the store)\n * → SystemAccessService / AuditLogsService → SaaS.AuditLogSink\n * ```\n \n which InversifyJS reports as `Circular dependency found: (No dependency trace)` +\n * `RangeError: Maximum call stack size exceeded` at BOOT — every platform service and every\n * application backend, since `AuditLogsBackendService` injects the sink. The same edge\n * poisons `LlmObservabilityAgentCallTraceSink`, which depends on this registry too.\n \n Resolving on demand is also what the port's own contract already assumed: this service is\n * constructed at configuration tier, BEFORE repositories exist, while a tenant credential is\n * only ever needed once a request is being served. Lazy-container is the pattern\n * `AuthorizationsBackendService` and `WebSocketService` use to break their own cycles.\n \n When the container is absent (a unit harness) or the store is unbound (a minion resolving\n * an LLM key), no tenant has its own credential here and resolution falls through to the\n * deployment environment — the behaviour every caller had before the store existed.\n /\n @inject('Container') @optional() protected readonly container?: Container,\n ) {\n this.logDebug = this.logger.debugByType('ExternalProvidersRegistryBackendService');\n this.logger.setDebugTypeLogging('ExternalProvidersRegistryBackendService', false);\n\n this.logDebug('External providers registry service created (not yet initialized)');\n }\n\n // ================================\n // Initialization Method\n // ================================\n\n /\n Initialize by projecting first-class backend provider modules into the\n * runtime registry facade used by existing callers.\n /\n public async initialize(): Promise<void> {\n if (this.isInitialized) {\n this.logDebug('Service already initialized, skipping');\n return;\n }\n\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.reportMissingProviderRuntimePeers();\n\n this.registry = registry;\n\n this.isInitialized = true;\n try {\n this.assertSharedConnectionsCoherent();\n this.assertDeclaredAudiencesCoherent();\n } catch (error) {\n // A host that refused its shared connections is not initialized: nothing may resolve a grant through\n // a declaration this boot has just proven wrong.\n this.isInitialized = false;\n this.registry = null;\n throw error;\n }\n this.logDebug('External providers registry initialized from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n }\n\n /\n @wildo_source:part:start saas.backend.providers.optional-runtime-peers facet:layer:backend facet:audience:app-developer\n \n Report a registered provider whose optional runtime peer is not installed (#438).\n \n What this means for an application: a provider may lazy-load a vendor SDK. A provider package\n * your application installs (`wildo registry add`) carries its SDK as its own dependency, so\n * installing the package installs it. An engine-shipped provider does not: declaring it in a scope\n * does not install its SDK. YOU install it, in the runtime that enables the provider — which is your\n * own `backend-api`, not the engine package — and if you do not, the capability that provider serves\n * quietly does not work.\n \n The startup warning names the provider and the missing packages, so read it as an\n * installation instruction rather than as noise.\n \n `requiredPackages` declares the npm packages a provider LAZY-LOADS — a vendor SDK that is never\n * an ENGINE dependency: an engine-shipped provider's is installed by the runtime that enables it, a\n * provider package's is that package's own dependency. The engine's immudb declares it\n * (`immudb-node`), as does the registry PostHog package (`posthog-node`), and\n * until 2026-09-08 the field had NO READER anywhere: no start-up check, no installation step,\n * no diagnostic. A provider could be registered with its SDK absent and the first sign was the\n * feature quietly not working.\n \n A REPORT, never a refusal, and the asymmetry is deliberate: a declared provider may\n * legitimately never be reached (a fan-out audit sink in an environment that emits nothing),\n * so an absent optional peer is information rather than a misconfiguration. The capability\n * DISAGREEMENT check in `define-saas-config` refuses, because a wrong declaration is wrong\n * whatever happens next.\n \n Resolution is attempted from the RUNNING APPLICATION first and from this module second. The\n * peer is installed in the application's own `backend-api`, not in the engine package, so\n * resolving only from here would report a false absence — and a diagnostic that cries wolf is\n * worse than the silence it replaces. For the same reason an application-owned provider is also\n * asked from its OWN package (#2579, {@link findMissingProviderRuntimePeers}): its SDK is that\n * package's dependency, which is where its lazy import resolves from.\n /\n private reportMissingProviderRuntimePeers(): void {\n const resolvers = [\n (() => { try { return createRequire(join(process.cwd(), 'package.json')); } catch { return undefined; } })(),\n (() => { try { return createRequire(import.meta.url); } catch { return undefined; } })(),\n ].filter((resolver): resolver is NodeRequire => Boolean(resolver));\n\n for (const { providerRef, missingPackages } of findMissingProviderRuntimePeers(this.backendProviderRegistry.getRegistry().modules.values(), resolvers)) {\n this.logger.warn('Provider is registered without its declared optional runtime peer(s)', {\n providerRef,\n missingPackages,\n detail: 'The provider lazy-loads these and degrades without them, so the capability it serves will not work. '\n + 'Install them in the runtime that enables this provider, or stop declaring the provider in that scope.',\n });\n }\n }\n /* @wildo_source:part:end saas.backend.providers.optional-runtime-peers /\n\n private buildRuntimeRegistryFromProviderModules(): External_Providers_Registry {\n const registry: External_Providers_Registry = {};\n for (const provider of this.backendProviderRegistry.getRegistry().modules.values()) {\n const providerRef = provider.metadata.ref;\n const protocols = this.backendProviderRegistry.getProtocolKinds(providerRef);\n const engineCapabilities = provider.providerCapabilities\n .map((capability) => PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability])\n .filter((capability): capability is EngineCapability => Boolean(capability));\n\n registry[providerRef] = {\n providerRef,\n protocols,\n engineCapabilities: [...new Set(engineCapabilities)],\n supportsOAuth2: protocols.includes(ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2) \|\| undefined,\n };\n }\n return registry;\n }\n\n // ================================\n // Access Methods\n // ================================\n\n public getExternalProvidersRegistry(): External_Providers_Registry {\n this.ensureInitialized();\n return this.registry!;\n }\n\n public getProviderTypes(): string[] {\n this.ensureInitialized();\n return Object.keys(this.registry!);\n }\n\n public getProvider(providerRef: string): External_Providers_RegistryItem \| undefined {\n this.ensureInitialized();\n return this.registry![providerRef];\n }\n\n public hasProvider(providerRef: string): boolean {\n this.ensureInitialized();\n return providerRef in (this.registry \|\| {});\n }\n\n /\n Public, NON-throwing readiness probe — whether `initialize()` has run.\n * Lets lazy consumers (e.g. `CompositeAuditLogSink`) distinguish the expected\n * pre-startup window (skip silently, retry later) from a genuine post-init\n * resolution fault (which must be surfaced, not swallowed) — without tripping\n * the `ensureInitialized()` throw just to probe.\n /\n public isReady(): boolean {\n return this.isInitialized;\n }\n\n /\n The providers that serve a capability on this runtime, the one asked first at the head: the registry's facts\n * (definitions, configuration, scope, the per-environment override) handed to `orderProvidersForEngineCapability`,\n * the one ordering rule, which an evidence collector runs too (#2846 review B1).\n /\n public getProvidersForEngineCapability(capability: EngineCapability): string[] {\n return orderProvidersForEngineCapability(this.buildProviderOrderInput(capability));\n }\n\n /\n The providers that may take a call the `attemptedProviderRefs` failed TRANSIENTLY (#2301), in declared order: the\n * runtime scope's `failover` list for the capability, narrowed by the SAME eligibility a selected provider passes\n * (`failoverProvidersForEngineCapability`). Empty for a capability whose consumer performs no call-time failover.\n * Which failures are transient is the consumer's decision (`DocumentExtractionBackendService` for\n * `AI_DOCUMENT_EXTRACTION`); this only answers who may be asked next.\n /\n public getFailoverProvidersForEngineCapability(capability: EngineCapability, attemptedProviderRefs: readonly string[]): string[] {\n return failoverProvidersForEngineCapability({ ...this.buildProviderOrderInput(capability), attemptedProviderRefs });\n }\n\n /\n The `failover` list the runtime scope's selection DECLARES for a capability (#2301), as authored and before any\n * eligibility narrowing. What `getFailoverProvidersForEngineCapability` hands out is this list narrowed; a consumer's\n * startup check compares the two to refuse a declared provider this runtime cannot reach (not loaded, which includes a\n * data residency refusal at load, or not declared for the capability in this scope) instead of discovering it during\n * the outage the declaration exists for. Empty for a capability whose consumer performs no call-time failover.\n /\n public getDeclaredFailoverProviders(capability: EngineCapability): string[] {\n if (!engineCapabilityPerformsCallTimeFailover(capability)) return [];\n this.ensureInitialized();\n return [...(this.getActiveRuntimeProviderScope()?.selection?.[capability]?.failover ?? [])];\n }\n\n /* The registry's facts for one capability, as the ordering rule and the failover rule both read them. /\n private buildProviderOrderInput(capability: EngineCapability): EngineCapabilityProviderOrderInput {\n this.ensureInitialized();\n const configured = this.configService.isInitialized();\n const selectionOverride = this.getProviderSelectionOverride(capability);\n return {\n capability,\n registeredProviders: Object.values(this.registry!).map((provider) => ({ providerRef: provider.providerRef, engineCapabilities: provider.engineCapabilities })),\n ...(configured\n ? {\n configuration: {\n capabilityEnabled: isEngineCapabilityEnabled(this.configService.config.engineCapabilities, capability),\n runtimeScope: this.getActiveRuntimeProviderScope(),\n configuredProviderRefs: new Set(Object.keys(this.configService.config.providerConfigurations ?? {})\n .filter((providerRef) => Boolean(this.configService.config.providerConfigurations?.[providerRef]))),\n },\n }\n : {}),\n ...(selectionOverride ? { selectionOverride } : {}),\n };\n }\n\n public getPrimaryProviderForEngineCapability(capability: EngineCapability): string \| undefined {\n return this.getProvidersForEngineCapability(capability)[0];\n }\n\n /\n Resolve the provider ref(s) that should be ACTIVE for a capability,\n * honouring its declared `EngineCapabilityResolutionMode`:\n * - `SELECT_ONE` (the default — billing, email, observability, …): the\n * single primary, as a 0- or 1-element list. A declared `whenUnavailable` entry\n * only orders the candidate list ahead of this call — it substitutes for a\n * primary that is not AVAILABLE. A call the primary FAILED is handed on only by\n * a consumer that performs call-time failover, through\n * {@link getFailoverProvidersForEngineCapability} (#2301), never through this list.\n * - `FAN_OUT` (e.g. `COMPLIANCE_AUDIT_TRAIL`): EVERY declared + available\n * provider — all active simultaneously (no primary, no failover).\n * - `BOUND_PER_PURPOSE` (`KEY_MANAGEMENT`, #2891): every declared provider; which one\n * serves a purpose is the `keyManagement` binding's answer, never this list's order.\n \n The single entry point a fan-out consumer (the `CompositeAuditLogSink`)\n * uses, so the resolution mode is honoured centrally rather than each\n * consumer choosing `getPrimary…` vs `getProviders…` by convention.\n /\n public getResolvedProviderRefsForCapability(capability: EngineCapability): string[] {\n const mode = getEngineCapabilityResolutionMode(capability);\n switch (mode) {\n case EngineCapabilityResolutionMode.FAN_OUT:\n return this.getProvidersForEngineCapability(capability);\n case EngineCapabilityResolutionMode.BOUND_PER_PURPOSE:\n // Every declared provider is active for the purposes bound to it (#2891). WHICH provider serves a given\n // purpose is the key-management resolver's answer, from the `keyManagement` binding, never this list's\n // order: a consumer of keys asks by purpose and never picks from here.\n return this.getProvidersForEngineCapability(capability);\n case EngineCapabilityResolutionMode.SELECT_ONE: {\n const primary = this.getPrimaryProviderForEngineCapability(capability);\n return primary ? [primary] : [];\n }\n default:\n return assertNeverResolutionMode(mode);\n }\n }\n\n public isEngineCapabilityAvailable(capability: EngineCapability): boolean {\n return this.getProvidersForEngineCapability(capability).length > 0;\n }\n\n /\n G4 (audit Phase 5) — fail-open reconcile support. Whether a capability is\n * switched ON in `engineCapabilities` config (`activation.enabled === true`),\n * INDEPENDENT of whether any provider resolves to serve it. Distinct from:\n * - `isEngineCapabilityAvailable` — a provider is DECLARED (says nothing about\n * the operator's config intent), and\n * - `getRequiredCapabilitiesWithoutProvider` — a HARD requirement is unmet\n * (throws at boot; F5).\n * The G4 warn pairs this (\"the operator turned audit on\") with a zero-resolved-\n * provider check (\"but nothing is delivering it\") to flag a SILENT Layer-2\n * fan-out — a warn, never a throw.\n /\n public isEngineCapabilityEnabled(capability: EngineCapability): boolean {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n // An always-enabled capability (#2891) is on before configuration is read too: nothing can switch it off.\n return isEngineCapabilityEnabled(undefined, capability);\n }\n return isEngineCapabilityEnabled(this.configService.config.engineCapabilities, capability);\n }\n\n /\n F5 (audit Phase 5) — boot-guard support. Returns every capability the app\n * marked `activation.required === true` that resolves to ZERO active providers\n * (respecting the capability's resolution mode — SELECT_ONE needs a primary,\n * FAN_OUT needs ≥1 declared; a `required` capability left `enabled: false`\n * resolves to none and is therefore also caught). A non-empty result means a\n * misconfigured deployment — a HARD requirement with nothing to serve it — and\n * `StartApplicationBackendService.initialize()` throws CONFIGURATION on any.\n * Audit (`COMPLIANCE_AUDIT_TRAIL`, when marked required) is the FIRST user, not\n * a special case: this generalizes the coherence to EVERY capability.\n /\n public getRequiredCapabilitiesWithoutProvider(\n options: RequiredCapabilityFloorOptions = { includeEngineFloor: true },\n ): EngineCapability[] {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n // Used to answer `[]` here, which read as \"nothing missing\" on a host whose config\n // had never loaded — a floor that cannot see its inputs must refuse, not reassure.\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'The required-capability floor was evaluated before the application configuration '\n + 'was initialized; it cannot decide what is required.',\n },\n });\n }\n const activations = this.configService.config.engineCapabilities ?? {};\n const missing: EngineCapability[] = [];\n // Swept over the ENUM, not over the authored keys (#328), so the population and its order\n // are the engine's. Requiredness itself always needs an activation entry — an absent key is\n // neither `enabled` nor `required` — so this is about which list is authoritative, not about\n // catching an omitted key.\n for (const capability of Object.values(EngineCapability)) {\n const activation = activations[capability];\n const requiredByApplication = activation?.required === true;\n const requiredByEngine = options.includeEngineFloor\n && isEngineCapabilityEnabled(activations, capability)\n && ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED.has(capability);\n if (\n (requiredByApplication \|\| requiredByEngine)\n && this.getResolvedProviderRefsForCapability(capability).length === 0\n ) {\n missing.push(capability);\n }\n }\n return missing;\n }\n\n /\n The floor as a single fail-closed door (#328): every host that serves the application\n * calls this after its registry is ready — the application backend, and the platform\n * services after `refreshFromConfig()` — so \"required with nothing serving it\" cannot pass\n * one host's boot because the check happened to live on another's branch.\n /\n public assertRequiredCapabilityFloor(options?: RequiredCapabilityFloorOptions): void {\n const missingRequiredCapabilities = this.getRequiredCapabilitiesWithoutProvider(options);\n if (missingRequiredCapabilities.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Required engine capabilities resolve no active provider: [${missingRequiredCapabilities.join(', ')}]. `\n + 'Each is either marked `required` in engineCapabilities or is an engine flow that needs a provider '\n + 'the moment it is enabled (EMAIL_TRANSACTIONAL, BILLING, SMS) — declare a provider for it '\n + '(SELECT_ONE needs a primary; FAN_OUT needs ≥1 declared), or disable the capability.',\n missingRequiredCapabilities,\n },\n });\n }\n\n /\n Per-environment external-provider selection override, read once from\n * `process.env.WILDO_PROVIDER_SELECTION_OVERRIDES` (a JSON map of\n * `EngineCapability -> { primary, whenUnavailable? }`). Projected by the Wildo\n * CLI's `env-vars-builder` from `wildo.infra.<env>.config.ts > providerSelection`.\n * Read as a string literal (not via a `platform-config-lib` import) to\n * preserve the engine → platform dependency direction — mirrors how\n * `LoggerService` reads `LOG_LEVEL` and `otel-preload` reads `OTEL_ENABLED`.\n \n Memoized on first read: env vars are fixed for a process lifetime, and\n * `getProvidersForEngineCapability` is a hot path. A malformed value is\n * tolerated (logged + ignored) so a bad override degrades to the SaaS-config\n * selection rather than breaking provider resolution.\n /\n private providerSelectionOverridesCache?: Partial<Record<EngineCapability, { primary: string; whenUnavailable?: string[] }>>;\n private providerSelectionOverridePayloadMalformed = false;\n private readonly malformedProviderSelectionOverrides = new Set<EngineCapability>();\n\n private getProviderSelectionOverride(\n capability: EngineCapability,\n ): { primary: string; whenUnavailable?: string[] } \| undefined {\n if (this.providerSelectionOverridesCache === undefined) {\n const raw = process.env.WILDO_PROVIDER_SELECTION_OVERRIDES;\n if (!raw) {\n this.providerSelectionOverridesCache = {};\n } else {\n try {\n const parsed = JSON.parse(raw) as unknown;\n if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n this.providerSelectionOverridesCache = parsed as Partial<Record<EngineCapability, { primary: string; whenUnavailable?: string[] }>>;\n } else {\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n } catch (error) {\n this.logDebug('Failed to parse WILDO_PROVIDER_SELECTION_OVERRIDES; ignoring per-env override', {\n error: describeCaughtError(error),\n });\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n }\n }\n const override = this.providerSelectionOverridesCache[capability];\n // Guard the shape defensively — a hand-crafted env var could carry a\n // non-conforming entry that upstream Zod validation never saw.\n if (override === undefined) return undefined;\n if (\n typeof override.primary !== 'string'\n \|\| override.primary.length === 0\n \|\| (override.whenUnavailable !== undefined && (\n !Array.isArray(override.whenUnavailable)\n \|\| !override.whenUnavailable.every((substitute) => typeof substitute === 'string' && substitute.length > 0)\n ))\n ) {\n this.malformedProviderSelectionOverrides.add(capability);\n return undefined;\n }\n return override;\n }\n\n /\n Sanitized provenance for the effective provider selection. This exposes\n * neither environment bytes nor provider configuration; it only preserves\n * which authority won and the generated artifact identities behind it.\n /\n public getProviderSelectionResolutionEvidence(capability: EngineCapability): ExternalProviderSelectionResolutionEvidence {\n this.ensureInitialized();\n const runtimeSelection = this.getActiveRuntimeProviderScope()?.selection?.[capability];\n const environmentSelection = this.getProviderSelectionOverride(capability);\n const overrideMalformed = this.providerSelectionOverridePayloadMalformed \|\| this.malformedProviderSelectionOverrides.has(capability);\n return Object.freeze({\n authorityKind: environmentSelection\n ? ExternalProviderSelectionAuthorityKind.ENVIRONMENT_OVERRIDE\n : runtimeSelection\n ? ExternalProviderSelectionAuthorityKind.APPLICATION_RUNTIME_ARTIFACT\n : ExternalProviderSelectionAuthorityKind.DEFAULT_RESOLUTION,\n overrideStatus: overrideMalformed\n ? ExternalProviderSelectionOverrideStatus.MALFORMED\n : environmentSelection\n ? ExternalProviderSelectionOverrideStatus.APPLIED\n : ExternalProviderSelectionOverrideStatus.ABSENT,\n applicationPrimaryProviderRef: runtimeSelection?.primary ?? null,\n applicationSubstituteProviderRefs: Object.freeze([...(runtimeSelection?.whenUnavailable ?? [])]),\n applicationFailoverProviderRefs: Object.freeze([...(runtimeSelection?.failover ?? [])]),\n environmentPrimaryProviderRef: environmentSelection?.primary ?? null,\n environmentSubstituteProviderRefs: Object.freeze([...(environmentSelection?.whenUnavailable ?? [])]),\n providerRuntimeArtifact: this.configService.getProviderRuntimeArtifactEvidenceMetadata(),\n });\n }\n\n private getActiveRuntimeProviderScope(): RuntimeProviderScope \| undefined {\n if (!this.configService.isInitialized()) {\n return undefined;\n }\n\n const scopes = this.configService.config.providers?.scopes;\n if (!scopes) {\n return undefined;\n }\n\n const serviceName = typeof (this.configService as { serviceName?: string }).serviceName === 'string'\n ? (this.configService as { serviceName?: string }).serviceName!\n : '';\n if (scopes.companion && isCompanionRuntimeServiceName(serviceName)) {\n return scopes.companion as RuntimeProviderScope;\n }\n\n return scopes.backend as RuntimeProviderScope \| undefined;\n }\n\n /\n Get provider configuration for a specific protocol.\n * Falls back to default configuration from cached provider definitions if not overridden.\n /\n public getProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n this.ensureInitialized();\n try {\n if (!this.configService.isInitialized()) {\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n const appConfig = this.configService.config;\n const providerConfigs = appConfig.providerConfigurations \|\| {};\n\n const defaultConfig = this.getDefaultProviderConfiguration(providerRef, protocolKind);\n const customConfig = providerConfigs[providerRef]?.[protocolKind];\n this.refuseModuleOwnedConfigurationKeys(providerRef, protocolKind, customConfig);\n this.assertAuthoredCredentialFieldsAdmitted(providerRef, protocolKind, customConfig);\n if (customConfig) {\n this.logDebug(`Using merged custom configuration for ${providerRef}.${protocolKind}`);\n return this.mergeProviderConfiguration(\n defaultConfig,\n customConfig as ResolvedProviderConfiguration,\n );\n }\n\n if (defaultConfig) {\n this.logDebug(`Using default configuration for ${providerRef}.${protocolKind}`);\n }\n return defaultConfig;\n } catch (error) {\n // Programmer-error / contract-violation paths (cross-`kind`\n // merge guard, authKind misuse on `agent-client-protocol`) throw via\n // `errorBuilder.buildError`, producing `WildoError_Backend`.\n // Those MUST surface — they signal projection drift that the\n // silent fallback would mask. Only network/runtime hiccups\n // (the original intent of this catch) fall back to default.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting provider configuration, falling back to default', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n }\n\n /\n Refuse a configuration bag that carries a key the provider MODULE owns (#2995), naming the provider and the key.\n \n The three schemas a configuration passes (`defineSaaSConfig`, the per-environment overlay, the backend's application\n * configuration) already refuse these keys. This is the second door, for a configuration that reached the registry\n * by another road: a stored declaration written before those schemas refused, a configuration hydrated in-process.\n * It is a CONFIGURATION error built through the error builder, so `getProviderConfiguration`'s catch re-throws it\n * rather than falling back to the module's defaults as though nothing had been authored.\n /\n private refuseModuleOwnedConfigurationKeys(providerRef: string, protocolKind: string, customConfig: unknown): void {\n const [finding] = findModuleOwnedProviderConfigurationKeys({ [providerRef]: { [protocolKind]: customConfig } });\n if (finding === undefined) return;\n // assurance-control: WILDO.NETWORK.OUTBOUND_TARGET_CONTROL — a configuration cannot re-point a provider's request, and its credential, off the module's declared destination (#2995).\n // assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a provider credential travels only to the destination its module declares, whatever reached the registry (#2995).\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: describeModuleOwnedProviderConfigurationKey(finding),\n providerRef: finding.providerRef,\n protocolKind: finding.protocolKey,\n key: finding.key,\n },\n },\n );\n }\n\n /\n Refuse an authored `authConfig.secretRef` that names no secret the provider module declares (#3002), naming the\n * provider, the protocol, the value and what the module does declare.\n \n `authConfig.secretRef` decides which environment variable is sent to the provider as its key or client secret, and\n * `getProviderSecret` reads whatever name it is given. Before this, one configuration line\n * (`authConfig: { secretRef: 'DATABASE_PASSWORD' }`) made the registry hand an unrelated process secret to a vendor:\n * another provider's key, a database password, the platform's own secret. The host it went to was still the module's\n * (#2995 holds that); which credential travelled was the configuration's choice.\n \n The rule: a configuration may name ONLY a slot the module's `secretsContract` declares, by its environment variable\n * or by its slug (the CLI's secret requirements match a configured ref to a slot both ways, so the two agree on what a\n * ref means; {@link getProviderSecret} reads such an authored slug as its slot's variable). That keeps the one legitimate use,\n * pointing a protocol at a declared slot its binding does not name (#2054), and removes the rest. Every reader that\n * takes the configuration through {@link getProviderConfiguration} inherits the refusal: the API key\n * ({@link getProviderApiKey}), {@link getProviderSecret}, the protocol secrets, the REST access resolver and the\n * webhook signature secret, and each surfaces it rather than reading it as \"no value\". The two readers that read the\n * raw configuration first read the runtime contract through {@link getProviderConfiguration}, so they are refused\n * before their raw read: {@link resolveConnectionOAuth2ClientCredentials}'s sign-in branch, and the OAuth2 sign-in\n * resolver (its step 1). And {@link getProviderSecret} reads no variable the module does not declare, whoever names it.\n \n At startup, {@link assertAuthoredSecretRefsDeclared} checks every authored value once: the application backend (and\n * the minion and worker runtimes, which run its startup), the development companion and apps-manager. The CLI refuses\n * the same configuration earlier, at `wildo config sync` and creation readiness (`resolveEnvironmentProviderConfigurations`).\n \n Rejected: refusing `authConfig.secretRef` outright. A module may declare a second slot for an arm its binding does\n * not name, and #2054 made that a supported shape. Also rejected: refusing only names that look like another\n * provider's secret. That is a guess about every other variable in the process, and the declared set is a fact.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a configuration may point a protocol's credential only at a slot its provider module declares.\n /\n public assertAuthoredSecretRefDeclared(providerRef: string, protocolKey: string, authored: unknown): void {\n if (authored === undefined) return;\n if (typeof authored === 'string' && this.resolveDeclaredSecretEnvVarName(providerRef, authored) !== undefined) return;\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `providerConfigurations.${providerRef}.${protocolKey}.authConfig.secretRef names '${String(authored)}', which ${providerRef} `\n + `does not declare as a secret. A configuration may point a protocol only at a slot the provider module declares, `\n + `by its variable or its slug (${this.describeDeclaredSecretSlots(providerRef)}); the variable was not read.`,\n providerRef,\n protocolKind: protocolKey,\n secretRef: String(authored),\n },\n },\n );\n }\n\n /\n Startup half of {@link assertAuthoredCredentialFieldsAdmitted}: every credential-naming field authored in the\n * application's configuration, for a provider this runtime loads, is checked once before anything is served (#3002,\n * #3018). A provider this runtime does not load is skipped: its module (and so its declared slots) is not here to check\n * against, and nothing here reads its secret. The runtime that does load it refuses it, and the CLI refuses it for\n * every provider it knows before any of them starts.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — every runtime that boots refuses, before it serves anything, a configuration naming a credential its provider module or the framework does not admit.\n /\n public assertAuthoredSecretRefsDeclared(): void {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) return;\n for (const [providerRef, protocols] of Object.entries(this.configService.config.providerConfigurations ?? {})) {\n if (this.backendProviderRegistry.getProvider(providerRef) === undefined) continue;\n for (const [protocolKey, bag] of Object.entries((protocols ?? {}) as Record<string, unknown>)) {\n this.assertAuthoredCredentialFieldsAdmitted(providerRef, protocolKey, bag);\n }\n }\n }\n\n /\n Hold every credential-naming field of one authored protocol bag to its rule (#3022): the one branch, over\n * {@link ProviderConfigurationCredentialField}, that this registry's read path and its startup walk share. A member\n * added to the vocabulary is a compile error here until its rule is decided.\n \n - `authConfig.secretRef`: a declared slot, by variable or slug ({@link assertAuthoredSecretRefDeclared}, #3002).\n * - an execution profile's `secretEnvVarName`: a declared variable ({@link assertExecutionProfileSecretEnvVarNameDeclared}, #3002).\n * - an execution profile's `inheritedEnvironmentVariables`: no secret the framework declares\n * ({@link assertAgentInheritedEnvironmentVariablesAreNotSecrets}, #3018).\n \n The profile fields are read on the agent-client-protocol bag under its wire value or its member name, the reading\n * the CLI door makes, so a bag authored under the member name is refused here too.\n /\n private assertAuthoredCredentialFieldsAdmitted(providerRef: string, protocolKey: string, bag: unknown): void {\n for (const reading of readProviderConfigurationCredentialFields(protocolKey, bag)) {\n switch (reading.field) {\n case ProviderConfigurationCredentialField.AUTH_SECRET_REF:\n this.assertAuthoredSecretRefDeclared(providerRef, protocolKey, reading.value);\n break;\n case ProviderConfigurationCredentialField.EXECUTION_PROFILE_SECRET_ENV_VAR_NAME:\n this.assertExecutionProfileSecretEnvVarNameDeclared(providerRef, protocolKey, reading.executionProfileRef ?? '', reading.value);\n break;\n case ProviderConfigurationCredentialField.EXECUTION_PROFILE_INHERITED_ENVIRONMENT:\n if (Array.isArray(reading.value)) {\n this.assertAgentInheritedEnvironmentVariablesAreNotSecrets(\n providerRef,\n `providerConfigurations.${providerRef}.${protocolKey}.${reading.path}`,\n reading.value.filter((name): name is string => typeof name === 'string'),\n );\n }\n break;\n default: {\n const exhaustive: never = reading.field;\n return exhaustive;\n }\n }\n }\n }\n\n /\n Refuse an authored ACP execution profile whose `secretEnvVarName` the provider module does not declare (#3002).\n \n That one name is both the variable read from this process and the variable set in the coding agent's subprocess\n * (`getAgentClientProtocolExecutionProfileSecret`, then the agent runner), so it decides which process secret the\n * agent receives: the same choice as `authConfig.secretRef`, through another field. Held to the declared variables\n * only, not to slugs: it names the variable the agent reads, so it must be one. A profile the module synthesizes\n * (`default`) takes its name from the module's own contract and is never authored here.\n \n The same profile's `inheritedEnvironmentVariables` forwards the host's own environment (the agent's login, its\n * tool paths) to the agent, and is held to the opposite rule (#3018): it may name anything EXCEPT a secret, checked\n * by {@link assertAgentInheritedEnvironmentVariablesAreNotSecrets}. A provider credential reaches an agent only\n * through `secretEnvVarName`, held here.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — an execution profile hands the coding agent only a variable its provider module declares.\n /\n private assertExecutionProfileSecretEnvVarNameDeclared(providerRef: string, protocolKey: string, executionProfileRef: string, named: unknown): void {\n if (typeof named === 'string' && this.declaredSecretSlots(providerRef).envVarNames.has(named)) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `providerConfigurations.${providerRef}.${protocolKey}.executionProfiles.${executionProfileRef}.secretEnvVarName names `\n + `'${String(named)}', which ${providerRef} does not declare as a secret. An execution profile may hand the agent only a `\n + `variable the provider module declares (${this.describeDeclaredSecretSlots(providerRef)}); the variable was not read.`,\n providerRef,\n protocolKind: protocolKey,\n executionProfileRef,\n secretEnvVarName: String(named),\n },\n });\n }\n\n /\n Refuse forwarding a secret into a coding agent's subprocess (#3018).\n \n `inheritedEnvironmentVariables` copies named variables from the process that spawns the agent (the application\n * backend, the companion) into the agent's environment, and that process holds the platform's and the providers'\n * secrets: the companion's env carries the platform's Redis and RabbitMQ admin passwords, the backend's its\n * primary secret, its admin-door secret, its inbound endpoints' secrets and its systems of record's credentials. So\n * no name the framework declares secret may be forwarded, whoever lists it: an application's execution profile, or\n * a provider contract's own list. The test is DERIVED ({@link isForbiddenAgentInheritedEnvironmentVariableName}).\n * A name it admits is one the FRAMEWORK does not declare secret, which is not the same as harmless: under\n * `wildo local dev` the spawning process also carries the developer's own shell environment, and a name such as\n * `GITHUB_TOKEN` is not the framework's to know. A provider credential the agent needs reaches it through the\n * profile's `secretEnvVarName`, which is held to that provider's declared slots.\n \n Called where the configuration is read (`getProviderConfiguration`, so every reader and startup), and at dispatch\n * on the exact list the agent is started with.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a coding agent inherits no secret the framework or a provider module declares.\n /\n public assertAgentInheritedEnvironmentVariablesAreNotSecrets(providerRef: string, source: string, names: readonly string[]): void {\n const named = [...new Set(names.filter((name) => this.isForbiddenAgentInheritedEnvironmentVariableName(name)))].sort();\n if (named.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `${source} names ${named.map((name) => `'${name}'`).join(', ')}, which ${named.length === 1 ? 'is a secret' : 'are secrets'} `\n + `of this platform or of a provider. A coding agent may not inherit a secret the framework declares; a provider `\n + `credential the agent needs is handed to it through the execution profile's secretEnvVarName. Nothing was started.`,\n providerRef,\n source,\n forbiddenNames: named,\n },\n });\n }\n\n /\n Whether a coding agent may never inherit `name`: a secret a Wildo runtime env declares (`isRuntimeSecretEnvVarName`:\n * the platform services', the application backend's and the workers' contract keys, every inbound endpoint secret\n * and every system-of-record slot), or a secret any provider module in THIS runtime's registry declares. The CLI\n * door asks the same question against every provider it can see, a superset. Derived on each call from those\n * declarations, so a secret added to any of them is refused the day it is added.\n /\n private isForbiddenAgentInheritedEnvironmentVariableName(name: string): boolean {\n if (isRuntimeSecretEnvVarName(name)) return true;\n for (const module of this.backendProviderRegistry.getRegistry().modules.values()) {\n if (Object.values(module.secretsContract ?? {}).some((entry) => entry.envVarName === name)) return true;\n }\n return false;\n }\n\n /\n The secrets a provider module declares: each slot's environment variable, and each slug mapped to its variable.\n * These are the only names a configuration may point at, and the only variables {@link getProviderSecret} reads.\n /\n private declaredSecretSlots(providerRef: string): { readonly envVarNames: ReadonlySet<string>; readonly envVarNameBySlug: ReadonlyMap<string, string> } {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract ?? {};\n const envVarNameBySlug = new Map<string, string>();\n for (const [slug, entry] of Object.entries(contract)) {\n if (typeof entry?.envVarName === 'string' && entry.envVarName !== '') envVarNameBySlug.set(slug, entry.envVarName);\n }\n return { envVarNames: new Set(envVarNameBySlug.values()), envVarNameBySlug };\n }\n\n /* The declared variable a name stands for: itself when it is a declared variable, its slot's variable when it is a slug. /\n private resolveDeclaredSecretEnvVarName(providerRef: string, name: string): string \| undefined {\n const { envVarNames, envVarNameBySlug } = this.declaredSecretSlots(providerRef);\n return envVarNames.has(name) ? name : envVarNameBySlug.get(name);\n }\n\n /* `slug (VARIABLE)` for each declared slot, for a refusal to name what is admitted. /\n private describeDeclaredSecretSlots(providerRef: string): string {\n const pairs = [...this.declaredSecretSlots(providerRef).envVarNameBySlug].map(([slug, envVarName]) => `${slug} (${envVarName})`).sort();\n return pairs.join(', ') \|\| 'none';\n }\n\n /\n The module's configuration with the application's values laid over it.\n \n The MODULE alone supplies `runtimeContract` and `endpoints` (#2995): both are taken from `defaultConfig`, never from\n * `customConfig`. Until #2995 the authored `runtimeContract` was deep-merged over the module's, which let a configuration\n * line send a provider's key to any URL; and a cross-`kind` guard here refused only the case where the two contracts\n * disagreed on `kind`. That guard is gone because its whole population is now refused before this runs\n * ({@link refuseModuleOwnedConfigurationKeys}): an authored contract of ANY kind is a configuration error, which is the\n * stronger statement of what the guard protected.\n \n With no module configuration for the protocol (`defaultConfig` undefined) the application's values are returned as\n * they are, and they cannot carry a contract either, for the same reason.\n /\n private mergeProviderConfiguration(\n defaultConfig: ResolvedProviderConfiguration \| undefined,\n customConfig: ResolvedProviderConfiguration\n ): ResolvedProviderConfiguration {\n if (!defaultConfig) {\n return customConfig;\n }\n\n return {\n ...defaultConfig,\n ...customConfig,\n // `executionProfiles` is a MAP OF NAMED PROFILES, so the top-level\n // spread above would drop every profile the provider synthesized\n // (including `default`, which existing consumers still resolve) as\n // soon as an application authors one profile of its own. Merge by\n // ref instead — and replace a same-named profile WHOLE rather than\n // deep-merging it: a deep merge would let an override inherit\n // `secretRef`/`secretEnvVarName` from the synthesized default and\n // silently turn a host-managed profile into a secret-injecting one.\n ...(defaultConfig.executionProfiles \|\| customConfig.executionProfiles\n ? {\n executionProfiles: {\n ...(defaultConfig.executionProfiles ?? {}),\n ...(customConfig.executionProfiles ?? {}),\n },\n }\n : {}),\n authConfig: this.deepMergeRecord(\n defaultConfig.authConfig,\n customConfig.authConfig,\n ) as ResolvedProviderConfiguration['authConfig'],\n // From the module, and from nothing else (#2995).\n runtimeContract: defaultConfig.runtimeContract,\n endpoints: defaultConfig.endpoints,\n };\n }\n\n private deepMergeRecord(\n defaultValue: unknown,\n customValue: unknown\n ): Record<string, unknown> \| undefined {\n if (!defaultValue && !customValue) return undefined;\n if (!defaultValue \|\| typeof defaultValue !== 'object' \|\| Array.isArray(defaultValue)) {\n return customValue as Record<string, unknown> \| undefined;\n }\n if (!customValue \|\| typeof customValue !