npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1358) hide show

package/dist/esm/security/connected-accounts/controllers/provider-connection.controller.backend.service.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"provider-connection.controller.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/controllers/provider-connection.controller.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,SAAS,EACT,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,EACf,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,sCAAsC,EACtC,uCAAuC,EACvC,sCAAsC,EACtC,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAG1F,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAS5I,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,mCAAmC,EAAE,+BAA+B,EAAE,MAAM,qGAAqG,CAAC;AAC3L,OAAO,EAAE,mBAAmB,EAAE,MAAM,kFAAkF,CAAC;AAEvH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAEnH,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AAQtD;;;;;;GAMG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,uCAAuC;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,gGAAgG;IAChG,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,uCAAuC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACvD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CAClC,CAAC,CAAC;AAEH,kGAAkG;AAClG,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;AAE3G;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,gCAAgC,GAAqE;IACzG,CAAC,sCAAsC,CAAC,IAAI,CAAC,EAAE,mCAAmC;IAClF,CAAC,sCAAsC,CAAC,YAAY,CAAC,EAAE,gCAAgC;IACvF,CAAC,sCAAsC,CAAC,WAAW,CAAC,EAAE,mCAAmC;CAC1F,CAAC;AAEF,yFAAyF;AACzF,MAAM,wCAAwC,GAC5C,gCAAgC,CAAC,sCAAsC,CAAC,IAAI,CAAC,CAAC;AAEhF;;;;;;;GAOG;AACH,MAAM,gCAAiC,SAAQ,KAAK;IACtB;IAAqC;IAAjE,YAA4B,WAAmB,EAAkB,SAAiB;QAChF,KAAK,CAAC,aAAa,WAAW,mFAAmF,SAAS,IAAI,CAAC,CAAC;QADtG,gBAAW,GAAX,WAAW,CAAQ;QAAkB,cAAS,GAAT,SAAS,CAAQ;QAEhF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAGM,IAAM,0CAA0C,GAAhD,MAAM,0CAA2C,SAAQ,gCAAgC;IAK3B;IACQ;IACK;IACS;IACR;IACH;IACQ;IACtB;IACqB;IAZrF,YACqC,MAAqB,EACR,YAAwC,EACxC,YAAiC,EAChB,YAAwC,EAChC,aAAwD,EACnD,QAAiD,EACxC,OAAyD,EACjE,mBAAsD,EACzD,eAA0D,EAClD,uBAA0E,EAChG,SAAkC,EACb,SAAgD;QAEnI,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,8BAA8B,CAAC,CAAC;QAVT,iBAAY,GAAZ,YAAY,CAA4B;QAChC,kBAAa,GAAb,aAAa,CAA2C;QACnD,aAAQ,GAAR,QAAQ,CAAyC;QACxC,YAAO,GAAP,OAAO,CAAkD;QACjE,wBAAmB,GAAnB,mBAAmB,CAAmC;QACzD,oBAAe,GAAf,eAAe,CAA2C;QAClD,4BAAuB,GAAvB,uBAAuB,CAAmD;QAChG,cAAS,GAAT,SAAS,CAAyB;QACb,cAAS,GAAT,SAAS,CAAuC;IAGrI,CAAC;IAES,WAAW;QACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EACjF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAC/C,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAE/J,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,aAAa,EAAE,+DAA+D,CAAC,CAAC;QAEjH,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EACpF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAClD,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,0DAA0D,CAAC,CAAC;QAEpL,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAC5F,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACzD,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAE5J,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,6BAA6B,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EACxF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACrD,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE,oDAAoD,CAAC,CAAC;QAEjL,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EACrF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACnD,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACnJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAEzD,4FAA4F;YAC5F,+DAA+D;YAC/D,MAAM,aAAa,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,MAAM,IAAI,GAAG,mCAAmC,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;YAC5F,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAC5B,IAAI,IAAI,CAAC,OAAO,KAAK,+BAA+B,CAAC,wBAAwB,EAAE,CAAC;oBAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,IAAI,CAAC,OAAO;wBACnB,OAAO,EAAE,aAAa,WAAW,oFAAoF;qBACtH,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,IAAI,CAAC,OAAO;oBACnB,OAAO,EAAE,aAAa,WAAW,sFAAsF;iBACxH,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;YAE5B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;YACzG,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,2BAA2B,WAAW,gEAAgE;iBAChH,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,6FAA6F;YAC7F,+FAA+F;YAC/F,4DAA4D;YAC5D,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;YAE3H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,WAAW,EAAE,UAAU,CAAC,KAAK;gBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QACvD,IAAI,CAAC;YACH,yFAAyF;YACzF,+FAA+F;YAC/F,sBAAsB;YACtB,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE;iBAC/C,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;gBACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;gBACxH,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjG,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;gBAChE,OAAO;oBACL,WAAW;oBACX;;;;;;;;uBAQG;oBACH,WAAW,EAAE,OAAO,KAAK,SAAS;oBAClC,qBAAqB,EAAE,OAAO;oBAC9B;;;;uBAIG;oBACH,WAAW,EAAE,MAAM,KAAK,SAAS;wBAC/B,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC;wBACtC,CAAC,CAAC,CAAC,kBAAkB,CAAC,yBAAyB,CAAC;oBAClD;;;;;;uBAMG;oBACH,gBAAgB,EAAE,KAAK;yBACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,UAAU,CAAC;yBACxE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC9H;;;;;;;uBAOG;oBACH,mBAAmB,EAAE,KAAK;yBACvB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;yBAC/G,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;oBAClF,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC,WAAW,CAAC;yBAC/E,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;oBACpE,sFAAsF;oBACtF,uEAAuE;oBACvE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB;oBAClD,MAAM,EAAE,MAAM,EAAE,MAAM;iBACvB,CAAC;YACJ,CAAC,CAAC;gBACF,oFAAoF;gBACpF,yBAAyB;gBACzB,EAAE;gBACF,0FAA0F;gBAC1F,kEAAkE;gBAClE,0FAA0F;gBAC1F,4FAA4F;gBAC5F,qFAAqF;gBACrF,EAAE;gBACF,2FAA2F;gBAC3F,6FAA6F;gBAC7F,sFAAsF;gBACtF,+CAA+C;iBAC9C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CACnF,CAAC,CAAC;YAEL,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,KAAK,CAAC,qBAAqB,CAAC,GAAY,EAAE,GAAa;QAC7D,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACtG,OAAO;YACT,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;YAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC,WAAW,CAAC;iBACzE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC;YACrG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,2BAA2B;oBAClC,OAAO,EAAE,aAAa,WAAW,sBAAsB,MAAM,CAAC,UAAU,WAAW,MAAM,CAAC,UAAU,wBAAwB;iBAC7H,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;gBACjH,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAChE,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,4BAA4B,CAAC,UAAU,CAAC,CAAC;YACvG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAE3E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,0BAA0B;wBACjC,OAAO,EAAE,aAAa,WAAW,+BAA+B,IAAI,kBAAkB;8BAClF,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG;qBAClF,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,8BAA8B;wBACrC,OAAO,EAAE,IAAI,IAAI,0BAA0B,WAAW,6CAA6C;8BAC/F,uFAAuF;qBAC5F,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,eAAe;iBAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;iBACzE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,uBAAuB;oBAC9B,OAAO,EAAE,aAAa,WAAW,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C;iBAC/G,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,gFAAgF;YAChF,EAAE;YACF,iFAAiF;YACjF,6DAA6D;YAC7D,4FAA4F;YAC5F,8FAA8F;YAC9F,oFAAoF;YACpF,EAAE;YACF,2FAA2F;YAC3F,yFAAyF;YACzF,qFAAqF;YACrF,+EAA+E;YAC/E,EAAE;YACF,uFAAuF;YACvF,mFAAmF;YACnF,oFAAoF;YACpF,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAChG,CAAC;YAED,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,0CAA0C,EAAE;gBAC7D,WAAW;gBACX,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,4BAA4B,CACxC,WAAmB,EACnB,UAAkB,EAClB,KAAa,EACb,MAAyC;QAEzC,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,CACrD,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,KAAK,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oCAAoC,WAAW,oDAAoD;cACjG,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QACnD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACtG,OAAO;YACT,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;YAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YACxH,IAAI,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,0BAA0B;oBACjC,OAAO,EAAE,aAAa,WAAW,yEAAyE;0BACtG,qFAAqF;iBAC1F,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC,WAAW,CAAC;iBACzE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC;YACrG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,2BAA2B;oBAClC,OAAO,EAAE,aAAa,WAAW,sBAAsB,MAAM,CAAC,UAAU,WAAW,MAAM,CAAC,UAAU,wBAAwB;iBAC7H,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC/C,8FAA8F;gBAC9F,2FAA2F;gBAC3F,4EAA4E;gBAC5E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,yDAAyD;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,uFAAuF;YACvF,sFAAsF;YACtF,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAE7G,+EAA+E;YAC/E,EAAE;YACF,yFAAyF;YACzF,4FAA4F;YAC5F,6FAA6F;YAC7F,6FAA6F;YAC7F,0FAA0F;YAC1F,0CAA0C;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC5E,IAAI,KAAK,KAAK,4BAA4B,CAAC,UAAU,EAAE,CAAC;gBACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,8BAA8B;oBACrC,OAAO,EAAE,IAAI,UAAU,0BAA0B,WAAW,6CAA6C;0BACrG,6FAA6F;0BAC7F,6DAA6D;iBAClE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,yBAAyB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAE7C,MAAM,YAAY,GAAG,+BAA+B,CAAC;gBACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC9E,WAAW;gBACX,KAAK;gBACL,IAAI;gBACJ,oBAAoB;gBACpB,MAAM;aACP,CAAC,CAAC;YAEH,wFAAwF;YACxF,4FAA4F;YAC5F,2BAA2B;YAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE;gBACjC,WAAW;gBACX,UAAU;gBACV,MAAM;gBACN,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,WAAW;gBACX,oBAAoB;gBACpB,iBAAiB,EAAE,MAAM;gBACzB,iEAAiE;gBACjE,mBAAmB,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAC,KAAK,QAAQ;oBACzF,CAAC,CAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAY;oBAChE,CAAC,CAAC,SAAS;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QACtD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAEtE,8FAA8F;YAC9F,mFAAmF;YACnF,MAAM,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAErE,+FAA+F;YAC/F,+FAA+F;YAC/F,6BAA6B;YAC7B,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxC,4FAA4F;gBAC5F,4FAA4F;gBAC5F,4BAA4B;gBAC5B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACrH,OAAO;YACT,CAAC;YAED,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBACpC,4FAA4F;gBAC5F,oEAAoE;gBACpE,EAAE;gBACF,2FAA2F;gBAC3F,8EAA8E;gBAC9E,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YAED,oEAAoE;YACpE,EAAE;YACF,+FAA+F;YAC/F,+FAA+F;YAC/F,8FAA8F;YAC9F,yFAAyF;YACzF,yFAAyF;YACzF,wDAAwD;YACxD,EAAE;YACF,8FAA8F;YAC9F,0FAA0F;YAC1F,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,wCAAwC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,cAAc,CAAC,GAAY,EAAE,GAAa;QACtD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACtG,OAAO;YACT,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;YAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,4FAA4F;gBAC5F,0FAA0F;gBAC1F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,OAAO,EAAE,6DAA6D,EAAE,CAAC,CAAC;gBACtI,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;gBACpF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,CAAC;gBAC/G,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,OAAO,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YAChI,IAAI,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,0BAA0B;oBACjC,OAAO,EAAE,aAAa,OAAO,CAAC,WAAW,wCAAwC;iBAClF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC;gBAC7C,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACtF,YAAY,EAAE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;gBAClG,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAClD,IAAI;gBACJ,0FAA0F;gBAC1F,yFAAyF;gBACzF,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAEpE,+FAA+F;YAC/F,4FAA4F;YAC5F,0FAA0F;YAC1F,iDAAiD;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,oCAAoC,EAAE;gBACvD,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;gBACrC,YAAY;gBACZ,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,wCAAwC;aACzC,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAGD;;;;;;;;;;;;;;;;;;OAkBG;IACK,eAAe,CACrB,GAAa,EACb,mBAAuC,EACvC,OAAyC,EACzC,UAAmD;QAEnD,MAAM,IAAI,GAAG,mBAAmB,KAAK,SAAS;YAC5C,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QAE5F,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,+FAA+F;YAC/F,mDAAmD;YACnD,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,KAAK,SAAS;gBAClD,CAAC,CAAC,kFAAkF;gBACpF,CAAC,CAAC,4FAA4F,CAAC;YACjG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;iBAC1D,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,oEAAoE,MAAM,MAAM,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,gCAAgC,CAAC,UAAU,CAAC,EAChD,IAAI,CACL,CAAC;QACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7F,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,mBAAmB,CAC/B,OAA2C,EAC3C,KAA0B;QAE1B,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC;QAE1E,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,CACpC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EACpD,KAAK,EACL,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAC5C,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAC5D,KAAK,EACL,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8BAA8B,WAAW,0DAA0D;cACjG,4FAA4F;cAC5F,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,qBAAqB,CAC3B,WAAmB,EACnB,MAAkF;QAElF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,6BAA6B,CAAC,qBAAqB,CAAC;QACrF,MAAM,MAAM,GAAG,CAAC,GAAuB,EAAsB,EAAE,CAAC,CAAC,GAAG,KAAK,SAAS;YAChF,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACxG,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;YAC7E,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,6BAA6B,CAAC,0BAA0B,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACK,KAAK,CAAC,SAAS,CACrB,MAAyC,EACzC,MAAc,EACd,GAAY;QAEZ,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC1F,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACtE,+FAA+F;YAC/F,0FAA0F;YAC1F,OAAO,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC;QACnC,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,yCAAyC,CAAC,GAAG,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,kBAAkB,CAAC,WAAmB,EAAE,GAAW;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,WAAW,CAAC;aAC3D,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,IAAI,SAAS,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAC/E,OAAO,IAAI,EAAE,UAAU,IAAI,GAAG,CAAC;IACjC,CAAC;IAEO,eAAe,CAAC,WAAmB,EAAE,SAA6B;QACxE,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS;YACnC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7G,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,gCAAgC,CAAC,WAAW,EAAE,SAAS,IAAI,sCAAsC,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAGO,mBAAmB,CAAC,WAAmB,EAAE,SAA6B;QAC5E,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS;YACnC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7G,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,aAAa,WAAW,kFAAkF;kBACxG,IAAI,SAAS,IAAI,2BAA2B,4CAA4C,CAC3F,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,GAAY;QACjC,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;YAC9E,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE;YACtC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjB,OAAO,GAAG,QAAQ,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,GAAG,GAAG,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAY;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAAC,CAAC;QACnH,OAAO,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAAC,KAAc,EAAE,GAAa,EAAE,MAAc;QACzE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,8BAA8B,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,KAAK,YAAY,gCAAgC,EAAE,CAAC;YACtD,yFAAyF;YACzF,+FAA+F;YAC/F,gEAAgE;YAChE,EAAE;YACF,6FAA6F;YAC7F,2FAA2F;YAC3F,4BAA4B;YAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,+BAA+B;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,6CAA6C,KAAK,CAAC,WAAW,kDAAkD,KAAK,CAAC,SAAS,iEAAiE;aAC1M,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,aAAa,MAAM,yCAAyC;SACtE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAt4BY,0CAA0C;IADtD,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAC3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,yCAAyC,CAAC,CAAA;IACpE,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAC5D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAAA;IACjE,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;;GAbxD,0CAA0C,CAs4BtD","sourcesContent":["/**\n * Connecting a third-party account — the two HTTP legs of the authorization-code flow.\n *\n * `POST /connections/:providerRef/start` answers with the URL to send somebody to.\n * `GET /connections/callback` receives them back and stores the grant.