== 'object' \|\| Array.isArray(customValue)) {\n return defaultValue as Record<string, unknown>;\n }\n\n const merged: Record<string, unknown> = {\n ...(defaultValue as Record<string, unknown>),\n };\n for (const [key, value] of Object.entries(customValue as Record<string, unknown>)) {\n const previous = merged[key];\n if (Array.isArray(previous) && Array.isArray(value)) {\n merged[key] = [...new Set([...previous, ...value])];\n continue;\n }\n merged[key] = previous\n && typeof previous === 'object'\n && !Array.isArray(previous)\n && value\n && typeof value === 'object'\n && !Array.isArray(value)\n ? this.deepMergeRecord(previous, value)\n : value;\n }\n return merged;\n }\n\n\n /\n The environment the OPERATOR declared for this runtime, or `undefined` (#2991). The reading every relaxation outside\n * production keys on (`readDeclaredOutboundAdmissionEnvironment`): a configuration hydrated without a declared\n * environment answers `undefined`, which the readers treat as production. Here because every reader of a host-held\n * slot already holds this registry; one accessor keeps them from each re-deriving the fallback.\n /\n public getDeclaredApplicationEnvironment(): RuntimeEnvironment \| undefined {\n return readDeclaredOutboundAdmissionEnvironment(this.configService);\n }\n\n /\n WHAT a declared secret identifies — the integration, or an account.\n \n DECLARED wins; otherwise DERIVED, and the derivation is deliberately narrow. A ref the REST\n * runtime contract names as the OAuth2 client id or client secret is a REGISTRATION. Everything\n * else answers CREDENTIAL.\n \n The fallback exists because the field arrived after 689 provider packages had been emitted,\n * from catalogues that live outside this repository — a mark that only worked once every package\n * had been re-emitted would enforce nothing until then, which for a guard is the same as not\n * existing.\n \n It is a FLOOR, not a complete answer, and the direction of its error matters. Deriving\n * CREDENTIAL for a registration secret the contract does not name in those two slots is the\n * permissive mistake: such a secret would still be storable as a tenant's own. That is exactly\n * the case a provider must declare explicitly, and it is why `scope` is authorable at all rather\n * than purely computed.\n /\n /\n A provider's declared secret slots, each classified and each answered as configured or not.\n \n The contract already says everything a screen needs — the slug, the environment variable, the\n * operator-facing description, whether it is required — and nothing was reading it. So a person\n * connecting an account typed a `secretSlug` into a free-text field, and an operator learned that\n * `ASANA_CLIENT_ID` was missing only when somebody pressed Connect and got a 502.\n \n NEVER the value, only whether one is present. The whole point is to make a missing secret\n * REPORTABLE on a screen, and a report that carried the secret would be the one thing that must\n * not leave the backend.\n \n Scope comes from {@link getProviderSecretScope}, so this and the connect leg's refusal cannot\n * disagree about which slot is a registration and which is an account.\n /\n public getProviderSecretSlots(providerRef: string): readonly ProviderSecretSlot[] {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract;\n if (contract === undefined) return [];\n return Object.entries(contract).map(([slug, entry]) => ({\n slug,\n envVarName: entry.envVarName,\n required: entry.required,\n description: entry.description,\n scope: this.getProviderSecretScope(providerRef, slug),\n ...(entry.holdsDeploymentHost === true ? { holdsDeploymentHost: true as const } : {}),\n ...(entry.holdsBrowserPublicValue === true ? { holdsBrowserPublicValue: true as const } : {}),\n // Read by the slot's variable only. A second read used to take the SLUG as an environment variable name;\n // `getProviderSecret` reads only declared variables (#3002), and no generator writes a variable by slug.\n configured: Boolean(this.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, entry.envVarName)),\n }));\n }\n\n public getProviderSecretScope(\n providerRef: string,\n secretRef: string,\n ): ExternalProvider_SecretScope {\n const entry = this.findSecretsContractEntry(providerRef, secretRef);\n if (entry?.scope !== undefined) {\n return entry.scope;\n }\n\n // Compare on the ENV-VAR NAME, not on the ref as supplied. A ref may arrive as either the\n // authoring slug (`accessToken`) or the env-var name (`SLACK_API_KEY`), while a runtime\n // contract only ever references the latter — so deriving from the raw ref answered CREDENTIAL\n // for `clientSecret` and REGISTRATION for `SLACK_CLIENT_SECRET`, two names for one secret.\n const comparableRef = entry?.envVarName ?? secretRef;\n const contract = this.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n const oauth2 = contract?.kind === ProviderProtocolRuntimeKind.REST ? contract.oauth2 : undefined;\n const namesRegistration = oauth2 !== undefined\n && (oauth2.clientIdSecretRef === comparableRef \|\| oauth2.clientSecretSecretRef === comparableRef);\n\n return namesRegistration\n ? ExternalProvider_SecretScope.REGISTRATION\n : ExternalProvider_SecretScope.CREDENTIAL;\n }\n\n /\n The contract entry for a ref, found by ENV-VAR NAME or by SLUG.\n \n Both are real addresses for the same thing and callers use both: the map key is the authoring\n * slug (`accessToken`), while runtime contracts reference the env-var name (`SLACK_API_KEY`).\n * Matching only one would leave half the callers unable to find an entry that is plainly there.\n /\n private findSecretsContractEntry(providerRef: string, secretRef: string): SecretsContractEntry \| undefined {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract;\n if (contract === undefined) {\n return undefined;\n }\n const slug = this.findSecretsContractSlug(providerRef, secretRef);\n return slug === undefined ? undefined : contract[slug];\n }\n\n /\n The secrets-contract KEY for either of a slot's two names, or `undefined` when the provider\n * declares no such slot.\n \n Kept as the ONE lookup rule: {@link findSecretsContractEntry} and\n * {@link canonicalCredentialSlug} both go through it, so \"which slot did the caller mean\" cannot\n * be answered two ways. Before this, the entry lookup and the connect leg's canonicalisation each\n * re-derived it, which is how they came to disagree about which of the two names to keep.\n /\n private findSecretsContractSlug(providerRef: string, secretRef: string): string \| undefined {\n // Tolerant of an unbound or partially-bound provider registry, because this is now reached\n // from the credential RESOLUTION path: a wiring gap there must degrade to \"I cannot map this\n // name\" and let the caller's own refusal speak, never turn a missing credential into a crash\n // whose message names neither the provider nor the owner.\n const contract = this.backendProviderRegistry?.getProvider?.(providerRef)?.secretsContract;\n if (contract === undefined) {\n return undefined;\n }\n // OWN keys only: `contract['constructor']` is a function inherited from `Object.prototype`, and a\n // bare `!== undefined` read it as a declared slot — so a stored slug named `constructor` would\n // have classified as CURRENT and a lookup would have \"canonicalised\" to a slot that does not exist.\n if (Object.prototype.hasOwnProperty.call(contract, secretRef)) {\n return secretRef;\n }\n return Object.entries(contract).find(([, entry]) => entry.envVarName === secretRef)?.[0];\n }\n\n /\n The name a STORED credential is keyed on: the provider's secrets-contract KEY, never its\n * environment-variable spelling.\n \n ## Why the contract key and not the env-var name (#624)\n \n A slot has two names and they have different LIFETIMES:\n \n \| \| example \| may it change? \|\n * \|---\|---\|---\|\n * \| the contract KEY \| `accessToken` \| no — it is the slot's identity, and there are five across all providers \|\n * \| `envVarName` \| `ASANA_ACCESS_TOKEN` \| yes — it is a deployment-configuration spelling \|\n \n A durable credential row must be keyed on the stable one. It was keyed on the other, and on\n * 2026-09-10 commit `2e8f7488` renamed the env-var spelling for 130 OAuth2 vendors — a\n * correct rename, `ASANA_API_KEY` was the wrong name for an OAuth2 account slot — thirty-one\n * minutes after two real grants were minted. Every stored credential on the machine (7 of 7,\n * across asana and slack) became a row whose provider no longer declares its key, and the\n * refusal an operator read was \"no credential for 'ASANA_ACCESS_TOKEN'\": indistinguishable from\n * never having connected.\n \n There is no silent substitution — the ORGANIZATION and USER branches of\n * {@link resolveProviderSecretForTarget} refuse rather than fall through to the deployment's own\n * credential — so this was never a wrong-account defect. It was a live secret reported as absent.\n \n Those rows are NOT migrated and never will be: the seal binds the slot name, so they cannot be\n * renamed, and re-sealing them was decided against (2026-09-12). Instead a refusal that misses now\n * names the retired slot and says to reconnect, and the boot report counts every such row — see\n * {@link classifyStoredCredentialSlot} and `retired-credential-slot.backend.utils.ts`.\n \n ## Accepting both names is deliberate, and permanent\n \n A caller may still NAME either one — the runtime contract's `apiKey.secretRef` carries the\n * env-var spelling, and every generated provider emits it that way — so this maps rather than\n * refuses. What it guarantees is that whatever a caller names, the value that reaches a store is\n * the one a rename cannot move.\n \n ## The environment lookup does NOT use this\n \n {@link getProviderSecret} resolves `process.env[envVarName]`, and must keep doing so: there the\n * spelling IS the identity, because it is what an operator writes in a deployment environment.\n * The two names exist for two jobs, and this method is the boundary between them.\n /\n public canonicalCredentialSlug(providerRef: string, secretRef: string): string {\n return this.findSecretsContractSlug(providerRef, secretRef) ?? secretRef;\n }\n\n /\n The CONNECTION a credential spent or written through `providerRef` belongs to (#1670).\n \n ## Why a connection and not the ref\n \n A stored credential is keyed and sealed on `(owner, connectionRef, secretSlug)`. A connection is the\n * unit a vendor grant belongs to, and a vendor may be served by several refs — an engine part and the\n * add-on packages beside it — that must spend ONE grant rather than ask the person to authorize once\n * per ref (#1669).\n \n ## A declared member maps to its BASE; everything else is its own connection\n \n `providers.sharedConnections` (#1725) names a base ref and the members that spend its grant, and this\n * answers the base for every one of them. An undeclared ref is its own connection — which is also why every\n * row stored before the key moved was backfilled to `connectionRef = providerRef` and still opens under the\n * same seal. The membership rule itself is `resolveProviderConnectionRef` in `@wildo-ai/saas-models`, the one\n * function `wildo config sync` records the lock entry with, so config and runtime cannot disagree.\n \n A row a member stored under its OWN ref before it joined a connection is keyed on that ref, not the base,\n * and is never read through the connection: it was sealed to the other identity, and there is deliberately no\n * re-seal door (2026-09-12). The miss names it instead — see {@link resolveProviderSecretForTarget}.\n \n ONE function, deliberately: every write door derives the row's `connectionRef` through it and every\n * read path addresses the store through {@link resolveCredentialAddress}, which calls it — so when the\n * mapping stops being the identity, reading and writing change together rather than one of them\n * keeping the ref (the invariant-applied-at-one-site shape this subsystem has met before).\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — which delegated grant a call through a ref\n * may spend is decided here, in one place, never by the caller.\n /\n public resolveCredentialConnectionRef(providerRef: string): string {\n return resolveProviderConnectionRef(this.declaredSharedConnections(), providerRef);\n }\n\n /\n The npm package that owns `providerRef` — its module's `metadata.packageName` — or `undefined` when no module\n * of that ref is loaded here. Named on the audit rows of a shared connection (#1725), where the connection alone\n * no longer says whose code spent the grant.\n /\n public getProviderPackageName(providerRef: string): string \| undefined {\n return this.backendProviderRegistry?.getProvider?.(providerRef)?.metadata?.packageName;\n }\n\n /\n The module's vendor registration and the parts of the module it is judged against (#2713): its secrets contract,\n * whose `holdsPublicIdentifier` slots are the only values read into a registration, and the fields that place\n * those slots. `undefined` when no module of that ref is loaded here, or its module registers nothing at the vendor.\n /\n public getProviderVendorRegistration(providerRef: string): {\n readonly registration: ProviderVendorRegistration;\n readonly module: Pick<BackendProviderModule, 'secretsContract' \| 'protocols'> & Partial<Pick<BackendProviderModule, 'otlpAuth'>>;\n } \| undefined {\n const module = this.backendProviderRegistry?.getProvider?.(providerRef);\n const registration = module?.vendorRegistration;\n return module === undefined \|\| registration === undefined ? undefined : { registration, module };\n }\n\n /\n How `providerRef`'s vendor opens a chat command's form while the person waits (#2770, Slack's modal), or `undefined`\n * when no module of that ref is loaded here or its vendor opens none. Read by the chat command form lane at receipt.\n /\n public getProviderChatCommandForm(providerRef: string): ProviderChatCommandFormContract \| undefined {\n return this.backendProviderRegistry?.getProvider?.(providerRef)?.chatCommandForm;\n }\n\n /\n The declared shared connection `providerRef` belongs to (as base or member), or `undefined` when it is its\n * own connection (#1725). What the connect, refresh and revoke paths ask before choosing whose OAuth client\n * to use.\n /\n public getProviderSharedConnection(providerRef: string): ResolvedProviderSharedConnection \| undefined {\n return resolveDeclaredSharedConnection(this.declaredSharedConnections(), providerRef);\n }\n\n /\n The application's `providers.sharedConnections`, or `undefined` on a host whose configuration carries none\n * — a platform service, a harness with no configuration. Read on every call, never cached, so the answer is\n * always the configuration the host is running.\n /\n private declaredSharedConnections(): ProviderSharedConnections \| undefined {\n try {\n return this.configService.isInitialized() ? this.configService.config.providers?.sharedConnections : undefined;\n } catch {\n return undefined;\n }\n }\n\n /\n The OAuth client a connect, refresh or revocation through `providerRef` must use (#1725): the BASE ref's\n * REST OAuth2 block and client slots for a declared connection — a member's own block is inert — and the\n * ref's own for an undeclared one. `undefined` when the owner declares no REST OAuth2 block.\n \n With `sharedWithSignIn`, the endpoints, scopes and audiences stay the base's connected-account block, and\n * only the CLIENT changes to the base's sign-in registration: that is the one thing the option decides.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — one connection has exactly one OAuth client,\n * the declared base's, whichever ref the person connects through.\n /\n public getConnectionOAuth2Client(providerRef: string): ProviderConnectionOAuth2Client \| undefined {\n const declared = this.getProviderSharedConnection(providerRef);\n const connectionRef = declared?.connectionRef ?? providerRef;\n const contract = this.getProviderRuntimeContract(connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n if (contract?.kind !== ProviderProtocolRuntimeKind.REST \|\| contract.oauth2 === undefined) return undefined;\n return {\n connectionRef,\n providerRef,\n oauth2: contract.oauth2,\n restContract: contract,\n sharedWithSignIn: declared?.sharedWithSignIn === true,\n };\n }\n\n /\n The scopes the connection `providerRef` spends may ask a person to consent to (#1671) — see\n * `computeProviderConnectionScopeCeiling`. `undefined` when the connection's owner declares no REST OAuth2 block,\n * which means there is no consent flow to grow.\n /\n public getConnectionScopeCeiling(providerRef: string): ProviderConnectionScopeCeiling \| undefined {\n const client = this.getConnectionOAuth2Client(providerRef);\n if (client === undefined) return undefined;\n const memberRefs = this.getProviderSharedConnection(providerRef)?.memberRefs ?? [];\n const sources: ProviderConnectionScopeSource[] = [];\n for (const memberRef of memberRefs) {\n const contract = this.getProviderRuntimeContract(memberRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n const scopes = contract?.kind === ProviderProtocolRuntimeKind.REST ? contract.oauth2?.scopes ?? [] : [];\n if (scopes.length > 0) sources.push({ providerRef: memberRef, scopes: scopes.flatMap((scope) => scope.split(/\\s+/)).filter((scope) => scope.length > 0) });\n }\n for (const ref of [client.connectionRef, ...memberRefs]) {\n for (const applied of this.backendProviderRegistry?.getProvider?.(ref)?.appliedAugmentations ?? []) {\n if (applied.requiredScopes.length > 0) sources.push({ providerRef: ref, augmentationPackageName: applied.packageName, scopes: applied.requiredScopes });\n }\n }\n return computeProviderConnectionScopeCeiling({ connectionRef: client.connectionRef, ownerOAuth2: client.oauth2, sources });\n }\n\n /\n The npm package whose code an operation of `providerRef` is — the opted-in augmentation that declares\n * `operationId`, else the ref's own package (#1671). Read from static declarations, so it loads no catalogue; named\n * on the grant row of a re-authorization so the trail says whose operation widened the consent.\n /\n public describeOperationContributorPackage(providerRef: string, operationId: string): string \| undefined {\n const applied = this.backendProviderRegistry?.getProvider?.(providerRef)?.appliedAugmentations ?? [];\n return applied.find((augmentation) => augmentation.operationIds.includes(operationId))?.packageName\n ?? this.getProviderPackageName(providerRef);\n }\n\n /\n The offer a call refused for `missingScopes` carries (#1671): which of them a person may grant by re-authorizing\n * the connection, which need an administrator, and which nobody can ask for on this connection. `undefined` when the\n * connection has no consent flow at all (a pasted credential, the deployment's own) — then only an operator can act.\n /\n public planProviderScopeReauthorization(providerRef: string, operationId: string, missingScopes: readonly string[]): ProviderScopeReauthorizationOffer \| undefined {\n const ceiling = this.getConnectionScopeCeiling(providerRef);\n if (ceiling === undefined) return undefined;\n const classified = classifyProviderConnectionScopes(ceiling, missingScopes);\n return {\n connectionRef: ceiling.connectionRef,\n providerRef,\n operationId,\n requestableScopes: classified.requestable,\n administratorConsentScopes: classified.administratorConsent,\n unrequestableScopes: classified.unrequestable,\n };\n }\n\n /\n The application's registration with the vendor for a connection — the two values an operator pastes —\n * resolved from the deployment for the connection's OWNER, never per connection and never from a row.\n \n Default: the base's connected-account slots (`oauth2.clientIdSecretRef` / `clientSecretSecretRef`). With\n * `sharedWithSignIn`: the base's sign-in registration, read exactly as the sign-in lane reads it — the client\n * id from `providerConfigurations.<base>.sso_oauth2`, the secret from the sign-in contract's secret ref — so\n * the two lanes cannot come to use two different registrations while both claim to share one.\n \n The REFS are returned beside the values so a refusal can name what to configure.\n /\n public resolveConnectionOAuth2ClientCredentials(client: ProviderConnectionOAuth2Client): {\n clientId?: string;\n clientSecret?: string;\n clientIdRef?: string;\n clientSecretRef?: string;\n } {\n if (!client.sharedWithSignIn) {\n const { clientIdSecretRef, clientSecretSecretRef } = client.oauth2;\n return {\n clientIdRef: clientIdSecretRef,\n clientSecretRef: clientSecretSecretRef,\n clientId: clientIdSecretRef === undefined ? undefined\n : this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, clientIdSecretRef),\n clientSecret: clientSecretSecretRef === undefined ? undefined\n : this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, clientSecretSecretRef),\n };\n }\n const signIn = this.getProviderRuntimeContract(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2);\n if (signIn?.kind !== ProviderProtocolRuntimeKind.OAUTH2_SSO) return {};\n const protocolConfiguration = (this.configService.config.providerConfigurations?.[client.connectionRef] as Record<string, unknown> \| undefined)\n ?.[ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2] as { clientId?: string; authConfig?: { clientId?: string; secretRef?: string } } & Record<string, unknown> \| undefined;\n const clientId = protocolConfiguration?.authConfig?.clientId\n ?? protocolConfiguration?.clientId\n ?? (signIn.clientIdPublicConfigKey === undefined ? undefined : protocolConfiguration?.[signIn.clientIdPublicConfigKey] as string \| undefined);\n // The authored ref is read raw here. It is already held to the module's declared slots (#3002): the\n // `getProviderRuntimeContract` call above reads through `getProviderConfiguration`, which refuses an undeclared one.\n const clientSecretRef = protocolConfiguration?.authConfig?.secretRef ?? signIn.clientSecretRef;\n return {\n clientIdRef: `providerConfigurations.${client.connectionRef}.${ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2}.clientId`,\n clientSecretRef,\n ...(typeof clientId === 'string' && clientId.length > 0 ? { clientId } : {}),\n clientSecret: this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2, clientSecretRef),\n };\n }\n\n /\n Refuse, at boot, a loaded provider whose OAuth2 block declares resource AUDIENCES it cannot honour (#1725) — or an\n * incremental-consent declaration restating a scope it does not declare (#1671), or ID token requirements no sign-in\n * could meet (#2663) —\n * `describeProviderOAuth2AudienceDefects`: no primary, a primary the authorization is not for, two audiences\n * admitting one host. The token-host binding selects a token by host, so an ambiguous declaration would let the\n * order of a record decide which token a request carries.\n \n Every rule lives in `describeProviderModuleAuthenticationDefects` (external-connectors-private), which\n * `wildo registry publish` runs too, so a module that would be refused here is refused before it is published\n * (follow-up to #3392).\n /\n private assertDeclaredAudiencesCoherent(): void {\n const defects: string[] = [];\n for (const module of this.backendProviderRegistry.getRegistry?.()?.modules?.values() ?? []) {\n // The one validator `wildo registry publish` runs too (follow-up to #3392), over the contract THIS registry\n // resolved for the module (augmentations applied).\n const contract = this.getProviderRuntimeContract(module.metadata.ref, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n defects.push(...describeProviderModuleAuthenticationDefects(module, contract?.kind === ProviderProtocolRuntimeKind.REST ? contract : undefined));\n }\n if (defects.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: { message: `A provider declares an authentication contract that cannot be honoured:\\n- ${defects.join('\\n- ')}`, defects },\n });\n }\n\n /\n Refuse, at boot, declared shared connections this host's loaded modules cannot honour (#1725) — see\n * `findSharedConnectionBootDefects`. A CONFIGURATION refusal, because the remedy is editing the SaaS config\n * and needs nothing running.\n /\n private assertSharedConnectionsCoherent(): void {\n const connections = this.declaredSharedConnections();\n if (connections === undefined \|\| Object.keys(connections).length === 0) return;\n const restOAuth2Of = (ref: string) => {\n const contract = this.getProviderRuntimeContract(ref, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n return contract?.kind === ProviderProtocolRuntimeKind.REST ? contract : undefined;\n };\n const defects = findSharedConnectionBootDefects({\n connections,\n systemOfRecordInstanceNames: Object.keys(this.configService.config.systemsOfRecord ?? {}),\n isLoaded: (ref) => this.backendProviderRegistry.getProvider(ref) !== undefined,\n viewOf: (ref) => {\n const contract = restOAuth2Of(ref);\n return {\n ...(contract?.oauth2 === undefined ? {} : { oauth2: contract.oauth2 }),\n ...(contract?.apiKey?.secretRef === undefined ? {} : { spentCredentialSlotKey: this.canonicalCredentialSlug(ref, contract.apiKey.secretRef) }),\n };\n },\n baseAdmitsCredentialSlot: (baseRef, slotKey) => this.resolveStorableCredentialSlot(baseRef, slotKey).admitted,\n baseHasSignInClient: (baseRef) =>\n this.getProviderRuntimeContract(baseRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2)?.kind === ProviderProtocolRuntimeKind.OAUTH2_SSO,\n });\n if (defects.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `providers.sharedConnections cannot run on this host:\\n- ${defects.join('\\n- ')}`,\n defects,\n },\n });\n }\n\n /\n Where a READ through `providerRef` finds its stored credential: the connection and the contract KEY\n * of the slot the caller named by either of its two names (#1670, #624).\n \n The read-side counterpart of the write doors' derivation — see {@link resolveCredentialConnectionRef}\n * for the connection and {@link canonicalCredentialSlug} for the slot. Every caller that addresses a\n * credential store asks this, never assembles the address itself.\n /\n public resolveCredentialAddress(providerRef: string, secretRef: string): ProviderCredentialAddress {\n return {\n connectionRef: this.resolveCredentialConnectionRef(providerRef),\n secretSlug: this.canonicalCredentialSlug(providerRef, secretRef),\n };\n }\n\n /\n Where a slug a credential row was STORED under stands against the provider's CURRENT contract.\n \n ## The definition, and why it is this one\n \n A stored slug is {@link StoredCredentialSlotStanding.CURRENT} exactly when canonicalising it is a\n * FIXED POINT — when {@link canonicalCredentialSlug}'s own rule answers the slug back unchanged.\n * Defined through {@link findSecretsContractSlug} rather than by re-reading the contract, so \"which\n * slot is current\" and \"which name a lookup asks for\" are one rule and cannot disagree.\n \n That makes an env-var SPELLING that the provider still declares RETIRED as a stored key, which\n * is correct rather than harsh: every lookup now asks for the contract key, so a row keyed on\n * `ASANA_ACCESS_TOKEN` is as unreachable as one keyed on the renamed `ASANA_API_KEY` (#624).\n \n Tolerant of an unbound provider registry for the reason {@link findSecretsContractSlug} states;\n * an absent provider is reported as such, never as a retired slot, because its remedy differs.\n /\n public classifyStoredCredentialSlot(providerRef: string, storedSecretSlug: string): StoredCredentialSlotStanding {\n if (this.backendProviderRegistry?.getProvider?.(providerRef) === undefined) {\n return StoredCredentialSlotStanding.PROVIDER_UNREGISTERED;\n }\n return this.findSecretsContractSlug(providerRef, storedSecretSlug) === storedSecretSlug\n ? StoredCredentialSlotStanding.CURRENT\n : StoredCredentialSlotStanding.RETIRED;\n }\n\n /\n The slot a credential VALUE may be written under, or why it may not (#624).\n \n The write-side twin of {@link canonicalCredentialSlug}, and the one rule every write door asks\n * — the connect leg, and the resource's own CREATE and UPDATE hooks — so \"may a value be stored\n * here\" cannot be answered differently by different doors.\n \n ## Admitted only for a DECLARED CREDENTIAL slot, and always as its KEY\n \n - A name that maps to no slot of the provider's current contract (under either of a slot's two\n * names) is refused {@link ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_DECLARED}. The\n * read-side canonicaliser passes such a name through, which is right for a READ — the caller's\n * own refusal speaks — and wrong for a WRITE: stored under a name nobody asks for, the value\n * reports success and resolves as absent forever. That is how a retired slot keeps producing\n * orphans after the keying was fixed forward.\n * - A slot holding the application's own OAuth2 registration is refused\n * {@link ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_A_CREDENTIAL}, as the connect leg\n * always did: the exchange reads that from the deployment environment, never from a row.\n * - An admitted name comes back as the contract KEY whichever name the caller used.\n \n Every generated provider's default slot passes: measured 2026-09-12 over 695 provider modules\n * with a literal `apiKey.secretRef`, all 695 name a declared slot.\n /\n public resolveStorableCredentialSlot(providerRef: string, secretName: string): StorableCredentialSlot {\n const secretSlug = this.findSecretsContractSlug(providerRef, secretName);\n if (secretSlug === undefined) {\n return { admitted: false, refusal: ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_DECLARED };\n }\n if (this.getProviderSecretScope(providerRef, secretSlug) !== ExternalProvider_SecretScope.CREDENTIAL) {\n return { admitted: false, refusal: ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_A_CREDENTIAL };\n }\n return { admitted: true, secretSlug };\n }\n\n public getProviderRuntimeContract(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): ProviderProtocolRuntimeContract \| undefined {\n return this.getProviderConfiguration(providerRef, protocolKind)?.runtimeContract;\n }\n\n public getLLMSemanticOperationKeys(providerRef: string): LLMProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.LLM) {\n return [];\n }\n\n return this.toSemanticOperationKeys(runtimeContract.operations);\n }\n\n /\n The semantic embeddings operations a provider's `EMBEDDINGS_PROVIDER` contract declares.\n * Consumer: `EmbeddingsBackendService`, which refuses to invoke a provider whose contract\n * does not declare {@link EmbeddingsProvider_OperationKey.EMBED_TEXTS} (fail-closed, named —\n * never an undefined-method throw inside an SDK call).\n /\n public getEmbeddingsSemanticOperationKeys(providerRef: string): EmbeddingsProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.EMBEDDINGS) {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is EmbeddingsProvider_OperationKey => operation !== undefined);\n }\n\n\n /\n The semantic extraction operations a provider's `DOCUMENT_EXTRACTION_PROVIDER` contract\n * declares. Consumer: `DocumentExtractionBackendService`, which refuses to invoke a provider\n * whose contract does not declare\n * {@link DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT} — fail-closed and\n * named, rather than a 404 from a route the provider never claimed to serve.\n /\n public getDocumentExtractionSemanticOperationKeys(providerRef: string): DocumentExtractionProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION) {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is DocumentExtractionProvider_OperationKey => operation !== undefined);\n }\n\n\n /\n The semantic operations a provider's `CONTENT_SAFETY_PROVIDER` contract declares (#2292). Consumer:\n * `ContentSafetyBackendService`, which refuses a selected provider that does not declare the operation it is asked\n * for, rather than sending it a request it never claimed to serve.\n /\n public getContentSafetySemanticOperationKeys(providerRef: string): ContentSafetyProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.CONTENT_SAFETY_PROVIDER);\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.CONTENT_SAFETY) return [];\n return runtimeContract.operations\n .map((operation) => RUNTIME_CONTENT_SAFETY_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is ContentSafetyProvider_OperationKey => operation !== undefined);\n }\n\n\n public getAgentClientProtocolConfiguration(providerRef: string): AgentClientProtocol_Configuration \| undefined {\n const config = this.getProviderConfiguration(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n return config as AgentClientProtocol_Configuration \| undefined;\n }\n\n public getAgentClientProtocolProfile(providerRef: string): RuntimeAgentClientProtocolProfile \| undefined {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL) {\n return undefined;\n }\n\n const supportedModels = [\n ...(runtimeContract.models ?? []),\n ...(runtimeContract.defaultModel ? [runtimeContract.defaultModel] : []),\n ];\n return {\n agentCommand: runtimeContract.agentCommand,\n agentArgs: [...(runtimeContract.agentArgs ?? [])],\n supportedOperationKeys: runtimeContract.operations\n .map((operation) => RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is CodingAgent_OperationKey => operation !== undefined),\n supportedModels: [...new Set(supportedModels)],\n supportedProtocolVersions: [...(runtimeContract.supportedProtocolVersions ?? [1])],\n ...(runtimeContract.sessionMetaExtensions ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions } : {}),\n ...(runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance\n ? { sessionMetaExtensionsByHostConfigurationInheritance: runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance }\n : {}),\n ...(runtimeContract.modelDelivery ? { modelDelivery: runtimeContract.modelDelivery } : {}),\n ...(runtimeContract.modelTransportIds\n ? { modelTransportIds: { ...runtimeContract.modelTransportIds } }\n : {}),\n ...(runtimeContract.inheritedEnvironmentVariables\n ? { inheritedEnvironmentVariables: [...runtimeContract.inheritedEnvironmentVariables] }\n : {}),\n ...(runtimeContract.hostLogin ? { hostLogin: runtimeContract.hostLogin } : {}),\n // Normalised to the AUTHORED vocabulary: the contract spells these\n // with hyphens and the profile enum with underscores, and comparing\n // the two spellings directly is a guard that never fires.\n supportedAuthModes: runtimeContract.authModes.map((mode) => mode.replace(/-/g, '_')),\n ...(runtimeContract.sessionModeIdsByPermissionCeiling\n ? {\n sessionModeIdsByPermissionCeiling: Object.fromEntries(\n Object.entries(runtimeContract.sessionModeIdsByPermissionCeiling).map(\n ([ceiling, modeIds]) => [ceiling, [...(modeIds ?? [])]],\n ),\n ),\n }\n : {}),\n };\n }\n\n /\n Resolve one named ACP execution profile, PARSED rather than trusted.\n \n Application-authored `providerConfigurations` are typed `unknown` all the\n * way to here, so an authored profile would otherwise reach the runner\n * unvalidated — and for this transport the unvalidated fields include the\n * environment gate and the permission ceiling. Parsing here makes the\n * profile fail closed BEFORE any agent is spawned, and applies the schema\n * defaults the authoring contract promises.\n /\n public getAgentClientProtocolExecutionProfile(\n providerRef: string,\n executionProfileRef: string,\n ): AgentClientProtocol_ExecutionProfile \| undefined {\n this.ensureInitialized();\n\n const configuration = this.getAgentClientProtocolConfiguration(providerRef);\n const executionProfile = configuration?.executionProfiles?.[executionProfileRef];\n\n if (!executionProfile) {\n this.logDebug(`ACP execution profile ${executionProfileRef} not found for ${providerRef}`);\n return undefined;\n }\n\n try {\n return AgentClientProtocol_ExecutionProfileSchema.parse(executionProfile);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n providerRef,\n executionProfileRef,\n message: '[external-providers-registry] ACP execution profile is not a valid authored profile',\n validationError: describeCaughtError(error),\n },\n },\n );\n }\n }\n\n public getAgentClientProtocolExecutionProfileSecret(\n providerRef: string,\n executionProfileRef: string,\n ): string \| undefined {\n this.ensureInitialized();\n\n const executionProfile = this.getAgentClientProtocolExecutionProfile(providerRef, executionProfileRef);\n if (\n !executionProfile\n \|\| executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n return undefined;\n }\n\n const runtimeSecret = executionProfile.secretEnvVarName\n ? process.env[executionProfile.secretEnvVarName]\n : undefined;\n if (runtimeSecret && runtimeSecret.length > 0) {\n this.logDebug('Resolved ACP secret from process env', { providerRef, executionProfileRef });\n return runtimeSecret;\n }\n\n return undefined;\n }\n\n private toSemanticOperationKeys(operations: readonly string[]): LLMProvider_OperationKey[] {\n return operations\n .map((operation) => RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION[operation] ?? operation)\n .filter((operation): operation is LLMProvider_OperationKey => (\n Object.values(LLMProvider_OperationKey).includes(operation as LLMProvider_OperationKey)\n ));\n }\n\n private getDefaultProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n try {\n const runtimeContract = this.backendProviderRegistry.getRuntimeContract(providerRef, protocolKind);\n\n if (!runtimeContract) {\n this.logDebug(`Runtime contract not found: ${providerRef}:${protocolKind}`);\n return undefined;\n }\n\n\n if (runtimeContract.kind === ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL) {\n const defaultExecutionProfileRef = 'default';\n const hasExplicitSecretBinding = Boolean(\n runtimeContract.secretRef\n && runtimeContract.secretEnvVarName\n && runtimeContract.authModes.includes('secret-ref-env-injection'),\n );\n return {\n enabled: true,\n defaultExecutionProfileRef,\n executionProfiles: {\n [defaultExecutionProfileRef]: {\n runnerHost: AgentClientProtocol_RunnerHost.BACKEND_SUBPROCESS,\n command: runtimeContract.agentCommand,\n args: [...(runtimeContract.agentArgs ?? [])],\n inheritedEnvironmentVariables: [...(runtimeContract.inheritedEnvironmentVariables ?? [])],\n authMode: hasExplicitSecretBinding\n ? AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n : runtimeContract.authModes.includes('host-managed')\n ? AgentClientProtocol_AuthMode.HOST_MANAGED\n : AgentClientProtocol_AuthMode.NONE,\n ...(hasExplicitSecretBinding\n ? { secretRef: runtimeContract.secretRef, secretEnvVarName: runtimeContract.secretEnvVarName }\n : {}),\n // DEVELOPMENT only, and deliberately NARROWER than any other\n // synthesized default. Nobody authored this profile and\n // nobody reviewed it, and what it authorises is an agent\n // that edits a workspace. An application that wants a coding\n // agent anywhere else must say so in its own profile, where\n // the decision is visible.\n allowedApplicationEnvironments: [APPLICATION_ENVIRONMENT.DEVELOPMENT],\n workingDirectoryPolicy: AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_ROOT,\n // Both safety postures stated rather than left to a schema\n // default, so reading this profile tells you what it permits\n // without resolving anything.\n permissionCeiling: AgentClientProtocol_PermissionCeiling.PROMPT_ALWAYS,\n hostConfigurationInheritance: AgentClientProtocol_HostConfigurationInheritance.APPLICATION_SCOPED,\n ...(runtimeContract.sessionMetaExtensions\n ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions }\n : {}),\n },\n },\n runtimeContract,\n };\n }\n\n // One derivation for this default and for the companion contribution's `protocolSecretRefs`, so the\n // key tooling predicts (#2229) is the key this refusal reads.\n const secretRef = describeProviderProtocolSecretRef(runtimeContract);\n return {\n enabled: true,\n ...(secretRef\n ? {\n authConfig: {\n authKind: this.authKindForRuntimeContract(runtimeContract),\n secretRef,\n },\n }\n : {}),\n ...(runtimeContract.kind === ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR\n ? { endpoints: this.buildWebhookEndpoints(runtimeContract) }\n : {}),\n runtimeContract,\n };\n } catch (error) {\n // Same pattern as `getProviderConfiguration` — contract\n // violations (`authKindForRuntimeContract` misuse) throw a\n // `WildoError_Backend` instance that MUST surface.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting default provider configuration', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n /\n Map a runtime contract's `kind` to the canonical\n * `ExternalProvider_Auth_Kind` for the `authConfig` projection.\n * Used by `getDefaultProviderConfiguration` so the emitted\n * `authConfig: { authKind, secretRef }` satisfies the schema's\n * required-`authKind` invariant (was previously `{ secretRef }`\n * with no `authKind`, masked by `as unknown as` casts).\n \n Mapping rationale:\n \n - `llm` / `email` / `sms` / `billing` — providers authenticate\n * with an opaque API key supplied via env var.\n * - `webhook-originator` — provider signs payloads with HMAC; the\n * `secretRef` is the HMAC signing key.\n * - `oauth2-sso` — kind `OAUTH2`; the `secretRef` is the OAuth2\n * client secret.\n * - `agent-client-protocol` — auth is encoded on the executionProfile,\n * not `authConfig`; this method is not called for that kind\n * because that arm returns from the dedicated branch in\n * `getDefaultProviderConfiguration` BEFORE reaching this\n * mapping. A misuse throws via `errorBuilder` so the\n * `WildoError_Backend` instance bypasses the\n * `getProviderConfiguration` fallback catch.\n /\n private authKindForRuntimeContract(\n runtimeContract: ProviderProtocolRuntimeContract,\n ): ExternalProvider_Auth_Kind {\n switch (runtimeContract.kind) {\n case ProviderProtocolRuntimeKind.LLM:\n case ProviderProtocolRuntimeKind.IMAGE:\n case ProviderProtocolRuntimeKind.EMBEDDINGS:\n // Document extraction authenticates with an opaque API key in a request header, like\n // its siblings above; the header SHAPE (name/prefix) stays on the contract because\n // this family builds its own HTTPS request rather than handing a key to an SDK.