\n *\n * ## The opposite direction from the OAuth controller next door\n *\n * `oauth-provider-controller` makes this application an OAuth PROVIDER, and\n * `authentication-controller` signs people IN using a vendor as their identity provider. This\n * connects a vendor account so the application can act AS that account. Same RFC, opposite arrow,\n * and nothing is shared but the specification.\n *\n * ## Everything arriving on the callback is attacker-controllable\n *\n * The callback is reached by a redirect through the person's own browser. Its query string is\n * whatever somebody put there. So the callback trusts NOTHING from its own URL except the `state`,\n * which it uses only as a lookup key — the provider, the owner, the PKCE verifier and the redirect\n * URI all come from the record that was written when the redirect went out. A callback that read the\n * owner from a query parameter would let anybody choose whose account a grant is stored against.\n *\n * ## Why the start leg returns a URL instead of redirecting\n *\n * The caller is a fetch from a settings screen, not a browser navigation. A 302 to a vendor would be\n * followed by the fetch, produce an opaque cross-origin response, and never reach the person — the\n * consent screen would render into a response body nobody sees. The screen navigates itself.\n *\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a principal authorizes this\n * application to act toward a named third party on their behalf.\n */\n\nimport 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport type { Request, Response } from 'express';\nimport { z } from 'zod';\nimport {\n ErrorType,\n MANUAL_CONTROLLER_ROUTES_URLS,\n ManualControllerRouteKey,\n WildoHeaderKeys,\n isWildoBackendError,\n} from '@wildo-ai/saas-models';\nimport {\n ExternalProvider_Connection_DelegationMode,\n ExternalProvider_Connection_OwnerScope,\n ExternalProvider_ConnectionTargetSchema,\n ExternalProvider_ExchangeProtocol_Kind,\n ExternalProvider_SecretScope,\n ProviderProtocolRuntimeKind,\n} from '@wildo-ai/external-connectors-models';\nimport type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';\nimport { ProviderAuthMethod, ProviderConnectabilityBlocker } from '@wildo-ai/saas-models';\nimport type { ProviderOAuth2Grant } from '@wildo-ai/saas-models';\n\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport type { AuthJwtGuardBackendService } from '~wildo-backend-lib/security/jwt/services/auth-jwt-guard.backend.service';\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport type { ConnectionTargetAuthorizationPort } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-provider-access.backend';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { resolveUserDelegatedAccessTokenSlot, UserDelegatedAccessTokenRefusal } from '~wildo-backend-lib/security/connected-accounts/utils/user-delegated-access-token-slot.backend.utils';\nimport { AuthControllerUtils } from '~wildo-backend-lib/security/authentications/services/utils/auth-controller.utils';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\nimport {\n buildProviderOAuth2AuthorizeUrl,\n createProviderOAuth2Pkce,\n createProviderOAuth2State,\n exchangeProviderOAuth2Code,\n} from '../services/provider-oauth2-exchange.backend';\nimport type {\n ProviderOAuth2PendingAuthorization,\n ProviderOAuth2PendingAuthorizationBackendService,\n} from '../services/provider-oauth2-pending-authorization.backend.service';\nimport type { UserProviderCredentialStoreBackendService } from '../services/user-provider-credential-store.backend.service';\nimport type { OrganizationProviderCredentialStoreBackendService } from '../services/organization-provider-credential-store.backend.service';\n\n/**\n * The start request.\n *\n * `target` is validated by the connection-target schema, which already refuses the incoherent\n * combinations — an APPLICATION target naming an owner, a SERVICE call naming somebody to act for.\n * Reusing it here means the connect leg and the call leg cannot disagree about what a target is.\n */\nconst StartConnectionRequestSchema = z.object({\n target: ExternalProvider_ConnectionTargetSchema,\n secretSlug: z.string().min(1).max(200).optional(),\n scopes: z.array(z.string().min(1)).optional(),\n /** Answers for the endpoints' `{placeholders}` — which cloud, which directory, which region. */\n connectionParameters: z.record(z.string(), z.string()).optional(),\n});\n\n/**\n * A typed credential, one value per slot the provider declares.\n *\n * Keyed by SLUG rather than carrying a `secretSlug` field, because the shape then says what the rule\n * is: a provider needing three values gets three keys, and there is no single slot for a caller to\n * point somewhere unintended. The keys are validated against the contract, so the schema's job here\n * is only to refuse an empty value.\n */\nconst StoreCredentialRequestSchema = z.object({\n target: ExternalProvider_ConnectionTargetSchema,\n values: z.record(z.string().min(1), z.string().min(1)),\n});\n\n/**\n * The approval, handed back by the frontend that received it.\n *\n * Nothing here identifies an owner, and that is deliberate: the target lives in the remembered\n * attempt, so a caller cannot choose whose account a grant is stored against by editing a body.\n */\nconst CompleteConnectionRequestSchema = z.object({\n state: z.string().min(1).max(500),\n code: z.string().min(1).max(4000),\n});\n\n/** Where the vendor sends people back. One URI for every provider — see the route's own JSDoc. */\nconst CALLBACK_PATH = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_CALLBACK];\n\n/**\n * Where the person lands afterwards, on the FRONTEND — CHOSEN BY THE OWNER SCOPE.\n *\n * The settings hub routes by section ref, and connected accounts live at TWO of them: a personal\n * one and a tenant one, each with its own Connect panel and its own credential list. So the\n * destination is a function of whose account was connected, not a constant.\n *\n * It was `my-provider-credentials` unconditionally until 2026-09-10, which meant somebody who\n * connected their ORGANIZATION's account was returned to their PERSONAL settings — a screen whose\n * credential list shows their own rows and therefore says nothing about the tenant credential that\n * had just been created. The connection worked and looked as though it had not, which is the\n * report that found this. The organization destination's own definition already asserted the\n * opposite (\"Connect comes first because it is where the connection callback returns\"), so the two\n * halves disagreed and only one of them was executable.\n *\n * An APPLICATION-owned connection has no settings screen of its own — the deployment's credential\n * is authored in the environment — and cannot reach the start leg's store check anyway, so it takes\n * the personal destination as the one that exists rather than inventing a third.\n */\nconst PROVIDER_CONNECTION_RETURN_PATHS: Readonly<Record<ExternalProvider_Connection_OwnerScope, string>> = {\n [ExternalProvider_Connection_OwnerScope.USER]: '/settings/my-provider-credentials',\n [ExternalProvider_Connection_OwnerScope.ORGANIZATION]: '/settings/provider-credentials',\n [ExternalProvider_Connection_OwnerScope.APPLICATION]: '/settings/my-provider-credentials',\n};\n\n/** The destination for an attempt whose record is gone, so its owner cannot be known. */\nconst PROVIDER_CONNECTION_FALLBACK_RETURN_PATH =\n PROVIDER_CONNECTION_RETURN_PATHS[ExternalProvider_Connection_OwnerScope.USER];\n\n/**\n * This deployment has not registered an application with the vendor.\n *\n * Its own class because the answer it deserves is nothing like the catch-all's. A vendor's token\n * endpoint misbehaving IS an upstream failure and 502 says so correctly; a client id that was never\n * configured is entirely local, and answering 502 made a browser report \"upstream server error\" and\n * sent an operator looking at infrastructure that is working perfectly.\n */\nclass ProviderRegistrationMissingError extends Error {\n constructor(public readonly providerRef: string, public readonly secretRef: string) {\n super(`Provider '${providerRef}' cannot be connected: the application's OAuth2 registration is not configured (${secretRef}).