\n case ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION:\n // A content-safety classifier authenticates the same way, with a key header named on its contract.\n case ProviderProtocolRuntimeKind.CONTENT_SAFETY:\n // An electronic-signature vendor too (#2293): the engine sends every request of the conversation with it.\n case ProviderProtocolRuntimeKind.ELECTRONIC_SIGNATURE:\n case ProviderProtocolRuntimeKind.EMAIL:\n case ProviderProtocolRuntimeKind.SMS:\n // A receiving provider authenticates the engine's fetches with an opaque API key in a header.\n case ProviderProtocolRuntimeKind.EMAIL_INBOUND:\n case ProviderProtocolRuntimeKind.BILLING:\n // `rest` authenticates with an opaque API key supplied via env var, like its siblings\n // above; the header SHAPE (name/prefix) stays on the contract for its consumer.\n case ProviderProtocolRuntimeKind.REST:\n return ExternalProvider_Auth_Kind.API_KEY;\n case ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR:\n return ExternalProvider_Auth_Kind.HMAC_SIGNATURE;\n case ProviderProtocolRuntimeKind.OAUTH2_SSO:\n return ExternalProvider_Auth_Kind.OAUTH2;\n case ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL:\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message: '[external-providers-registry] authKindForRuntimeContract called with kind=agent-client-protocol; '\n + 'ACP auth lives on executionProfiles[].authMode, not on authConfig.',\n },\n },\n );\n default: {\n const exhaustiveCheck: never = runtimeContract;\n return exhaustiveCheck;\n }\n }\n }\n\n /\n Project the provider-authored `runtimeContract.endpoints` into\n * the canonical `Hook_Endpoint` shape consumed by the framework\n * webhook controller. Provider-agnostic: each endpoint descriptor\n * is owned by the provider module (see Stripe's `endpoints` array\n * on `stripe.backend.module.ts`); the only field this projection\n * adds is `signatureConfig.headerName`, sourced from the contract's\n * top-level `signatureHeaderName` so providers don't repeat it on\n * every endpoint.\n \n Previously branched on a Stripe-only provider literal\n * with the entire endpoint shape (event types, polymorphic\n * variants, `lookupField`) hardcoded inside this consumer site —\n * the same anti-pattern Step 7 was supposed to eliminate. Moved\n * to the provider module 2026-05-06 to close the gap; the CI\n * guard regex (`no-provider-ref-branches.guard.test.ts`) now\n * also catches the `runtimeContract.provider` literal pattern.\n \n Per-endpoint secret overrides (if a future provider needs them)\n * still flow through `HookInitiatorProvider_Configuration.endpointSecrets`,\n * not through this projection.\n /\n private buildWebhookEndpoints(\n runtimeContract: Extract<ProviderProtocolRuntimeContract, { kind: typeof ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR }>,\n ): ReadonlyArray<Hook_Endpoint> {\n return runtimeContract.endpoints.map(({ signatureConfig, ...endpoint }) => ({\n ...endpoint,\n // A re-read trigger endpoint (#2909) declares no signature, and must not be given one here.\n ...(signatureConfig === undefined ? {} : {\n signatureConfig: { ...signatureConfig, headerName: runtimeContract.signatureHeaderName },\n }),\n eventTypes: [...endpoint.eventTypes],\n }));\n }\n\n /\n Get provider secrets for a specific protocol and secret reference.\n * Provider secrets are runtime-delivered via env/K8s materialization.\n * The secret binding contract is still declared by the provider protocol\n * configuration, but the secret value source is `process.env`.\n \n It reads ONLY a variable the provider module declares (#3002). The name\n * asked for resolves to a declared variable, or nothing is read: a\n * declared variable reads itself; the configuration's own\n * `authConfig.secretRef` may name its slot by slug and reads that slot's\n * variable; an ACP execution profile's `secretRef` reads that profile's\n * (declared) `secretEnvVarName`. Any other slug reads nothing, since a slug\n * is a credential-store key rather than an environment spelling. Until #3002 an unresolved name fell back to\n * `process.env[<name>]`, so whoever named the variable chose which process\n * secret was read. Measured 2026-10-20, every secret ref the engine's and\n * the registry's provider modules carry is a declared variable, so the\n * fallback read nothing a module needed.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — the registry reads no process variable its provider module does not declare, whoever names it.\n /\n /\n Why calling `model` through `providerRef` would process outside the region the application declared for it, or\n * `null` (#2294): a model id that names its own routing (Bedrock's `global.` profiles) against the provider's\n * `modelIdRouting` and the region this host's artifact binds it to. Asked by the agent registration at startup; the\n * provider's client asks the same predicate again when it builds the model.\n /\n public describeModelOutsideDeclaredProcessingRegion(providerRef: string, model: string): string \| null {\n return modelIdProcessingRegionRefusal({\n providerRef,\n profile: this.backendProviderRegistry.getProvider(providerRef)?.complianceProfile,\n processingRegion: this.backendProviderRegistry.getDeclaredProcessingRegion(providerRef),\n model,\n });\n }\n\n public getProviderSecret(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const envVarName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef);\n if (envVarName === undefined) {\n this.logDebug(`Secret '${secretRef}' is not a secret ${providerRef} declares; nothing was read`, { providerRef, protocolKind });\n return undefined;\n }\n\n const secretValue = process.env[envVarName];\n return secretValue && secretValue.length > 0 ? secretValue : undefined;\n } catch (error) {\n // Same as `getProviderApiKey`: a configuration refusal (#3002, an authored `secretRef` naming no declared\n // slot) surfaces, rather than reading as \"this secret has no value\".\n if (isWildoBackendError(error)) throw error;\n return undefined;\n }\n }\n\n private getProviderSecretEnvVarName(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n ): string \| undefined {\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n && executionProfile.secretRef === secretRef\n ) {\n return executionProfile.secretEnvVarName;\n }\n }\n }\n\n // The configuration's own `authConfig.secretRef` (held to the declared slots by `getProviderConfiguration`, #3002)\n // may name its slot by slug, and then reads that slot's variable. Any other name reads only as a declared\n // variable: a slug is a credential-store key, never an environment spelling (`canonicalCredentialSlug`), so a\n // plain read by slug resolves nothing.\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n if (protocolConfig?.authConfig?.secretRef === secretRef) {\n return this.resolveDeclaredSecretEnvVarName(providerRef, secretRef);\n }\n return this.declaredSecretSlots(providerRef).envVarNames.has(secretRef) ? secretRef : undefined;\n }\n\n /\n The sentence for a provider API key that has no value — naming the environment variable and how\n * to provide it (#1637). Secrets are asked when a feature needs one rather than all up front, so\n * this refusal IS the moment a person learns which key a feature waits on; a message that said\n * \"configure the provider secrets\" left them to find out which, and where.\n /\n public describeMissingProviderApiKey(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): string {\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n const envVarName = secretRef ? (this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef) : undefined;\n return envVarName\n ? `No value for ${envVarName} (${providerRef}, ${protocolKind}). ${describeProviderSecretRemedy(envVarName)}`\n : `${providerRef} declares no API key for ${protocolKind}, so this call cannot authenticate.`;\n }\n\n public getConfiguredProviderSecretRef(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n return config?.authConfig?.secretRef;\n }\n\n\n\n public getProviderApiKey(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n if (!secretRef) {\n this.logDebug(`No authConfig.secretRef found for ${providerRef}.${protocolKind}`);\n return undefined;\n }\n\n const apiKey = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (!apiKey) {\n this.logDebug(`Secret ${secretRef} not found for ${providerRef}.${protocolKind}`);\n }\n return apiKey;\n } catch (error) {\n // A configuration refusal (#2995, #3002) is a framework error and surfaces: reading it as \"no key\" would send\n // an operator to set a variable when the configuration itself is what is refused.\n if (isWildoBackendError(error)) throw error;\n this.logDebug('Error getting provider API key', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n /\n WHICH connections this provider admits — the recorded decision, or the FLOOR.\n \n The floor is an APPLICATION-owned, undelegated connection and nothing else, and it is what a\n * provider that has recorded no decision gets. It is not a permissive default: it is the one\n * answer always available (an operator can author an environment variable) and the one that\n * cannot produce a cross-tenant mistake (it has exactly one instance).\n \n Never derived here from a provider's auth shape. Whether a vendor can be connected per tenant\n * is a fact about that vendor's product and about what somebody verified — see the catalogue\n * record for a generated provider, or the module itself for a hand-authored one.\n /\n public getProviderAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[] {\n // The one reading of the default, shared with the module checks that admit the provider (#3398).\n const catalogue = providerModuleAdmissibleConnections(this.backendProviderRegistry.getProvider(providerRef));\n\n return this.narrowToApplicationConnectionPolicy(providerRef, catalogue);\n }\n\n /\n What the VENDOR admits, before this application's policy narrows it.\n \n Exists so a refusal can name the right cause. Once a policy can subtract, \"this provider does\n * not admit that connection\" has two meanings — nobody recorded the vendor's capability, or this\n * application switched it off — and they are repaired in different files by different people.\n * A diagnostic that always blamed the catalogue would send an operator to edit a decision record\n * that is already correct.\n /\n public getProviderCatalogueAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[] {\n return providerModuleAdmissibleConnections(this.backendProviderRegistry.getProvider(providerRef));\n }\n\n /\n Intersect what the VENDOR admits with what THIS application permits.\n \n Two layers answering different questions, and the intersection is what makes them composable:\n * the catalogue record says an organization-owned Slack connection is possible because Slack is\n * installed per workspace, while `providers.connections.slack` says whether this product offers\n * one. A vendor opening a capability and a product deciding to use it are different events, and\n * a single list would make them look identical.\n \n NARROWING ONLY, and that direction is the guarantee rather than a convention. An application\n * cannot declare a connection the vendor does not support into existence — the connect leg would\n * build an authorize URL the vendor rejects, or store a grant nothing can spend — so a policy\n * entry naming an unadmitted shape contributes nothing instead of granting it.\n \n An ABSENT policy means \"everything the catalogue admits\", never \"nothing\". Most applications\n * will never author one, and reading their silence as a refusal would switch off the whole\n * connect surface for every product that has not yet thought about it.\n \n An intersection that empties is a legitimate outcome, not a misconfiguration: it is how an\n * application switches a provider's connect surface off without removing the provider, which it\n * may still need for its own application-scope credential.\n /\n private narrowToApplicationConnectionPolicy(\n providerRef: string,\n catalogue: readonly ExternalProvider_ConnectionShape[],\n ): readonly ExternalProvider_ConnectionShape[] {\n const permitted = this.configService.config.providers?.connections?.[providerRef]?.admissible;\n if (permitted === undefined) {\n return catalogue;\n }\n return catalogue.filter((shape) => permitted.some(\n (allowed) => allowed.ownerScope === shape.ownerScope && allowed.delegation === shape.delegation,\n ));\n }\n\n /\n @wildo_source:part:start saas.backend.providers.connection-target-credential-resolution facet:layer:backend facet:audience:app-developer\n \n One provider secret for ONE connection target — strictly, with no substitution.\n \n Reached as `ExternalProvidersRegistryBackendService` from `@wildo-ai/saas-backend-lib`, through\n * the container token `SAAS_SERVICE_TYPES.ExternalProvidersRegistryService`.\n \n ## What a TARGET is, and why the call names one\n \n A target is `ownerScope` × `delegation`: WHOSE credential is spent, and whether the call acts\n * for a person. The four combinations are different principals, not four ways of saying the same\n * thing — an ORGANIZATION target spends the tenant's own connected account, an APPLICATION target\n * spends the deployment's shared one, a USER target spends one person's.\n \n Naming the target is what makes the identity on the wire a decision the calling code states\n * rather than one the engine infers.\n \n ## There is NO fallback, deliberately, and that is the whole design\n \n A miss in any branch REFUSES, naming what it will not substitute. It never quietly reaches for\n * a different principal's credential.\n \n This replaced a resolver that did fall back — an organization with no credential of its own\n * silently spent the deployment's — and the difference is not a tightening of one idea, it is the\n * opposite policy. A fallback means the vendor sees the application's identity while the\n * application believes it acted as the tenant, so every artifact the call leaves behind — a\n * message, a record, a line in the vendor's own audit log — is attributed to the wrong party, and\n * nothing downstream can detect it.\n \n *An application that wants \"the tenant's key when they have connected one, otherwise ours\"\n still has it*, and composes it itself: try an ORGANIZATION target, and on the refusal call\n again with an APPLICATION one. That is three lines in the application's own code, where the\n * substitution is visible to whoever reads it. What no longer exists is the engine performing\n * that swap underneath a call that asked for a tenant.\n \n ## A refusal is never `undefined`\n \n Every miss throws. Returning nothing was the original defect: several callers passed the empty\n * value onward, the vendor received a blank credential and answered 401, and that is\n * indistinguishable from a revoked key — which is how \"nobody ever configured this\" stayed\n * invisible. Each refusal below therefore names the PLACE an operator must go.\n \n Two misses are deliberately not fall-throughs, and both are cases where the tenant or the\n * person DID connect:\n \n - a credential stored under a RETIRED slot name (a provider regeneration renamed it). Nothing\n * can read or rename that row — its seal binds the slot name — so the owner reconnects the\n * account. The deployment's credential is NOT used instead, because the fallback that would\n * have applied is for an owner that has none (#624);\n * - a credential that cannot be OPENED. The envelope failure is not caught: a principal that HAS\n * an unreadable credential and one that has none are indistinguishable to a caller, and only\n * one of them is safe to continue from.\n /\n public async resolveProviderSecretForTarget(\n target: ExternalProvider_ConnectionTarget,\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n /\n A resource AUDIENCE other than the grant's primary (#1725): the token is minted from the stored grant's\n * refresh token for these scopes (or read from the audience cache), never the stored primary token. Absent:\n * the stored credential, as always. For an APPLICATION target, served only from the application's own stored grant\n * (#3398), and refused when it has none: the environment's value has no refresh token to mint from.\n /\n options?: {\n readonly audience?: ProviderOAuth2RefreshAudience;\n /\n The vendor answered 401 to the token this target's grant last served: the store renews it once (2026-11-10).\n * See `ProviderRefusedTokenRenewal`. For an APPLICATION target, honoured by its stored grant (#3398); an\n * environment value is never a grant and is served as it is.\n /\n readonly renewAfterRefusal?: ProviderRefusedTokenRenewal;\n },\n ): Promise<{\n value: string;\n source: ProviderCredentialResolutionSource;\n credentialId?: string;\n credentialSetByUserId?: string;\n /* The connection row's account facts, for a tenant-owned credential (#333, #1047). Absent for the deployment's own. /\n connectionFacts?: ProviderConnectionFacts;\n /* What the vendor granted, when it stated it (#979). Absent means not recorded, never nothing granted. /\n grantedScopes?: readonly string[];\n /\n What `value` is: the pasted value itself, or a token minted from a stored grant ({@link ProviderSpentCredentialForm}),\n * as the store that opened the row stated it. Decides whether the vendor's `401` is recorded against the row.\n /\n form?: ProviderSpentCredentialForm;\n }> {\n this.ensureInitialized();\n\n // Only the APPLICATION's identity impersonating a person is unbuilt. It needs a vendor-side\n // impersonation grant (domain-wide delegation) that no store holds, so it refuses by name.\n //\n // An ORGANIZATION × USER target resolves below like any tenant credential: it IS one — a member\n // linked their own account for the organization, and every member spends it (decision on #18).\n // This used to refuse every USER delegation with \"no outbound per-principal token store exists\n // yet\", after both stores existed, while the connect leg admitted and stored the very shape\n // this refused: a grant could be connected that nothing could ever spend.\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n && target.delegation === ExternalProvider_Connection_DelegationMode.USER) {\n throw this.buildConnectionRefusal(\n providerRef,\n `the application cannot act as user '${target.actingForUserId}': impersonating a person with the application's own `\n + 'identity needs a vendor impersonation grant, which nothing stores. Declare a USER-owned connection, so the person '\n + 'connects their own account.',\n );\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n // An envelope failure is NOT caught here, deliberately, for the organization branch's\n // reason: a person who HAS a credential which cannot be opened must refuse loudly rather\n // than be treated as a person who has none. The two are indistinguishable to a caller\n // and only one of them is a safe thing to continue from.\n const userResolver = this.resolveUserCredentialResolver();\n if (!userResolver) {\n throw this.buildConnectionRefusal(\n providerRef,\n 'no user credential store is bound, so a person-owned connection cannot be read at all. '\n + 'This is a wiring fault rather than a missing credential.',\n );\n }\n // The row's ADDRESS: the connection the ref belongs to (#1670) and the contract KEY of the slot,\n // never the env-var spelling a rename can move (#624). One answer for every read path.\n const { connectionRef: userConnectionRef, secretSlug: userSecretSlug } = this.resolveCredentialAddress(providerRef, secretRef);\n // A name the provider no longer declares is never sent to the store: its row would still open,\n // because the seal binds the name it was stored under, and spend a credential this subsystem\n // reports as unusable (#624). The miss path below then names that row as retired.\n const userSlotRetired = this.classifyStoredCredentialSlot(providerRef, userSecretSlug) === StoredCredentialSlotStanding.RETIRED;\n const ownedByUser = userSlotRetired ? undefined : await userResolver.resolveUserCredential({\n userId: target.ownerId!,\n providerRef,\n connectionRef: userConnectionRef,\n secretSlug: userSecretSlug,\n ...(options?.audience === undefined ? {} : { audience: options.audience }),\n ...(options?.renewAfterRefusal === undefined ? {} : { renewAfterRefusal: options.renewAfterRefusal }),\n });\n if (!ownedByUser) {\n const retiredSlots = await this.findRetiredSlotsBehindMiss(providerRef, userSlotRetired ? undefined : userSecretSlug, ExternalProvider_Connection_OwnerScope.USER, () =>\n userResolver.listStoredSecretSlugs({ userId: target.ownerId!, providerRef, connectionRef: userConnectionRef }));\n const storedBeforeJoining = await this.describeRowStoredBeforeJoining(providerRef, userConnectionRef, () =>\n userResolver.listStoredSecretSlugs({ userId: target.ownerId!, providerRef, connectionRef: providerRef }));\n throw this.buildConnectionRefusal(\n providerRef,\n storedBeforeJoining\n + (retiredSlots.length === 0\n ? `user '${target.ownerId}' has not connected '${secretRef}'. `\n : `user '${target.ownerId}' has no credential for '${secretRef}' under the provider's current secrets contract. `\n + `${describeCredentialsStoredUnderRetiredSlots(retiredSlots)} `)\n + \"It is not substituted with the deployment's or their organization's: the call asked to act as this person, and \"\n + 'acting as anyone else would put the wrong name on the record the provider keeps.',\n );\n }\n return {\n value: ownedByUser.value,\n source: ProviderCredentialResolutionSource.USER_CREDENTIAL,\n credentialId: ownedByUser.credentialId,\n ...(ownedByUser.connectionFacts === undefined ? {} : { connectionFacts: ownedByUser.connectionFacts }),\n ...(ownedByUser.grantedScopes === undefined ? {} : { grantedScopes: ownedByUser.grantedScopes }),\n ...(ownedByUser.form === undefined ? {} : { form: ownedByUser.form }),\n };\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION) {\n return this.resolveApplicationOwnedSecret(providerRef, protocolKind, secretRef, options);\n }\n\n // ORGANIZATION. An envelope failure is NOT caught, deliberately: a tenant that HAS a\n // credential which cannot be opened must refuse loudly rather than be treated as a tenant\n // that has none — the two are indistinguishable to a caller and only one is safe.\n const resolver = this.resolveOrganizationCredentialResolver();\n if (!resolver) {\n throw this.buildConnectionRefusal(\n providerRef,\n 'no organization credential store is bound, so a tenant-owned connection cannot be read at all. '\n + 'This is a wiring fault rather than a missing credential.',\n );\n }\n // The row's ADDRESS — connection and contract KEY — see the USER branch above (#1670, #624).\n const { connectionRef: organizationConnectionRef, secretSlug: organizationSecretSlug } = this.resolveCredentialAddress(providerRef, secretRef);\n // Never sends a RETIRED name to the store — see the USER branch above (#624).\n const organizationSlotRetired = this.classifyStoredCredentialSlot(providerRef, organizationSecretSlug) === StoredCredentialSlotStanding.RETIRED;\n const owned = organizationSlotRetired ? undefined : await resolver.resolveOrganizationCredential({\n organizationId: target.ownerId!,\n providerRef,\n connectionRef: organizationConnectionRef,\n secretSlug: organizationSecretSlug,\n ...(options?.audience === undefined ? {} : { audience: options.audience }),\n ...(options?.renewAfterRefusal === undefined ? {} : { renewAfterRefusal: options.renewAfterRefusal }),\n });\n if (!owned) {\n const retiredSlots = await this.findRetiredSlotsBehindMiss(providerRef, organizationSlotRetired ? undefined : organizationSecretSlug, ExternalProvider_Connection_OwnerScope.ORGANIZATION, () =>\n resolver.listStoredSecretSlugs({ organizationId: target.ownerId!, providerRef, connectionRef: organizationConnectionRef }));\n const storedBeforeJoining = await this.describeRowStoredBeforeJoining(providerRef, organizationConnectionRef, () =>\n resolver.listStoredSecretSlugs({ organizationId: target.ownerId!, providerRef, connectionRef: providerRef }));\n throw this.buildConnectionRefusal(\n providerRef,\n storedBeforeJoining\n + (retiredSlots.length === 0\n ? `organization '${target.ownerId}' has no credential for '${secretRef}'. `\n : `organization '${target.ownerId}' has no credential for '${secretRef}' under the provider's current secrets contract. `\n + `${describeCredentialsStoredUnderRetiredSlots(retiredSlots)} `)\n + \"It is not substituted with the deployment's: the call asked to act as this tenant, and acting as someone else \"\n + 'instead would be attributed to the wrong party.',\n );\n }\n return {\n value: owned.value,\n source: ProviderCredentialResolutionSource.ORGANIZATION_CREDENTIAL,\n credentialId: owned.credentialId,\n ...(owned.setByUserId === undefined ? {} : { credentialSetByUserId: owned.setByUserId }),\n ...(owned.connectionFacts === undefined ? {} : { connectionFacts: owned.connectionFacts }),\n ...(owned.grantedScopes === undefined ? {} : { grantedScopes: owned.grantedScopes }),\n ...(owned.form === undefined ? {} : { form: owned.form }),\n };\n }\n /* @wildo_source:part:end saas.backend.providers.connection-target-credential-resolution /\n\n /\n The APPLICATION's own credential: its stored OAuth2 grant when a super-administrator connected one (#3398), else\n * the value the deployment environment authors, as it always was.\n /\n private async resolveApplicationOwnedSecret(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n options: { readonly audience?: ProviderOAuth2RefreshAudience; readonly renewAfterRefusal?: ProviderRefusedTokenRenewal } \| undefined,\n ): Promise<{\n value: string;\n source: ProviderCredentialResolutionSource;\n credentialId?: string;\n connectionFacts?: ProviderConnectionFacts;\n grantedScopes?: readonly string[];\n form?: ProviderSpentCredentialForm;\n }> {\n const stored = await this.resolveApplicationStoredGrant(providerRef, protocolKind, secretRef, options);\n if (stored !== undefined) return stored;\n if (options?.audience !== undefined) {\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own credential cannot serve the '${options.audience.id}' audience: a token for another resource `\n + 'is minted from a connected account\\'s refresh token, and the application has connected no account for this provider.',\n );\n }\n const fromEnvironment = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (fromEnvironment) {\n // The deployment's configured value goes on the wire as it is: nothing re-mints it.\n return { value: fromEnvironment, source: ProviderCredentialResolutionSource.DEPLOYMENT_ENVIRONMENT, form: ProviderSpentCredentialForm.STATIC };\n }\n const environmentVariableName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef;\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own credential for '${secretRef}' is not set. Author '${environmentVariableName}' in the deployment environment`\n + (this.getConnectionOAuth2Client(providerRef) === undefined\n ? '.'\n : ', or connect the application\\'s own account through the provider connection flow as a super-administrator.'),\n );\n }\n\n /\n The APPLICATION's own STORED OAuth2 grant for a provider's slot (#3398), renewed when it must be, or `undefined`\n * when none is stored (or it is disabled, or no store is bound in this runtime). The one place both readers of the\n * application's own credential ask it: {@link resolveProviderSecretForTarget} and the provider HTTP access resolver.\n \n Only a provider whose connection declares an OAuth2 client can hold a grant, so only such a provider pays the\n * store's read: every other call (a model key, a pasted API key) never reaches the store.\n \n A stored grant AND an environment value for the same slot never both apply: the call is REFUSED, naming both,\n * because one of them is stale and spending either would leave a reader of the configuration believing the other\n * acts. Removing the environment value, or reconnecting the account meant, settles it.\n /\n public async resolveApplicationStoredGrant(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n options?: { readonly audience?: ProviderOAuth2RefreshAudience; readonly renewAfterRefusal?: ProviderRefusedTokenRenewal },\n ): Promise<{\n value: string;\n source: ProviderCredentialResolutionSource.APPLICATION_CREDENTIAL;\n credentialId: string;\n connectionFacts?: ProviderConnectionFacts;\n grantedScopes?: readonly string[];\n form: ProviderSpentCredentialForm;\n } \| undefined> {\n this.ensureInitialized();\n if (this.getConnectionOAuth2Client(providerRef) === undefined) return undefined;\n const applicationResolver = this.resolveApplicationCredentialResolver();\n if (applicationResolver === undefined) return undefined;\n const { connectionRef, secretSlug } = this.resolveCredentialAddress(providerRef, secretRef);\n // A name the provider no longer declares is never sent to the store (#624), as for the other owners.\n if (this.classifyStoredCredentialSlot(providerRef, secretSlug) === StoredCredentialSlotStanding.RETIRED) return undefined;\n const providerPackageName = this.getProviderPackageName(providerRef);\n const stored = await applicationResolver.resolveApplicationCredential({\n providerRef,\n connectionRef,\n secretSlug,\n ...(providerPackageName === undefined ? {} : { providerPackageName }),\n ...(options?.audience === undefined ? {} : { audience: options.audience }),\n ...(options?.renewAfterRefusal === undefined ? {} : { renewAfterRefusal: options.renewAfterRefusal }),\n });\n if (stored === undefined) return undefined;\n if (this.getProviderSecret(providerRef, protocolKind, secretRef)) {\n const environmentVariableName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef;\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own account is connected (a stored grant for connection '${connectionRef}'), and the deployment `\n + `environment also sets '${environmentVariableName}'. One of them is stale: remove '${environmentVariableName}' to `\n + 'spend the connected account, or reconnect the account you mean the application to act as.',\n );\n }\n return {\n value: stored.value,\n source: ProviderCredentialResolutionSource.APPLICATION_CREDENTIAL,\n credentialId: stored.credentialId,\n ...(stored.connectionFacts === undefined ? {} : { connectionFacts: stored.connectionFacts }),\n ...(stored.grantedScopes === undefined ? {} : { grantedScopes: stored.grantedScopes }),\n form: stored.form,\n };\n }\n\n /\n Record that the credential {@link resolveProviderSecretForTarget} just handed out was SPENT,\n * and what the provider thought of it.\n \n ## Why the recording lives HERE, beside the resolution\n \n Because the two must never disagree about which store they are talking about. This method\n * dispatches on `target.ownerScope` in exactly the same order and by exactly the same rule as\n * the resolution above, so the store that was read is the store that is stamped is a property\n * of one function rather than an agreement between two.\n \n The alternative — the caller routing for itself — was tried and is the defect this replaces.\n * The provider-operation executor held a thunk to A store, typed with an `organizationId` field,\n * and `target.ownerId` is a USER id whenever `ownerScope` is `USER` (#333's two-axis connection\n * shape). Wired as it stood, a person-owned call would have stamped a tenant row that does not\n * exist and emitted an organization audit event naming a user id as the organization. The\n * caller cannot route this correctly, because the ORDER is this class's knowledge — the same\n * argument `OrganizationProviderCredentialResolverPort`'s own docstring makes for why the order\n * does not live on the port.\n \n ## Fire-and-forget is the CALLER's decision, not this method's\n \n This returns a promise and lets a store failure reject. The outbound call has already happened\n * by the time anybody calls this, so the caller must not fail its own request on a bookkeeping\n * write — but swallowing here would also hide the rejection from the caller's loss counter, and\n * an observation nobody counts is the shape this whole change exists to remove. The executor\n * routes it through `emitAuditObservation`, which counts a rejection and never rethrows.\n \n @param provenance Exactly what {@link resolveProviderSecretForTarget} returned for this call,\n * carried through the access resolver. Passing anything else describes a row that was not the\n * one spent.\n /\n public async recordProviderSecretUseForTarget(\n target: ExternalProvider_ConnectionTarget,\n providerRef: string,\n provenance: { source: ProviderCredentialResolutionSource; credentialId?: string; secretSlug: string; credentialSetByUserId?: string },\n outcome?: { accepted: boolean; providerMessage?: string },\n ): Promise<void> {\n // The USE event names the STORED slot — the contract KEY — so it joins the credential's own SET,\n // ROTATED and DELETED events, which all carry the row's `secretSlug`. A caller's provenance may still\n // carry the env-var spelling a runtime contract names (#624); canonicalising here, at the one\n // recording chokepoint, makes that unrepresentable in the trail rather than a rule every caller keeps.\n const storedSecretSlug = this.canonicalCredentialSlug(providerRef, provenance.secretSlug);\n // The CONNECTION the spent row is keyed on, by the one function the resolution addressed it with (#1670),\n // so the use event names the grant beside the ref the call went through.\n const connectionRef = this.resolveCredentialConnectionRef(providerRef);\n // And WHOSE package the ref belongs to (#1725): on a shared connection several packages spend one grant.\n const providerPackageName = this.getProviderPackageName(providerRef);\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n && provenance.source === ProviderCredentialResolutionSource.APPLICATION_CREDENTIAL\n && provenance.credentialId !== undefined) {\n // The application's own stored grant (#3398) has a row to stamp, unlike a value the environment authors.\n await this.resolveApplicationCredentialResolver()?.recordCredentialUse({\n credentialId: provenance.credentialId,\n ...(outcome === undefined ? {} : { outcome }),\n });\n return;\n }\n if (target.ownerId === undefined) {\n // A value the deployment environment authors names no owner and has no row. Inventing one would\n // create a credential the tenant never set, which would then appear on their settings\n // screen as something they are responsible for rotating.\n return;\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n const userResolver = this.resolveUserCredentialResolver();\n // A person's credential ALWAYS has a row — there is nothing for a person to fall through\n // to — so an absent id here means the caller did not pass this method the provenance the\n // resolution produced, and stamping some other row would be worse than stamping none.\n if (!userResolver \|\| !provenance.credentialId) return;\n await userResolver.recordCredentialUse({\n userId: target.ownerId,\n providerRef,\n connectionRef,\n ...(providerPackageName === undefined ? {} : { providerPackageName }),\n secretSlug: storedSecretSlug,\n credentialId: provenance.credentialId,\n ...(outcome === undefined ? {} : { outcome }),\n });\n return;\n }\n\n if (target.ownerScope !== ExternalProvider_Connection_OwnerScope.ORGANIZATION) return;\n\n const resolver = this.resolveOrganizationCredentialResolver();\n if (!resolver) return;\n // `source` is passed through rather than filtered here: the store emits the use audit for\n // BOTH sources and stamps a row only for the tenant's own, and that split is its decision to\n // make. Filtering here would silently drop the audit row for the case a reviewer most wants\n // — a tenant acting as the shared deployment principal.\n await resolver.recordCredentialUse({\n organizationId: target.ownerId,\n providerRef,\n connectionRef,\n ...(providerPackageName === undefined ? {} : { providerPackageName }),\n secretSlug: storedSecretSlug,\n source: provenance.source,\n ...(provenance.credentialId === undefined ? {} : { credentialId: provenance.credentialId }),\n ...(provenance.credentialSetByUserId === undefined ? {} : { credentialSetByUserId: provenance.credentialSetByUserId }),\n ...(outcome === undefined ? {} : { outcome }),\n });\n }\n\n /\n After a store lookup under the current key MISSED: the retired slot names a credential is stored\n * under for the same owner and provider, so the refusal can say the row exists (#624).\n \n Chooses WORDS, never an outcome — the caller throws its refusal whatever this answers, and a\n * failure here (a store that cannot list, a partial binding) answers `[]` so that refusal is thrown\n * exactly as it was. Use it ONLY where the refusal is already decided; where the answer permits a\n * fall-through to another principal, use `requireCredentialsStoredUnderRetiredSlots`, which throws.\n * See `retired-credential-slot.backend.utils.ts`.\n /\n private findRetiredSlotsBehindMiss(\n providerRef: string,\n /* `undefined` when no lookup was made because the requested name was itself retired. /\n lookedUpSecretSlug: string \| undefined,\n ownerScope: ExternalProvider_Connection_OwnerScope,\n listStoredSecretSlugs: () => Promise<readonly string[]>,\n ): Promise<readonly string[]> {\n return findCredentialsStoredUnderRetiredSlots({\n registry: this,\n providerRef,\n lookedUpSecretSlug,\n listStoredSecretSlugs,\n onDetectionFailure: (error) => this.logDebug('Retired credential slot detection could not run; refusing with the plain message', {\n providerRef,\n ownerScope,\n error: describeCaughtError(error),\n }),\n });\n }\n\n /\n After a miss under a SHARED connection: whether the owner holds a row the ref stored under its OWN identity\n * before it joined that connection (#1725), as the sentence that opens the refusal — empty otherwise.\n \n Such a row is sealed to `(owner, providerRef, slot)`, the connection it was written for, and is never spent\n * through the shared one: re-sealing was decided against (2026-09-12), and a grant quietly read across two\n * identities is exactly what the connection key exists to prevent. So the person reconnects once, and the\n * refusal tells them why rather than claiming they never connected. Words only — a listing that fails answers\n * empty, and the refusal is thrown either way.\n /\n private async describeRowStoredBeforeJoining(\n providerRef: string,\n connectionRef: string,\n listStoredUnderOwnRef: () => Promise<readonly string[]>,\n ): Promise<string> {\n if (connectionRef === providerRef) return '';\n try {\n const stored = await listStoredUnderOwnRef();\n return stored.length === 0 ? '' : `a credential is stored under '${providerRef}' from before it joined the shared connection `\n + `'${connectionRef}'; it is not spent through the connection. Reconnect through any ref of '${connectionRef}'. `;\n } catch {\n return '';\n }\n }\n\n /\n One shape for every connection refusal, so an operator reads the same sentence everywhere — and one\n * CLASS, so a consumer can tell a refusal (a gap somebody fixes by connecting) from a fault (an unopenable\n * envelope, a failing store), which stays a plain error and stays loud.\n /\n private buildConnectionRefusal(providerRef: string, detail: string): ExternalProviderConnectionRefusedError {\n return new ExternalProviderConnectionRefusedError(`Provider '${providerRef}': ${detail}`);\n }\n\n // ══════════════════════════════════════════════════════════════════════════════════════════\n // PER-ORGANIZATION SECRET RESOLUTION (#357)\n //\n // ## Why these are separate methods and not a change to `getProviderSecret`\n //\n // `getProviderSecret` is synchronous, and six consumers across four other workstreams' files\n // call it that way. A per-organization credential lives in the database, so resolving one is\n // necessarily asynchronous — making the existing method async would reshape every one of those\n // call sites at once, in files this slice may not touch. So the environment path stays exactly\n // as it was, and the tenant-aware path is added beside it.\n //\n // This is a seam, not a duplication: the async path CALLS `getProviderSecret` for its second\n // step, so there remains exactly one implementation of \"what does the environment say\".\n //\n // ## The ORDER, and why the third step is a throw\n //\n // 1. the organization's OWN credential\n // 2. the deployment's env-projected `SecretsContract`\n // 3. refuse, BY NAME\n //\n // Step 3 is the one that matters. Before this existed, an unresolvable secret returned\n // `undefined`, and every caller then decided for itself what that meant — several of them by\n // passing it onward, so a vendor received an empty Authorization header and answered 401. A 401\n // from a vendor is indistinguishable from a revoked credential, so the real fault (nobody ever\n // configured one) was invisible. Naming both places that were checked turns that into a\n // sentence an operator can act on.\n //\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — resolving which principal this\n // application acts as toward a third party, per tenant.\n // ══════════════════════════════════════════════════════════════════════════════════════════\n\n /\n Lazy getter for the per-organization credential store — see the `container` constructor\n * param's JSDoc for why this cannot be a constructor injection.\n \n `isBound` is what preserves the old `@optional()` semantics: a host that binds no store\n * (a minion, a unit harness) resolves nothing here and falls through to the deployment\n * environment, exactly as it did before the store existed.