`);\n this.name = 'ProviderRegistrationMissingError';\n }\n}\n\n@injectable()\nexport class ProviderConnectionControllerBackendService extends AbstractControllerBackendService {\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) errorHandler: ErrorHandlerService,\n @inject(SAAS_SERVICE_TYPES.AuthJwtGuardService) private readonly authJwtGuard: AuthJwtGuardBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) private readonly authEcFactory: AuthExecutionContextFactoryBackendService,\n @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly registry: ExternalProvidersRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ProviderOAuth2PendingAuthorizationService) private readonly pending: ProviderOAuth2PendingAuthorizationBackendService,\n @inject(SAAS_SERVICE_TYPES.ConnectionTargetAuthorizationPort) private readonly targetAuthorization: ConnectionTargetAuthorizationPort,\n @inject(SAAS_SERVICE_TYPES.UserProviderCredentialResolver) private readonly userCredentials: UserProviderCredentialStoreBackendService,\n @inject(SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver) private readonly organizationCredentials: OrganizationProviderCredentialStoreBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfig: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly ecCreator: ExecutionContextCreatorBackendService,\n ) {\n super(logger, errorBuilder, errorHandler, 'ProviderConnectionController');\n }\n\n protected setupRoutes(): void {\n this.router.post(\n MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_START],\n this.asyncHandler(this.handleStart.bind(this)),\n );\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_START], 'Begin connecting a third-party account');\n\n this.router.get(CALLBACK_PATH, this.asyncHandler(this.handleCallback.bind(this)));\n this.logRouteRegistration('GET', CALLBACK_PATH, 'Receive the authorization code and hand it to the application');\n\n this.router.post(\n MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE],\n this.asyncHandler(this.handleComplete.bind(this)),\n );\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE], 'Finish an approved connection as the person who began it');\n\n this.router.post(\n MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL],\n this.asyncHandler(this.handleStoreCredential.bind(this)),\n );\n this.logRouteRegistration('POST', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL], 'Store a typed credential');\n\n this.router.get(\n MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN],\n this.asyncHandler(this.handleAccessToken.bind(this)),\n );\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN], 'Hand the caller their own short-lived access token');\n\n this.router.get(\n MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE],\n this.asyncHandler(this.handleCatalogue.bind(this)),\n );\n this.logRouteRegistration('GET', MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE], 'What can be connected');\n }\n\n /**\n * What can be connected — the question the stored-credential list cannot answer.\n *\n * A settings screen listing somebody's connections shows an empty table on the day they have none,\n * which is precisely the day they need to learn what they might connect. So the CATALOGUE and the\n * ROWS are two reads, deliberately: this one is about the provider, the resource LIST is about the\n * person, and merging them would make \"nothing connected\" and \"nothing connectable\" indistinguishable.\n *\n * ## It reports a DECISION, and computes nothing\n *\n * `admissibleConnections` is the recorded decision in the provider's catalogue record — never\n * derived from what a vendor's API happens to support. A vendor with a personal-token endpoint does\n * not thereby become a provider a person may connect individually; somebody decided that, and this\n * route repeats what they decided.\n *\n * ## It answers ADMISSIBILITY, not AUTHORIZATION, and that split is not laziness\n *\n * Whether this caller may act for a given owner depends on the owner's ID, which a catalogue has\n * none of — an organization-scoped shape is admissible for the provider while the caller may be\n * entitled to act for one tenant and not another. So the start leg keeps both gates in the same\n * order every credential path uses, and a screen that renders an owner it cannot act for gets a\n * 403 there rather than a silently missing row here.\n *\n * ## Nothing here is a secret\n *\n * Which vendors an application integrates with is a property of the application, visible on its own\n * marketing pages. No token, no client secret, no env-var VALUE is reported — `connectionParameters`\n * names the placeholders a connection must ANSWER, which is an input to ask a person for.\n */\n /**\n * Hands the CALLER their own short-lived access token for one provider (#394 P4).\n *\n * ## Why a browser is handed a token at all\n *\n * A vendor's picker authorizes as the signed-in user. Drive's cannot render without that user's\n * OAuth2 token, so the token is in the browser during picking whether the selected bytes are later\n * fetched by the backend (`REMOTE_REFERENCE`) or not. #383 named a user-consented token a\n * browser-safe grant for exactly this reason: it is the PERSON's grant, not the tenant's credential.\n *\n * ## What keeps this the one safe door\n *\n * - **The caller's own account, and nobody else's.** The row is resolved as `{ userId: caller }`;\n * there is no target in the request to name another owner, so `mayActFor` has nothing to decide.\n * - **Admissibility is the provider's recorded decision**, the same catalogue `start` consults: a\n * provider that does not admit a user-owned, self-delegated connection has no grant to hand out.\n * - **Never the refresh token.** The resolution carries the access token, its expiry and its\n * scopes; the refresh token stays in the sealed row and the renewal happens here, server-side.\n * - **Every hand-out is a USE.** `recordCredentialUse` emits `USER_PROVIDER_CREDENTIAL_USED` and\n * stamps `lastUsedAt`, so a token that left the process is visible against the revocation and\n * erasure that end it.\n * - **404 when nothing is connected**, so a surface can offer the connection instead of opening a\n * picker on nobody's files — the picker's own `onError` then names what is missing.\n *\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — a person's delegated grant reaches\n * the browser only as their own, only as an access token, and only as a recorded use.\n */\n private async handleAccessToken(req: Request, res: Response): Promise<void> {\n try {\n const { userId } = await this.extractCaller(req);\n const providerRef = String(req.params.providerRef ?? '');\n\n // The same predicate the Drive storage reads a linked file through (#394 P5): one answer to\n // \"does this provider hand a person their own token\", not two.\n const requestedSlug = typeof req.query.secretSlug === 'string' ? req.query.secretSlug : undefined;\n const slot = resolveUserDelegatedAccessTokenSlot(this.registry, providerRef, requestedSlug);\n if (slot.admitted === false) {\n if (slot.refusal === UserDelegatedAccessTokenRefusal.PROVIDER_NOT_CONNECTABLE) {\n res.status(400).json({\n error: slot.refusal,\n message: `Provider '${providerRef}' does not declare an OAuth2 contract, so there is no delegated token to hand out.`,\n });\n return;\n }\n res.status(409).json({\n error: slot.refusal,\n message: `Provider '${providerRef}' does not admit a user-owned connection, so there is no personal token to hand out.`,\n });\n return;\n }\n const { secretSlug } = slot;\n\n const resolution = await this.userCredentials.resolveUserCredential({ userId, providerRef, secretSlug });\n if (resolution === undefined) {\n res.status(404).json({\n error: 'NOT_CONNECTED',\n message: `You have not connected '${providerRef}'. Connect it first; the picker cannot open on nobody's files.`,\n });\n return;\n }\n\n // Best-effort by design (see the store): the token is about to leave the process either way,\n // and a bookkeeping failure must not turn a working picker into an error. Awaited so the audit\n // row lands BEFORE the response that carries the token out.\n await this.userCredentials.recordCredentialUse({ userId, providerRef, secretSlug, credentialId: resolution.credentialId });\n\n res.status(200).json({\n accessToken: resolution.value,\n expiresAt: resolution.expiresAt,\n grantedScopes: resolution.grantedScopes,\n });\n } catch (error) {\n this.handleControllerError(error, res, 'hand out an access token');\n }\n }\n\n private async handleCatalogue(req: Request, res: Response): Promise<void> {\n try {\n // Authenticated, though nothing here is owner-specific: an unauthenticated reader has no\n // screen to render it on, and an integration inventory is not something to hand to anybody who\n // can reach the port.\n await this.extractCaller(req);\n\n const providers = this.registry.getProviderTypes()\n .map((providerRef) => {\n const contract = this.registry.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n const oauth2 = contract?.kind === ProviderProtocolRuntimeKind.REST ? contract.oauth2 : undefined;\n const blocker = this.connectabilityBlocker(providerRef, oauth2);\n const slots = this.registry.getProviderSecretSlots(providerRef);\n return {\n providerRef,\n /**\n * Whether THIS DEPLOYMENT can begin a connection — not whether the vendor supports one.\n *\n * Those were the same field until somebody pressed Connect on Asana and got a 502. Asana\n * supports OAuth2 perfectly well and this application has never registered with it, so\n * the button could only ever fail. A provider that is not connectable still APPEARS, with\n * the reason: a supported vendor rendered as absent is a worse answer than one rendered\n * with what is missing.\n */\n connectable: blocker === undefined,\n notConnectableBecause: blocker,\n /**\n * HOW this provider is connected, so the screen can be the right screen. A vendor with an\n * authorization flow gets the consent round trip; one whose credential is typed gets a\n * form over the fields BELOW, and never a free-text slug.\n */\n authMethods: oauth2 === undefined\n ? [ProviderAuthMethod.DECLARED_SECRET]\n : [ProviderAuthMethod.OAUTH2_AUTHORIZATION_CODE],\n /**\n * The account-identifying slots a person fills, DECLARED by the provider rather than typed.\n *\n * This is what removes the free-text `secretSlug`: a vendor needing three values says so,\n * and the form asks for those three by name. Empty for a vendor whose only credential is\n * minted by an exchange.\n */\n credentialFields: slots\n .filter((slot) => slot.scope === ExternalProvider_SecretScope.CREDENTIAL)\n .map(({ slug, envVarName, required, description, configured }) => ({ slug, envVarName, required, description, configured })),\n /**\n * What an OPERATOR still has to set for this provider to be connectable at all.\n *\n * Reported rather than used to hide the provider: an absent vendor answers \"we do not\n * support Asana\", which is false and unfixable, while a named missing variable is true and\n * is the thing that gets it set. Only the REQUIRED ones — an optional slot that is unset\n * is not a gap, and listing it would make the real gaps harder to see.\n */\n missingRegistration: slots\n .filter((slot) => slot.scope === ExternalProvider_SecretScope.REGISTRATION && slot.required && !slot.configured)\n .map(({ slug, envVarName, description }) => ({ slug, envVarName, description })),\n admissibleConnections: this.registry.getProviderAdmissibleConnections(providerRef)\n .map(({ ownerScope, delegation }) => ({ ownerScope, delegation })),\n // Absent, not empty, when the endpoints are plain — the same distinction the contract\n // draws, so \"no placeholder\" stays separable from \"nobody has looked\".\n connectionParameters: oauth2?.connectionParameters,\n scopes: oauth2?.scopes,\n };\n })\n // Keep only what somebody could actually connect: a provider admitting at least one\n // NON-APPLICATION owner.\n //\n // The obvious test — \"admits nothing\" — is INERT here, and measuring is what showed it. A\n // provider with no recorded decision does not admit an empty set:\n // `getProviderAdmissibleConnections` defaults it to APPLICATION/SERVICE, so the length is\n // never zero and that filter removed exactly nothing. With 689 transposed providers and one\n // recorded decision, this route was returning all 689 to a screen that can show one.\n //\n // APPLICATION is the right thing to exclude rather than an approximation of it. That scope\n // means the DEPLOYMENT's own credential, authored in the environment — `storeGrantForTarget`\n // refuses an APPLICATION target outright and says so — leaving no flow to begin, so a\n // Connect button for one could only ever fail.\n .filter((entry) => entry.admissibleConnections.some(\n (shape) => shape.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION,\n ));\n\n res.status(200).json({ providers });\n } catch (error) {\n this.handleControllerError(error, res, 'list the connectable providers');\n }\n }\n\n /**\n * Store a credential somebody typed — the whole flow for a vendor with no authorization dance.\n *\n * ## The slugs are CHECKED, not trusted\n *\n * Every key must be a slot the provider declares as identifying an ACCOUNT. That refusal is the\n * point of the route: a screen can offer only declared fields and still be bypassed by anything\n * that posts JSON, so \"nothing is typed by hand\" has to be enforced where the write happens.\n *\n * Two refusals rather than one, because the causes differ. A name the provider never declared is a\n * caller inventing a slot. A name it declares as a REGISTRATION is worse and looks reasonable: the\n * application's own client secret has a slug like any other, and writing an account token there\n * would store a value nothing ever reads — the connect reports success and every call afterwards\n * resolves as absent.\n *\n * ## Required slots must all arrive\n *\n * A partial credential is not a smaller credential; it is one that cannot authenticate. Refusing\n * here costs a round trip, where accepting costs a stored row that fails at the vendor with an\n * error naming the vendor rather than the omission.\n *\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — an account credential is recorded\n * against the owner an authorized caller named.\n */\n private async handleStoreCredential(req: Request, res: Response): Promise<void> {\n try {\n const { userId } = await this.extractCaller(req);\n const providerRef = String(req.params.providerRef ?? '');\n const parsed = StoreCredentialRequestSchema.safeParse(req.body);\n if (!parsed.success) {\n res.status(400).json({ error: 'VALIDATION_FAILED', message: 'The credential request is not valid.' });\n return;\n }\n const { target, values } = parsed.data;\n\n const admitted = this.registry.getProviderAdmissibleConnections(providerRef)\n .some((shape) => shape.ownerScope === target.ownerScope && shape.delegation === target.delegation);\n if (!admitted) {\n res.status(409).json({\n error: 'CONNECTION_NOT_ADMISSIBLE',\n message: `Provider '${providerRef}' does not admit a ${target.ownerScope}-owned, ${target.delegation}-delegated connection.`,\n });\n return;\n }\n\n if (!await this.mayActFor(target, userId, req)) {\n res.status(403).json({ error: 'FORBIDDEN', message: 'You may not store a credential on behalf of that owner.' });\n return;\n }\n\n const slots = this.registry.getProviderSecretSlots(providerRef);\n const credentialSlots = slots.filter((slot) => slot.scope === ExternalProvider_SecretScope.CREDENTIAL);\n const declared = new Map(credentialSlots.map((slot) => [slot.slug, slot]));\n\n for (const slug of Object.keys(values)) {\n const slot = slots.find((candidate) => candidate.slug === slug);\n if (slot === undefined) {\n res.status(400).json({\n error: 'SECRET_SLUG_NOT_DECLARED',\n message: `Provider '${providerRef}' declares no secret named '${slug}'. It declares: `\n + `${credentialSlots.map((candidate) => candidate.slug).join(', ') || 'none'}.`,\n });\n return;\n }\n if (!declared.has(slug)) {\n res.status(400).json({\n error: 'SECRET_SLUG_NOT_A_CREDENTIAL',\n message: `'${slug}' identifies provider '${providerRef}'\\u2019s own registration, not an account, `\n + 'so a credential cannot be stored there. It is authored in the deployment environment.',\n });\n return;\n }\n }\n\n const missing = credentialSlots\n .filter((slot) => slot.required && (values[slot.slug] ?? '').length === 0)\n .map((slot) => slot.slug);\n if (missing.length > 0) {\n res.status(400).json({\n error: 'CREDENTIAL_INCOMPLETE',\n message: `Provider '${providerRef}' requires ${missing.join(', ')}. A partial credential cannot authenticate.`,\n });\n return;\n }\n\n // STORED UNDER THE SAME REFERENCE EVERY READER USES, which is the env-var name.\n //\n // A slot has two names — the authoring slug (`accessToken`) and its `envVarName`\n // (`ASANA_API_KEY`) — and a credential row's business key is\n // `(owner, providerRef, secretSlug)`, matched EXACTLY. Every runtime reader arrives holding\n // `runtimeContract.apiKey.secretRef`, and a runtime contract only ever references a secret by\n // its env-var name, so a row written under the slug is a row nothing can ever find.