\n /\n protected resolveOrganizationCredentialResolver(): OrganizationProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver)) return undefined;\n return this.container.get<OrganizationProviderCredentialResolverPort>(\n SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver,\n );\n }\n\n /\n Lazy getter for the per-user credential store — same mechanics as the organization one above,\n * and the OPPOSITE meaning when it resolves nothing.\n \n An unbound organization store falls through to the deployment environment, because a tenant\n * legitimately may not have its own credential. An unbound USER store REFUSES, because there is\n * nothing a person's credential could fall through to: spending the deployment's shared\n * principal on someone's behalf would attribute the act to the wrong party at the vendor. So a\n * host that forgot to bind this gets a refusal naming the wiring fault, never a silent\n * substitution.\n /\n /\n Lazy getter for the application's own grant store (#3398) — same mechanics as the two above. Unbound (a minion, a\n * harness), an APPLICATION target reads the deployment environment only, which is what it did before the store existed.\n /\n protected resolveApplicationCredentialResolver(): ApplicationProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.ApplicationProviderCredentialResolver)) return undefined;\n return this.container.get<ApplicationProviderCredentialResolverPort>(SAAS_SERVICE_TYPES.ApplicationProviderCredentialResolver);\n }\n\n protected resolveUserCredentialResolver(): UserProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.UserProviderCredentialResolver)) return undefined;\n return this.container.get<UserProviderCredentialResolverPort>(\n SAAS_SERVICE_TYPES.UserProviderCredentialResolver,\n );\n }\n\n\n /\n Whether THIS runtime may use the provider through `protocolKind`: the provider is loaded, its module declares the\n * protocol, the runtime's provider scope entry lists it, and its configuration does not set `enabled: false`.\n \n The scope entry is the gate (#2805, decided 2026-10-12). A runtime uses exactly what its scope entry binds, as\n * {@link getProvidersForEngineCapability} already requires the entry to list the engine capability. So an entry\n * binding nothing (`{ engineCapabilities: [], providerCapabilities: [], protocols: [] }`, what `wildo registry add`\n * writes) uses the provider for nothing: no inbound endpoint is mounted for it, no chat connection is offered, no\n * operation is executed through it. Until then the list was recorded, validated by `wildo config sync`, and read by\n * nothing at runtime, so an unbound entry still mounted the module's webhook endpoints.\n \n Four engine-capability services read a provider's contract after {@link getProvidersForEngineCapability} chose it\n * and do not ask this method: embeddings, document extraction, inbound email and contributed file storage. They can\n * reach only a provider whose entry binds the capability, so nothing unbound is reached; the email service asks both.\n \n A runtime with no provider scope at all (a platform service, a harness with no generated artifact) has declared\n * nothing to gate against and keeps the module's declaration, the behaviour before the scope existed. Every\n * application runtime has one: each applies its own projected scope (`applyProviderRuntime`), a minion and a worker\n * included.\n /\n public isProviderEnabled(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): boolean {\n this.ensureInitialized();\n try {\n if (!this.hasProvider(providerRef)) {\n return false;\n }\n\n const provider = this.getProvider(providerRef);\n if (!provider \|\| !provider.protocols.includes(protocolKind)) {\n return false;\n }\n\n const runtimeScope = this.getActiveRuntimeProviderScope();\n if (runtimeScope?.providers !== undefined) {\n const scopeKey = scopeKeyOfProtocolKind(protocolKind);\n const listed = runtimeScope.providers[providerRef]?.protocols ?? [];\n if (scopeKey === undefined \|\| !listed.includes(scopeKey)) {\n return false;\n }\n }\n\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n if (!config) {\n return true;\n }\n\n return config.enabled !== false;\n } catch (error) {\n // A configuration refusal (#2995, #3002) reads as \"not enabled\" here, which fails closed: nothing runs and no\n // secret is read. It is not surfaced because a predicate's callers branch on a boolean, and every host that\n // reads provider configuration refuses such a configuration at startup before this can meet it.\n this.logDebug('Error checking if provider is enabled', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return false;\n }\n }\n\n public getProviderProtocolSecrets(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): Record<string, string> \| undefined {\n this.ensureInitialized();\n try {\n const resolvedSecrets: Record<string, string> = {};\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n const protocolSecretRef = protocolConfig?.authConfig?.secretRef;\n if (protocolSecretRef) {\n const secretValue = this.getProviderSecret(providerRef, protocolKind, protocolSecretRef);\n if (secretValue) {\n resolvedSecrets[protocolSecretRef] = secretValue;\n }\n }\n\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n continue;\n }\n\n const secretValue = this.getProviderSecret(providerRef, protocolKind, executionProfile.secretRef);\n if (secretValue) {\n resolvedSecrets[executionProfile.secretRef] = secretValue;\n }\n }\n }\n\n return Object.keys(resolvedSecrets).length > 0 ? resolvedSecrets : undefined;\n } catch (error) {\n // Same as `getProviderApiKey`: a configuration refusal surfaces rather than reading as \"no secrets\".\n if (isWildoBackendError(error)) throw error;\n return undefined;\n }\n }\n\n /\n Refresh the runtime registry facade from first-class backend provider modules.\n \n This mirrors `initialize()` and intentionally no longer depends on the\n * deleted capability-bindings service.\n /\n public async refreshFromConfig(): Promise<void> {\n try {\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.registry = registry;\n this.isInitialized = true;\n\n this.logDebug('External providers registry refreshed from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n } catch (error) {\n this.logDebug('Failed to refresh registry from config', {\n error: describeCaughtError(error)\n });\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n error: describeCaughtError(error),\n },\n }\n );\n }\n }\n\n // ================================\n // Initialization Utils\n // ================================\n\n protected ensureInitialized(): void {\n if (!this.isInitialized \|\| !this.registry) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED\n }\n );\n }\n }\n}\n\n/\n The `selection` policy that orders a capability's providers, by resolution mode. Only a `SELECT_ONE` capability has\n * one: a `FAN_OUT` capability uses every declared provider, and a `BOUND_PER_PURPOSE` capability is bound per purpose\n * (#2891), so a stray `selection` from a hand-authored artifact never reorders or truncates either set.\n */\nfunction selectionPolicyFor<P>(mode: EngineCapabilityResolutionMode, selection: P \| undefined): P \| undefined {\n return engineCapabilityResolutionModeTakesASelection(mode) ? selection : undefined;\n}\n\nfunction assertNeverResolutionMode(mode: never): never {\n throw new Error(`Unhandled engine capability resolution mode: ${String(mode)}`);\n}\n"]}
1	+ {"version":3,"file":"external-providers-registry.backend.service.js","sourceRoot":"","sources":["../../../../src/external-providers/services/external-providers-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,EAAE,sCAAsC,EAAE,MAAM,gDAAgD,CAAC;AAExG,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrG,OAAO,EACH,+BAA+B,EAC/B,+BAA+B,GAElC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACH,gCAAgC,EAChC,qCAAqC,GAGxC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAGH,gBAAgB,EAChB,8BAA8B,EAC9B,qDAAqD,EACrD,iCAAiC,EACjC,6CAA6C,EAC7C,wCAAwC,EACxC,yBAAyB,EACzB,wCAAwC,GAC3C,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAc1E,OAAO,EACL,sCAAsC,EAEtC,wBAAwB,EACxB,kCAAkC,EAClC,uCAAuC,EACvC,+BAA+B,EAC/B,uBAAuB,EACvB,2BAA2B,EAC3B,4BAA4B,EAC5B,2CAA2C,EAC3C,wCAAwC,EACxC,oCAAoC,EACpC,yCAAyC,GAC1C,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAOpF,OAAO,EAAE,2BAA2B,EAAoC,MAAM,uFAAuF,CAAC;AACtK,OAAO,EACH,4BAA4B,EAC5B,0CAA0C,EAC1C,sCAAsC,GAEzC,MAAM,4FAA4F,CAAC;AAEpG,OAAO,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAA2B,MAAM,uBAAuB,CAAC;AAC7H,OAAO,EAAE,wCAAwC,EAAE,MAAM,0EAA0E,CAAC;AASpI,OAAO,EACH,2CAA2C,EAC3C,iCAAiC,EACjC,mCAAmC,GACtC,MAAM,uDAAuD,CAAC;AAC/D,gJAAgJ;AAChJ,yIAAyI;AACzI,oIAAoI;AACpI,0CAA0C;AAC1C,OAAO,EACH,oCAAoC,EACpC,iCAAiC,GAEpC,MAAM,kDAAkD,CAAC;AAE1D,OAAO,EACH,4BAA4B,EAC5B,0CAA0C,EAC1C,gDAAgD,EAChD,qCAAqC,EACrC,8BAA8B,EAC9B,0CAA0C,EAC1C,wBAAwB,GAG3B,MAAM,sCAAsC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,8CAA8C,GAA6C;IAC7F,aAAa,EAAE,wBAAwB,CAAC,eAAe;CAC1D,CAAC;AAgEF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACH,sCAAsC,EACtC,uCAAuC,GAE1C,MAAM,yGAAyG,CAAC;AAwCjH,MAAM,6BAA6B,GAAG;IAClC,uBAAuB,CAAC,WAAW;IACnC,uBAAuB,CAAC,OAAO;IAC/B,uBAAuB,CAAC,UAAU;CACrC,CAAC;AAEF,SAAS,6BAA6B,CAAC,WAAmB;IACtD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,OAAO,UAAU,KAAK,WAAW;WAC1B,UAAU,KAAK,qBAAqB;WACpC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,2CAA2C,GAA6C;IAC1F,YAAY,EAAE,wBAAwB,CAAC,aAAa;IACpD,UAAU,EAAE,wBAAwB,CAAC,WAAW;IAChD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,kBAAkB,EAAE,wBAAwB,CAAC,mBAAmB;IAChE,gBAAgB,EAAE,wBAAwB,CAAC,iBAAiB;IAC5D,8EAA8E;IAC9E,sEAAsE;CACzE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kDAAkD,GAAoD;IACxG,UAAU,EAAE,+BAA+B,CAAC,WAAW;CAC1D,CAAC;AAEF;;;;GAIG;AACH,MAAM,2DAA2D,GAA4D;IACzH,mBAAmB,EAAE,uCAAuC,CAAC,qBAAqB;CACrF,CAAC;AAEF,iHAAiH;AACjH,MAAM,sDAAsD,GAAuD;IAC/G,qBAAqB,EAAE,kCAAkC,CAAC,uBAAuB;IACjF,cAAc,EAAE,kCAAkC,CAAC,eAAe;CACrE,CAAC;AAYF,uGAAuG;AACvG,SAAS,sBAAsB,CAAC,YAAoD;IAChF,OAAQ,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAgE;SACrH,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,sCAAsC,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,CAAC;AAC3F,CAAC;AA6ED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC3D,OAAO,uCAAuC,UAAU,0EAA0E;UAC5H,mEAAmE,CAAC;AAC9E,CAAC;AAGM,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAOU;IACU;IACG;IACW;IAgC1B;IAzC9C,QAAQ,CAA+D;IACvE,QAAQ,GAAuC,IAAI,CAAC;IAEpD,aAAa,GAAG,KAAK,CAAC;IAEhC,YAC0D,MAAqB,EACX,aAAsC,EACnC,YAAwC,EAC7B,uBAA8D,EAgCxF,SAAqB;QAnCnB,WAAM,GAAN,MAAM,CAAe;QACX,kBAAa,GAAb,aAAa,CAAyB;QACnC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAgCxF,cAAS,GAAT,SAAS,CAAY;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAElF,IAAI,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,mCAAmC;IACnC,wBAAwB;IACxB,mCAAmC;IAEnC;;;OAGG;IACI,KAAK,CAAC,UAAU;QACnB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YACvD,OAAO;QACX,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;QAEhE,IAAI,CAAC,iCAAiC,EAAE,CAAC;QAEzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC;YACD,IAAI,CAAC,+BAA+B,EAAE,CAAC;YACvC,IAAI,CAAC,+BAA+B,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,qGAAqG;YACrG,iDAAiD;YACjD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,uEAAuE,EAAE;YACnF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;SAC/C,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACK,iCAAiC;QACrC,MAAM,SAAS,GAAG;YACd,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5G,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE;SAC3F,CAAC,MAAM,CAAC,CAAC,QAAQ,EAA2B,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnE,KAAK,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,+BAA+B,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;YACrJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;gBACrF,WAAW;gBACX,eAAe;gBACf,MAAM,EAAE,sGAAsG;sBACxG,uGAAuG;aAChH,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,2EAA2E;IAEnE,uCAAuC;QAC3C,MAAM,QAAQ,GAAgC,EAAE,CAAC;QACjD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,oBAAoB;iBACnD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,wCAAwC,CAAC,UAAU,CAAC,CAAC;iBACzE,MAAM,CAAC,CAAC,UAAU,EAAkC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAEjF,QAAQ,CAAC,WAAW,CAAC,GAAG;gBACpB,WAAW;gBACX,SAAS;gBACT,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACpD,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,sCAAsC,CAAC,UAAU,CAAC,IAAI,SAAS;aACrG,CAAC;QACN,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,mCAAmC;IACnC,iBAAiB;IACjB,mCAAmC;IAE5B,4BAA4B;QAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC;IAC1B,CAAC;IAEM,gBAAgB;QACnB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACI,OAAO;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACI,+BAA+B,CAAC,UAA4B;QAC/D,OAAO,iCAAiC,CAAC,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;IACvF,CAAC;IAED;;;;;;OAMG;IACI,uCAAuC,CAAC,UAA4B,EAAE,qBAAwC;QACjH,OAAO,oCAAoC,CAAC,EAAE,GAAG,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACxH,CAAC;IAED;;;;;;OAMG;IACI,4BAA4B,CAAC,UAA4B;QAC5D,IAAI,CAAC,wCAAwC,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QACrE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,0GAA0G;IAClG,uBAAuB,CAAC,UAA4B;QACxD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC;QACxE,OAAO;YACH,UAAU;YACV,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAC9J,GAAG,CAAC,UAAU;gBACV,CAAC,CAAC;oBACE,aAAa,EAAE;wBACX,iBAAiB,EAAE,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,UAAU,CAAC;wBACtG,YAAY,EAAE,IAAI,CAAC,6BAA6B,EAAE;wBAClD,sBAAsB,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC;6BAC9F,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;qBAC1G;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACI,mCAAmC,CAAC,UAA4B;QACnE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACvG,MAAM,KAAK,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAChG,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACxH,CAAC;IAEM,qCAAqC,CAAC,UAA4B;QACrE,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,oCAAoC,CAAC,UAA4B;QACpE,MAAM,IAAI,GAAG,iCAAiC,CAAC,UAAU,CAAC,CAAC;QAC3D,QAAQ,IAAI,EAAE,CAAC;YACX,KAAK,8BAA8B,CAAC,OAAO;gBACvC,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;YAC5D,KAAK,8BAA8B,CAAC,iBAAiB;gBACjD,wGAAwG;gBACxG,uGAAuG;gBACvG,uEAAuE;gBACvE,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;YAC5D,KAAK,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC,CAAC;gBACvE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,CAAC;YACD;gBACI,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;IAEM,2BAA2B,CAAC,UAA4B;QAC3D,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;OAWG;IACI,yBAAyB,CAAC,UAA4B;QACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,0GAA0G;YAC1G,OAAO,yBAAyB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;IAC/F,CAAC;IAED;;;;;;;;;;OAUG;IACI,sCAAsC,CACzC,UAA0C,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAEtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,mFAAmF;YACnF,mFAAmF;YACnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,OAAO,EAAE,mFAAmF;0BACtF,qDAAqD;iBAC9D;aACJ,CAAC,CAAC;QACP,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACvE,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,2BAA2B;QAC3B,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,qBAAqB,GAAG,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAC;YAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,kBAAkB;mBAC5C,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC;mBAClD,qDAAqD,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7E,IACI,CAAC,qBAAqB,IAAI,gBAAgB,CAAC;mBACxC,IAAI,CAAC,oCAAoC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EACvE,CAAC;gBACC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7B,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAwC;QACzE,MAAM,2BAA2B,GAAG,IAAI,CAAC,sCAAsC,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,2BAA2B,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EACH,6DAA6D,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;sBACtG,oGAAoG;sBACpG,2FAA2F;sBAC3F,qFAAqF;gBAC3F,2BAA2B;aAC9B;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,+BAA+B,CAAsF;IACrH,yCAAyC,GAAG,KAAK,CAAC;IACzC,mCAAmC,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE3E,4BAA4B,CAChC,UAA4B;QAE5B,IAAI,IAAI,CAAC,+BAA+B,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;oBAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjE,IAAI,CAAC,+BAA+B,GAAG,MAA4F,CAAC;oBACxI,CAAC;yBAAM,CAAC;wBACJ,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;wBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;oBAC1D,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE;wBAC3F,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBACpC,CAAC,CAAC;oBACH,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;oBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;gBAC1D,CAAC;YACL,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAClE,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IACI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;eACjC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;eAC7B,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS,IAAI,CAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;mBACrC,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAC9G,CAAC,EACJ,CAAC;YACC,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACI,sCAAsC,CAAC,UAA4B;QACtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QACvF,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,iBAAiB,GAAG,IAAI,CAAC,yCAAyC,IAAI,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrI,OAAO,MAAM,CAAC,MAAM,CAAC;YACjB,aAAa,EAAE,oBAAoB;gBAC/B,CAAC,CAAC,sCAAsC,CAAC,oBAAoB;gBAC7D,CAAC,CAAC,gBAAgB;oBACd,CAAC,CAAC,sCAAsC,CAAC,4BAA4B;oBACrE,CAAC,CAAC,sCAAsC,CAAC,kBAAkB;YACnE,cAAc,EAAE,iBAAiB;gBAC7B,CAAC,CAAC,uCAAuC,CAAC,SAAS;gBACnD,CAAC,CAAC,oBAAoB;oBAClB,CAAC,CAAC,uCAAuC,CAAC,OAAO;oBACjD,CAAC,CAAC,uCAAuC,CAAC,MAAM;YACxD,6BAA6B,EAAE,gBAAgB,EAAE,OAAO,IAAI,IAAI;YAChE,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YAChG,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;YACvF,6BAA6B,EAAE,oBAAoB,EAAE,OAAO,IAAI,IAAI;YACpE,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YACpG,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,0CAA0C,EAAE;SAC3F,CAAC,CAAC;IACP,CAAC;IAEO,6BAA6B;QACjC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAG,OAAQ,IAAI,CAAC,aAA0C,CAAC,WAAW,KAAK,QAAQ;YAChG,CAAC,CAAE,IAAI,CAAC,aAA0C,CAAC,WAAY;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,SAAS,IAAI,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,SAAiC,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,CAAC,OAA2C,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACI,wBAAwB,CAC3B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5C,MAAM,eAAe,GAAG,SAAS,CAAC,sBAAsB,IAAI,EAAE,CAAC;YAE/D,MAAM,aAAa,GAAG,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACtF,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAClE,IAAI,CAAC,kCAAkC,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,sCAAsC,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YACrF,IAAI,YAAY,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,yCAAyC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBACtF,OAAO,IAAI,CAAC,0BAA0B,CAClC,aAAa,EACb,YAA6C,CAChD,CAAC;YACN,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,mCAAmC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,aAAa,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,4DAA4D;YAC5D,qEAAqE;YACrE,6DAA6D;YAC7D,6DAA6D;YAC7D,2DAA2D;YAC3D,4DAA4D;YAC5D,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE;gBAC3E,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,kCAAkC,CAAC,WAAmB,EAAE,YAAoB,EAAE,YAAqB;QACvG,MAAM,CAAC,OAAO,CAAC,GAAG,wCAAwC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAChH,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,sLAAsL;QACtL,0KAA0K;QAC1K,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACI,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,2CAA2C,CAAC,OAAO,CAAC;gBAC7D,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,GAAG,EAAE,OAAO,CAAC,GAAG;aACnB;SACJ,CACJ,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACI,+BAA+B,CAAC,WAAmB,EAAE,WAAmB,EAAE,QAAiB;QAC9F,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,SAAS;YAAE,OAAO;QACtH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;YACI,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,0BAA0B,WAAW,IAAI,WAAW,gCAAgC,MAAM,CAAC,QAAQ,CAAC,YAAY,WAAW,GAAG;sBACjI,kHAAkH;sBAClH,gCAAgC,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,+BAA+B;gBAClH,WAAW;gBACX,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC;aAC9B;SACJ,CACJ,CAAC;IACN,CAAC;IAED;;;;;;;;OAQG;IACI,gCAAgC;QACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE;YAAE,OAAO;QAChD,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5G,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,SAAS;gBAAE,SAAS;YAClF,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC,EAAE,CAAC;gBAC5F,IAAI,CAAC,sCAAsC,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,sCAAsC,CAAC,WAAmB,EAAE,WAAmB,EAAE,GAAY;QACjG,KAAK,MAAM,OAAO,IAAI,yCAAyC,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;YAChF,QAAQ,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpB,KAAK,oCAAoC,CAAC,eAAe;oBACrD,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC9E,MAAM;gBACV,KAAK,oCAAoC,CAAC,qCAAqC;oBAC3E,IAAI,CAAC,8CAA8C,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,mBAAmB,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;oBAChI,MAAM;gBACV,KAAK,oCAAoC,CAAC,uCAAuC;oBAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC/B,IAAI,CAAC,qDAAqD,CACtD,WAAW,EACX,0BAA0B,WAAW,IAAI,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,EACtE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC3E,CAAC;oBACN,CAAC;oBACD,MAAM;gBACV,OAAO,CAAC,CAAC,CAAC;oBACN,MAAM,UAAU,GAAU,OAAO,CAAC,KAAK,CAAC;oBACxC,OAAO,UAAU,CAAC;gBACtB,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,8CAA8C,CAAC,WAAmB,EAAE,WAAmB,EAAE,mBAA2B,EAAE,KAAc;QACxI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QACtG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,0BAA0B,WAAW,IAAI,WAAW,sBAAsB,mBAAmB,0BAA0B;sBAC1H,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,WAAW,gFAAgF;sBACxH,0CAA0C,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,+BAA+B;gBAC5H,WAAW;gBACX,YAAY,EAAE,WAAW;gBACzB,mBAAmB;gBACnB,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC;aAClC;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACI,qDAAqD,CAAC,WAAmB,EAAE,MAAc,EAAE,KAAwB;QACtH,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,GAAG,MAAM,UAAU,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,GAAG;sBACjI,gHAAgH;sBAChH,mHAAmH;gBACzH,WAAW;gBACX,MAAM;gBACN,cAAc,EAAE,KAAK;aACxB;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACK,gDAAgD,CAAC,IAAY;QACjE,IAAI,yBAAyB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/E,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5G,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,mBAAmB,CAAC,WAAmB;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,IAAI,EAAE,CAAC;QAC9F,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,KAAK,EAAE,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE;gBAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjF,CAAC;IAED,6HAA6H;IACrH,+BAA+B,CAAC,WAAmB,EAAE,IAAY;QACrE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAChF,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IAED,wFAAwF;IAChF,2BAA2B,CAAC,WAAmB;QACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACxI,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,0BAA0B,CAC9B,aAAwD,EACxD,YAA2C;QAE3C,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC;QACxB,CAAC;QAED,OAAO;YACH,GAAG,aAAa;YAChB,GAAG,YAAY;YACf,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,kEAAkE;YAClE,oEAAoE;YACpE,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,YAAY,CAAC,iBAAiB;gBACjE,CAAC,CAAC;oBACE,iBAAiB,EAAE;wBACf,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,EAAE,CAAC;wBAC1C,GAAG,CAAC,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC;qBAC5C;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;YACT,UAAU,EAAE,IAAI,CAAC,eAAe,CAC5B,aAAa,CAAC,UAAU,EACxB,YAAY,CAAC,UAAU,CACqB;YAChD,kDAAkD;YAClD,eAAe,EAAE,aAAa,CAAC,eAAe;YAC9C,SAAS,EAAE,aAAa,CAAC,SAAS;SACrC,CAAC;IACN,CAAC;IAEO,eAAe,CACnB,YAAqB,EACrB,WAAoB;QAEpB,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACpD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACnF,OAAO,WAAkD,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,OAAO,YAAuC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAA4B;YACpC,GAAI,YAAwC;SAC/C,CAAC;QACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpD,SAAS;YACb,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ;mBACf,OAAO,QAAQ,KAAK,QAAQ;mBAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;mBACxB,KAAK;mBACL,OAAO,KAAK,KAAK,QAAQ;mBACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;gBACvC,CAAC,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAGD;;;;;OAKG;IACI,iCAAiC;QACpC,OAAO,wCAAwC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH;;;;;;;;;;;;;;OAcG;IACI,sBAAsB,CAAC,WAAmB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QACxF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI;YACJ,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,IAAI,CAAC;YACrD,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,yGAAyG;YACzG,yGAAyG;YACzG,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;SAC9H,CAAC,CAAC,CAAC;IACR,CAAC;IAEM,sBAAsB,CACzB,WAAmB,EACnB,SAAiB;QAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC;QACvB,CAAC;QAED,0FAA0F;QAC1F,wFAAwF;QACxF,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,aAAa,GAAG,KAAK,EAAE,UAAU,IAAI,SAAS,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,iBAAiB,GAAG,MAAM,KAAK,SAAS;eACvC,CAAC,MAAM,CAAC,iBAAiB,KAAK,aAAa,IAAI,MAAM,CAAC,qBAAqB,KAAK,aAAa,CAAC,CAAC;QAEtG,OAAO,iBAAiB;YACpB,CAAC,CAAC,4BAA4B,CAAC,YAAY;YAC3C,CAAC,CAAC,4BAA4B,CAAC,UAAU,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QACxF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;;OAQG;IACK,uBAAuB,CAAC,WAAmB,EAAE,SAAiB;QAClE,2FAA2F;QAC3F,6FAA6F;QAC7F,6FAA6F;QAC7F,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QAC3F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,kGAAkG;QAClG,+FAA+F;QAC/F,oGAAoG;QACpG,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5D,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACI,uBAAuB,CAAC,WAAmB,EAAE,SAAiB;QACjE,OAAO,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACI,8BAA8B,CAAC,WAAmB;QACrD,OAAO,4BAA4B,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,WAAmB;QAC7C,OAAO,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACI,6BAA6B,CAAC,WAAmB;QAIpD,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,YAAY,GAAG,MAAM,EAAE,kBAAkB,CAAC;QAChD,OAAO,MAAM,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IACrG,CAAC;IAED;;;OAGG;IACI,0BAA0B,CAAC,WAAmB;QACjD,OAAO,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACI,2BAA2B,CAAC,WAAmB;QAClD,OAAO,+BAA+B,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACK,yBAAyB;QAC7B,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QACnH,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,WAAmB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,QAAQ,EAAE,aAAa,IAAI,WAAW,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;QACjH,IAAI,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3G,OAAO;YACH,aAAa;YACb,WAAW;YACX,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY,EAAE,QAAQ;YACtB,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,KAAK,IAAI;SACxD,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,yBAAyB,CAAC,WAAmB;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QACnF,MAAM,OAAO,GAAoC,EAAE,CAAC;QACpD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YAC7G,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/J,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;YACtD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;gBACjG,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,uBAAuB,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YAC5J,CAAC;QACL,CAAC;QACD,OAAO,qCAAqC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED;;;;OAIG;IACI,mCAAmC,CAAC,WAAmB,EAAE,WAAmB;QAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,oBAAoB,IAAI,EAAE,CAAC;QACrG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,WAAW;eAC5F,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACI,gCAAgC,CAAC,WAAmB,EAAE,WAAmB,EAAE,aAAgC;QAC9G,MAAM,OAAO,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,UAAU,GAAG,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC5E,OAAO;YACH,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW;YACX,WAAW;YACX,iBAAiB,EAAE,UAAU,CAAC,WAAW;YACzC,0BAA0B,EAAE,UAAU,CAAC,oBAAoB;YAC3D,mBAAmB,EAAE,UAAU,CAAC,aAAa;SAChD,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACI,wCAAwC,CAAC,MAAsC;QAMlF,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;YACnE,OAAO;gBACH,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,qBAAqB;gBACtC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;oBACjD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACtH,YAAY,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;oBACzD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE,qBAAqB,CAAC;aAC7H,CAAC;QACN,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,UAAU,CAAC,CAAC;QACxH,IAAI,MAAM,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QACvE,MAAM,qBAAqB,GAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,aAAa,CAClG,EAAE,CAAC,sCAAsC,CAAC,UAAU,CAAwH,CAAC;QACjL,MAAM,QAAQ,GAAG,qBAAqB,EAAE,UAAU,EAAE,QAAQ;eACrD,qBAAqB,EAAE,QAAQ;eAC/B,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAuB,CAAC,CAAC;QAClJ,oGAAoG;QACpG,qHAAqH;QACrH,MAAM,eAAe,GAAG,qBAAqB,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,CAAC,eAAe,CAAC;QAC/F,OAAO;YACH,WAAW,EAAE,0BAA0B,MAAM,CAAC,aAAa,IAAI,sCAAsC,CAAC,UAAU,WAAW;YAC3H,eAAe;YACf,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,UAAU,EAAE,eAAe,CAAC;SACjI,CAAC;IACN,CAAC;IAED;;;;;;;;;;;OAWG;IACK,+BAA+B;QACnC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACzF,4GAA4G;YAC5G,mDAAmD;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YACvH,OAAO,CAAC,IAAI,CAAC,GAAG,2CAA2C,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACrJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,8EAA8E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE;SACtI,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACK,+BAA+B;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACrD,IAAI,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/E,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YACvG,OAAO,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,+BAA+B,CAAC;YAC5C,WAAW;YACX,2BAA2B,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;YACzF,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,SAAS;YAC9E,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACnC,OAAO;oBACH,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACtE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;iBACjJ,CAAC;YACN,CAAC;YACD,wBAAwB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ;YAC7G,mBAAmB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC7B,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,sCAAsC,CAAC,UAAU,CAAC,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU;SACnJ,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,2DAA2D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC1F,OAAO;aACV;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;OAOG;IACI,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;QAClE,OAAO;YACH,aAAa,EAAE,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC;YAC/D,UAAU,EAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC;SACnE,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,4BAA4B,CAAC,WAAmB,EAAE,gBAAwB;QAC7E,IAAI,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACzE,OAAO,4BAA4B,CAAC,qBAAqB,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,gBAAgB,CAAC,KAAK,gBAAgB;YACnF,CAAC,CAAC,4BAA4B,CAAC,OAAO;YACtC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,6BAA6B,CAAC,WAAmB,EAAE,UAAkB;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,CAAC,wBAAwB,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,UAAU,CAAC,KAAK,4BAA4B,CAAC,UAAU,EAAE,CAAC;YACnG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,CAAC,4BAA4B,EAAE,CAAC;QACzG,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC;IACrF,CAAC;IAEM,2BAA2B,CAAC,WAAmB;QAClD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,YAAY,CACtD,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,GAAG,EAAE,CAAC;YAC5D,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACI,kCAAkC,CAAC,WAAmB;QACzD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,mBAAmB,CAC7D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU,EAAE,CAAC;YACnE,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kDAAkD,CAAC,SAAS,CAAC,CAAC;aACjF,MAAM,CAAC,CAAC,SAAS,EAAgD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACtG,CAAC;IAGD;;;;;;OAMG;IACI,0CAA0C,CAAC,WAAmB;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,4BAA4B,CACtE,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,mBAAmB,EAAE,CAAC;YAC5E,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2DAA2D,CAAC,SAAS,CAAC,CAAC;aAC1F,MAAM,CAAC,CAAC,SAAS,EAAwD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC9G,CAAC;IAGD;;;;OAIG;IACI,qCAAqC,CAAC,WAAmB;QAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,uBAAuB,CAAC,CAAC;QACrI,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,cAAc;YAAE,OAAO,EAAE,CAAC;QACpF,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,sDAAsD,CAAC,SAAS,CAAC,CAAC;aACrF,MAAM,CAAC,CAAC,SAAS,EAAmD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACzG,CAAC;IAGM,mCAAmC,CAAC,WAAmB;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CACxC,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QACF,OAAO,MAAuD,CAAC;IACnE,CAAC;IAEM,6BAA6B,CAAC,WAAmB;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;YAC9E,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,eAAe,GAAG;YACpB,GAAG,CAAC,eAAe,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;QACF,OAAO;YACH,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,SAAS,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACjD,sBAAsB,EAAE,eAAe,CAAC,UAAU;iBAC7C,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8CAA8C,CAAC,SAAS,CAAC,CAAC;iBAC7E,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;YAC1F,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YAC9C,yBAAyB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,yBAAyB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,GAAG,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,GAAG,CAAC,eAAe,CAAC,mDAAmD;gBACnE,CAAC,CAAC,EAAE,mDAAmD,EAAE,eAAe,CAAC,mDAAmD,EAAE;gBAC9H,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,eAAe,CAAC,iBAAiB;gBACjC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,GAAG,eAAe,CAAC,iBAAiB,EAAE,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,6BAA6B;gBAC7C,CAAC,CAAC,EAAE,6BAA6B,EAAE,CAAC,GAAG,eAAe,CAAC,6BAA6B,CAAC,EAAE;gBACvF,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,mEAAmE;YACnE,oEAAoE;YACpE,0DAA0D;YAC1D,kBAAkB,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpF,GAAG,CAAC,eAAe,CAAC,iCAAiC;gBACjD,CAAC,CAAC;oBACE,iCAAiC,EAAE,MAAM,CAAC,WAAW,CACjD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAC,GAAG,CACjE,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAC1D,CACJ;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACI,sCAAsC,CACzC,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,aAAa,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,aAAa,EAAE,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,yBAAyB,mBAAmB,kBAAkB,WAAW,EAAE,CAAC,CAAC;YAC3F,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC;YACD,OAAO,0CAA0C,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,WAAW;oBACX,mBAAmB;oBACnB,OAAO,EAAE,qFAAqF;oBAC9F,eAAe,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAC9C;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAEM,4CAA4C,CAC/C,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,sCAAsC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACvG,IACI,CAAC,gBAAgB;eACd,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;eACnF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;YACC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB;YACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5F,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAEO,uBAAuB,CAAC,UAA6B;QACzD,OAAO,UAAU;aACZ,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2CAA2C,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;aACvF,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,CAC1D,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,SAAqC,CAAC,CAC1F,CAAC,CAAC;IACX,CAAC;IAEO,+BAA+B,CACnC,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAEnG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,+BAA+B,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAC5E,OAAO,SAAS,CAAC;YACrB,CAAC;YAGD,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;gBAC7E,MAAM,0BAA0B,GAAG,SAAS,CAAC;gBAC7C,MAAM,wBAAwB,GAAG,OAAO,CACpC,eAAe,CAAC,SAAS;uBACtB,eAAe,CAAC,gBAAgB;uBAChC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CACpE,CAAC;gBACF,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,0BAA0B;oBAC1B,iBAAiB,EAAE;wBACf,CAAC,0BAA0B,CAAC,EAAE;4BAC1B,UAAU,EAAE,8BAA8B,CAAC,kBAAkB;4BAC7D,OAAO,EAAE,eAAe,CAAC,YAAY;4BACrC,IAAI,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;4BAC5C,6BAA6B,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;4BACzF,QAAQ,EAAE,wBAAwB;gCAC9B,CAAC,CAAC,4BAA4B,CAAC,wBAAwB;gCACvD,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;oCAChD,CAAC,CAAC,4BAA4B,CAAC,YAAY;oCAC3C,CAAC,CAAC,4BAA4B,CAAC,IAAI;4BAC3C,GAAG,CAAC,wBAAwB;gCACxB,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,EAAE;gCAC9F,CAAC,CAAC,EAAE,CAAC;4BACT,6DAA6D;4BAC7D,wDAAwD;4BACxD,yDAAyD;4BACzD,6DAA6D;4BAC7D,4DAA4D;4BAC5D,2BAA2B;4BAC3B,8BAA8B,EAAE,CAAC,uBAAuB,CAAC,WAAW,CAAC;4BACrE,sBAAsB,EAAE,0CAA0C,CAAC,cAAc;4BACjF,2DAA2D;4BAC3D,6DAA6D;4BAC7D,8BAA8B;4BAC9B,iBAAiB,EAAE,qCAAqC,CAAC,aAAa;4BACtE,4BAA4B,EAAE,gDAAgD,CAAC,kBAAkB;4BACjG,GAAG,CAAC,eAAe,CAAC,qBAAqB;gCACrC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE;gCAClE,CAAC,CAAC,EAAE,CAAC;yBACZ;qBACJ;oBACD,eAAe;iBAClB,CAAC;YACN,CAAC;YAED,oGAAoG;YACpG,8DAA8D;YAC9D,MAAM,SAAS,GAAG,iCAAiC,CAAC,eAAe,CAAC,CAAC;YACrE,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS;oBACT,CAAC,CAAC;wBACE,UAAU,EAAE;4BACR,QAAQ,EAAE,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC;4BAC1D,SAAS;yBACZ;qBACJ;oBACD,CAAC,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,kBAAkB;oBACvE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE;oBAC5D,CAAC,CAAC,EAAE,CAAC;gBACT,eAAe;aAClB,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,wDAAwD;YACxD,2DAA2D;YAC3D,mDAAmD;YACnD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE;gBAC1D,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,0BAA0B,CAC9B,eAAgD;QAEhD,QAAQ,eAAe,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,KAAK,2BAA2B,CAAC,KAAK,CAAC;YACvC,KAAK,2BAA2B,CAAC,UAAU,CAAC;YAC5C,qFAAqF;YACrF,mFAAmF;YACnF,gFAAgF;YAChF,KAAK,2BAA2B,CAAC,mBAAmB,CAAC;YACrD,mGAAmG;YACnG,KAAK,2BAA2B,CAAC,cAAc,CAAC;YAChD,0GAA0G;YAC1G,KAAK,2BAA2B,CAAC,oBAAoB,CAAC;YACtD,KAAK,2BAA2B,CAAC,KAAK,CAAC;YACvC,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,8FAA8F;YAC9F,KAAK,2BAA2B,CAAC,aAAa,CAAC;YAC/C,KAAK,2BAA2B,CAAC,OAAO,CAAC;YACzC,sFAAsF;YACtF,gFAAgF;YAChF,KAAK,2BAA2B,CAAC,IAAI;gBACjC,OAAO,0BAA0B,CAAC,OAAO,CAAC;YAC9C,KAAK,2BAA2B,CAAC,kBAAkB;gBAC/C,OAAO,0BAA0B,CAAC,cAAc,CAAC;YACrD,KAAK,2BAA2B,CAAC,UAAU;gBACvC,OAAO,0BAA0B,CAAC,MAAM,CAAC;YAC7C,KAAK,2BAA2B,CAAC,qBAAqB;gBAClD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;oBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;oBACpG,OAAO,EAAE;wBACL,OAAO,EAAE,mGAAmG;8BACtG,oEAAoE;qBAC7E;iBACJ,CACJ,CAAC;YACN,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,eAAe,GAAU,eAAe,CAAC;gBAC/C,OAAO,eAAe,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,qBAAqB,CACzB,eAA0H;QAE1H,OAAO,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACxE,GAAG,QAAQ;YACX,4FAA4F;YAC5F,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrC,eAAe,EAAE,EAAE,GAAG,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC,mBAAmB,EAAE;aAC3F,CAAC;YACF,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC;SACvC,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH;;;;;OAKG;IACI,4CAA4C,CAAC,WAAmB,EAAE,KAAa;QAClF,OAAO,8BAA8B,CAAC;YAClC,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,iBAAiB;YACjF,gBAAgB,EAAE,IAAI,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,WAAW,CAAC;YACvF,KAAK;SACR,CAAC,CAAC;IACP,CAAC;IAEM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC1F,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,QAAQ,CAAC,WAAW,SAAS,qBAAqB,WAAW,6BAA6B,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;gBAChI,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC5C,OAAO,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,0GAA0G;YAC1G,qEAAqE;YACrE,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,2BAA2B,CAC/B,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;YAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;YAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;uBAChF,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAC7C,CAAC;oBACC,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,CAAC;YACL,CAAC;QACL,CAAC;QAED,mHAAmH;QACnH,0GAA0G;QAC1G,8GAA8G;QAC9G,uCAAuC;QACvC,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAChF,IAAI,cAAc,EAAE,UAAU,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAChC,WAAmB,EACnB,YAAoD;QAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjI,OAAO,UAAU;YACb,CAAC,CAAC,gBAAgB,UAAU,KAAK,WAAW,KAAK,YAAY,MAAM,4BAA4B,CAAC,UAAU,CAAC,EAAE;YAC7G,CAAC,CAAC,GAAG,WAAW,4BAA4B,YAAY,qCAAqC,CAAC;IACtG,CAAC;IAEM,8BAA8B,CACjC,WAAmB,EACnB,YAAoD;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;IACzC,CAAC;IAIM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,qCAAqC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAClF,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,UAAU,SAAS,kBAAkB,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,8GAA8G;YAC9G,kFAAkF;YAClF,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE;gBAC5C,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACI,gCAAgC,CAAC,WAAmB;QACvD,iGAAiG;QACjG,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QAE7G,OAAO,IAAI,CAAC,mCAAmC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;OAQG;IACI,yCAAyC,CAAC,WAAmB;QAChE,OAAO,mCAAmC,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,mCAAmC,CACvC,WAAmB,EACnB,SAAsD;QAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC;QAC9F,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAC7C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAClG,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACI,KAAK,CAAC,8BAA8B,CACvC,MAAyC,EACzC,WAAmB,EACnB,YAAoD,EACpD,SAAiB;IACjB;;;;;OAKG;IACH,OAQC;QAgBD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,4FAA4F;QAC5F,2FAA2F;QAC3F,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,4FAA4F;QAC5F,0EAA0E;QAC1E,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;eACrE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,uCAAuC,MAAM,CAAC,eAAe,uDAAuD;kBAClH,oHAAoH;kBACpH,6BAA6B,CAClC,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACpE,sFAAsF;YACtF,yFAAyF;YACzF,sFAAsF;YACtF,yDAAyD;YACzD,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,yFAAyF;sBACvF,0DAA0D,CAC/D,CAAC;YACN,CAAC;YACD,iGAAiG;YACjG,uFAAuF;YACvF,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC/H,+FAA+F;YAC/F,6FAA6F;YAC7F,kFAAkF;YAClF,MAAM,eAAe,GAAG,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,KAAK,4BAA4B,CAAC,OAAO,CAAC;YAChI,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,qBAAqB,CAAC;gBACvF,MAAM,EAAE,MAAM,CAAC,OAAQ;gBACvB,WAAW;gBACX,aAAa,EAAE,iBAAiB;gBAChC,UAAU,EAAE,cAAc;gBAC1B,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC1E,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;aACxG,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,sCAAsC,CAAC,IAAI,EAAE,GAAG,EAAE,CACpK,YAAY,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;gBACpH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,EAAE,CACvG,YAAY,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC9G,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,mBAAmB;sBACjB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;wBACxB,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,wBAAwB,SAAS,KAAK;wBAC/D,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,4BAA4B,SAAS,mDAAmD;8BAC3G,GAAG,0CAA0C,CAAC,YAAY,CAAC,GAAG,CAAC;sBACvE,iHAAiH;sBACjH,kFAAkF,CACvF,CAAC;YACN,CAAC;YACD,OAAO;gBACH,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,MAAM,EAAE,kCAAkC,CAAC,eAAe;gBAC1D,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,GAAG,CAAC,WAAW,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC;gBACtG,GAAG,CAAC,WAAW,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC;gBAChG,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;aACxE,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7F,CAAC;QAED,qFAAqF;QACrF,0FAA0F;QAC1F,kFAAkF;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,iGAAiG;kBAC/F,0DAA0D,CAC/D,CAAC;QACN,CAAC;QACD,6FAA6F;QAC7F,MAAM,EAAE,aAAa,EAAE,yBAAyB,EAAE,UAAU,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC/I,8EAA8E;QAC9E,MAAM,uBAAuB,GAAG,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,sBAAsB,CAAC,KAAK,4BAA4B,CAAC,OAAO,CAAC;QAChJ,MAAM,KAAK,GAAG,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,6BAA6B,CAAC;YAC7F,cAAc,EAAE,MAAM,CAAC,OAAQ;YAC/B,WAAW;YACX,aAAa,EAAE,yBAAyB;YACxC,UAAU,EAAE,sBAAsB;YAClC,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1E,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;SACxG,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,YAAY,EAAE,GAAG,EAAE,CAC5L,QAAQ,CAAC,qBAAqB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;YAChI,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAC/G,QAAQ,CAAC,qBAAqB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAClH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,mBAAmB;kBACjB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;oBACxB,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,4BAA4B,SAAS,KAAK;oBAC3E,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,4BAA4B,SAAS,mDAAmD;0BACnH,GAAG,0CAA0C,CAAC,YAAY,CAAC,GAAG,CAAC;kBACvE,gHAAgH;kBAChH,iDAAiD,CACtD,CAAC;QACN,CAAC;QACD,OAAO;YACH,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,kCAAkC,CAAC,uBAAuB;YAClE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YACxF,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1F,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5D,CAAC;IACN,CAAC;IACD,4FAA4F;IAE5F;;;OAGG;IACK,KAAK,CAAC,6BAA6B,CACvC,WAAmB,EACnB,YAAoD,EACpD,SAAiB,EACjB,OAAoI;QASpI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvG,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,sDAAsD,OAAO,CAAC,QAAQ,CAAC,EAAE,2CAA2C;kBAClH,sHAAsH,CAC3H,CAAC;QACN,CAAC;QACD,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACrF,IAAI,eAAe,EAAE,CAAC;YAClB,oFAAoF;YACpF,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,kCAAkC,CAAC,sBAAsB,EAAE,IAAI,EAAE,2BAA2B,CAAC,MAAM,EAAE,CAAC;QACnJ,CAAC;QACD,MAAM,uBAAuB,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;QACpH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,yCAAyC,SAAS,yBAAyB,uBAAuB,iCAAiC;cACjI,CAAC,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,KAAK,SAAS;gBACxD,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,4GAA4G,CAAC,CACtH,CAAC;IACN,CAAC;IAED;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,6BAA6B,CACtC,WAAmB,EACnB,YAAoD,EACpD,SAAiB,EACjB,OAAyH;QASzH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAChF,MAAM,mBAAmB,GAAG,IAAI,CAAC,oCAAoC,EAAE,CAAC;QACxE,IAAI,mBAAmB,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC5F,qGAAqG;QACrG,IAAI,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,UAAU,CAAC,KAAK,4BAA4B,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC1H,MAAM,mBAAmB,GAAG,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,4BAA4B,CAAC;YAClE,WAAW;YACX,aAAa;YACb,UAAU;YACV,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1E,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;SACxG,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/D,MAAM,uBAAuB,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;YACpH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,8EAA8E,aAAa,yBAAyB;kBAClH,0BAA0B,uBAAuB,oCAAoC,uBAAuB,OAAO;kBACnH,2FAA2F,CAChG,CAAC;QACN,CAAC;QACD,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,kCAAkC,CAAC,sBAAsB;YACjE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;YACtF,IAAI,EAAE,MAAM,CAAC,IAAI;SACpB,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,KAAK,CAAC,gCAAgC,CACzC,MAAyC,EACzC,WAAmB,EACnB,UAAqI,EACrI,OAAyD;QAEzD,iGAAiG;QACjG,sGAAsG;QACtG,8FAA8F;QAC9F,uGAAuG;QACvG,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1F,0GAA0G;QAC1G,yEAAyE;QACzE,MAAM,aAAa,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;QACvE,yGAAyG;QACzG,MAAM,mBAAmB,GAAG,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;eACrE,UAAU,CAAC,MAAM,KAAK,kCAAkC,CAAC,sBAAsB;eAC/E,UAAU,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,yGAAyG;YACzG,MAAM,IAAI,CAAC,oCAAoC,EAAE,EAAE,mBAAmB,CAAC;gBACnE,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,gGAAgG;YAChG,sFAAsF;YACtF,yDAAyD;YACzD,OAAO;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACpE,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,yFAAyF;YACzF,yFAAyF;YACzF,sFAAsF;YACtF,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY;gBAAE,OAAO;YACtD,MAAM,YAAY,CAAC,mBAAmB,CAAC;gBACnC,MAAM,EAAE,MAAM,CAAC,OAAO;gBACtB,WAAW;gBACX,aAAa;gBACb,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;gBACrE,UAAU,EAAE,gBAAgB;gBAC5B,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;YAAE,OAAO;QAEtF,MAAM,QAAQ,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,0FAA0F;QAC1F,6FAA6F;QAC7F,4FAA4F;QAC5F,wDAAwD;QACxD,MAAM,QAAQ,CAAC,mBAAmB,CAAC;YAC/B,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,WAAW;YACX,aAAa;YACb,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;YACrE,UAAU,EAAE,gBAAgB;YAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;YAC3F,GAAG,CAAC,UAAU,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACtH,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAChD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACK,0BAA0B,CAC9B,WAAmB;IACnB,yFAAyF;IACzF,kBAAsC,EACtC,UAAkD,EAClD,qBAAuD;QAEvD,OAAO,sCAAsC,CAAC;YAC1C,QAAQ,EAAE,IAAI;YACd,WAAW;YACX,kBAAkB;YAClB,qBAAqB;YACrB,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kFAAkF,EAAE;gBAC7H,WAAW;gBACX,UAAU;gBACV,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC;SACL,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,8BAA8B,CACxC,WAAmB,EACnB,aAAqB,EACrB,qBAAuD;QAEvD,IAAI,aAAa,KAAK,WAAW;YAAE,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iCAAiC,WAAW,gDAAgD;kBACxH,IAAI,aAAa,4EAA4E,aAAa,KAAK,CAAC;QAC1H,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAAC,WAAmB,EAAE,MAAc;QAC9D,OAAO,IAAI,sCAAsC,CAAC,aAAa,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,6FAA6F;IAC7F,4CAA4C;IAC5C,EAAE;IACF,4EAA4E;IAC5E,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,2DAA2D;IAC3D,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,EAAE;IACF,kDAAkD;IAClD,EAAE;IACF,yCAAyC;IACzC,wDAAwD;IACxD,uBAAuB;IACvB,EAAE;IACF,uFAAuF;IACvF,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,wFAAwF;IACxF,mCAAmC;IACnC,EAAE;IACF,6FAA6F;IAC7F,wDAAwD;IACxD,6FAA6F;IAE7F;;;;;;;OAOG;IACO,qCAAqC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1G,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACrB,kBAAkB,CAAC,sCAAsC,CAC5D,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACH;;;OAGG;IACO,oCAAoC;QAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,qCAAqC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzG,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IACnI,CAAC;IAES,6BAA6B;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC;YAAE,OAAO,SAAS,CAAC;QAClG,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACrB,kBAAkB,CAAC,8BAA8B,CACpD,CAAC;IACN,CAAC;IAGD;;;;;;;;;;;;;;;;;;;OAmBG;IACI,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,IAAI,YAAY,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;gBACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvD,OAAO,KAAK,CAAC;gBACjB,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,OAAO,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,8GAA8G;YAC9G,4GAA4G;YAC5G,gGAAgG;YAChG,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;gBACnD,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,eAAe,GAA2B,EAAE,CAAC;YACnD,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAChF,MAAM,iBAAiB,GAAG,cAAc,EAAE,UAAU,EAAE,SAAS,CAAC;YAChE,IAAI,iBAAiB,EAAE,CAAC;gBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBACzF,IAAI,WAAW,EAAE,CAAC;oBACd,eAAe,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC;gBACrD,CAAC;YACL,CAAC;YAED,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;gBAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;gBAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;oBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;2BAChF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;oBAClG,IAAI,WAAW,EAAE,CAAC;wBACd,eAAe,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;oBAC9D,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,qGAAqG;YACrG,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,iBAAiB;QAC1B,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;YAEhE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAE1B,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;gBACjF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;aAC/C,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACpD,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBACpC;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,uBAAuB;IACvB,mCAAmC;IAEzB,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;aACvG,CACJ,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AA7sFY,uCAAuC;IADnD,UAAU,EAAE;IAQJ,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAgCzD,WAAA,MAAM,CAAC,WAAW,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;yDAjCiD,0BAA0B;GATtG,uCAAuC,CA6sFnD;;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAI,IAAoC,EAAE,SAAwB;IACzF,OAAO,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAW;IAC1C,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC","sourcesContent":["/*\n External Providers Registry Backend Service\n \n Provides runtime access to the backend provider registry and\n * their protocol configurations, secrets, and operations.\n /\n\nimport { ExternalProviderConnectionRefusedError } from './external-provider-connection-refusal.backend';\nimport type { ProviderConnectionFacts, ProviderCredentialAddress, ProviderSharedConnections } from '@wildo-ai/saas-models';\nimport { modelIdProcessingRegionRefusal, resolveProviderConnectionRef } from '@wildo-ai/saas-models';\nimport {\n findSharedConnectionBootDefects,\n resolveDeclaredSharedConnection,\n type ResolvedProviderSharedConnection,\n} from './provider-shared-connection.backend';\nimport {\n classifyProviderConnectionScopes,\n computeProviderConnectionScopeCeiling,\n type ProviderConnectionScopeCeiling,\n type ProviderConnectionScopeSource,\n} from './provider-connection-scope-ceiling.backend';\nimport type { ProviderScopeReauthorizationOffer } from '@wildo-ai/saas-models';\nimport { createRequire } from 'node:module';\nimport { findMissingProviderRuntimePeers } from './provider-runtime-peers.backend';\nimport { join } from 'node:path';\nimport { injectable, inject, optional } from 'inversify';\nimport type { Container } from 'inversify';\nimport {\n External_Providers_Registry,\n External_Providers_RegistryItem,\n EngineCapability,\n EngineCapabilityResolutionMode,\n ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED,\n getEngineCapabilityResolutionMode,\n engineCapabilityResolutionModeTakesASelection,\n engineCapabilityPerformsCallTimeFailover,\n isEngineCapabilityEnabled,\n PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY,\n} from '@wildo-ai/saas-models';\nimport { isRuntimeSecretEnvVarName } from '@wildo-ai/platform-config-lib';\n\n/\n How the required-capability floor is evaluated on the calling host.\n \n `includeEngineFloor` — whether ENABLED members of\n * `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` count as required. True on a host\n * expected to SERVE those slots (the application backend, the platform services); false on a\n * scope-filtered host such as a minion, whose registry legitimately resolves none of them.\n * The application's own `required` flags are honoured on every host regardless.\n /\nexport interface RequiredCapabilityFloorOptions {\n includeEngineFloor: boolean;\n}\nimport {\n ExternalProvider_ExchangeProtocol_Kind,\n ExternalProvider_ExchangeProtocol_Configuration_Base,\n LLMProvider_OperationKey,\n ContentSafetyProvider_OperationKey,\n DocumentExtractionProvider_OperationKey,\n EmbeddingsProvider_OperationKey,\n APPLICATION_ENVIRONMENT,\n ProviderProtocolRuntimeKind,\n ExternalProvider_SecretScope,\n describeModuleOwnedProviderConfigurationKey,\n findModuleOwnedProviderConfigurationKeys,\n ProviderConfigurationCredentialField,\n readProviderConfigurationCredentialFields,\n} from '@wildo-ai/external-connectors-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { OrganizationProviderCredentialResolverPort } from '~wildo-backend-lib/security/connected-accounts/organization-provider-credential-resolver.port';\nimport type {\n UserProviderCredentialResolverPort,\n} from '~wildo-backend-lib/security/connected-accounts/user-provider-credential-resolver.port';\nimport type { ApplicationProviderCredentialResolverPort } from '~wildo-backend-lib/security/connected-accounts/application-provider-credential-resolver.port';\nimport type { ProviderOAuth2RefreshAudience } from '~wildo-backend-lib/security/connected-accounts/provider-oauth2-refresher.port';\nimport { ProviderSpentCredentialForm, type ProviderRefusedTokenRenewal } from '~wildo-backend-lib/security/connected-accounts/provider-spent-credential-form.backend';\nimport {\n StoredCredentialSlotStanding,\n describeCredentialsStoredUnderRetiredSlots,\n findCredentialsStoredUnderRetiredSlots,\n requireCredentialsStoredUnderRetiredSlots,\n} from '~wildo-backend-lib/security/connected-accounts/utils/retired-credential-slot.backend.utils';\nimport type { StorableCredentialSlot } from '~wildo-backend-lib/security/connected-accounts/utils/retired-credential-slot.backend.utils';\nimport { ProviderCredentialResolutionSource, ProviderCredentialSlotWriteRefusal } from '@wildo-ai/saas-models';\nimport {\n ExternalProvider_Connection_DelegationMode,\n ExternalProvider_Connection_OwnerScope,\n} from '@wildo-ai/external-connectors-models';\nimport type {\n ExternalProvider_ConnectionShape,\n ExternalProvider_ConnectionTarget,\n} from '@wildo-ai/external-connectors-models';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError, type RuntimeEnvironment } from '@wildo-ai/saas-models';\nimport { readDeclaredOutboundAdmissionEnvironment } from '~wildo-backend-lib/security/ssrf/outbound-target-admission.backend.utils';\nimport type { BackendProviderRegistryBackendService } from './backend-provider-registry.backend.service';\nimport type { ProviderProtocolRuntimeContract,\n SecretsContractEntry,\n CodingAgentHostLoginContract,\n BackendProviderModule,\n ProviderVendorRegistration,\n ProviderChatCommandFormContract,\n} from '@wildo-ai/external-connectors-private/backend';\nimport {\n describeProviderModuleAuthenticationDefects,\n describeProviderProtocolSecretRef,\n providerModuleAdmissibleConnections,\n} from '@wildo-ai/external-connectors-private/backend-runtime';\n// entrypoint-closure-waiver: `engine-capability-provider-order.backend.utils` is published only by `./assurance-derivations` (#2846 review B1).\n// It declares two functions and three interfaces, no enum, class or brand, so nothing nominal can cross; and no public signature of this\n// service names any of them (`getProvidersForEngineCapability` and `getFailoverProvidersForEngineCapability` return `string[]`; the\n// input type is only a private method's).\nimport {\n failoverProvidersForEngineCapability,\n orderProvidersForEngineCapability,\n type EngineCapabilityProviderOrderInput,\n} from './engine-capability-provider-order.backend.utils';\nimport type { Hook_Endpoint, ProviderRestOAuth2 } from '@wildo-ai/external-connectors-models';\nimport {\n AgentClientProtocol_AuthMode,\n AgentClientProtocol_ExecutionProfileSchema,\n AgentClientProtocol_HostConfigurationInheritance,\n AgentClientProtocol_PermissionCeiling,\n AgentClientProtocol_RunnerHost,\n AgentClientProtocol_WorkingDirectoryPolicy,\n CodingAgent_OperationKey,\n type AgentClientProtocol_Configuration,\n type AgentClientProtocol_ExecutionProfile,\n} from '@wildo-ai/external-connectors-models';\n\n/\n Provider-contract operation literal → the semantic coding operation key. The\n * contract package uses short literals so it need not depend on the operation\n * family that consumes it; this map is the single translation.\n /\nconst RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION: Record<string, CodingAgent_OperationKey> = {\n runCodingTask: CodingAgent_OperationKey.RUN_CODING_TASK,\n};\n\n/\n The runtime projection of an ACP provider's transport capability.\n \n Far smaller than a request/response protocol's, because ACP agents advertise\n * their own capabilities, modes and commands during `initialize` /\n * `session/new`. Re-declaring any of that in authored configuration would\n * create a second source of truth that drifts the first time the agent is\n * upgraded — so what remains is only what the HOST must know before it opens a\n * connection.\n /\nexport type RuntimeAgentClientProtocolProfile = {\n /* How the provider says to START its agent — the authority an application inherits. /\n agentCommand: string;\n agentArgs: string[];\n supportedOperationKeys: CodingAgent_OperationKey[];\n supportedModels: string[];\n supportedProtocolVersions: number[];\n sessionMetaExtensions?: Record<string, unknown>;\n /* How this agent expresses each isolation posture; an absent posture is refused, never substituted. /\n sessionMetaExtensionsByHostConfigurationInheritance?: Partial<Record<string, Record<string, unknown>>>;\n /\n How the selected model reaches this agent. Absent means the provider\n * declared none, and a run that selected a model is refused rather than\n * started with the choice silently dropped.\n /\n modelDelivery?:\n \| { channel: 'environment-variable'; environmentVariableName: string }\n \| { channel: 'session-config-option'; configId: string };\n /\n Semantic model id → this agent's own spelling, where the two differ.\n \n Absent, or absent for a given model, means the semantic id is sent\n * unchanged — correct for every agent whose vocabulary already is Wildo's.\n /\n modelTransportIds?: Record<string, string>;\n /* Agent-vocabulary session-mode ids to prefer per ceiling; an optimisation, never the guarantee. /\n sessionModeIdsByPermissionCeiling?: Partial<Record<string, string[]>>;\n /\n The auth modes the PROVIDER declares its agent can actually use.\n \n Carried so an application-authored profile can be validated against it.\n * The contract's list previously reached only the synthesized `default`\n * profile, so an authored profile could declare any mode and nothing checked\n * whether the agent supports it.\n /\n supportedAuthModes?: string[];\n /\n Host environment variables the AGENT ITSELF needs, declared by its provider.\n \n Distinct from the execution profile's list, which is application policy.\n * This one is provider knowledge — which variable an agent reads to find its\n * own credentials is not something an application can be expected to know —\n * and it is UNIONED with the profile's rather than replaced by it.\n /\n inheritedEnvironmentVariables?: string[];\n /\n How to ask the host whether this agent's operator is signed in, without a model call — the\n * provider's declaration, carried so a runtime can refuse a dispatch to a signed-out agent before\n * spawning it rather than discover the login on the first prompt (#1637).\n /\n hostLogin?: CodingAgentHostLoginContract;\n};\nimport { ExternalProvider_Auth_Kind } from '@wildo-ai/external-connectors-models';\nimport {\n ExternalProviderSelectionAuthorityKind,\n ExternalProviderSelectionOverrideStatus,\n type ExternalProviderSelectionResolutionEvidence,\n} from '~wildo-backend-lib/external-providers/models/provider-selection-resolution-evidence.backend.definitions';\n\n/\n F-6 (2026-05-06) — runtime-side projection of a resolved provider\n * configuration. The base schema (`ExternalProvider_ExchangeProtocol_Configuration_Base`)\n * lives in `external-connectors-models` (which can't import the\n * backend-only discriminated union); we extend it here at the consumer\n * boundary so callers narrow on `runtimeContract.kind` instead of\n * casting through `as any`.\n \n Optional fields beyond the base also appear on this projection:\n \n - `defaultExecutionProfileRef` / `executionProfiles` — set by\n * `getDefaultProviderConfiguration` for `kind: ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL`\n * contracts, consumed by `getAgentClientProtocolProfile` and the ACP runner.\n * - `endpoints` — set for `kind: ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR`.\n \n They stay typed as `unknown` here because their canonical schemas\n * live in `external-connectors-models`'s `AgentClientProtocol_Configuration` /\n * webhook surfaces and are narrowed at consumer sites already.\n /\nexport type ResolvedProviderConfiguration =\n & ExternalProvider_ExchangeProtocol_Configuration_Base\n & {\n runtimeContract?: ProviderProtocolRuntimeContract;\n defaultExecutionProfileRef?: string;\n executionProfiles?: Record<string, unknown>;\n /\n Webhook-originator endpoint descriptors emitted by\n * `buildWebhookEndpoints` 2026-05-06: now matches the canonical\n * `Hook_Endpoint` shape (with the optional `displayName` field).\n * The dead extras (`providerRef`, `path`, `secretBinding`) that\n * previously polluted the emit have been removed; their values\n * were redundant with information already carried by other\n * fields (controller loop key, route convention, `authConfig.secretRef`).\n /\n endpoints?: ReadonlyArray<Hook_Endpoint>;\n };\n\n\nconst DEFAULT_IDENTITY_ENVIRONMENTS = [\n APPLICATION_ENVIRONMENT.DEVELOPMENT,\n APPLICATION_ENVIRONMENT.STAGING,\n APPLICATION_ENVIRONMENT.PRODUCTION,\n];\n\nfunction isCompanionRuntimeServiceName(serviceName: string): boolean {\n const normalized = serviceName.trim().toLowerCase();\n return normalized === 'companion'\n \|\| normalized === 'wildo-dev-companion'\n \|\| normalized.endsWith('-companion');\n}\n\nconst RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION: Record<string, LLMProvider_OperationKey> = {\n generateText: LLMProvider_OperationKey.GENERATE_TEXT,\n streamText: LLMProvider_OperationKey.STREAM_TEXT,\n chatCompletion: LLMProvider_OperationKey.CHAT_COMPLETION,\n chatMultimodal: LLMProvider_OperationKey.CHAT_MULTIMODAL,\n generateStructured: LLMProvider_OperationKey.GENERATE_STRUCTURED,\n streamStructured: LLMProvider_OperationKey.STREAM_STRUCTURED,\n // The `Thinking` runtime operation names were RETIRED 2026-07-17 — reasoning\n // depth is the `reasoningEffort` PARAMETER, not a separate operation.\n};\n\n/*\n The embeddings protocol's OWN runtime-op → semantic-key map (RAG plan DL2/H4 surface 1):\n * embeddings operations never enter {@link RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION}, whose\n * `toSemanticOperationKeys` filter would silently DROP any key outside `LLMProvider_OperationKey`\n * — the exact fall-through a sixth LLM operation key would have died in. Disjoint kind, disjoint map.\n /\nconst RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION: Record<string, EmbeddingsProvider_OperationKey> = {\n embedTexts: EmbeddingsProvider_OperationKey.EMBED_TEXTS,\n};\n\n/\n The document-extraction protocol's OWN runtime-op → semantic-key map, for the same reason its\n * embeddings sibling above has one: each protocol kind owns a disjoint operation vocabulary, so a\n * key never falls through a foreign filter and silently disappears.\n /\nconst RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION: Record<string, DocumentExtractionProvider_OperationKey> = {\n extractDocumentText: DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT,\n};\n\n/* The content-safety protocol's own runtime-op → semantic-key map (#2292), disjoint like its siblings above. /\nconst RUNTIME_CONTENT_SAFETY_OPERATION_TO_SEMANTIC_OPERATION: Record<string, ContentSafetyProvider_OperationKey> = {\n screenPromptInjection: ContentSafetyProvider_OperationKey.SCREEN_PROMPT_INJECTION,\n moderateOutput: ContentSafetyProvider_OperationKey.MODERATE_OUTPUT,\n};\n\ninterface RuntimeProviderScopeSelection {\n engineCapabilities?: EngineCapability[];\n /\n The protocols this runtime uses the provider through, as authored: `BUILTIN_PROVIDER_PROTOCOL` keys, which are the\n * MEMBER NAMES of `ExternalProvider_ExchangeProtocol_Kind` (`AGENT_CLIENT_PROTOCOL`, not `agent_client_protocol`).\n * The gate of {@link ExternalProvidersRegistryBackendService.isProviderEnabled} (#2805).\n /\n protocols?: string[];\n}\n\n/* The authored key of a protocol kind: its enum member NAME, which is how a scope entry spells it. /\nfunction scopeKeyOfProtocolKind(protocolKind: ExternalProvider_ExchangeProtocol_Kind): string \| undefined {\n return (Object.keys(ExternalProvider_ExchangeProtocol_Kind) as Array<keyof typeof ExternalProvider_ExchangeProtocol_Kind>)\n .find((member) => ExternalProvider_ExchangeProtocol_Kind[member] === protocolKind);\n}\n\ninterface RuntimeProviderScope {\n providers?: Record<string, RuntimeProviderScopeSelection \| undefined>;\n selection?: Partial<Record<EngineCapability, {\n primary: string;\n whenUnavailable?: string[];\n failover?: string[];\n }>>;\n}\n\n\n/\n * `PROVIDER_ADMISSIBLE_CONNECTIONS_FLOOR` (external-connectors-private, read through `providerModuleAdmissibleConnections`):\n * what a provider admits when NOBODY HAS JUDGED IT — the SAFETY NET, not the answer.\n \n Named and stated once because it was previously an anonymous literal inlined at two call sites, and since #3398\n * it lives beside the module checks so they and this registry read one default,\n * and a value that applies to most of the catalogue should be readable as the decision it is.\n \n ONE row, and it is the conservative end deliberately. APPLICATION x SERVICE is the deployment's\n * own credential, authored in the environment by the operator — the only claim that needs no\n * knowledge of the vendor whatsoever.\n \n It was briefly widened to include ORGANIZATION x SERVICE, with a careful argument that a tenant\n * bringing its own key is a fact about Wildo's tenancy model rather than about any vendor. The\n * argument holds and the change was still wrong: it made a blanket rule decide for 688 vendors at\n * once, which is precisely the per-vendor judgement this framework refuses to shortcut. A default\n * that carries the whole catalogue is not a fallback — it is mass management with a justification\n * attached, and the justification is what makes it hard to notice.\n \n So a provider earns every row beyond this one by somebody ANALYSING it and recording why, as a registry\n * provider's own `admissibleConnections` does (`providers-registry/asana/`), and as the archived catalogue's\n * `_code_archive/providers/catalogue-record/decisions/slack.json` did. The population that needs that judgement\n * is far smaller than the catalogue: 99 of the 689 transposed vendors declare an OAuth2 contract,\n * and only those have a connection flow to admit anybody to.\n /\n\n/\n One declared secret slot of a provider, as a SCREEN needs it.\n \n Carries the slug so a form can name the field without anybody typing it, the environment variable\n * so an operator knows exactly what to set, and `configured` so a missing one can be reported rather\n * than discovered by pressing a button. It carries no VALUE, and there is no field for one.\n /\n/\n The OAuth client a connect, refresh or revocation must use — see\n * `ExternalProvidersRegistryBackendService.getConnectionOAuth2Client` (#1725).\n /\nexport interface ProviderConnectionOAuth2Client {\n /* The connection's identity: the declared base, or the ref itself when undeclared. /\n readonly connectionRef: string;\n /* The ref the flow came through. Recorded and audited; never the client's owner for a member. /\n readonly providerRef: string;\n /* The OWNER's REST OAuth2 block — endpoints, scopes, allowances, audiences. /\n readonly oauth2: ProviderRestOAuth2;\n /* The owner's REST contract, for the deployment base URL and the deployment-configured hosts. /\n readonly restContract: Extract<ProviderProtocolRuntimeContract, { kind: typeof ProviderProtocolRuntimeKind.REST }>;\n /* The client is the owner's sign-in registration (`sharedWithSignIn`) rather than its connected-account one. /\n readonly sharedWithSignIn: boolean;\n}\n\nexport interface ProviderSecretSlot {\n readonly slug: string;\n readonly envVarName: string;\n readonly required: boolean;\n readonly description: string;\n readonly scope: ExternalProvider_SecretScope;\n /* Whether the deployment environment supplies it. Never the value itself. /\n readonly configured: boolean;\n /* Present when the contract marks the slot as holding a deployment host (see `SecretsContractEntry.holdsDeploymentHost`). /\n readonly holdsDeploymentHost?: true;\n /* Present when the contract marks the slot as holding a vendor value made for browsers (see `SecretsContractEntry.holdsBrowserPublicValue`). /\n readonly holdsBrowserPublicValue?: true;\n}\n\n\n/\n How an operator provides an application-owned provider secret (#1637) — one wording for every refusal\n * that reaches a person because a key is missing, so each names the same door: `wildo secrets set`, or\n * the workbench's Secrets section, which runs it.\n /\nexport function describeProviderSecretRemedy(envVarName: string): string {\n return `Provide it with \\`wildo secrets set ${envVarName}\\` (add \\`--env <environment>\\` for a remote one) or in the workbench's `\n + 'Secrets section; the runtimes that read it restart to pick it up.';\n}\n\n@injectable()\nexport class ExternalProvidersRegistryBackendService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n protected registry: External_Providers_Registry \| null = null;\n\n protected isInitialized = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) protected readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) protected readonly configService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) protected readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) protected readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n /\n The container, used ONLY to resolve the per-organization credential store on demand\n * ({@link resolveOrganizationCredentialResolver}). OPTIONAL, and appended LAST so no\n * existing parameter position moves.\n \n *Deliberately NOT a constructor injection of\n {@link OrganizationProviderCredentialResolverPort}.** `@optional()` tolerates an ABSENT\n * BINDING; it does not defer construction. So injecting the port directly made this\n * configuration-tier registry construct the entire resource stack that stands behind the\n * store — and that stack closes a cycle straight back here:\n \n ```\n * SaaS.AuditLogSink → CompositeAuditLogSink → ExternalProvidersRegistryService\n * → OrganizationProviderCredentialResolver (the store)\n * → SystemAccessService / AuditLogsService → SaaS.AuditLogSink\n * ```\n \n which InversifyJS reports as `Circular dependency found: (No dependency trace)` +\n * `RangeError: Maximum call stack size exceeded` at BOOT — every platform service and every\n * application backend, since `AuditLogsBackendService` injects the sink. The same edge\n * poisons `LlmObservabilityAgentCallTraceSink`, which depends on this registry too.\n \n Resolving on demand is also what the port's own contract already assumed: this service is\n * constructed at configuration tier, BEFORE repositories exist, while a tenant credential is\n * only ever needed once a request is being served. Lazy-container is the pattern\n * `AuthorizationsBackendService` and `WebSocketService` use to break their own cycles.\n \n When the container is absent (a unit harness) or the store is unbound (a minion resolving\n * an LLM key), no tenant has its own credential here and resolution falls through to the\n * deployment environment — the behaviour every caller had before the store existed.\n /\n @inject('Container') @optional() protected readonly container?: Container,\n ) {\n this.logDebug = this.logger.debugByType('ExternalProvidersRegistryBackendService');\n this.logger.setDebugTypeLogging('ExternalProvidersRegistryBackendService', false);\n\n this.logDebug('External providers registry service created (not yet initialized)');\n }\n\n // ================================\n // Initialization Method\n // ================================\n\n /\n Initialize by projecting first-class backend provider modules into the\n * runtime registry facade used by existing callers.\n /\n public async initialize(): Promise<void> {\n if (this.isInitialized) {\n this.logDebug('Service already initialized, skipping');\n return;\n }\n\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.reportMissingProviderRuntimePeers();\n\n this.registry = registry;\n\n this.isInitialized = true;\n try {\n this.assertSharedConnectionsCoherent();\n this.assertDeclaredAudiencesCoherent();\n } catch (error) {\n // A host that refused its shared connections is not initialized: nothing may resolve a grant through\n // a declaration this boot has just proven wrong.\n this.isInitialized = false;\n this.registry = null;\n throw error;\n }\n this.logDebug('External providers registry initialized from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n }\n\n /\n @wildo_source:part:start saas.backend.providers.optional-runtime-peers facet:layer:backend facet:audience:app-developer\n \n Report a registered provider whose optional runtime peer is not installed (#438).\n \n What this means for an application: a provider may lazy-load a vendor SDK. A provider package\n * your application installs (`wildo registry add`) carries its SDK as its own dependency, so\n * installing the package installs it. An engine-shipped provider does not: declaring it in a scope\n * does not install its SDK. YOU install it, in the runtime that enables the provider — which is your\n * own `backend-api`, not the engine package — and if you do not, the capability that provider serves\n * quietly does not work.\n \n The startup warning names the provider and the missing packages, so read it as an\n * installation instruction rather than as noise.\n \n `requiredPackages` declares the npm packages a provider LAZY-LOADS — a vendor SDK that is never\n * an ENGINE dependency: an engine-shipped provider's is installed by the runtime that enables it, a\n * provider package's is that package's own dependency. The engine's immudb declares it\n * (`immudb-node`), as does the registry PostHog package (`posthog-node`), and\n * until 2026-09-08 the field had NO READER anywhere: no start-up check, no installation step,\n * no diagnostic. A provider could be registered with its SDK absent and the first sign was the\n * feature quietly not working.\n \n A REPORT, never a refusal, and the asymmetry is deliberate: a declared provider may\n * legitimately never be reached (a fan-out audit sink in an environment that emits nothing),\n * so an absent optional peer is information rather than a misconfiguration. The capability\n * DISAGREEMENT check in `define-saas-config` refuses, because a wrong declaration is wrong\n * whatever happens next.\n \n Resolution is attempted from the RUNNING APPLICATION first and from this module second. The\n * peer is installed in the application's own `backend-api`, not in the engine package, so\n * resolving only from here would report a false absence — and a diagnostic that cries wolf is\n * worse than the silence it replaces. For the same reason an application-owned provider is also\n * asked from its OWN package (#2579, {@link findMissingProviderRuntimePeers}): its SDK is that\n * package's dependency, which is where its lazy import resolves from.\n /\n private reportMissingProviderRuntimePeers(): void {\n const resolvers = [\n (() => { try { return createRequire(join(process.cwd(), 'package.json')); } catch { return undefined; } })(),\n (() => { try { return createRequire(import.meta.url); } catch { return undefined; } })(),\n ].filter((resolver): resolver is NodeRequire => Boolean(resolver));\n\n for (const { providerRef, missingPackages } of findMissingProviderRuntimePeers(this.backendProviderRegistry.getRegistry().modules.values(), resolvers)) {\n this.logger.warn('Provider is registered without its declared optional runtime peer(s)', {\n providerRef,\n missingPackages,\n detail: 'The provider lazy-loads these and degrades without them, so the capability it serves will not work. '\n + 'Install them in the runtime that enables this provider, or stop declaring the provider in that scope.',\n });\n }\n }\n /* @wildo_source:part:end saas.backend.providers.optional-runtime-peers /\n\n private buildRuntimeRegistryFromProviderModules(): External_Providers_Registry {\n const registry: External_Providers_Registry = {};\n for (const provider of this.backendProviderRegistry.getRegistry().modules.values()) {\n const providerRef = provider.metadata.ref;\n const protocols = this.backendProviderRegistry.getProtocolKinds(providerRef);\n const engineCapabilities = provider.providerCapabilities\n .map((capability) => PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability])\n .filter((capability): capability is EngineCapability => Boolean(capability));\n\n registry[providerRef] = {\n providerRef,\n protocols,\n engineCapabilities: [...new Set(engineCapabilities)],\n supportsOAuth2: protocols.includes(ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2) \|\| undefined,\n };\n }\n return registry;\n }\n\n // ================================\n // Access Methods\n // ================================\n\n public getExternalProvidersRegistry(): External_Providers_Registry {\n this.ensureInitialized();\n return this.registry!;\n }\n\n public getProviderTypes(): string[] {\n this.ensureInitialized();\n return Object.keys(this.registry!);\n }\n\n public getProvider(providerRef: string): External_Providers_RegistryItem \| undefined {\n this.ensureInitialized();\n return this.registry![providerRef];\n }\n\n public hasProvider(providerRef: string): boolean {\n this.ensureInitialized();\n return providerRef in (this.registry \|\| {});\n }\n\n /\n Public, NON-throwing readiness probe — whether `initialize()` has run.\n * Lets lazy consumers (e.g. `CompositeAuditLogSink`) distinguish the expected\n * pre-startup window (skip silently, retry later) from a genuine post-init\n * resolution fault (which must be surfaced, not swallowed) — without tripping\n * the `ensureInitialized()` throw just to probe.\n /\n public isReady(): boolean {\n return this.isInitialized;\n }\n\n /\n The providers that serve a capability on this runtime, the one asked first at the head: the registry's facts\n * (definitions, configuration, scope, the per-environment override) handed to `orderProvidersForEngineCapability`,\n * the one ordering rule, which an evidence collector runs too (#2846 review B1).\n /\n public getProvidersForEngineCapability(capability: EngineCapability): string[] {\n return orderProvidersForEngineCapability(this.buildProviderOrderInput(capability));\n }\n\n /\n The providers that may take a call the `attemptedProviderRefs` failed TRANSIENTLY (#2301), in declared order: the\n * runtime scope's `failover` list for the capability, narrowed by the SAME eligibility a selected provider passes\n * (`failoverProvidersForEngineCapability`). Empty for a capability whose consumer performs no call-time failover.\n * Which failures are transient is the consumer's decision (`DocumentExtractionBackendService` for\n * `AI_DOCUMENT_EXTRACTION`); this only answers who may be asked next.