\n //\n // This door wrote the slug and the OAuth2 door wrote the env-var name, so the same account\n // stored through the two paths produced two rows that could not see each other — and the\n // typed one resolved as absent forever. It reported success, which is the shape this\n // controller already refuses for registration slugs (\"a value NOTHING reads\").\n //\n // Canonicalising on the env-var name rather than on the slug follows the decision this\n // subsystem already took for exactly this \"two names for one secret\" problem — see\n // `getProviderSecretScope`, which compares on the env-var name for the same reason.\n const stored: Record<string, string> = {};\n for (const [slug, value] of Object.entries(values)) {\n const secretRef = this.canonicalSecretRef(providerRef, slug);\n stored[slug] = await this.storeDeclaredSecretForTarget(providerRef, secretRef, value, target);\n }\n\n // Never the values, and never how many characters they were.\n this.logger.info?.('[oauth2-connect] typed credential stored', {\n providerRef,\n ownerScope: target.ownerScope,\n slugs: Object.keys(stored),\n });\n\n res.status(200).json({ stored });\n } catch (error) {\n this.handleControllerError(error, res, 'store a provider credential');\n }\n }\n\n /**\n * Route a typed credential to the store that owns the owner's table.\n *\n * An APPLICATION target has no store — the deployment's own credential lives in the environment —\n * so a value arriving for one would be written where nothing reads it.\n */\n private async storeDeclaredSecretForTarget(\n providerRef: string,\n secretSlug: string,\n value: string,\n target: ExternalProvider_ConnectionTarget,\n ): Promise<string> {\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n return this.userCredentials.storeDeclaredSecret({ userId: target.ownerId!, providerRef, secretSlug }, value);\n }\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION) {\n return this.organizationCredentials.storeDeclaredSecret(\n { organizationId: target.ownerId!, providerRef, secretSlug }, value,\n );\n }\n throw new Error(\n `A typed credential for provider '${providerRef}' named an APPLICATION-owned target, which has no `\n + \"credential store: the deployment's own credential is authored in the environment.\",\n );\n }\n\n /**\n * Leg one: decide whether this caller may connect this target, and hand back the URL.\n *\n * The two gates are the SAME pair every credential path goes through, in the same order.\n * ADMISSIBLE — does this provider admit this owner scope at all? AUTHORIZED — may this execution\n * act for that owner? Running them here rather than only at the callback means a person who cannot\n * connect is told so before being sent to a vendor, rather than after granting consent.\n */\n private async handleStart(req: Request, res: Response): Promise<void> {\n try {\n const { userId } = await this.extractCaller(req);\n const providerRef = String(req.params.providerRef ?? '');\n const parsed = StartConnectionRequestSchema.safeParse(req.body);\n if (!parsed.success) {\n res.status(400).json({ error: 'VALIDATION_FAILED', message: 'The connection request is not valid.' });\n return;\n }\n const { target, scopes, connectionParameters } = parsed.data;\n\n const contract = this.registry.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n if (contract?.kind !== ProviderProtocolRuntimeKind.REST || contract.oauth2 === undefined) {\n res.status(400).json({\n error: 'PROVIDER_NOT_CONNECTABLE',\n message: `Provider '${providerRef}' does not declare an OAuth2 contract, so there is nothing to connect. `\n + 'A provider whose credential is pasted is authored on the credential screen instead.',\n });\n return;\n }\n\n const admitted = this.registry.getProviderAdmissibleConnections(providerRef)\n .some((shape) => shape.ownerScope === target.ownerScope && shape.delegation === target.delegation);\n if (!admitted) {\n res.status(409).json({\n error: 'CONNECTION_NOT_ADMISSIBLE',\n message: `Provider '${providerRef}' does not admit a ${target.ownerScope}-owned, ${target.delegation}-delegated connection.`,\n });\n return;\n }\n\n if (!await this.mayActFor(target, userId, req)) {\n // 403 rather than 404: the caller is authenticated and the provider exists; what they may not\n // do is act for THIS owner. Answering 404 would make an authorization decision look like a\n // missing provider and send an operator looking for a registration problem.\n res.status(403).json({\n error: 'FORBIDDEN',\n message: 'You may not connect an account on behalf of that owner.',\n });\n return;\n }\n\n // Canonical, because `secretSlug` is caller-supplied and optional: a caller naming the\n // authoring slug would otherwise have the minted grant written where no reader looks.\n const secretSlug = this.canonicalSecretRef(providerRef, parsed.data.secretSlug ?? contract.apiKey.secretRef);\n\n // WHERE the grant will be stored, and it must be a slug that holds an ACCOUNT.\n //\n // `secretSlug` is caller-supplied and optional, so without this a request could name the\n // provider's OAuth2 client-secret slug and have a minted grant written to it. Nothing would\n // ever read that row — the exchange takes the client secret from the deployment environment,\n // never from a credential row — so the connect would report success and the connection would\n // resolve as absent forever. A refusal that says which slug is wrong is worth more than a\n // silent write to a slot nobody consults.\n const scope = this.registry.getProviderSecretScope(providerRef, secretSlug);\n if (scope !== ExternalProvider_SecretScope.CREDENTIAL) {\n res.status(400).json({\n error: 'SECRET_SLUG_NOT_A_CREDENTIAL',\n message: `'${secretSlug}' identifies provider '${providerRef}'\\u2019s own registration, not an account, `\n + 'so a minted grant cannot be stored there. Omit `secretSlug` to use the credential slot the '\n + 'provider declares, or name one that holds an account token.',\n });\n return;\n }\n\n const state = createProviderOAuth2State();\n const pkce = createProviderOAuth2Pkce();\n const redirectUri = this.callbackUrlFor(req);\n\n const authorizeUrl = buildProviderOAuth2AuthorizeUrl({\n oauth2: contract.oauth2,\n providerRef,\n clientId: this.requireClientId(providerRef, contract.oauth2.clientIdSecretRef),\n redirectUri,\n state,\n pkce,\n connectionParameters,\n scopes,\n });\n\n // Recorded BEFORE the URL is handed out. The other order has a window in which somebody\n // completes a flow whose record does not exist yet, and the callback would answer as though\n // their state were forged.\n await this.pending.remember(state, {\n providerRef,\n secretSlug,\n target,\n pkceVerifier: pkce.verifier,\n redirectUri,\n connectionParameters,\n initiatedByUserId: userId,\n // The header only exists on this leg. See the field's own JSDoc.\n frontendServiceName: typeof req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] === 'string'\n ? (req.headers[WildoHeaderKeys.FRONTEND_SERVICE_NAME] as string)\n : undefined,\n startedAt: new Date().toISOString(),\n });\n\n res.status(200).json({ authorizeUrl });\n } catch (error) {\n this.handleControllerError(error, res, 'start a provider connection');\n }\n }\n\n /**\n * Leg two: the person comes back with a code.\n *\n * Consuming the record is the first thing that happens, and it is atomic — so a replayed callback\n * finds nothing and there is no window in which two concurrent callbacks both proceed.\n */\n private async handleCallback(req: Request, res: Response): Promise<void> {\n try {\n const state = typeof req.query.state === 'string' ? req.query.state : '';\n const code = typeof req.query.code === 'string' ? req.query.code : '';\n\n // PEEKED, never consumed. This leg only needs the frontend to send the person back to; taking\n // the attempt here would destroy it before the authenticated half could redeem it.\n const pending = state === '' ? null : await this.pending.peek(state);\n\n // A vendor that reports a refusal reports it HERE, in the redirect, not at the token endpoint.\n // Treating a missing code as a forged state would tell somebody who simply pressed \"Deny\" that\n // their request was invalid.\n if (typeof req.query.error === 'string') {\n // The vendor reports a refusal HERE, in the redirect. Somebody who pressed \"Deny\" is not an\n // error case to explain — they are a person who changed their mind, and they go back to the\n // screen they started from.\n this.finishInBrowser(res, pending?.frontendServiceName, { connectionError: 'declined' }, pending?.target.ownerScope);\n return;\n }\n\n if (pending === null || code === '') {\n // ONE answer for expired, already-used, never-existed and missing-code. Distinguishing them\n // would confirm to somebody probing that a state they hold is real.\n //\n // No frontend to return to either: the record that would have named one is exactly what is\n // missing, so this is the one exit that cannot land anywhere but a bare page.\n this.finishInBrowser(res, undefined, { connectionError: 'invalid' });\n return;\n }\n\n // Handed to the application to finish, because THIS request cannot.\n //\n // A vendor redirect is a top-level navigation: no script ran to set an `Authorization` header,\n // and the application's only auth cookie is `SameSite=Strict` on `Path=/api/v1/auth`, so it is\n // not sent here either. There is therefore no credential on this request and no way to obtain\n // one — which is why the initiator check moved to the completion route rather than being\n // dropped. It used to be attempted here, and every consent answered 401 with the attempt\n // already consumed, so the person could not even retry.\n //\n // The code crosses the browser a second time. That is not a new exposure — the vendor already\n // put it in this URL — and the frontend strips it from history once it has been redeemed.\n this.finishInBrowser(res, pending.frontendServiceName, { state, code }, pending.target.ownerScope);\n } catch (error) {\n this.handleControllerError(error, res, 'receive a provider connection callback');\n }\n }\n\n /**\n * Finish an approval, as the person who began it.\n *\n * The authenticated half of the callback, and a POST because it is a FETCH — which is the whole\n * point: a fetch carries the bearer token that a redirect cannot. Everything the callback used to\n * guarantee is guaranteed here instead, in the same order.\n *\n * - **The attempt is consumed once, atomically**, so two concurrent completions cannot both\n * proceed and a replay finds nothing.\n * - **The finisher must be the initiator.** Without it, somebody who obtained a valid `state`\n * could redeem their own approval against the original initiator's target — connecting THEIR\n * vendor account into somebody else's organization.\n * - **The owner comes from the RECORD**, never from this request. A caller naming their own target\n * here would be choosing whose account a grant is stored against.\n *\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the grant is recorded against the\n * owner the ATTEMPT named, by the person who began it, and by nobody else.\n */\n private async handleComplete(req: Request, res: Response): Promise<void> {\n try {\n const { userId } = await this.extractCaller(req);\n const parsed = CompleteConnectionRequestSchema.safeParse(req.body);\n if (!parsed.success) {\n res.status(400).json({ error: 'VALIDATION_FAILED', message: 'The completion request is not valid.' });\n return;\n }\n const { state, code } = parsed.data;\n\n const pending = await this.pending.consume(state);\n if (pending === null) {\n // The same single answer the callback gives, for the same reason: expired, already used and\n // never existed must not be distinguishable to somebody holding a state they are probing.\n res.status(400).json({ error: 'CONNECTION_ATTEMPT_INVALID', message: 'This connection attempt is no longer valid. Start it again.' });\n return;\n }\n\n if (pending.initiatedByUserId !== undefined && pending.initiatedByUserId !== userId) {\n res.status(403).json({ error: 'NOT_YOURS', message: 'This connection attempt was started by somebody else.' });\n return;\n }\n\n const contract = this.registry.getProviderRuntimeContract(pending.providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n if (contract?.kind !== ProviderProtocolRuntimeKind.REST || contract.oauth2 === undefined) {\n res.status(400).json({\n error: 'PROVIDER_NOT_CONNECTABLE',\n message: `Provider '${pending.providerRef}' does not declare an OAuth2 contract.`,\n });\n return;\n }\n\n const grant = await exchangeProviderOAuth2Code({\n oauth2: contract.oauth2,\n providerRef: pending.providerRef,\n clientId: this.requireClientId(pending.providerRef, contract.oauth2.clientIdSecretRef),\n clientSecret: this.requireClientSecret(pending.providerRef, contract.oauth2.clientSecretSecretRef),\n connectionParameters: pending.connectionParameters,\n code,\n // The SAME redirect URI that was authorized, from the record rather than rebuilt: vendors\n // verify it byte-for-byte, and a proxy or a host header could make a rebuilt one differ.\n redirectUri: pending.redirectUri,\n pkceVerifier: pending.pkceVerifier,\n });\n\n const credentialId = await this.storeGrantForTarget(pending, grant);\n\n // Logged AFTER the write, so the line means the connection EXISTS rather than that an exchange\n // succeeded. `grantedScopes` is the fact worth having: a vendor may issue a token for fewer\n // scopes than were asked for, and the resulting failure arrives on an unrelated operation\n // weeks later with nothing to correlate against.\n this.logger.info?.('[oauth2-connect] account connected', {\n providerRef: pending.providerRef,\n ownerScope: pending.target.ownerScope,\n credentialId,\n grantedScopes: grant.grantedScopes,\n // Never the token, and never the grant.\n });\n\n res.status(200).json({ connected: pending.providerRef });\n } catch (error) {\n this.handleControllerError(error, res, 'complete a provider connection');\n }\n }\n\n\n /**\n * End the callback the way a BROWSER expects: a redirect, never a payload.\n *\n * This leg is reached by the vendor redirecting the person's own browser. Whatever it writes is\n * rendered as a page, so answering `res.json(...)` — which this flow did until it was driven —\n * shows somebody who has just granted consent a raw JSON blob on a backend origin, with no way\n * back. Every exit therefore lands them on the settings screen they started from, with the outcome\n * in the query string for that screen to render.\n *\n * The frontend is resolved from the RECORD's `frontendServiceName`, never from a header: the\n * vendor's redirect carries none of Wildo's own headers. When it cannot be resolved — an attempt\n * whose record is exactly what is missing, or a caller that omitted the header at start — the\n * fallback is a minimal HTML page rather than JSON. It says the same thing in the same medium the\n * browser is already rendering.\n *\n * Status is 303, not 302: the callback arrives as a GET and the destination is a different\n * resource to fetch with GET, which is what 303 means.\n * spec-cite: RFC 9110 §15.4.4 (303 See Other).\n */\n private finishInBrowser(\n res: Response,\n frontendServiceName: string | undefined,\n outcome: Readonly<Record<string, string>>,\n ownerScope?: ExternalProvider_Connection_OwnerScope,\n ): void {\n const base = frontendServiceName === undefined\n ? null\n : AuthControllerUtils.lookupFrontendPublicUrl(this.appConfig.config, frontendServiceName);\n\n if (base === null) {\n // No origin to return to. Say so in HTML — a person on a vendor redirect is looking at a page,\n // and the one thing not to give them is a payload.\n const detail = outcome.connectionError === undefined\n ? 'The account was connected. You can close this tab and return to the application.'\n : 'This connection attempt could not be completed. Return to the application and start again.';\n res.status(outcome.connectionError === undefined ? 200 : 400)\n .type('html')\n .send(`<!doctype html><meta charset=\"utf-8\"><title>Connection</title><p>${detail}</p>`);\n return;\n }\n\n const destination = new URL(\n ownerScope === undefined\n ? PROVIDER_CONNECTION_FALLBACK_RETURN_PATH\n : PROVIDER_CONNECTION_RETURN_PATHS[ownerScope],\n base,\n );\n for (const [key, value] of Object.entries(outcome)) destination.searchParams.set(key, value);\n res.redirect(303, destination.toString());\n }\n\n /**\n * Route the minted grant to the store that owns the owner's table.\n *\n * The target comes from the PENDING RECORD, so the row is written for whoever the authorized\n * attempt named. Reading it from the callback's request instead would let somebody choose whose\n * account a grant lands on — the failure the whole state mechanism exists to prevent.