\n /\n public getFailoverProvidersForEngineCapability(capability: EngineCapability, attemptedProviderRefs: readonly string[]): string[] {\n return failoverProvidersForEngineCapability({ ...this.buildProviderOrderInput(capability), attemptedProviderRefs });\n }\n\n /\n The `failover` list the runtime scope's selection DECLARES for a capability (#2301), as authored and before any\n * eligibility narrowing. What `getFailoverProvidersForEngineCapability` hands out is this list narrowed; a consumer's\n * startup check compares the two to refuse a declared provider this runtime cannot reach (not loaded, which includes a\n * data residency refusal at load, or not declared for the capability in this scope) instead of discovering it during\n * the outage the declaration exists for. Empty for a capability whose consumer performs no call-time failover.\n /\n public getDeclaredFailoverProviders(capability: EngineCapability): string[] {\n if (!engineCapabilityPerformsCallTimeFailover(capability)) return [];\n this.ensureInitialized();\n return [...(this.getActiveRuntimeProviderScope()?.selection?.[capability]?.failover ?? [])];\n }\n\n /* The registry's facts for one capability, as the ordering rule and the failover rule both read them. /\n private buildProviderOrderInput(capability: EngineCapability): EngineCapabilityProviderOrderInput {\n this.ensureInitialized();\n const configured = this.configService.isInitialized();\n const selectionOverride = this.getProviderSelectionOverride(capability);\n return {\n capability,\n registeredProviders: Object.values(this.registry!).map((provider) => ({ providerRef: provider.providerRef, engineCapabilities: provider.engineCapabilities })),\n ...(configured\n ? {\n configuration: {\n capabilityEnabled: isEngineCapabilityEnabled(this.configService.config.engineCapabilities, capability),\n runtimeScope: this.getActiveRuntimeProviderScope(),\n configuredProviderRefs: new Set(Object.keys(this.configService.config.providerConfigurations ?? {})\n .filter((providerRef) => Boolean(this.configService.config.providerConfigurations?.[providerRef]))),\n },\n }\n : {}),\n ...(selectionOverride ? { selectionOverride } : {}),\n };\n }\n\n /\n Whether this runtime's configuration DECLARES a provider for `capability`, whether or not one was loaded: the\n * capability is enabled and the runtime's scope lists a provider with it, or a selection (the per-environment override\n * or the scope's own) names one. Unlike {@link getProvidersForEngineCapability}, a provider that the configuration\n * declares and that did not load (a data residency refusal at load, a module missing) still counts.\n \n Read by the agent guardrail waiver (#2292): an environment that runs its agents unguarded \"where no classifier is\n * declared\" must not be waived because a declared classifier FAILED to load; that is a failure, not the absence the\n * environment declared. `true` while the configuration is not loaded, since nothing can say it declares none.\n /\n public declaresProviderForEngineCapability(capability: EngineCapability): boolean {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) return true;\n if (!isEngineCapabilityEnabled(this.configService.config.engineCapabilities, capability)) return false;\n const scope = this.getActiveRuntimeProviderScope();\n if (!scope) return false;\n if (this.getProviderSelectionOverride(capability) \|\| scope.selection?.[capability]) return true;\n return Object.values(scope.providers ?? {}).some((entry) => (entry?.engineCapabilities ?? []).includes(capability));\n }\n\n public getPrimaryProviderForEngineCapability(capability: EngineCapability): string \| undefined {\n return this.getProvidersForEngineCapability(capability)[0];\n }\n\n /\n Resolve the provider ref(s) that should be ACTIVE for a capability,\n * honouring its declared `EngineCapabilityResolutionMode`:\n * - `SELECT_ONE` (the default — billing, email, observability, …): the\n * single primary, as a 0- or 1-element list. A declared `whenUnavailable` entry\n * only orders the candidate list ahead of this call — it substitutes for a\n * primary that is not AVAILABLE. A call the primary FAILED is handed on only by\n * a consumer that performs call-time failover, through\n * {@link getFailoverProvidersForEngineCapability} (#2301), never through this list.\n * - `FAN_OUT` (e.g. `COMPLIANCE_AUDIT_TRAIL`): EVERY declared + available\n * provider — all active simultaneously (no primary, no failover).\n * - `BOUND_PER_PURPOSE` (`KEY_MANAGEMENT`, #2891): every declared provider; which one\n * serves a purpose is the `keyManagement` binding's answer, never this list's order.\n \n The single entry point a fan-out consumer (the `CompositeAuditLogSink`)\n * uses, so the resolution mode is honoured centrally rather than each\n * consumer choosing `getPrimary…` vs `getProviders…` by convention.\n /\n public getResolvedProviderRefsForCapability(capability: EngineCapability): string[] {\n const mode = getEngineCapabilityResolutionMode(capability);\n switch (mode) {\n case EngineCapabilityResolutionMode.FAN_OUT:\n return this.getProvidersForEngineCapability(capability);\n case EngineCapabilityResolutionMode.BOUND_PER_PURPOSE:\n // Every declared provider is active for the purposes bound to it (#2891). WHICH provider serves a given\n // purpose is the key-management resolver's answer, from the `keyManagement` binding, never this list's\n // order: a consumer of keys asks by purpose and never picks from here.\n return this.getProvidersForEngineCapability(capability);\n case EngineCapabilityResolutionMode.SELECT_ONE: {\n const primary = this.getPrimaryProviderForEngineCapability(capability);\n return primary ? [primary] : [];\n }\n default:\n return assertNeverResolutionMode(mode);\n }\n }\n\n public isEngineCapabilityAvailable(capability: EngineCapability): boolean {\n return this.getProvidersForEngineCapability(capability).length > 0;\n }\n\n /\n G4 (audit Phase 5) — fail-open reconcile support. Whether a capability is\n * switched ON in `engineCapabilities` config (`activation.enabled === true`),\n * INDEPENDENT of whether any provider resolves to serve it. Distinct from:\n * - `isEngineCapabilityAvailable` — a provider is DECLARED (says nothing about\n * the operator's config intent), and\n * - `getRequiredCapabilitiesWithoutProvider` — a HARD requirement is unmet\n * (throws at boot; F5).\n * The G4 warn pairs this (\"the operator turned audit on\") with a zero-resolved-\n * provider check (\"but nothing is delivering it\") to flag a SILENT Layer-2\n * fan-out — a warn, never a throw.\n /\n public isEngineCapabilityEnabled(capability: EngineCapability): boolean {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n // An always-enabled capability (#2891) is on before configuration is read too: nothing can switch it off.\n return isEngineCapabilityEnabled(undefined, capability);\n }\n return isEngineCapabilityEnabled(this.configService.config.engineCapabilities, capability);\n }\n\n /\n F5 (audit Phase 5) — boot-guard support. Returns every capability the app\n * marked `activation.required === true` that resolves to ZERO active providers\n * (respecting the capability's resolution mode — SELECT_ONE needs a primary,\n * FAN_OUT needs ≥1 declared; a `required` capability left `enabled: false`\n * resolves to none and is therefore also caught). A non-empty result means a\n * misconfigured deployment — a HARD requirement with nothing to serve it — and\n * `StartApplicationBackendService.initialize()` throws CONFIGURATION on any.\n * Audit (`COMPLIANCE_AUDIT_TRAIL`, when marked required) is the FIRST user, not\n * a special case: this generalizes the coherence to EVERY capability.\n /\n public getRequiredCapabilitiesWithoutProvider(\n options: RequiredCapabilityFloorOptions = { includeEngineFloor: true },\n ): EngineCapability[] {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n // Used to answer `[]` here, which read as \"nothing missing\" on a host whose config\n // had never loaded — a floor that cannot see its inputs must refuse, not reassure.\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'The required-capability floor was evaluated before the application configuration '\n + 'was initialized; it cannot decide what is required.',\n },\n });\n }\n const activations = this.configService.config.engineCapabilities ?? {};\n const missing: EngineCapability[] = [];\n // Swept over the ENUM, not over the authored keys (#328), so the population and its order\n // are the engine's. Requiredness itself always needs an activation entry — an absent key is\n // neither `enabled` nor `required` — so this is about which list is authoritative, not about\n // catching an omitted key.\n for (const capability of Object.values(EngineCapability)) {\n const activation = activations[capability];\n const requiredByApplication = activation?.required === true;\n const requiredByEngine = options.includeEngineFloor\n && isEngineCapabilityEnabled(activations, capability)\n && ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED.has(capability);\n if (\n (requiredByApplication \|\| requiredByEngine)\n && this.getResolvedProviderRefsForCapability(capability).length === 0\n ) {\n missing.push(capability);\n }\n }\n return missing;\n }\n\n /\n The floor as a single fail-closed door (#328): every host that serves the application\n * calls this after its registry is ready — the application backend, and the platform\n * services after `refreshFromConfig()` — so \"required with nothing serving it\" cannot pass\n * one host's boot because the check happened to live on another's branch.\n /\n public assertRequiredCapabilityFloor(options?: RequiredCapabilityFloorOptions): void {\n const missingRequiredCapabilities = this.getRequiredCapabilitiesWithoutProvider(options);\n if (missingRequiredCapabilities.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Required engine capabilities resolve no active provider: [${missingRequiredCapabilities.join(', ')}]. `\n + 'Each is either marked `required` in engineCapabilities or is an engine flow that needs a provider '\n + 'the moment it is enabled (EMAIL_TRANSACTIONAL, BILLING, SMS) — declare a provider for it '\n + '(SELECT_ONE needs a primary; FAN_OUT needs ≥1 declared), or disable the capability.',\n missingRequiredCapabilities,\n },\n });\n }\n\n /\n Per-environment external-provider selection override, read once from\n * `process.env.WILDO_PROVIDER_SELECTION_OVERRIDES` (a JSON map of\n * `EngineCapability -> { primary, whenUnavailable? }`). Projected by the Wildo\n * CLI's `env-vars-builder` from `wildo.infra.<env>.config.ts > providerSelection`.\n * Read as a string literal (not via a `platform-config-lib` import) to\n * preserve the engine → platform dependency direction — mirrors how\n * `LoggerService` reads `LOG_LEVEL` and `otel-preload` reads `OTEL_ENABLED`.\n \n Memoized on first read: env vars are fixed for a process lifetime, and\n * `getProvidersForEngineCapability` is a hot path. A malformed value is\n * tolerated (logged + ignored) so a bad override degrades to the SaaS-config\n * selection rather than breaking provider resolution.\n /\n private providerSelectionOverridesCache?: Partial<Record<EngineCapability, { primary: string; whenUnavailable?: string[] }>>;\n private providerSelectionOverridePayloadMalformed = false;\n private readonly malformedProviderSelectionOverrides = new Set<EngineCapability>();\n\n private getProviderSelectionOverride(\n capability: EngineCapability,\n ): { primary: string; whenUnavailable?: string[] } \| undefined {\n if (this.providerSelectionOverridesCache === undefined) {\n const raw = process.env.WILDO_PROVIDER_SELECTION_OVERRIDES;\n if (!raw) {\n this.providerSelectionOverridesCache = {};\n } else {\n try {\n const parsed = JSON.parse(raw) as unknown;\n if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n this.providerSelectionOverridesCache = parsed as Partial<Record<EngineCapability, { primary: string; whenUnavailable?: string[] }>>;\n } else {\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n } catch (error) {\n this.logDebug('Failed to parse WILDO_PROVIDER_SELECTION_OVERRIDES; ignoring per-env override', {\n error: describeCaughtError(error),\n });\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n }\n }\n const override = this.providerSelectionOverridesCache[capability];\n // Guard the shape defensively — a hand-crafted env var could carry a\n // non-conforming entry that upstream Zod validation never saw.\n if (override === undefined) return undefined;\n if (\n typeof override.primary !== 'string'\n \|\| override.primary.length === 0\n \|\| (override.whenUnavailable !== undefined && (\n !Array.isArray(override.whenUnavailable)\n \|\| !override.whenUnavailable.every((substitute) => typeof substitute === 'string' && substitute.length > 0)\n ))\n ) {\n this.malformedProviderSelectionOverrides.add(capability);\n return undefined;\n }\n return override;\n }\n\n /\n Sanitized provenance for the effective provider selection. This exposes\n * neither environment bytes nor provider configuration; it only preserves\n * which authority won and the generated artifact identities behind it.\n /\n public getProviderSelectionResolutionEvidence(capability: EngineCapability): ExternalProviderSelectionResolutionEvidence {\n this.ensureInitialized();\n const runtimeSelection = this.getActiveRuntimeProviderScope()?.selection?.[capability];\n const environmentSelection = this.getProviderSelectionOverride(capability);\n const overrideMalformed = this.providerSelectionOverridePayloadMalformed \|\| this.malformedProviderSelectionOverrides.has(capability);\n return Object.freeze({\n authorityKind: environmentSelection\n ? ExternalProviderSelectionAuthorityKind.ENVIRONMENT_OVERRIDE\n : runtimeSelection\n ? ExternalProviderSelectionAuthorityKind.APPLICATION_RUNTIME_ARTIFACT\n : ExternalProviderSelectionAuthorityKind.DEFAULT_RESOLUTION,\n overrideStatus: overrideMalformed\n ? ExternalProviderSelectionOverrideStatus.MALFORMED\n : environmentSelection\n ? ExternalProviderSelectionOverrideStatus.APPLIED\n : ExternalProviderSelectionOverrideStatus.ABSENT,\n applicationPrimaryProviderRef: runtimeSelection?.primary ?? null,\n applicationSubstituteProviderRefs: Object.freeze([...(runtimeSelection?.whenUnavailable ?? [])]),\n applicationFailoverProviderRefs: Object.freeze([...(runtimeSelection?.failover ?? [])]),\n environmentPrimaryProviderRef: environmentSelection?.primary ?? null,\n environmentSubstituteProviderRefs: Object.freeze([...(environmentSelection?.whenUnavailable ?? [])]),\n providerRuntimeArtifact: this.configService.getProviderRuntimeArtifactEvidenceMetadata(),\n });\n }\n\n private getActiveRuntimeProviderScope(): RuntimeProviderScope \| undefined {\n if (!this.configService.isInitialized()) {\n return undefined;\n }\n\n const scopes = this.configService.config.providers?.scopes;\n if (!scopes) {\n return undefined;\n }\n\n const serviceName = typeof (this.configService as { serviceName?: string }).serviceName === 'string'\n ? (this.configService as { serviceName?: string }).serviceName!\n : '';\n if (scopes.companion && isCompanionRuntimeServiceName(serviceName)) {\n return scopes.companion as RuntimeProviderScope;\n }\n\n return scopes.backend as RuntimeProviderScope \| undefined;\n }\n\n /\n Get provider configuration for a specific protocol.\n * Falls back to default configuration from cached provider definitions if not overridden.\n /\n public getProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n this.ensureInitialized();\n try {\n if (!this.configService.isInitialized()) {\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n const appConfig = this.configService.config;\n const providerConfigs = appConfig.providerConfigurations \|\| {};\n\n const defaultConfig = this.getDefaultProviderConfiguration(providerRef, protocolKind);\n const customConfig = providerConfigs[providerRef]?.[protocolKind];\n this.refuseModuleOwnedConfigurationKeys(providerRef, protocolKind, customConfig);\n this.assertAuthoredCredentialFieldsAdmitted(providerRef, protocolKind, customConfig);\n if (customConfig) {\n this.logDebug(`Using merged custom configuration for ${providerRef}.${protocolKind}`);\n return this.mergeProviderConfiguration(\n defaultConfig,\n customConfig as ResolvedProviderConfiguration,\n );\n }\n\n if (defaultConfig) {\n this.logDebug(`Using default configuration for ${providerRef}.${protocolKind}`);\n }\n return defaultConfig;\n } catch (error) {\n // Programmer-error / contract-violation paths (cross-`kind`\n // merge guard, authKind misuse on `agent-client-protocol`) throw via\n // `errorBuilder.buildError`, producing `WildoError_Backend`.\n // Those MUST surface — they signal projection drift that the\n // silent fallback would mask. Only network/runtime hiccups\n // (the original intent of this catch) fall back to default.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting provider configuration, falling back to default', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n }\n\n /\n Refuse a configuration bag that carries a key the provider MODULE owns (#2995), naming the provider and the key.\n \n The three schemas a configuration passes (`defineSaaSConfig`, the per-environment overlay, the backend's application\n * configuration) already refuse these keys. This is the second door, for a configuration that reached the registry\n * by another road: a stored declaration written before those schemas refused, a configuration hydrated in-process.\n * It is a CONFIGURATION error built through the error builder, so `getProviderConfiguration`'s catch re-throws it\n * rather than falling back to the module's defaults as though nothing had been authored.\n /\n private refuseModuleOwnedConfigurationKeys(providerRef: string, protocolKind: string, customConfig: unknown): void {\n const [finding] = findModuleOwnedProviderConfigurationKeys({ [providerRef]: { [protocolKind]: customConfig } });\n if (finding === undefined) return;\n // assurance-control: WILDO.NETWORK.OUTBOUND_TARGET_CONTROL — a configuration cannot re-point a provider's request, and its credential, off the module's declared destination (#2995).\n // assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a provider credential travels only to the destination its module declares, whatever reached the registry (#2995).\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: describeModuleOwnedProviderConfigurationKey(finding),\n providerRef: finding.providerRef,\n protocolKind: finding.protocolKey,\n key: finding.key,\n },\n },\n );\n }\n\n /\n Refuse an authored `authConfig.secretRef` that names no secret the provider module declares (#3002), naming the\n * provider, the protocol, the value and what the module does declare.\n \n `authConfig.secretRef` decides which environment variable is sent to the provider as its key or client secret, and\n * `getProviderSecret` reads whatever name it is given. Before this, one configuration line\n * (`authConfig: { secretRef: 'DATABASE_PASSWORD' }`) made the registry hand an unrelated process secret to a vendor:\n * another provider's key, a database password, the platform's own secret. The host it went to was still the module's\n * (#2995 holds that); which credential travelled was the configuration's choice.\n \n The rule: a configuration may name ONLY a slot the module's `secretsContract` declares, by its environment variable\n * or by its slug (the CLI's secret requirements match a configured ref to a slot both ways, so the two agree on what a\n * ref means; {@link getProviderSecret} reads such an authored slug as its slot's variable). That keeps the one legitimate use,\n * pointing a protocol at a declared slot its binding does not name (#2054), and removes the rest. Every reader that\n * takes the configuration through {@link getProviderConfiguration} inherits the refusal: the API key\n * ({@link getProviderApiKey}), {@link getProviderSecret}, the protocol secrets, the REST access resolver and the\n * webhook signature secret, and each surfaces it rather than reading it as \"no value\". The two readers that read the\n * raw configuration first read the runtime contract through {@link getProviderConfiguration}, so they are refused\n * before their raw read: {@link resolveConnectionOAuth2ClientCredentials}'s sign-in branch, and the OAuth2 sign-in\n * resolver (its step 1). And {@link getProviderSecret} reads no variable the module does not declare, whoever names it.\n \n At startup, {@link assertAuthoredSecretRefsDeclared} checks every authored value once: the application backend (and\n * the minion and worker runtimes, which run its startup), the development companion and apps-manager. The CLI refuses\n * the same configuration earlier, at `wildo config sync` and creation readiness (`resolveEnvironmentProviderConfigurations`).\n \n Rejected: refusing `authConfig.secretRef` outright. A module may declare a second slot for an arm its binding does\n * not name, and #2054 made that a supported shape. Also rejected: refusing only names that look like another\n * provider's secret. That is a guess about every other variable in the process, and the declared set is a fact.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a configuration may point a protocol's credential only at a slot its provider module declares.\n /\n public assertAuthoredSecretRefDeclared(providerRef: string, protocolKey: string, authored: unknown): void {\n if (authored === undefined) return;\n if (typeof authored === 'string' && this.resolveDeclaredSecretEnvVarName(providerRef, authored) !== undefined) return;\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `providerConfigurations.${providerRef}.${protocolKey}.authConfig.secretRef names '${String(authored)}', which ${providerRef} `\n + `does not declare as a secret. A configuration may point a protocol only at a slot the provider module declares, `\n + `by its variable or its slug (${this.describeDeclaredSecretSlots(providerRef)}); the variable was not read.`,\n providerRef,\n protocolKind: protocolKey,\n secretRef: String(authored),\n },\n },\n );\n }\n\n /\n Startup half of {@link assertAuthoredCredentialFieldsAdmitted}: every credential-naming field authored in the\n * application's configuration, for a provider this runtime loads, is checked once before anything is served (#3002,\n * #3018). A provider this runtime does not load is skipped: its module (and so its declared slots) is not here to check\n * against, and nothing here reads its secret. The runtime that does load it refuses it, and the CLI refuses it for\n * every provider it knows before any of them starts.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — every runtime that boots refuses, before it serves anything, a configuration naming a credential its provider module or the framework does not admit.\n /\n public assertAuthoredSecretRefsDeclared(): void {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) return;\n for (const [providerRef, protocols] of Object.entries(this.configService.config.providerConfigurations ?? {})) {\n if (this.backendProviderRegistry.getProvider(providerRef) === undefined) continue;\n for (const [protocolKey, bag] of Object.entries((protocols ?? {}) as Record<string, unknown>)) {\n this.assertAuthoredCredentialFieldsAdmitted(providerRef, protocolKey, bag);\n }\n }\n }\n\n /\n Hold every credential-naming field of one authored protocol bag to its rule (#3022): the one branch, over\n * {@link ProviderConfigurationCredentialField}, that this registry's read path and its startup walk share. A member\n * added to the vocabulary is a compile error here until its rule is decided.\n \n - `authConfig.secretRef`: a declared slot, by variable or slug ({@link assertAuthoredSecretRefDeclared}, #3002).\n * - an execution profile's `secretEnvVarName`: a declared variable ({@link assertExecutionProfileSecretEnvVarNameDeclared}, #3002).\n * - an execution profile's `inheritedEnvironmentVariables`: no secret the framework declares\n * ({@link assertAgentInheritedEnvironmentVariablesAreNotSecrets}, #3018).\n \n The profile fields are read on the agent-client-protocol bag under its wire value or its member name, the reading\n * the CLI door makes, so a bag authored under the member name is refused here too.\n /\n private assertAuthoredCredentialFieldsAdmitted(providerRef: string, protocolKey: string, bag: unknown): void {\n for (const reading of readProviderConfigurationCredentialFields(protocolKey, bag)) {\n switch (reading.field) {\n case ProviderConfigurationCredentialField.AUTH_SECRET_REF:\n this.assertAuthoredSecretRefDeclared(providerRef, protocolKey, reading.value);\n break;\n case ProviderConfigurationCredentialField.EXECUTION_PROFILE_SECRET_ENV_VAR_NAME:\n this.assertExecutionProfileSecretEnvVarNameDeclared(providerRef, protocolKey, reading.executionProfileRef ?? '', reading.value);\n break;\n case ProviderConfigurationCredentialField.EXECUTION_PROFILE_INHERITED_ENVIRONMENT:\n if (Array.isArray(reading.value)) {\n this.assertAgentInheritedEnvironmentVariablesAreNotSecrets(\n providerRef,\n `providerConfigurations.${providerRef}.${protocolKey}.${reading.path}`,\n reading.value.filter((name): name is string => typeof name === 'string'),\n );\n }\n break;\n default: {\n const exhaustive: never = reading.field;\n return exhaustive;\n }\n }\n }\n }\n\n /\n Refuse an authored ACP execution profile whose `secretEnvVarName` the provider module does not declare (#3002).\n \n That one name is both the variable read from this process and the variable set in the coding agent's subprocess\n * (`getAgentClientProtocolExecutionProfileSecret`, then the agent runner), so it decides which process secret the\n * agent receives: the same choice as `authConfig.secretRef`, through another field. Held to the declared variables\n * only, not to slugs: it names the variable the agent reads, so it must be one. A profile the module synthesizes\n * (`default`) takes its name from the module's own contract and is never authored here.\n \n The same profile's `inheritedEnvironmentVariables` forwards the host's own environment (the agent's login, its\n * tool paths) to the agent, and is held to the opposite rule (#3018): it may name anything EXCEPT a secret, checked\n * by {@link assertAgentInheritedEnvironmentVariablesAreNotSecrets}. A provider credential reaches an agent only\n * through `secretEnvVarName`, held here.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — an execution profile hands the coding agent only a variable its provider module declares.\n /\n private assertExecutionProfileSecretEnvVarNameDeclared(providerRef: string, protocolKey: string, executionProfileRef: string, named: unknown): void {\n if (typeof named === 'string' && this.declaredSecretSlots(providerRef).envVarNames.has(named)) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `providerConfigurations.${providerRef}.${protocolKey}.executionProfiles.${executionProfileRef}.secretEnvVarName names `\n + `'${String(named)}', which ${providerRef} does not declare as a secret. An execution profile may hand the agent only a `\n + `variable the provider module declares (${this.describeDeclaredSecretSlots(providerRef)}); the variable was not read.`,\n providerRef,\n protocolKind: protocolKey,\n executionProfileRef,\n secretEnvVarName: String(named),\n },\n });\n }\n\n /\n Refuse forwarding a secret into a coding agent's subprocess (#3018).\n \n `inheritedEnvironmentVariables` copies named variables from the process that spawns the agent (the application\n * backend, the companion) into the agent's environment, and that process holds the platform's and the providers'\n * secrets: the companion's env carries the platform's Redis and RabbitMQ admin passwords, the backend's its\n * primary secret, its admin-door secret, its inbound endpoints' secrets and its systems of record's credentials. So\n * no name the framework declares secret may be forwarded, whoever lists it: an application's execution profile, or\n * a provider contract's own list. The test is DERIVED ({@link isForbiddenAgentInheritedEnvironmentVariableName}).\n * A name it admits is one the FRAMEWORK does not declare secret, which is not the same as harmless: under\n * `wildo local dev` the spawning process also carries the developer's own shell environment, and a name such as\n * `GITHUB_TOKEN` is not the framework's to know. A provider credential the agent needs reaches it through the\n * profile's `secretEnvVarName`, which is held to that provider's declared slots.\n \n Called where the configuration is read (`getProviderConfiguration`, so every reader and startup), and at dispatch\n * on the exact list the agent is started with.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — a coding agent inherits no secret the framework or a provider module declares.\n /\n public assertAgentInheritedEnvironmentVariablesAreNotSecrets(providerRef: string, source: string, names: readonly string[]): void {\n const named = [...new Set(names.filter((name) => this.isForbiddenAgentInheritedEnvironmentVariableName(name)))].sort();\n if (named.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `${source} names ${named.map((name) => `'${name}'`).join(', ')}, which ${named.length === 1 ? 'is a secret' : 'are secrets'} `\n + `of this platform or of a provider. A coding agent may not inherit a secret the framework declares; a provider `\n + `credential the agent needs is handed to it through the execution profile's secretEnvVarName. Nothing was started.`,\n providerRef,\n source,\n forbiddenNames: named,\n },\n });\n }\n\n /\n Whether a coding agent may never inherit `name`: a secret a Wildo runtime env declares (`isRuntimeSecretEnvVarName`:\n * the platform services', the application backend's and the workers' contract keys, every inbound endpoint secret\n * and every system-of-record slot), or a secret any provider module in THIS runtime's registry declares. The CLI\n * door asks the same question against every provider it can see, a superset. Derived on each call from those\n * declarations, so a secret added to any of them is refused the day it is added.\n /\n private isForbiddenAgentInheritedEnvironmentVariableName(name: string): boolean {\n if (isRuntimeSecretEnvVarName(name)) return true;\n for (const module of this.backendProviderRegistry.getRegistry().modules.values()) {\n if (Object.values(module.secretsContract ?? {}).some((entry) => entry.envVarName === name)) return true;\n }\n return false;\n }\n\n /\n The secrets a provider module declares: each slot's environment variable, and each slug mapped to its variable.\n * These are the only names a configuration may point at, and the only variables {@link getProviderSecret} reads.\n /\n private declaredSecretSlots(providerRef: string): { readonly envVarNames: ReadonlySet<string>; readonly envVarNameBySlug: ReadonlyMap<string, string> } {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract ?? {};\n const envVarNameBySlug = new Map<string, string>();\n for (const [slug, entry] of Object.entries(contract)) {\n if (typeof entry?.envVarName === 'string' && entry.envVarName !== '') envVarNameBySlug.set(slug, entry.envVarName);\n }\n return { envVarNames: new Set(envVarNameBySlug.values()), envVarNameBySlug };\n }\n\n /* The declared variable a name stands for: itself when it is a declared variable, its slot's variable when it is a slug. /\n private resolveDeclaredSecretEnvVarName(providerRef: string, name: string): string \| undefined {\n const { envVarNames, envVarNameBySlug } = this.declaredSecretSlots(providerRef);\n return envVarNames.has(name) ? name : envVarNameBySlug.get(name);\n }\n\n /* `slug (VARIABLE)` for each declared slot, for a refusal to name what is admitted. /\n private describeDeclaredSecretSlots(providerRef: string): string {\n const pairs = [...this.declaredSecretSlots(providerRef).envVarNameBySlug].map(([slug, envVarName]) => `${slug} (${envVarName})`).sort();\n return pairs.join(', ') \|\| 'none';\n }\n\n /\n The module's configuration with the application's values laid over it.\n \n The MODULE alone supplies `runtimeContract` and `endpoints` (#2995): both are taken from `defaultConfig`, never from\n * `customConfig`. Until #2995 the authored `runtimeContract` was deep-merged over the module's, which let a configuration\n * line send a provider's key to any URL; and a cross-`kind` guard here refused only the case where the two contracts\n * disagreed on `kind`. That guard is gone because its whole population is now refused before this runs\n * ({@link refuseModuleOwnedConfigurationKeys}): an authored contract of ANY kind is a configuration error, which is the\n * stronger statement of what the guard protected.\n \n With no module configuration for the protocol (`defaultConfig` undefined) the application's values are returned as\n * they are, and they cannot carry a contract either, for the same reason.\n /\n private mergeProviderConfiguration(\n defaultConfig: ResolvedProviderConfiguration \| undefined,\n customConfig: ResolvedProviderConfiguration\n ): ResolvedProviderConfiguration {\n if (!defaultConfig) {\n return customConfig;\n }\n\n return {\n ...defaultConfig,\n ...customConfig,\n // `executionProfiles` is a MAP OF NAMED PROFILES, so the top-level\n // spread above would drop every profile the provider synthesized\n // (including `default`, which existing consumers still resolve) as\n // soon as an application authors one profile of its own. Merge by\n // ref instead — and replace a same-named profile WHOLE rather than\n // deep-merging it: a deep merge would let an override inherit\n // `secretRef`/`secretEnvVarName` from the synthesized default and\n // silently turn a host-managed profile into a secret-injecting one.\n ...(defaultConfig.executionProfiles \|\| customConfig.executionProfiles\n ? {\n executionProfiles: {\n ...(defaultConfig.executionProfiles ?? {}),\n ...(customConfig.executionProfiles ?? {}),\n },\n }\n : {}),\n authConfig: this.deepMergeRecord(\n defaultConfig.authConfig,\n customConfig.authConfig,\n ) as ResolvedProviderConfiguration['authConfig'],\n // From the module, and from nothing else (#2995).\n runtimeContract: defaultConfig.runtimeContract,\n endpoints: defaultConfig.endpoints,\n };\n }\n\n private deepMergeRecord(\n defaultValue: unknown,\n customValue: unknown\n ): Record<string, unknown> \| undefined {\n if (!defaultValue && !customValue) return undefined;\n if (!defaultValue \|\| typeof defaultValue !== 'object' \|\| Array.isArray(defaultValue)) {\n return customValue as Record<string, unknown> \| undefined;\n }\n if (!customValue \|\| typeof customValue !== 'object' \|\| Array.isArray(customValue)) {\n return defaultValue as Record<string, unknown>;\n }\n\n const merged: Record<string, unknown> = {\n ...(defaultValue as Record<string, unknown>),\n };\n for (const [key, value] of Object.entries(customValue as Record<string, unknown>)) {\n const previous = merged[key];\n if (Array.isArray(previous) && Array.isArray(value)) {\n merged[key] = [...new Set([...previous, ...value])];\n continue;\n }\n merged[key] = previous\n && typeof previous === 'object'\n && !Array.isArray(previous)\n && value\n && typeof value === 'object'\n && !Array.isArray(value)\n ? this.deepMergeRecord(previous, value)\n : value;\n }\n return merged;\n }\n\n\n /\n The environment the OPERATOR declared for this runtime, or `undefined` (#2991). The reading every relaxation outside\n * production keys on (`readDeclaredOutboundAdmissionEnvironment`): a configuration hydrated without a declared\n * environment answers `undefined`, which the readers treat as production. Here because every reader of a host-held\n * slot already holds this registry; one accessor keeps them from each re-deriving the fallback.\n /\n public getDeclaredApplicationEnvironment(): RuntimeEnvironment \| undefined {\n return readDeclaredOutboundAdmissionEnvironment(this.configService);\n }\n\n /\n WHAT a declared secret identifies — the integration, or an account.\n \n DECLARED wins; otherwise DERIVED, and the derivation is deliberately narrow. A ref the REST\n * runtime contract names as the OAuth2 client id or client secret is a REGISTRATION. Everything\n * else answers CREDENTIAL.\n \n The fallback exists because the field arrived after 689 provider packages had been emitted,\n * from catalogues that live outside this repository — a mark that only worked once every package\n * had been re-emitted would enforce nothing until then, which for a guard is the same as not\n * existing.\n \n It is a FLOOR, not a complete answer, and the direction of its error matters. Deriving\n * CREDENTIAL for a registration secret the contract does not name in those two slots is the\n * permissive mistake: such a secret would still be storable as a tenant's own. That is exactly\n * the case a provider must declare explicitly, and it is why `scope` is authorable at all rather\n * than purely computed.\n /\n /\n A provider's declared secret slots, each classified and each answered as configured or not.\n \n The contract already says everything a screen needs — the slug, the environment variable, the\n * operator-facing description, whether it is required — and nothing was reading it. So a person\n * connecting an account typed a `secretSlug` into a free-text field, and an operator learned that\n * `ASANA_CLIENT_ID` was missing only when somebody pressed Connect and got a 502.\n \n NEVER the value, only whether one is present. The whole point is to make a missing secret\n * REPORTABLE on a screen, and a report that carried the secret would be the one thing that must\n * not leave the backend.\n \n Scope comes from {@link getProviderSecretScope}, so this and the connect leg's refusal cannot\n * disagree about which slot is a registration and which is an account.\n /\n public getProviderSecretSlots(providerRef: string): readonly ProviderSecretSlot[] {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract;\n if (contract === undefined) return [];\n return Object.entries(contract).map(([slug, entry]) => ({\n slug,\n envVarName: entry.envVarName,\n required: entry.required,\n description: entry.description,\n scope: this.getProviderSecretScope(providerRef, slug),\n ...(entry.holdsDeploymentHost === true ? { holdsDeploymentHost: true as const } : {}),\n ...(entry.holdsBrowserPublicValue === true ? { holdsBrowserPublicValue: true as const } : {}),\n // Read by the slot's variable only. A second read used to take the SLUG as an environment variable name;\n // `getProviderSecret` reads only declared variables (#3002), and no generator writes a variable by slug.\n configured: Boolean(this.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, entry.envVarName)),\n }));\n }\n\n public getProviderSecretScope(\n providerRef: string,\n secretRef: string,\n ): ExternalProvider_SecretScope {\n const entry = this.findSecretsContractEntry(providerRef, secretRef);\n if (entry?.scope !== undefined) {\n return entry.scope;\n }\n\n // Compare on the ENV-VAR NAME, not on the ref as supplied. A ref may arrive as either the\n // authoring slug (`accessToken`) or the env-var name (`SLACK_API_KEY`), while a runtime\n // contract only ever references the latter — so deriving from the raw ref answered CREDENTIAL\n // for `clientSecret` and REGISTRATION for `SLACK_CLIENT_SECRET`, two names for one secret.\n const comparableRef = entry?.envVarName ?? secretRef;\n const contract = this.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n const oauth2 = contract?.kind === ProviderProtocolRuntimeKind.REST ? contract.oauth2 : undefined;\n const namesRegistration = oauth2 !== undefined\n && (oauth2.clientIdSecretRef === comparableRef \|\| oauth2.clientSecretSecretRef === comparableRef);\n\n return namesRegistration\n ? ExternalProvider_SecretScope.REGISTRATION\n : ExternalProvider_SecretScope.CREDENTIAL;\n }\n\n /\n The contract entry for a ref, found by ENV-VAR NAME or by SLUG.\n \n Both are real addresses for the same thing and callers use both: the map key is the authoring\n * slug (`accessToken`), while runtime contracts reference the env-var name (`SLACK_API_KEY`).\n * Matching only one would leave half the callers unable to find an entry that is plainly there.\n /\n private findSecretsContractEntry(providerRef: string, secretRef: string): SecretsContractEntry \| undefined {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract;\n if (contract === undefined) {\n return undefined;\n }\n const slug = this.findSecretsContractSlug(providerRef, secretRef);\n return slug === undefined ? undefined : contract[slug];\n }\n\n /\n The secrets-contract KEY for either of a slot's two names, or `undefined` when the provider\n * declares no such slot.\n \n Kept as the ONE lookup rule: {@link findSecretsContractEntry} and\n * {@link canonicalCredentialSlug} both go through it, so \"which slot did the caller mean\" cannot\n * be answered two ways. Before this, the entry lookup and the connect leg's canonicalisation each\n * re-derived it, which is how they came to disagree about which of the two names to keep.\n /\n private findSecretsContractSlug(providerRef: string, secretRef: string): string \| undefined {\n // Tolerant of an unbound or partially-bound provider registry, because this is now reached\n // from the credential RESOLUTION path: a wiring gap there must degrade to \"I cannot map this\n // name\" and let the caller's own refusal speak, never turn a missing credential into a crash\n // whose message names neither the provider nor the owner.\n const contract = this.backendProviderRegistry?.getProvider?.(providerRef)?.secretsContract;\n if (contract === undefined) {\n return undefined;\n }\n // OWN keys only: `contract['constructor']` is a function inherited from `Object.prototype`, and a\n // bare `!== undefined` read it as a declared slot — so a stored slug named `constructor` would\n // have classified as CURRENT and a lookup would have \"canonicalised\" to a slot that does not exist.\n if (Object.prototype.hasOwnProperty.call(contract, secretRef)) {\n return secretRef;\n }\n return Object.entries(contract).find(([, entry]) => entry.envVarName === secretRef)?.[0];\n }\n\n /\n The name a STORED credential is keyed on: the provider's secrets-contract KEY, never its\n * environment-variable spelling.\n \n ## Why the contract key and not the env-var name (#624)\n \n A slot has two names and they have different LIFETIMES:\n \n \| \| example \| may it change? \|\n * \|---\|---\|---\|\n * \| the contract KEY \| `accessToken` \| no — it is the slot's identity, and there are five across all providers \|\n * \| `envVarName` \| `ASANA_ACCESS_TOKEN` \| yes — it is a deployment-configuration spelling \|\n \n A durable credential row must be keyed on the stable one. It was keyed on the other, and on\n * 2026-09-10 commit `2e8f7488` renamed the env-var spelling for 130 OAuth2 vendors — a\n * correct rename, `ASANA_API_KEY` was the wrong name for an OAuth2 account slot — thirty-one\n * minutes after two real grants were minted. Every stored credential on the machine (7 of 7,\n * across asana and slack) became a row whose provider no longer declares its key, and the\n * refusal an operator read was \"no credential for 'ASANA_ACCESS_TOKEN'\": indistinguishable from\n * never having connected.\n \n There is no silent substitution — the ORGANIZATION and USER branches of\n * {@link resolveProviderSecretForTarget} refuse rather than fall through to the deployment's own\n * credential — so this was never a wrong-account defect. It was a live secret reported as absent.\n \n Those rows are NOT migrated and never will be: the seal binds the slot name, so they cannot be\n * renamed, and re-sealing them was decided against (2026-09-12). Instead a refusal that misses now\n * names the retired slot and says to reconnect, and the boot report counts every such row — see\n * {@link classifyStoredCredentialSlot} and `retired-credential-slot.backend.utils.ts`.\n \n ## Accepting both names is deliberate, and permanent\n \n A caller may still NAME either one — the runtime contract's `apiKey.secretRef` carries the\n * env-var spelling, and every generated provider emits it that way — so this maps rather than\n * refuses. What it guarantees is that whatever a caller names, the value that reaches a store is\n * the one a rename cannot move.\n \n ## The environment lookup does NOT use this\n \n {@link getProviderSecret} resolves `process.env[envVarName]`, and must keep doing so: there the\n * spelling IS the identity, because it is what an operator writes in a deployment environment.\n * The two names exist for two jobs, and this method is the boundary between them.\n /\n public canonicalCredentialSlug(providerRef: string, secretRef: string): string {\n return this.findSecretsContractSlug(providerRef, secretRef) ?? secretRef;\n }\n\n /\n The CONNECTION a credential spent or written through `providerRef` belongs to (#1670).\n \n ## Why a connection and not the ref\n \n A stored credential is keyed and sealed on `(owner, connectionRef, secretSlug)`. A connection is the\n * unit a vendor grant belongs to, and a vendor may be served by several refs — an engine part and the\n * add-on packages beside it — that must spend ONE grant rather than ask the person to authorize once\n * per ref (#1669).\n \n ## A declared member maps to its BASE; everything else is its own connection\n \n `providers.sharedConnections` (#1725) names a base ref and the members that spend its grant, and this\n * answers the base for every one of them. An undeclared ref is its own connection — which is also why every\n * row stored before the key moved was backfilled to `connectionRef = providerRef` and still opens under the\n * same seal. The membership rule itself is `resolveProviderConnectionRef` in `@wildo-ai/saas-models`, the one\n * function `wildo config sync` records the lock entry with, so config and runtime cannot disagree.\n \n A row a member stored under its OWN ref before it joined a connection is keyed on that ref, not the base,\n * and is never read through the connection: it was sealed to the other identity, and there is deliberately no\n * re-seal door (2026-09-12). The miss names it instead — see {@link resolveProviderSecretForTarget}.\n \n ONE function, deliberately: every write door derives the row's `connectionRef` through it and every\n * read path addresses the store through {@link resolveCredentialAddress}, which calls it — so when the\n * mapping stops being the identity, reading and writing change together rather than one of them\n * keeping the ref (the invariant-applied-at-one-site shape this subsystem has met before).\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — which delegated grant a call through a ref\n * may spend is decided here, in one place, never by the caller.\n /\n public resolveCredentialConnectionRef(providerRef: string): string {\n return resolveProviderConnectionRef(this.declaredSharedConnections(), providerRef);\n }\n\n /\n The npm package that owns `providerRef` — its module's `metadata.packageName` — or `undefined` when no module\n * of that ref is loaded here. Named on the audit rows of a shared connection (#1725), where the connection alone\n * no longer says whose code spent the grant.\n /\n public getProviderPackageName(providerRef: string): string \| undefined {\n return this.backendProviderRegistry?.getProvider?.(providerRef)?.metadata?.packageName;\n }\n\n /\n The module's vendor registration and the parts of the module it is judged against (#2713): its secrets contract,\n * whose `holdsPublicIdentifier` slots are the only values read into a registration, and the fields that place\n * those slots. `undefined` when no module of that ref is loaded here, or its module registers nothing at the vendor.\n /\n public getProviderVendorRegistration(providerRef: string): {\n readonly registration: ProviderVendorRegistration;\n readonly module: Pick<BackendProviderModule, 'secretsContract' \| 'protocols'> & Partial<Pick<BackendProviderModule, 'otlpAuth'>>;\n } \| undefined {\n const module = this.backendProviderRegistry?.getProvider?.(providerRef);\n const registration = module?.vendorRegistration;\n return module === undefined \|\| registration === undefined ? undefined : { registration, module };\n }\n\n /\n How `providerRef`'s vendor opens a chat command's form while the person waits (#2770, Slack's modal), or `undefined`\n * when no module of that ref is loaded here or its vendor opens none. Read by the chat command form lane at receipt.\n /\n public getProviderChatCommandForm(providerRef: string): ProviderChatCommandFormContract \| undefined {\n return this.backendProviderRegistry?.getProvider?.(providerRef)?.chatCommandForm;\n }\n\n /\n The declared shared connection `providerRef` belongs to (as base or member), or `undefined` when it is its\n * own connection (#1725). What the connect, refresh and revoke paths ask before choosing whose OAuth client\n * to use.\n /\n public getProviderSharedConnection(providerRef: string): ResolvedProviderSharedConnection \| undefined {\n return resolveDeclaredSharedConnection(this.declaredSharedConnections(), providerRef);\n }\n\n /\n The application's `providers.sharedConnections`, or `undefined` on a host whose configuration carries none\n * — a platform service, a harness with no configuration. Read on every call, never cached, so the answer is\n * always the configuration the host is running.\n /\n private declaredSharedConnections(): ProviderSharedConnections \| undefined {\n try {\n return this.configService.isInitialized() ? this.configService.config.providers?.sharedConnections : undefined;\n } catch {\n return undefined;\n }\n }\n\n /\n The OAuth client a connect, refresh or revocation through `providerRef` must use (#1725): the BASE ref's\n * REST OAuth2 block and client slots for a declared connection — a member's own block is inert — and the\n * ref's own for an undeclared one. `undefined` when the owner declares no REST OAuth2 block.\n \n With `sharedWithSignIn`, the endpoints, scopes and audiences stay the base's connected-account block, and\n * only the CLIENT changes to the base's sign-in registration: that is the one thing the option decides.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — one connection has exactly one OAuth client,\n * the declared base's, whichever ref the person connects through.\n /\n public getConnectionOAuth2Client(providerRef: string): ProviderConnectionOAuth2Client \| undefined {\n const declared = this.getProviderSharedConnection(providerRef);\n const connectionRef = declared?.connectionRef ?? providerRef;\n const contract = this.getProviderRuntimeContract(connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n if (contract?.kind !== ProviderProtocolRuntimeKind.REST \|\| contract.oauth2 === undefined) return undefined;\n return {\n connectionRef,\n providerRef,\n oauth2: contract.oauth2,\n restContract: contract,\n sharedWithSignIn: declared?.sharedWithSignIn === true,\n };\n }\n\n /\n The scopes the connection `providerRef` spends may ask a person to consent to (#1671) — see\n * `computeProviderConnectionScopeCeiling`. `undefined` when the connection's owner declares no REST OAuth2 block,\n * which means there is no consent flow to grow.\n /\n public getConnectionScopeCeiling(providerRef: string): ProviderConnectionScopeCeiling \| undefined {\n const client = this.getConnectionOAuth2Client(providerRef);\n if (client === undefined) return undefined;\n const memberRefs = this.getProviderSharedConnection(providerRef)?.memberRefs ?? [];\n const sources: ProviderConnectionScopeSource[] = [];\n for (const memberRef of memberRefs) {\n const contract = this.getProviderRuntimeContract(memberRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n const scopes = contract?.kind === ProviderProtocolRuntimeKind.REST ? contract.oauth2?.scopes ?? [] : [];\n if (scopes.length > 0) sources.push({ providerRef: memberRef, scopes: scopes.flatMap((scope) => scope.split(/\\s+/)).filter((scope) => scope.length > 0) });\n }\n for (const ref of [client.connectionRef, ...memberRefs]) {\n for (const applied of this.backendProviderRegistry?.getProvider?.(ref)?.appliedAugmentations ?? []) {\n if (applied.requiredScopes.length > 0) sources.push({ providerRef: ref, augmentationPackageName: applied.packageName, scopes: applied.requiredScopes });\n }\n }\n return computeProviderConnectionScopeCeiling({ connectionRef: client.connectionRef, ownerOAuth2: client.oauth2, sources });\n }\n\n /\n The npm package whose code an operation of `providerRef` is — the opted-in augmentation that declares\n * `operationId`, else the ref's own package (#1671). Read from static declarations, so it loads no catalogue; named\n * on the grant row of a re-authorization so the trail says whose operation widened the consent.\n /\n public describeOperationContributorPackage(providerRef: string, operationId: string): string \| undefined {\n const applied = this.backendProviderRegistry?.getProvider?.(providerRef)?.appliedAugmentations ?? [];\n return applied.find((augmentation) => augmentation.operationIds.includes(operationId))?.packageName\n ?? this.getProviderPackageName(providerRef);\n }\n\n /\n The offer a call refused for `missingScopes` carries (#1671): which of them a person may grant by re-authorizing\n * the connection, which need an administrator, and which nobody can ask for on this connection. `undefined` when the\n * connection has no consent flow at all (a pasted credential, the deployment's own) — then only an operator can act.\n /\n public planProviderScopeReauthorization(providerRef: string, operationId: string, missingScopes: readonly string[]): ProviderScopeReauthorizationOffer \| undefined {\n const ceiling = this.getConnectionScopeCeiling(providerRef);\n if (ceiling === undefined) return undefined;\n const classified = classifyProviderConnectionScopes(ceiling, missingScopes);\n return {\n connectionRef: ceiling.connectionRef,\n providerRef,\n operationId,\n requestableScopes: classified.requestable,\n administratorConsentScopes: classified.administratorConsent,\n unrequestableScopes: classified.unrequestable,\n };\n }\n\n /\n The application's registration with the vendor for a connection — the two values an operator pastes —\n * resolved from the deployment for the connection's OWNER, never per connection and never from a row.\n \n Default: the base's connected-account slots (`oauth2.clientIdSecretRef` / `clientSecretSecretRef`). With\n * `sharedWithSignIn`: the base's sign-in registration, read exactly as the sign-in lane reads it — the client\n * id from `providerConfigurations.<base>.sso_oauth2`, the secret from the sign-in contract's secret ref — so\n * the two lanes cannot come to use two different registrations while both claim to share one.\n \n The REFS are returned beside the values so a refusal can name what to configure.\n /\n public resolveConnectionOAuth2ClientCredentials(client: ProviderConnectionOAuth2Client): {\n clientId?: string;\n clientSecret?: string;\n clientIdRef?: string;\n clientSecretRef?: string;\n } {\n if (!client.sharedWithSignIn) {\n const { clientIdSecretRef, clientSecretSecretRef } = client.oauth2;\n return {\n clientIdRef: clientIdSecretRef,\n clientSecretRef: clientSecretSecretRef,\n clientId: clientIdSecretRef === undefined ? undefined\n : this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, clientIdSecretRef),\n clientSecret: clientSecretSecretRef === undefined ? undefined\n : this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, clientSecretSecretRef),\n };\n }\n const signIn = this.getProviderRuntimeContract(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2);\n if (signIn?.kind !== ProviderProtocolRuntimeKind.OAUTH2_SSO) return {};\n const protocolConfiguration = (this.configService.config.providerConfigurations?.[client.connectionRef] as Record<string, unknown> \| undefined)\n ?.[ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2] as { clientId?: string; authConfig?: { clientId?: string; secretRef?: string } } & Record<string, unknown> \| undefined;\n const clientId = protocolConfiguration?.authConfig?.clientId\n ?? protocolConfiguration?.clientId\n ?? (signIn.clientIdPublicConfigKey === undefined ? undefined : protocolConfiguration?.[signIn.clientIdPublicConfigKey] as string \| undefined);\n // The authored ref is read raw here. It is already held to the module's declared slots (#3002): the\n // `getProviderRuntimeContract` call above reads through `getProviderConfiguration`, which refuses an undeclared one.\n const clientSecretRef = protocolConfiguration?.authConfig?.secretRef ?? signIn.clientSecretRef;\n return {\n clientIdRef: `providerConfigurations.${client.connectionRef}.${ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2}.clientId`,\n clientSecretRef,\n ...(typeof clientId === 'string' && clientId.length > 0 ? { clientId } : {}),\n clientSecret: this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2, clientSecretRef),\n };\n }\n\n /\n Refuse, at boot, a loaded provider whose OAuth2 block declares resource AUDIENCES it cannot honour (#1725) — or an\n * incremental-consent declaration restating a scope it does not declare (#1671), or ID token requirements no sign-in\n * could meet (#2663) —\n * `describeProviderOAuth2AudienceDefects`: no primary, a primary the authorization is not for, two audiences\n * admitting one host. The token-host binding selects a token by host, so an ambiguous declaration would let the\n * order of a record decide which token a request carries.\n \n Every rule lives in `describeProviderModuleAuthenticationDefects` (external-connectors-private), which\n * `wildo registry publish` runs too, so a module that would be refused here is refused before it is published\n * (follow-up to #3392).\n /\n private assertDeclaredAudiencesCoherent(): void {\n const defects: string[] = [];\n for (const module of this.backendProviderRegistry.getRegistry?.()?.modules?.values() ?? []) {\n // The one validator `wildo registry publish` runs too (follow-up to #3392), over the contract THIS registry\n // resolved for the module (augmentations applied).\n const contract = this.getProviderRuntimeContract(module.metadata.ref, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n defects.push(...describeProviderModuleAuthenticationDefects(module, contract?.kind === ProviderProtocolRuntimeKind.REST ? contract : undefined));\n }\n if (defects.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: { message: `A provider declares an authentication contract that cannot be honoured:\\n- ${defects.join('\\n- ')}`, defects },\n });\n }\n\n /\n Refuse, at boot, declared shared connections this host's loaded modules cannot honour (#1725) — see\n * `findSharedConnectionBootDefects`. A CONFIGURATION refusal, because the remedy is editing the SaaS config\n * and needs nothing running.\n /\n private assertSharedConnectionsCoherent(): void {\n const connections = this.declaredSharedConnections();\n if (connections === undefined \|\| Object.keys(connections).length === 0) return;\n const restOAuth2Of = (ref: string) => {\n const contract = this.getProviderRuntimeContract(ref, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n return contract?.kind === ProviderProtocolRuntimeKind.REST ? contract : undefined;\n };\n const defects = findSharedConnectionBootDefects({\n connections,\n systemOfRecordInstanceNames: Object.keys(this.configService.config.systemsOfRecord ?? {}),\n isLoaded: (ref) => this.backendProviderRegistry.getProvider(ref) !== undefined,\n viewOf: (ref) => {\n const contract = restOAuth2Of(ref);\n return {\n ...(contract?.oauth2 === undefined ? {} : { oauth2: contract.oauth2 }),\n ...(contract?.apiKey?.secretRef === undefined ? {} : { spentCredentialSlotKey: this.canonicalCredentialSlug(ref, contract.apiKey.secretRef) }),\n };\n },\n baseAdmitsCredentialSlot: (baseRef, slotKey) => this.resolveStorableCredentialSlot(baseRef, slotKey).admitted,\n baseHasSignInClient: (baseRef) =>\n this.getProviderRuntimeContract(baseRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2)?.kind === ProviderProtocolRuntimeKind.OAUTH2_SSO,\n });\n if (defects.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `providers.sharedConnections cannot run on this host:\\n- ${defects.join('\\n- ')}`,\n defects,\n },\n });\n }\n\n /\n Where a READ through `providerRef` finds its stored credential: the connection and the contract KEY\n * of the slot the caller named by either of its two names (#1670, #624).\n \n The read-side counterpart of the write doors' derivation — see {@link resolveCredentialConnectionRef}\n * for the connection and {@link canonicalCredentialSlug} for the slot. Every caller that addresses a\n * credential store asks this, never assembles the address itself.\n /\n public resolveCredentialAddress(providerRef: string, secretRef: string): ProviderCredentialAddress {\n return {\n connectionRef: this.resolveCredentialConnectionRef(providerRef),\n secretSlug: this.canonicalCredentialSlug(providerRef, secretRef),\n };\n }\n\n /\n Where a slug a credential row was STORED under stands against the provider's CURRENT contract.\n \n ## The definition, and why it is this one\n \n A stored slug is {@link StoredCredentialSlotStanding.CURRENT} exactly when canonicalising it is a\n * FIXED POINT — when {@link canonicalCredentialSlug}'s own rule answers the slug back unchanged.\n * Defined through {@link findSecretsContractSlug} rather than by re-reading the contract, so \"which\n * slot is current\" and \"which name a lookup asks for\" are one rule and cannot disagree.\n \n That makes an env-var SPELLING that the provider still declares RETIRED as a stored key, which\n * is correct rather than harsh: every lookup now asks for the contract key, so a row keyed on\n * `ASANA_ACCESS_TOKEN` is as unreachable as one keyed on the renamed `ASANA_API_KEY` (#624).\n \n Tolerant of an unbound provider registry for the reason {@link findSecretsContractSlug} states;\n * an absent provider is reported as such, never as a retired slot, because its remedy differs.\n /\n public classifyStoredCredentialSlot(providerRef: string, storedSecretSlug: string): StoredCredentialSlotStanding {\n if (this.backendProviderRegistry?.getProvider?.(providerRef) === undefined) {\n return StoredCredentialSlotStanding.PROVIDER_UNREGISTERED;\n }\n return this.findSecretsContractSlug(providerRef, storedSecretSlug) === storedSecretSlug\n ? StoredCredentialSlotStanding.CURRENT\n : StoredCredentialSlotStanding.RETIRED;\n }\n\n /\n The slot a credential VALUE may be written under, or why it may not (#624).\n \n The write-side twin of {@link canonicalCredentialSlug}, and the one rule every write door asks\n * — the connect leg, and the resource's own CREATE and UPDATE hooks — so \"may a value be stored\n * here\" cannot be answered differently by different doors.\n \n ## Admitted only for a DECLARED CREDENTIAL slot, and always as its KEY\n \n - A name that maps to no slot of the provider's current contract (under either of a slot's two\n * names) is refused {@link ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_DECLARED}. The\n * read-side canonicaliser passes such a name through, which is right for a READ — the caller's\n * own refusal speaks — and wrong for a WRITE: stored under a name nobody asks for, the value\n * reports success and resolves as absent forever. That is how a retired slot keeps producing\n * orphans after the keying was fixed forward.\n * - A slot holding the application's own OAuth2 registration is refused\n * {@link ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_A_CREDENTIAL}, as the connect leg\n * always did: the exchange reads that from the deployment environment, never from a row.\n * - An admitted name comes back as the contract KEY whichever name the caller used.\n \n Every generated provider's default slot passes: measured 2026-09-12 over 695 provider modules\n * with a literal `apiKey.secretRef`, all 695 name a declared slot.\n /\n public resolveStorableCredentialSlot(providerRef: string, secretName: string): StorableCredentialSlot {\n const secretSlug = this.findSecretsContractSlug(providerRef, secretName);\n if (secretSlug === undefined) {\n return { admitted: false, refusal: ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_DECLARED };\n }\n if (this.getProviderSecretScope(providerRef, secretSlug) !== ExternalProvider_SecretScope.CREDENTIAL) {\n return { admitted: false, refusal: ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_A_CREDENTIAL };\n }\n return { admitted: true, secretSlug };\n }\n\n public getProviderRuntimeContract(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): ProviderProtocolRuntimeContract \| undefined {\n return this.getProviderConfiguration(providerRef, protocolKind)?.runtimeContract;\n }\n\n public getLLMSemanticOperationKeys(providerRef: string): LLMProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.LLM) {\n return [];\n }\n\n return this.toSemanticOperationKeys(runtimeContract.operations);\n }\n\n /\n The semantic embeddings operations a provider's `EMBEDDINGS_PROVIDER` contract declares.\n * Consumer: `EmbeddingsBackendService`, which refuses to invoke a provider whose contract\n * does not declare {@link EmbeddingsProvider_OperationKey.EMBED_TEXTS} (fail-closed, named —\n * never an undefined-method throw inside an SDK call).\n /\n public getEmbeddingsSemanticOperationKeys(providerRef: string): EmbeddingsProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.EMBEDDINGS) {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is EmbeddingsProvider_OperationKey => operation !== undefined);\n }\n\n\n /\n The semantic extraction operations a provider's `DOCUMENT_EXTRACTION_PROVIDER` contract\n * declares. Consumer: `DocumentExtractionBackendService`, which refuses to invoke a provider\n * whose contract does not declare\n * {@link DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT} — fail-closed and\n * named, rather than a 404 from a route the provider never claimed to serve.\n /\n public getDocumentExtractionSemanticOperationKeys(providerRef: string): DocumentExtractionProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION) {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is DocumentExtractionProvider_OperationKey => operation !== undefined);\n }\n\n\n /\n The semantic operations a provider's `CONTENT_SAFETY_PROVIDER` contract declares (#2292). Consumer:\n * `ContentSafetyBackendService`, which refuses a selected provider that does not declare the operation it is asked\n * for, rather than sending it a request it never claimed to serve.\n /\n public getContentSafetySemanticOperationKeys(providerRef: string): ContentSafetyProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.CONTENT_SAFETY_PROVIDER);\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.CONTENT_SAFETY) return [];\n return runtimeContract.operations\n .map((operation) => RUNTIME_CONTENT_SAFETY_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is ContentSafetyProvider_OperationKey => operation !== undefined);\n }\n\n\n public getAgentClientProtocolConfiguration(providerRef: string): AgentClientProtocol_Configuration \| undefined {\n const config = this.getProviderConfiguration(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n return config as AgentClientProtocol_Configuration \| undefined;\n }\n\n public getAgentClientProtocolProfile(providerRef: string): RuntimeAgentClientProtocolProfile \| undefined {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL) {\n return undefined;\n }\n\n const supportedModels = [\n ...(runtimeContract.models ?? []),\n ...(runtimeContract.defaultModel ? [runtimeContract.defaultModel] : []),\n ];\n return {\n agentCommand: runtimeContract.agentCommand,\n agentArgs: [...(runtimeContract.agentArgs ?? [])],\n supportedOperationKeys: runtimeContract.operations\n .map((operation) => RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is CodingAgent_OperationKey => operation !== undefined),\n supportedModels: [...new Set(supportedModels)],\n supportedProtocolVersions: [...(runtimeContract.supportedProtocolVersions ?? [1])],\n ...(runtimeContract.sessionMetaExtensions ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions } : {}),\n ...(runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance\n ? { sessionMetaExtensionsByHostConfigurationInheritance: runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance }\n : {}),\n ...(runtimeContract.modelDelivery ? { modelDelivery: runtimeContract.modelDelivery } : {}),\n ...(runtimeContract.modelTransportIds\n ? { modelTransportIds: { ...runtimeContract.modelTransportIds } }\n : {}),\n ...(runtimeContract.inheritedEnvironmentVariables\n ? { inheritedEnvironmentVariables: [...runtimeContract.inheritedEnvironmentVariables] }\n : {}),\n ...(runtimeContract.hostLogin ? { hostLogin: runtimeContract.hostLogin } : {}),\n // Normalised to the AUTHORED vocabulary: the contract spells these\n // with hyphens and the profile enum with underscores, and comparing\n // the two spellings directly is a guard that never fires.\n supportedAuthModes: runtimeContract.authModes.map((mode) => mode.replace(/-/g, '_')),\n ...(runtimeContract.sessionModeIdsByPermissionCeiling\n ? {\n sessionModeIdsByPermissionCeiling: Object.fromEntries(\n Object.entries(runtimeContract.sessionModeIdsByPermissionCeiling).map(\n ([ceiling, modeIds]) => [ceiling, [...(modeIds ?? [])]],\n ),\n ),\n }\n : {}),\n };\n }\n\n /\n Resolve one named ACP execution profile, PARSED rather than trusted.\n \n Application-authored `providerConfigurations` are typed `unknown` all the\n * way to here, so an authored profile would otherwise reach the runner\n * unvalidated — and for this transport the unvalidated fields include the\n * environment gate and the permission ceiling. Parsing here makes the\n * profile fail closed BEFORE any agent is spawned, and applies the schema\n * defaults the authoring contract promises.\n /\n public getAgentClientProtocolExecutionProfile(\n providerRef: string,\n executionProfileRef: string,\n ): AgentClientProtocol_ExecutionProfile \| undefined {\n this.ensureInitialized();\n\n const configuration = this.getAgentClientProtocolConfiguration(providerRef);\n const executionProfile = configuration?.executionProfiles?.[executionProfileRef];\n\n if (!executionProfile) {\n this.logDebug(`ACP execution profile ${executionProfileRef} not found for ${providerRef}`);\n return undefined;\n }\n\n try {\n return AgentClientProtocol_ExecutionProfileSchema.parse(executionProfile);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n providerRef,\n executionProfileRef,\n message: '[external-providers-registry] ACP execution profile is not a valid authored profile',\n validationError: describeCaughtError(error),\n },\n },\n );\n }\n }\n\n public getAgentClientProtocolExecutionProfileSecret(\n providerRef: string,\n executionProfileRef: string,\n ): string \| undefined {\n this.ensureInitialized();\n\n const executionProfile = this.getAgentClientProtocolExecutionProfile(providerRef, executionProfileRef);\n if (\n !executionProfile\n \|\| executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n return undefined;\n }\n\n const runtimeSecret = executionProfile.secretEnvVarName\n ? process.env[executionProfile.secretEnvVarName]\n : undefined;\n if (runtimeSecret && runtimeSecret.length > 0) {\n this.logDebug('Resolved ACP secret from process env', { providerRef, executionProfileRef });\n return runtimeSecret;\n }\n\n return undefined;\n }\n\n private toSemanticOperationKeys(operations: readonly string[]): LLMProvider_OperationKey[] {\n return operations\n .map((operation) => RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION[operation] ?? operation)\n .filter((operation): operation is LLMProvider_OperationKey => (\n Object.values(LLMProvider_OperationKey).includes(operation as LLMProvider_OperationKey)\n ));\n }\n\n private getDefaultProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n try {\n const runtimeContract = this.backendProviderRegistry.getRuntimeContract(providerRef, protocolKind);\n\n if (!runtimeContract) {\n this.logDebug(`Runtime contract not found: ${providerRef}:${protocolKind}`);\n return undefined;\n }\n\n\n if (runtimeContract.kind === ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL) {\n const defaultExecutionProfileRef = 'default';\n const hasExplicitSecretBinding = Boolean(\n runtimeContract.secretRef\n && runtimeContract.secretEnvVarName\n && runtimeContract.authModes.includes('secret-ref-env-injection'),\n );\n return {\n enabled: true,\n defaultExecutionProfileRef,\n executionProfiles: {\n [defaultExecutionProfileRef]: {\n runnerHost: AgentClientProtocol_RunnerHost.BACKEND_SUBPROCESS,\n command: runtimeContract.agentCommand,\n args: [...(runtimeContract.agentArgs ?? [])],\n inheritedEnvironmentVariables: [...(runtimeContract.inheritedEnvironmentVariables ?? [])],\n authMode: hasExplicitSecretBinding\n ? AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n : runtimeContract.authModes.includes('host-managed')\n ? AgentClientProtocol_AuthMode.HOST_MANAGED\n : AgentClientProtocol_AuthMode.NONE,\n ...(hasExplicitSecretBinding\n ? { secretRef: runtimeContract.secretRef, secretEnvVarName: runtimeContract.secretEnvVarName }\n : {}),\n // DEVELOPMENT only, and deliberately NARROWER than any other\n // synthesized default. Nobody authored this profile and\n // nobody reviewed it, and what it authorises is an agent\n // that edits a workspace. An application that wants a coding\n // agent anywhere else must say so in its own profile, where\n // the decision is visible.\n allowedApplicationEnvironments: [APPLICATION_ENVIRONMENT.DEVELOPMENT],\n workingDirectoryPolicy: AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_ROOT,\n // Both safety postures stated rather than left to a schema\n // default, so reading this profile tells you what it permits\n // without resolving anything.\n permissionCeiling: AgentClientProtocol_PermissionCeiling.PROMPT_ALWAYS,\n hostConfigurationInheritance: AgentClientProtocol_HostConfigurationInheritance.APPLICATION_SCOPED,\n ...(runtimeContract.sessionMetaExtensions\n ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions }\n : {}),\n },\n },\n runtimeContract,\n };\n }\n\n // One derivation for this default and for the companion contribution's `protocolSecretRefs`, so the\n // key tooling predicts (#2229) is the key this refusal reads.\n const secretRef = describeProviderProtocolSecretRef(runtimeContract);\n return {\n enabled: true,\n ...(secretRef\n ? {\n authConfig: {\n authKind: this.authKindForRuntimeContract(runtimeContract),\n secretRef,\n },\n }\n : {}),\n ...(runtimeContract.kind === ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR\n ? { endpoints: this.buildWebhookEndpoints(runtimeContract) }\n : {}),\n runtimeContract,\n };\n } catch (error) {\n // Same pattern as `getProviderConfiguration` — contract\n // violations (`authKindForRuntimeContract` misuse) throw a\n // `WildoError_Backend` instance that MUST surface.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting default provider configuration', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n /\n Map a runtime contract's `kind` to the canonical\n * `ExternalProvider_Auth_Kind` for the `authConfig` projection.\n * Used by `getDefaultProviderConfiguration` so the emitted\n * `authConfig: { authKind, secretRef }` satisfies the schema's\n * required-`authKind` invariant (was previously `{ secretRef }`\n * with no `authKind`, masked by `as unknown as` casts).\n \n Mapping rationale:\n \n - `llm` / `email` / `sms` / `billing` — providers authenticate\n * with an opaque API key supplied via env var.\n * - `webhook-originator` — provider signs payloads with HMAC; the\n * `secretRef` is the HMAC signing key.\n * - `oauth2-sso` — kind `OAUTH2`; the `secretRef` is the OAuth2\n * client secret.\n * - `agent-client-protocol` — auth is encoded on the executionProfile,\n * not `authConfig`; this method is not called for that kind\n * because that arm returns from the dedicated branch in\n * `getDefaultProviderConfiguration` BEFORE reaching this\n * mapping. A misuse throws via `errorBuilder` so the\n * `WildoError_Backend` instance bypasses the\n * `getProviderConfiguration` fallback catch.\n /\n private authKindForRuntimeContract(\n runtimeContract: ProviderProtocolRuntimeContract,\n ): ExternalProvider_Auth_Kind {\n switch (runtimeContract.kind) {\n case ProviderProtocolRuntimeKind.LLM:\n case ProviderProtocolRuntimeKind.IMAGE:\n case ProviderProtocolRuntimeKind.EMBEDDINGS:\n // Document extraction authenticates with an opaque API key in a request header, like\n // its siblings above; the header SHAPE (name/prefix) stays on the contract because\n // this family builds its own HTTPS request rather than handing a key to an SDK.\n case ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION:\n // A content-safety classifier authenticates the same way, with a key header named on its contract.\n case ProviderProtocolRuntimeKind.CONTENT_SAFETY:\n // An electronic-signature vendor too (#2293): the engine sends every request of the conversation with it.\n case ProviderProtocolRuntimeKind.ELECTRONIC_SIGNATURE:\n case ProviderProtocolRuntimeKind.EMAIL:\n case ProviderProtocolRuntimeKind.SMS:\n // A receiving provider authenticates the engine's fetches with an opaque API key in a header.\n case ProviderProtocolRuntimeKind.EMAIL_INBOUND:\n case ProviderProtocolRuntimeKind.BILLING:\n // `rest` authenticates with an opaque API key supplied via env var, like its siblings\n // above; the header SHAPE (name/prefix) stays on the contract for its consumer.\n case ProviderProtocolRuntimeKind.REST:\n return ExternalProvider_Auth_Kind.API_KEY;\n case ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR:\n return ExternalProvider_Auth_Kind.HMAC_SIGNATURE;\n case ProviderProtocolRuntimeKind.OAUTH2_SSO:\n return ExternalProvider_Auth_Kind.OAUTH2;\n case ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL:\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message: '[external-providers-registry] authKindForRuntimeContract called with kind=agent-client-protocol; '\n + 'ACP auth lives on executionProfiles[].authMode, not on authConfig.',\n },\n },\n );\n default: {\n const exhaustiveCheck: never = runtimeContract;\n return exhaustiveCheck;\n }\n }\n }\n\n /\n Project the provider-authored `runtimeContract.endpoints` into\n * the canonical `Hook_Endpoint` shape consumed by the framework\n * webhook controller. Provider-agnostic: each endpoint descriptor\n * is owned by the provider module (see Stripe's `endpoints` array\n * on `stripe.backend.module.ts`); the only field this projection\n * adds is `signatureConfig.headerName`, sourced from the contract's\n * top-level `signatureHeaderName` so providers don't repeat it on\n * every endpoint.\n \n Previously branched on a Stripe-only provider literal\n * with the entire endpoint shape (event types, polymorphic\n * variants, `lookupField`) hardcoded inside this consumer site —\n * the same anti-pattern Step 7 was supposed to eliminate. Moved\n * to the provider module 2026-05-06 to close the gap; the CI\n * guard regex (`no-provider-ref-branches.guard.test.ts`) now\n * also catches the `runtimeContract.provider` literal pattern.\n \n Per-endpoint secret overrides (if a future provider needs them)\n * still flow through `HookInitiatorProvider_Configuration.endpointSecrets`,\n * not through this projection.\n /\n private buildWebhookEndpoints(\n runtimeContract: Extract<ProviderProtocolRuntimeContract, { kind: typeof ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR }>,\n ): ReadonlyArray<Hook_Endpoint> {\n return runtimeContract.endpoints.map(({ signatureConfig, ...endpoint }) => ({\n ...endpoint,\n // A re-read trigger endpoint (#2909) declares no signature, and must not be given one here.\n ...(signatureConfig === undefined ? {} : {\n signatureConfig: { ...signatureConfig, headerName: runtimeContract.signatureHeaderName },\n }),\n eventTypes: [...endpoint.eventTypes],\n }));\n }\n\n /\n Get provider secrets for a specific protocol and secret reference.\n * Provider secrets are runtime-delivered via env/K8s materialization.\n * The secret binding contract is still declared by the provider protocol\n * configuration, but the secret value source is `process.env`.\n \n It reads ONLY a variable the provider module declares (#3002). The name\n * asked for resolves to a declared variable, or nothing is read: a\n * declared variable reads itself; the configuration's own\n * `authConfig.secretRef` may name its slot by slug and reads that slot's\n * variable; an ACP execution profile's `secretRef` reads that profile's\n * (declared) `secretEnvVarName`. Any other slug reads nothing, since a slug\n * is a credential-store key rather than an environment spelling. Until #3002 an unresolved name fell back to\n * `process.env[<name>]`, so whoever named the variable chose which process\n * secret was read. Measured 2026-10-20, every secret ref the engine's and\n * the registry's provider modules carry is a declared variable, so the\n * fallback read nothing a module needed.\n \n assurance-control: WILDO.SECRETS.CREDENTIAL_SCOPING — the registry reads no process variable its provider module does not declare, whoever names it.\n /\n /\n Why calling `model` through `providerRef` would process outside the region the application declared for it, or\n * `null` (#2294): a model id that names its own routing (Bedrock's `global.` profiles) against the provider's\n * `modelIdRouting` and the region this host's artifact binds it to. Asked by the agent registration at startup; the\n * provider's client asks the same predicate again when it builds the model.\n /\n public describeModelOutsideDeclaredProcessingRegion(providerRef: string, model: string): string \| null {\n return modelIdProcessingRegionRefusal({\n providerRef,\n profile: this.backendProviderRegistry.getProvider(providerRef)?.complianceProfile,\n processingRegion: this.backendProviderRegistry.getDeclaredProcessingRegion(providerRef),\n model,\n });\n }\n\n public getProviderSecret(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const envVarName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef);\n if (envVarName === undefined) {\n this.logDebug(`Secret '${secretRef}' is not a secret ${providerRef} declares; nothing was read`, { providerRef, protocolKind });\n return undefined;\n }\n\n const secretValue = process.env[envVarName];\n return secretValue && secretValue.length > 0 ? secretValue : undefined;\n } catch (error) {\n // Same as `getProviderApiKey`: a configuration refusal (#3002, an authored `secretRef` naming no declared\n // slot) surfaces, rather than reading as \"this secret has no value\".\n if (isWildoBackendError(error)) throw error;\n return undefined;\n }\n }\n\n private getProviderSecretEnvVarName(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n ): string \| undefined {\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n && executionProfile.secretRef === secretRef\n ) {\n return executionProfile.secretEnvVarName;\n }\n }\n }\n\n // The configuration's own `authConfig.secretRef` (held to the declared slots by `getProviderConfiguration`, #3002)\n // may name its slot by slug, and then reads that slot's variable. Any other name reads only as a declared\n // variable: a slug is a credential-store key, never an environment spelling (`canonicalCredentialSlug`), so a\n // plain read by slug resolves nothing.\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n if (protocolConfig?.authConfig?.secretRef === secretRef) {\n return this.resolveDeclaredSecretEnvVarName(providerRef, secretRef);\n }\n return this.declaredSecretSlots(providerRef).envVarNames.has(secretRef) ? secretRef : undefined;\n }\n\n /\n The sentence for a provider API key that has no value — naming the environment variable and how\n * to provide it (#1637). Secrets are asked when a feature needs one rather than all up front, so\n * this refusal IS the moment a person learns which key a feature waits on; a message that said\n * \"configure the provider secrets\" left them to find out which, and where.\n /\n public describeMissingProviderApiKey(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): string {\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n const envVarName = secretRef ? (this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef) : undefined;\n return envVarName\n ? `No value for ${envVarName} (${providerRef}, ${protocolKind}). ${describeProviderSecretRemedy(envVarName)}`\n : `${providerRef} declares no API key for ${protocolKind}, so this call cannot authenticate.`;\n }\n\n public getConfiguredProviderSecretRef(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n return config?.authConfig?.secretRef;\n }\n\n\n\n public getProviderApiKey(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n if (!secretRef) {\n this.logDebug(`No authConfig.secretRef found for ${providerRef}.${protocolKind}`);\n return undefined;\n }\n\n const apiKey = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (!apiKey) {\n this.logDebug(`Secret ${secretRef} not found for ${providerRef}.${protocolKind}`);\n }\n return apiKey;\n } catch (error) {\n // A configuration refusal (#2995, #3002) is a framework error and surfaces: reading it as \"no key\" would send\n // an operator to set a variable when the configuration itself is what is refused.\n if (isWildoBackendError(error)) throw error;\n this.logDebug('Error getting provider API key', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n /\n WHICH connections this provider admits — the recorded decision, or the FLOOR.\n \n The floor is an APPLICATION-owned, undelegated connection and nothing else, and it is what a\n * provider that has recorded no decision gets. It is not a permissive default: it is the one\n * answer always available (an operator can author an environment variable) and the one that\n * cannot produce a cross-tenant mistake (it has exactly one instance).\n \n Never derived here from a provider's auth shape. Whether a vendor can be connected per tenant\n * is a fact about that vendor's product and about what somebody verified — see the catalogue\n * record for a generated provider, or the module itself for a hand-authored one.\n /\n public getProviderAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[] {\n // The one reading of the default, shared with the module checks that admit the provider (#3398).\n const catalogue = providerModuleAdmissibleConnections(this.backendProviderRegistry.getProvider(providerRef));\n\n return this.narrowToApplicationConnectionPolicy(providerRef, catalogue);\n }\n\n /\n What the VENDOR admits, before this application's policy narrows it.\n \n Exists so a refusal can name the right cause. Once a policy can subtract, \"this provider does\n * not admit that connection\" has two meanings — nobody recorded the vendor's capability, or this\n * application switched it off — and they are repaired in different files by different people.\n * A diagnostic that always blamed the catalogue would send an operator to edit a decision record\n * that is already correct.\n /\n public getProviderCatalogueAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[] {\n return providerModuleAdmissibleConnections(this.backendProviderRegistry.getProvider(providerRef));\n }\n\n /\n Intersect what the VENDOR admits with what THIS application permits.\n \n Two layers answering different questions, and the intersection is what makes them composable:\n * the catalogue record says an organization-owned Slack connection is possible because Slack is\n * installed per workspace, while `providers.connections.slack` says whether this product offers\n * one. A vendor opening a capability and a product deciding to use it are different events, and\n * a single list would make them look identical.\n \n NARROWING ONLY, and that direction is the guarantee rather than a convention. An application\n * cannot declare a connection the vendor does not support into existence — the connect leg would\n * build an authorize URL the vendor rejects, or store a grant nothing can spend — so a policy\n * entry naming an unadmitted shape contributes nothing instead of granting it.\n \n An ABSENT policy means \"everything the catalogue admits\", never \"nothing\". Most applications\n * will never author one, and reading their silence as a refusal would switch off the whole\n * connect surface for every product that has not yet thought about it.\n \n An intersection that empties is a legitimate outcome, not a misconfiguration: it is how an\n * application switches a provider's connect surface off without removing the provider, which it\n * may still need for its own application-scope credential.\n /\n private narrowToApplicationConnectionPolicy(\n providerRef: string,\n catalogue: readonly ExternalProvider_ConnectionShape[],\n ): readonly ExternalProvider_ConnectionShape[] {\n const permitted = this.configService.config.providers?.connections?.[providerRef]?.admissible;\n if (permitted === undefined) {\n return catalogue;\n }\n return catalogue.filter((shape) => permitted.some(\n (allowed) => allowed.ownerScope === shape.ownerScope && allowed.delegation === shape.delegation,\n ));\n }\n\n /\n @wildo_source:part:start saas.backend.providers.connection-target-credential-resolution facet:layer:backend facet:audience:app-developer\n \n One provider secret for ONE connection target — strictly, with no substitution.\n \n Reached as `ExternalProvidersRegistryBackendService` from `@wildo-ai/saas-backend-lib`, through\n * the container token `SAAS_SERVICE_TYPES.ExternalProvidersRegistryService`.\n \n ## What a TARGET is, and why the call names one\n \n A target is `ownerScope` × `delegation`: WHOSE credential is spent, and whether the call acts\n * for a person. The four combinations are different principals, not four ways of saying the same\n * thing — an ORGANIZATION target spends the tenant's own connected account, an APPLICATION target\n * spends the deployment's shared one, a USER target spends one person's.\n \n Naming the target is what makes the identity on the wire a decision the calling code states\n * rather than one the engine infers.\n \n ## There is NO fallback, deliberately, and that is the whole design\n \n A miss in any branch REFUSES, naming what it will not substitute. It never quietly reaches for\n * a different principal's credential.\n \n This replaced a resolver that did fall back — an organization with no credential of its own\n * silently spent the deployment's — and the difference is not a tightening of one idea, it is the\n * opposite policy. A fallback means the vendor sees the application's identity while the\n * application believes it acted as the tenant, so every artifact the call leaves behind — a\n * message, a record, a line in the vendor's own audit log — is attributed to the wrong party, and\n * nothing downstream can detect it.\n \n *An application that wants \"the tenant's key when they have connected one, otherwise ours\"\n still has it*, and composes it itself: try an ORGANIZATION target, and on the refusal call\n again with an APPLICATION one. That is three lines in the application's own code, where the\n * substitution is visible to whoever reads it. What no longer exists is the engine performing\n * that swap underneath a call that asked for a tenant.\n \n ## A refusal is never `undefined`\n \n Every miss throws. Returning nothing was the original defect: several callers passed the empty\n * value onward, the vendor received a blank credential and answered 401, and that is\n * indistinguishable from a revoked key — which is how \"nobody ever configured this\" stayed\n * invisible. Each refusal below therefore names the PLACE an operator must go.\n \n Two misses are deliberately not fall-throughs, and both are cases where the tenant or the\n * person DID connect:\n \n - a credential stored under a RETIRED slot name (a provider regeneration renamed it). Nothing\n * can read or rename that row — its seal binds the slot name — so the owner reconnects the\n * account. The deployment's credential is NOT used instead, because the fallback that would\n * have applied is for an owner that has none (#624);\n * - a credential that cannot be OPENED. The envelope failure is not caught: a principal that HAS\n * an unreadable credential and one that has none are indistinguishable to a caller, and only\n * one of them is safe to continue from.\n /\n public async resolveProviderSecretForTarget(\n target: ExternalProvider_ConnectionTarget,\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n /\n A resource AUDIENCE other than the grant's primary (#1725): the token is minted from the stored grant's\n * refresh token for these scopes (or read from the audience cache), never the stored primary token. Absent:\n * the stored credential, as always. For an APPLICATION target, served only from the application's own stored grant\n * (#3398), and refused when it has none: the environment's value has no refresh token to mint from.\n /\n options?: {\n readonly audience?: ProviderOAuth2RefreshAudience;\n /\n The vendor answered 401 to the token this target's grant last served: the store renews it once (2026-11-10).\n * See `ProviderRefusedTokenRenewal`. For an APPLICATION target, honoured by its stored grant (#3398); an\n * environment value is never a grant and is served as it is.\n /\n readonly renewAfterRefusal?: ProviderRefusedTokenRenewal;\n },\n ): Promise<{\n value: string;\n source: ProviderCredentialResolutionSource;\n credentialId?: string;\n credentialSetByUserId?: string;\n /* The connection row's account facts, for a tenant-owned credential (#333, #1047). Absent for the deployment's own. /\n connectionFacts?: ProviderConnectionFacts;\n /* What the vendor granted, when it stated it (#979). Absent means not recorded, never nothing granted. /\n grantedScopes?: readonly string[];\n /\n What `value` is: the pasted value itself, or a token minted from a stored grant ({@link ProviderSpentCredentialForm}),\n * as the store that opened the row stated it. Decides whether the vendor's `401` is recorded against the row.\n /\n form?: ProviderSpentCredentialForm;\n }> {\n this.ensureInitialized();\n\n // Only the APPLICATION's identity impersonating a person is unbuilt. It needs a vendor-side\n // impersonation grant (domain-wide delegation) that no store holds, so it refuses by name.\n //\n // An ORGANIZATION × USER target resolves below like any tenant credential: it IS one — a member\n // linked their own account for the organization, and every member spends it (decision on #18).\n // This used to refuse every USER delegation with \"no outbound per-principal token store exists\n // yet\", after both stores existed, while the connect leg admitted and stored the very shape\n // this refused: a grant could be connected that nothing could ever spend.\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n && target.delegation === ExternalProvider_Connection_DelegationMode.USER) {\n throw this.buildConnectionRefusal(\n providerRef,\n `the application cannot act as user '${target.actingForUserId}': impersonating a person with the application's own `\n + 'identity needs a vendor impersonation grant, which nothing stores. Declare a USER-owned connection, so the person '\n + 'connects their own account.',\n );\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n // An envelope failure is NOT caught here, deliberately, for the organization branch's\n // reason: a person who HAS a credential which cannot be opened must refuse loudly rather\n // than be treated as a person who has none. The two are indistinguishable to a caller\n // and only one of them is a safe thing to continue from.\n const userResolver = this.resolveUserCredentialResolver();\n if (!userResolver) {\n throw this.buildConnectionRefusal(\n providerRef,\n 'no user credential store is bound, so a person-owned connection cannot be read at all. '\n + 'This is a wiring fault rather than a missing credential.',\n );\n }\n // The row's ADDRESS: the connection the ref belongs to (#1670) and the contract KEY of the slot,\n // never the env-var spelling a rename can move (#624). One answer for every read path.\n const { connectionRef: userConnectionRef, secretSlug: userSecretSlug } = this.resolveCredentialAddress(providerRef, secretRef);\n // A name the provider no longer declares is never sent to the store: its row would still open,\n // because the seal binds the name it was stored under, and spend a credential this subsystem\n // reports as unusable (#624). The miss path below then names that row as retired.\n const userSlotRetired = this.classifyStoredCredentialSlot(providerRef, userSecretSlug) === StoredCredentialSlotStanding.RETIRED;\n const ownedByUser = userSlotRetired ? undefined : await userResolver.resolveUserCredential({\n userId: target.ownerId!,\n providerRef,\n connectionRef: userConnectionRef,\n secretSlug: userSecretSlug,\n ...(options?.audience === undefined ? {} : { audience: options.audience }),\n ...(options?.renewAfterRefusal === undefined ? {} : { renewAfterRefusal: options.renewAfterRefusal }),\n });\n if (!ownedByUser) {\n const retiredSlots = await this.findRetiredSlotsBehindMiss(providerRef, userSlotRetired ? undefined : userSecretSlug, ExternalProvider_Connection_OwnerScope.USER, () =>\n userResolver.listStoredSecretSlugs({ userId: target.ownerId!, providerRef, connectionRef: userConnectionRef }));\n const storedBeforeJoining = await this.describeRowStoredBeforeJoining(providerRef, userConnectionRef, () =>\n userResolver.listStoredSecretSlugs({ userId: target.ownerId!, providerRef, connectionRef: providerRef }));\n throw this.buildConnectionRefusal(\n providerRef,\n storedBeforeJoining\n + (retiredSlots.length === 0\n ? `user '${target.ownerId}' has not connected '${secretRef}'. `\n : `user '${target.ownerId}' has no credential for '${secretRef}' under the provider's current secrets contract. `\n + `${describeCredentialsStoredUnderRetiredSlots(retiredSlots)} `)\n + \"It is not substituted with the deployment's or their organization's: the call asked to act as this person, and \"\n + 'acting as anyone else would put the wrong name on the record the provider keeps.',\n );\n }\n return {\n value: ownedByUser.value,\n source: ProviderCredentialResolutionSource.USER_CREDENTIAL,\n credentialId: ownedByUser.credentialId,\n ...(ownedByUser.connectionFacts === undefined ? {} : { connectionFacts: ownedByUser.connectionFacts }),\n ...(ownedByUser.grantedScopes === undefined ? {} : { grantedScopes: ownedByUser.grantedScopes }),\n ...(ownedByUser.form === undefined ? {} : { form: ownedByUser.form }),\n };\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION) {\n return this.resolveApplicationOwnedSecret(providerRef, protocolKind, secretRef, options);\n }\n\n // ORGANIZATION. An envelope failure is NOT caught, deliberately: a tenant that HAS a\n // credential which cannot be opened must refuse loudly rather than be treated as a tenant\n // that has none — the two are indistinguishable to a caller and only one is safe.\n const resolver = this.resolveOrganizationCredentialResolver();\n if (!resolver) {\n throw this.buildConnectionRefusal(\n providerRef,\n 'no organization credential store is bound, so a tenant-owned connection cannot be read at all. '\n + 'This is a wiring fault rather than a missing credential.',\n );\n }\n // The row's ADDRESS — connection and contract KEY — see the USER branch above (#1670, #624).\n const { connectionRef: organizationConnectionRef, secretSlug: organizationSecretSlug } = this.resolveCredentialAddress(providerRef, secretRef);\n // Never sends a RETIRED name to the store — see the USER branch above (#624).\n const organizationSlotRetired = this.classifyStoredCredentialSlot(providerRef, organizationSecretSlug) === StoredCredentialSlotStanding.RETIRED;\n const owned = organizationSlotRetired ? undefined : await resolver.resolveOrganizationCredential({\n organizationId: target.ownerId!,\n providerRef,\n connectionRef: organizationConnectionRef,\n secretSlug: organizationSecretSlug,\n ...(options?.audience === undefined ? {} : { audience: options.audience }),\n ...(options?.renewAfterRefusal === undefined ? {} : { renewAfterRefusal: options.renewAfterRefusal }),\n });\n if (!owned) {\n const retiredSlots = await this.findRetiredSlotsBehindMiss(providerRef, organizationSlotRetired ? undefined : organizationSecretSlug, ExternalProvider_Connection_OwnerScope.ORGANIZATION, () =>\n resolver.listStoredSecretSlugs({ organizationId: target.ownerId!, providerRef, connectionRef: organizationConnectionRef }));\n const storedBeforeJoining = await this.describeRowStoredBeforeJoining(providerRef, organizationConnectionRef, () =>\n resolver.listStoredSecretSlugs({ organizationId: target.ownerId!, providerRef, connectionRef: providerRef }));\n throw this.buildConnectionRefusal(\n providerRef,\n storedBeforeJoining\n + (retiredSlots.length === 0\n ? `organization '${target.ownerId}' has no credential for '${secretRef}'. `\n : `organization '${target.ownerId}' has no credential for '${secretRef}' under the provider's current secrets contract. `\n + `${describeCredentialsStoredUnderRetiredSlots(retiredSlots)} `)\n + \"It is not substituted with the deployment's: the call asked to act as this tenant, and acting as someone else \"\n + 'instead would be attributed to the wrong party.',\n );\n }\n return {\n value: owned.value,\n source: ProviderCredentialResolutionSource.ORGANIZATION_CREDENTIAL,\n credentialId: owned.credentialId,\n ...(owned.setByUserId === undefined ? {} : { credentialSetByUserId: owned.setByUserId }),\n ...(owned.connectionFacts === undefined ? {} : { connectionFacts: owned.connectionFacts }),\n ...(owned.grantedScopes === undefined ? {} : { grantedScopes: owned.grantedScopes }),\n ...(owned.form === undefined ? {} : { form: owned.form }),\n };\n }\n /* @wildo_source:part:end saas.backend.providers.connection-target-credential-resolution /\n\n /\n The APPLICATION's own credential: its stored OAuth2 grant when a super-administrator connected one (#3398), else\n * the value the deployment environment authors, as it always was.\n /\n private async resolveApplicationOwnedSecret(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n options: { readonly audience?: ProviderOAuth2RefreshAudience; readonly renewAfterRefusal?: ProviderRefusedTokenRenewal } \| undefined,\n ): Promise<{\n value: string;\n source: ProviderCredentialResolutionSource;\n credentialId?: string;\n connectionFacts?: ProviderConnectionFacts;\n grantedScopes?: readonly string[];\n form?: ProviderSpentCredentialForm;\n }> {\n const stored = await this.resolveApplicationStoredGrant(providerRef, protocolKind, secretRef, options);\n if (stored !== undefined) return stored;\n if (options?.audience !== undefined) {\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own credential cannot serve the '${options.audience.id}' audience: a token for another resource `\n + 'is minted from a connected account\\'s refresh token, and the application has connected no account for this provider.',\n );\n }\n const fromEnvironment = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (fromEnvironment) {\n // The deployment's configured value goes on the wire as it is: nothing re-mints it.\n return { value: fromEnvironment, source: ProviderCredentialResolutionSource.DEPLOYMENT_ENVIRONMENT, form: ProviderSpentCredentialForm.STATIC };\n }\n const environmentVariableName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef;\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own credential for '${secretRef}' is not set. Author '${environmentVariableName}' in the deployment environment`\n + (this.getConnectionOAuth2Client(providerRef) === undefined\n ? '.'\n : ', or connect the application\\'s own account through the provider connection flow as a super-administrator.'),\n );\n }\n\n /\n The APPLICATION's own STORED OAuth2 grant for a provider's slot (#3398), renewed when it must be, or `undefined`\n * when none is stored (or it is disabled, or no store is bound in this runtime). The one place both readers of the\n * application's own credential ask it: {@link resolveProviderSecretForTarget} and the provider HTTP access resolver.\n \n Only a provider whose connection declares an OAuth2 client can hold a grant, so only such a provider pays the\n * store's read: every other call (a model key, a pasted API key) never reaches the store.\n \n A stored grant AND an environment value for the same slot never both apply: the call is REFUSED, naming both,\n * because one of them is stale and spending either would leave a reader of the configuration believing the other\n * acts. Removing the environment value, or reconnecting the account meant, settles it.\n /\n public async resolveApplicationStoredGrant(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n options?: { readonly audience?: ProviderOAuth2RefreshAudience; readonly renewAfterRefusal?: ProviderRefusedTokenRenewal },\n ): Promise<{\n value: string;\n source: ProviderCredentialResolutionSource.APPLICATION_CREDENTIAL;\n credentialId: string;\n connectionFacts?: ProviderConnectionFacts;\n grantedScopes?: readonly string[];\n form: ProviderSpentCredentialForm;\n } \| undefined> {\n this.ensureInitialized();\n if (this.getConnectionOAuth2Client(providerRef) === undefined) return undefined;\n const applicationResolver = this.resolveApplicationCredentialResolver();\n if (applicationResolver === undefined) return undefined;\n const { connectionRef, secretSlug } = this.resolveCredentialAddress(providerRef, secretRef);\n // A name the provider no longer declares is never sent to the store (#624), as for the other owners.\n if (this.classifyStoredCredentialSlot(providerRef, secretSlug) === StoredCredentialSlotStanding.RETIRED) return undefined;\n const providerPackageName = this.getProviderPackageName(providerRef);\n const stored = await applicationResolver.resolveApplicationCredential({\n providerRef,\n connectionRef,\n secretSlug,\n ...(providerPackageName === undefined ? {} : { providerPackageName }),\n ...(options?.audience === undefined ? {} : { audience: options.audience }),\n ...(options?.renewAfterRefusal === undefined ? {} : { renewAfterRefusal: options.renewAfterRefusal }),\n });\n if (stored === undefined) return undefined;\n if (this.getProviderSecret(providerRef, protocolKind, secretRef)) {\n const environmentVariableName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef;\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own account is connected (a stored grant for connection '${connectionRef}'), and the deployment `\n + `environment also sets '${environmentVariableName}'. One of them is stale: remove '${environmentVariableName}' to `\n + 'spend the connected account, or reconnect the account you mean the application to act as.',\n );\n }\n return {\n value: stored.value,\n source: ProviderCredentialResolutionSource.APPLICATION_CREDENTIAL,\n credentialId: stored.credentialId,\n ...(stored.connectionFacts === undefined ? {} : { connectionFacts: stored.connectionFacts }),\n ...(stored.grantedScopes === undefined ? {} : { grantedScopes: stored.grantedScopes }),\n form: stored.form,\n };\n }\n\n /\n Record that the credential {@link resolveProviderSecretForTarget} just handed out was SPENT,\n * and what the provider thought of it.\n \n ## Why the recording lives HERE, beside the resolution\n \n Because the two must never disagree about which store they are talking about. This method\n * dispatches on `target.ownerScope` in exactly the same order and by exactly the same rule as\n * the resolution above, so the store that was read is the store that is stamped is a property\n * of one function rather than an agreement between two.\n \n The alternative — the caller routing for itself — was tried and is the defect this replaces.\n * The provider-operation executor held a thunk to A store, typed with an `organizationId` field,\n * and `target.ownerId` is a USER id whenever `ownerScope` is `USER` (#333's two-axis connection\n * shape). Wired as it stood, a person-owned call would have stamped a tenant row that does not\n * exist and emitted an organization audit event naming a user id as the organization. The\n * caller cannot route this correctly, because the ORDER is this class's knowledge — the same\n * argument `OrganizationProviderCredentialResolverPort`'s own docstring makes for why the order\n * does not live on the port.\n \n ## Fire-and-forget is the CALLER's decision, not this method's\n \n This returns a promise and lets a store failure reject. The outbound call has already happened\n * by the time anybody calls this, so the caller must not fail its own request on a bookkeeping\n * write — but swallowing here would also hide the rejection from the caller's loss counter, and\n * an observation nobody counts is the shape this whole change exists to remove. The executor\n * routes it through `emitAuditObservation`, which counts a rejection and never rethrows.\n \n @param provenance Exactly what {@link resolveProviderSecretForTarget} returned for this call,\n * carried through the access resolver. Passing anything else describes a row that was not the\n * one spent.\n /\n public async recordProviderSecretUseForTarget(\n target: ExternalProvider_ConnectionTarget,\n providerRef: string,\n provenance: { source: ProviderCredentialResolutionSource; credentialId?: string; secretSlug: string; credentialSetByUserId?: string },\n outcome?: { accepted: boolean; providerMessage?: string },\n ): Promise<void> {\n // The USE event names the STORED slot — the contract KEY — so it joins the credential's own SET,\n // ROTATED and DELETED events, which all carry the row's `secretSlug`. A caller's provenance may still\n // carry the env-var spelling a runtime contract names (#624); canonicalising here, at the one\n // recording chokepoint, makes that unrepresentable in the trail rather than a rule every caller keeps.\n const storedSecretSlug = this.canonicalCredentialSlug(providerRef, provenance.secretSlug);\n // The CONNECTION the spent row is keyed on, by the one function the resolution addressed it with (#1670),\n // so the use event names the grant beside the ref the call went through.\n const connectionRef = this.resolveCredentialConnectionRef(providerRef);\n // And WHOSE package the ref belongs to (#1725): on a shared connection several packages spend one grant.\n const providerPackageName = this.getProviderPackageName(providerRef);\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n && provenance.source === ProviderCredentialResolutionSource.APPLICATION_CREDENTIAL\n && provenance.credentialId !== undefined) {\n // The application's own stored grant (#3398) has a row to stamp, unlike a value the environment authors.\n await this.resolveApplicationCredentialResolver()?.recordCredentialUse({\n credentialId: provenance.credentialId,\n ...(outcome === undefined ? {} : { outcome }),\n });\n return;\n }\n if (target.ownerId === undefined) {\n // A value the deployment environment authors names no owner and has no row. Inventing one would\n // create a credential the tenant never set, which would then appear on their settings\n // screen as something they are responsible for rotating.\n return;\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n const userResolver = this.resolveUserCredentialResolver();\n // A person's credential ALWAYS has a row — there is nothing for a person to fall through\n // to — so an absent id here means the caller did not pass this method the provenance the\n // resolution produced, and stamping some other row would be worse than stamping none.\n if (!userResolver \|\| !provenance.credentialId) return;\n await userResolver.recordCredentialUse({\n userId: target.ownerId,\n providerRef,\n connectionRef,\n ...(providerPackageName === undefined ? {} : { providerPackageName }),\n secretSlug: storedSecretSlug,\n credentialId: provenance.credentialId,\n ...(outcome === undefined ? {} : { outcome }),\n });\n return;\n }\n\n if (target.ownerScope !== ExternalProvider_Connection_OwnerScope.ORGANIZATION) return;\n\n const resolver = this.resolveOrganizationCredentialResolver();\n if (!resolver) return;\n // `source` is passed through rather than filtered here: the store emits the use audit for\n // BOTH sources and stamps a row only for the tenant's own, and that split is its decision to\n // make. Filtering here would silently drop the audit row for the case a reviewer most wants\n // — a tenant acting as the shared deployment principal.\n await resolver.recordCredentialUse({\n organizationId: target.ownerId,\n providerRef,\n connectionRef,\n ...(providerPackageName === undefined ? {} : { providerPackageName }),\n secretSlug: storedSecretSlug,\n source: provenance.source,\n ...(provenance.credentialId === undefined ? {} : { credentialId: provenance.credentialId }),\n ...(provenance.credentialSetByUserId === undefined ? {} : { credentialSetByUserId: provenance.credentialSetByUserId }),\n ...(outcome === undefined ? {} : { outcome }),\n });\n }\n\n /\n After a store lookup under the current key MISSED: the retired slot names a credential is stored\n * under for the same owner and provider, so the refusal can say the row exists (#624).\n \n Chooses WORDS, never an outcome — the caller throws its refusal whatever this answers, and a\n * failure here (a store that cannot list, a partial binding) answers `[]` so that refusal is thrown\n * exactly as it was. Use it ONLY where the refusal is already decided; where the answer permits a\n * fall-through to another principal, use `requireCredentialsStoredUnderRetiredSlots`, which throws.\n * See `retired-credential-slot.backend.utils.ts`.\n /\n private findRetiredSlotsBehindMiss(\n providerRef: string,\n /* `undefined` when no lookup was made because the requested name was itself retired. /\n lookedUpSecretSlug: string \| undefined,\n ownerScope: ExternalProvider_Connection_OwnerScope,\n listStoredSecretSlugs: () => Promise<readonly string[]>,\n ): Promise<readonly string[]> {\n return findCredentialsStoredUnderRetiredSlots({\n registry: this,\n providerRef,\n lookedUpSecretSlug,\n listStoredSecretSlugs,\n onDetectionFailure: (error) => this.logDebug('Retired credential slot detection could not run; refusing with the plain message', {\n providerRef,\n ownerScope,\n error: describeCaughtError(error),\n }),\n });\n }\n\n /\n After a miss under a SHARED connection: whether the owner holds a row the ref stored under its OWN identity\n * before it joined that connection (#1725), as the sentence that opens the refusal — empty otherwise.\n \n Such a row is sealed to `(owner, providerRef, slot)`, the connection it was written for, and is never spent\n * through the shared one: re-sealing was decided against (2026-09-12), and a grant quietly read across two\n * identities is exactly what the connection key exists to prevent. So the person reconnects once, and the\n * refusal tells them why rather than claiming they never connected. Words only — a listing that fails answers\n * empty, and the refusal is thrown either way.\n /\n private async describeRowStoredBeforeJoining(\n providerRef: string,\n connectionRef: string,\n listStoredUnderOwnRef: () => Promise<readonly string[]>,\n ): Promise<string> {\n if (connectionRef === providerRef) return '';\n try {\n const stored = await listStoredUnderOwnRef();\n return stored.length === 0 ? '' : `a credential is stored under '${providerRef}' from before it joined the shared connection `\n + `'${connectionRef}'; it is not spent through the connection. Reconnect through any ref of '${connectionRef}'. `;\n } catch {\n return '';\n }\n }\n\n /\n One shape for every connection refusal, so an operator reads the same sentence everywhere — and one\n * CLASS, so a consumer can tell a refusal (a gap somebody fixes by connecting) from a fault (an unopenable\n * envelope, a failing store), which stays a plain error and stays loud.\n /\n private buildConnectionRefusal(providerRef: string, detail: string): ExternalProviderConnectionRefusedError {\n return new ExternalProviderConnectionRefusedError(`Provider '${providerRef}': ${detail}`);\n }\n\n // ══════════════════════════════════════════════════════════════════════════════════════════\n // PER-ORGANIZATION SECRET RESOLUTION (#357)\n //\n // ## Why these are separate methods and not a change to `getProviderSecret`\n //\n // `getProviderSecret` is synchronous, and six consumers across four other workstreams' files\n // call it that way. A per-organization credential lives in the database, so resolving one is\n // necessarily asynchronous — making the existing method async would reshape every one of those\n // call sites at once, in files this slice may not touch. So the environment path stays exactly\n // as it was, and the tenant-aware path is added beside it.\n //\n // This is a seam, not a duplication: the async path CALLS `getProviderSecret` for its second\n // step, so there remains exactly one implementation of \"what does the environment say\".\n //\n // ## The ORDER, and why the third step is a throw\n //\n // 1. the organization's OWN credential\n // 2. the deployment's env-projected `SecretsContract`\n // 3. refuse, BY NAME\n //\n // Step 3 is the one that matters. Before this existed, an unresolvable secret returned\n // `undefined`, and every caller then decided for itself what that meant — several of them by\n // passing it onward, so a vendor received an empty Authorization header and answered 401. A 401\n // from a vendor is indistinguishable from a revoked credential, so the real fault (nobody ever\n // configured one) was invisible. Naming both places that were checked turns that into a\n // sentence an operator can act on.\n //\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — resolving which principal this\n // application acts as toward a third party, per tenant.\n // ══════════════════════════════════════════════════════════════════════════════════════════\n\n /\n Lazy getter for the per-organization credential store — see the `container` constructor\n * param's JSDoc for why this cannot be a constructor injection.\n \n `isBound` is what preserves the old `@optional()` semantics: a host that binds no store\n * (a minion, a unit harness) resolves nothing here and falls through to the deployment\n * environment, exactly as it did before the store existed.\n /\n protected resolveOrganizationCredentialResolver(): OrganizationProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver)) return undefined;\n return this.container.get<OrganizationProviderCredentialResolverPort>(\n SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver,\n );\n }\n\n /\n Lazy getter for the per-user credential store — same mechanics as the organization one above,\n * and the OPPOSITE meaning when it resolves nothing.\n \n An unbound organization store falls through to the deployment environment, because a tenant\n * legitimately may not have its own credential. An unbound USER store REFUSES, because there is\n * nothing a person's credential could fall through to: spending the deployment's shared\n * principal on someone's behalf would attribute the act to the wrong party at the vendor. So a\n * host that forgot to bind this gets a refusal naming the wiring fault, never a silent\n * substitution.\n /\n /\n Lazy getter for the application's own grant store (#3398) — same mechanics as the two above. Unbound (a minion, a\n * harness), an APPLICATION target reads the deployment environment only, which is what it did before the store existed.\n /\n protected resolveApplicationCredentialResolver(): ApplicationProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.ApplicationProviderCredentialResolver)) return undefined;\n return this.container.get<ApplicationProviderCredentialResolverPort>(SAAS_SERVICE_TYPES.ApplicationProviderCredentialResolver);\n }\n\n protected resolveUserCredentialResolver(): UserProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.UserProviderCredentialResolver)) return undefined;\n return this.container.get<UserProviderCredentialResolverPort>(\n SAAS_SERVICE_TYPES.UserProviderCredentialResolver,\n );\n }\n\n\n /\n Whether THIS runtime may use the provider through `protocolKind`: the provider is loaded, its module declares the\n * protocol, the runtime's provider scope entry lists it, and its configuration does not set `enabled: false`.\n \n The scope entry is the gate (#2805, decided 2026-10-12). A runtime uses exactly what its scope entry binds, as\n * {@link getProvidersForEngineCapability} already requires the entry to list the engine capability. So an entry\n * binding nothing (`{ engineCapabilities: [], providerCapabilities: [], protocols: [] }`, what `wildo registry add`\n * writes) uses the provider for nothing: no inbound endpoint is mounted for it, no chat connection is offered, no\n * operation is executed through it. Until then the list was recorded, validated by `wildo config sync`, and read by\n * nothing at runtime, so an unbound entry still mounted the module's webhook endpoints.\n \n Four engine-capability services read a provider's contract after {@link getProvidersForEngineCapability} chose it\n * and do not ask this method: embeddings, document extraction, inbound email and contributed file storage. They can\n * reach only a provider whose entry binds the capability, so nothing unbound is reached; the email service asks both.\n \n A runtime with no provider scope at all (a platform service, a harness with no generated artifact) has declared\n * nothing to gate against and keeps the module's declaration, the behaviour before the scope existed. Every\n * application runtime has one: each applies its own projected scope (`applyProviderRuntime`), a minion and a worker\n * included.\n /\n public isProviderEnabled(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): boolean {\n this.ensureInitialized();\n try {\n if (!this.hasProvider(providerRef)) {\n return false;\n }\n\n const provider = this.getProvider(providerRef);\n if (!provider \|\| !provider.protocols.includes(protocolKind)) {\n return false;\n }\n\n const runtimeScope = this.getActiveRuntimeProviderScope();\n if (runtimeScope?.providers !== undefined) {\n const scopeKey = scopeKeyOfProtocolKind(protocolKind);\n const listed = runtimeScope.providers[providerRef]?.protocols ?? [];\n if (scopeKey === undefined \|\| !listed.includes(scopeKey)) {\n return false;\n }\n }\n\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n if (!config) {\n return true;\n }\n\n return config.enabled !== false;\n } catch (error) {\n // A configuration refusal (#2995, #3002) reads as \"not enabled\" here, which fails closed: nothing runs and no\n // secret is read. It is not surfaced because a predicate's callers branch on a boolean, and every host that\n // reads provider configuration refuses such a configuration at startup before this can meet it.\n this.logDebug('Error checking if provider is enabled', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return false;\n }\n }\n\n public getProviderProtocolSecrets(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): Record<string, string> \| undefined {\n this.ensureInitialized();\n try {\n const resolvedSecrets: Record<string, string> = {};\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n const protocolSecretRef = protocolConfig?.authConfig?.secretRef;\n if (protocolSecretRef) {\n const secretValue = this.getProviderSecret(providerRef, protocolKind, protocolSecretRef);\n if (secretValue) {\n resolvedSecrets[protocolSecretRef] = secretValue;\n }\n }\n\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n continue;\n }\n\n const secretValue = this.getProviderSecret(providerRef, protocolKind, executionProfile.secretRef);\n if (secretValue) {\n resolvedSecrets[executionProfile.secretRef] = secretValue;\n }\n }\n }\n\n return Object.keys(resolvedSecrets).length > 0 ? resolvedSecrets : undefined;\n } catch (error) {\n // Same as `getProviderApiKey`: a configuration refusal surfaces rather than reading as \"no secrets\".\n if (isWildoBackendError(error)) throw error;\n return undefined;\n }\n }\n\n /\n Refresh the runtime registry facade from first-class backend provider modules.\n \n This mirrors `initialize()` and intentionally no longer depends on the\n * deleted capability-bindings service.\n /\n public async refreshFromConfig(): Promise<void> {\n try {\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.registry = registry;\n this.isInitialized = true;\n\n this.logDebug('External providers registry refreshed from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n } catch (error) {\n this.logDebug('Failed to refresh registry from config', {\n error: describeCaughtError(error)\n });\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n error: describeCaughtError(error),\n },\n }\n );\n }\n }\n\n // ================================\n // Initialization Utils\n // ================================\n\n protected ensureInitialized(): void {\n if (!this.isInitialized \|\| !this.registry) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED\n }\n );\n }\n }\n}\n\n/\n The `selection` policy that orders a capability's providers, by resolution mode. Only a `SELECT_ONE` capability has\n * one: a `FAN_OUT` capability uses every declared provider, and a `BOUND_PER_PURPOSE` capability is bound per purpose\n * (#2891), so a stray `selection` from a hand-authored artifact never reorders or truncates either set.\n */\nfunction selectionPolicyFor<P>(mode: EngineCapabilityResolutionMode, selection: P \| undefined): P \| undefined {\n return engineCapabilityResolutionModeTakesASelection(mode) ? selection : undefined;\n}\n\nfunction assertNeverResolutionMode(mode: never): never {\n throw new Error(`Unhandled engine capability resolution mode: ${String(mode)}`);\n}\n"]}