\n *\n * An APPLICATION target has no store: the deployment's own credential lives in the environment,\n * and a connect flow that produced one would be writing a row nobody reads.\n */\n private async storeGrantForTarget(\n pending: ProviderOAuth2PendingAuthorization,\n grant: ProviderOAuth2Grant,\n ): Promise<string> {\n const { providerRef, secretSlug, target, connectionParameters } = pending;\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n return this.userCredentials.storeGrant(\n { userId: target.ownerId!, providerRef, secretSlug },\n grant,\n connectionParameters,\n );\n }\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.ORGANIZATION) {\n return this.organizationCredentials.storeGrant(\n { organizationId: target.ownerId!, providerRef, secretSlug },\n grant,\n connectionParameters,\n );\n }\n throw new Error(\n `A connection for provider '${providerRef}' completed with an APPLICATION-owned target, which has `\n + 'no credential store: the deployment\\'s own credential is authored in the environment. The '\n + 'attempt should have been refused at the start leg.',\n );\n }\n\n /**\n * Why this deployment cannot begin a connection to a provider, or `undefined` when it can.\n *\n * Two different gaps that a boolean could not tell apart, and they are repaired by different people:\n * a vendor with no authorization flow is authored on the credential screen by an APPLICATION\n * AUTHOR, while a vendor this deployment has not registered with needs an OPERATOR to create an\n * application at the vendor and set two environment variables.\n *\n * The client SECRET is checked as well as the id. Checking only the id would let a half-configured\n * deployment advertise a provider as connectable and then fail at the token exchange — after the\n * person had already granted consent at the vendor, which is the worst moment to discover it.\n */\n private connectabilityBlocker(\n providerRef: string,\n oauth2: { clientIdSecretRef?: string; clientSecretSecretRef?: string } | undefined,\n ): ProviderConnectabilityBlocker | undefined {\n if (oauth2 === undefined) return ProviderConnectabilityBlocker.NO_AUTHORIZATION_FLOW;\n const secret = (ref: string | undefined): string | undefined => (ref === undefined\n ? undefined\n : this.registry.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, ref));\n return secret(oauth2.clientIdSecretRef) && secret(oauth2.clientSecretSecretRef)\n ? undefined\n : ProviderConnectabilityBlocker.APPLICATION_NOT_REGISTERED;\n }\n\n /**\n * May this caller act for that owner?\n *\n * An APPLICATION target has exactly one instance and the application IS the caller, so there is no\n * second party whose account might be spent. Every other target goes through the same membership\n * port the resolution path uses — one answer to \"may this execution act for that owner\", not two\n * that can disagree.\n *\n * ## The context is built from the REQUEST, and that is the whole correctness of this method\n *\n * The port decides an ORGANIZATION target by asking `initiatorRoles` which tenants the caller\n * belongs to organization-wide. So it can only answer from a context whose roles were built from\n * real memberships — which is what `createExecutionContextForManualController` does, and what the\n * auth-flow factory deliberately does not.\n *\n * This asked `authEcFactory.createForAuthenticatedAuthOperation` until 2026-09-10, and that\n * factory hardcodes `initiatorRoles` to a single APPLICATION-scoped `APP_USER` entry — correct for\n * its own audience (token issuance, password change, TOTP), which asks no membership question, and\n * taken verbatim by the creator rather than enriched. `organizationWideMembershipsOf` filters that\n * array on `relatedPrimaryScope === ORGANIZATIONS`, so it was ALWAYS empty and every organization\n * target was refused — for every caller, every tenant, both routes. Measured on the running stack:\n * `application × service` and `user × service` minted an authorize URL while an `ORG_OWNER`'s\n * `organization × user` answered 403, which is the one combination 75 vendors declare and the one\n * this lane exists for.\n *\n * The fix is here rather than in the factory on purpose: giving that factory a membership read\n * would put a repository round trip on every token refresh to answer a question its callers never\n * ask. This path is a settings-screen click.\n *\n * Built only on the ORGANIZATION branch, for the same reason: APPLICATION admits without a caller\n * and USER compares two ids, so neither reads a role and neither should pay for one.\n */\n private async mayActFor(\n target: ExternalProvider_ConnectionTarget,\n userId: string,\n req: Request,\n ): Promise<boolean> {\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION) return true;\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n // A person connects their OWN account and nobody else's. There is no administrative variant of\n // this resource at any tier, so the only admissible user target is the caller themselves.\n return target.ownerId === userId;\n }\n const ec = await this.ecCreator.createExecutionContextForManualController(req);\n return this.targetAuthorization.mayActFor(target, ec);\n }\n\n /**\n * The ONE name a credential row is keyed by, whichever of a slot's two names arrived.\n *\n * A declared slot has an authoring slug (`accessToken`) and an `envVarName` (`ASANA_API_KEY`), and\n * both circulate: an authoring surface names the slug, while a runtime contract only ever\n * references the env-var name. A credential row's business key is\n * `(owner, providerRef, secretSlug)` and it is matched EXACTLY, so the two spellings are two\n * different rows — and since every reader arrives holding `runtimeContract.apiKey.secretRef`, a\n * row written under the slug is one nothing can ever find.\n *\n * The env-var name is the canonical form because it is the one a runtime contract carries, which\n * is the same decision {@link ExternalProvidersRegistryBackendService.getProviderSecretScope} took\n * for this subsystem's other \"two names for one secret\" defect. Choosing the slug instead would\n * mean translating at every reader, and readers are the population that grows.\n *\n * An UNDECLARED ref is returned unchanged rather than rewritten: this normalises names the\n * provider declares and is not a place to invent one. The callers refuse an undeclared ref on\n * their own terms, and doing it here as well would answer the wrong error.\n */\n private canonicalSecretRef(providerRef: string, ref: string): string {\n const slot = this.registry.getProviderSecretSlots(providerRef)\n .find((candidate) => candidate.slug === ref || candidate.envVarName === ref);\n return slot?.envVarName ?? ref;\n }\n\n private requireClientId(providerRef: string, secretRef: string | undefined): string {\n const value = secretRef === undefined\n ? undefined\n : this.registry.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, secretRef);\n if (!value) {\n throw new ProviderRegistrationMissingError(providerRef, secretRef ?? 'the provider\\'s client-id secret ref');\n }\n return value;\n }\n\n\n private requireClientSecret(providerRef: string, secretRef: string | undefined): string {\n const value = secretRef === undefined\n ? undefined\n : this.registry.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, secretRef);\n if (!value) {\n throw new Error(\n `Provider '${providerRef}' cannot be connected: the application's OAuth2 client secret is not configured `\n + `(${secretRef ?? 'no client secret declared'}). This is a deployment configuration gap.`,\n );\n }\n return value;\n }\n\n /**\n * The redirect URI, built once and then carried in the pending record.\n *\n * Derived from the request's own origin so a deployment needs no extra configuration, and stored\n * rather than rebuilt at the callback: a vendor verifies it byte-for-byte, and a proxy that\n * rewrites the host would make the rebuilt one differ from the authorized one.\n */\n private callbackUrlFor(req: Request): string {\n const forwardedProto = req.get('x-forwarded-proto');\n const protocol = typeof forwardedProto === 'string' && forwardedProto.length > 0\n ? forwardedProto.split(',')[0]!.trim()\n : req.protocol;\n return `${protocol}://${req.get('host') ?? 'localhost'}${req.baseUrl}${CALLBACK_PATH}`;\n }\n\n private async extractCaller(req: Request): Promise<{ userId: string }> {\n const guardEc = await this.authEcFactory.createForPreAuthOperation(this.authEcFactory.getUsersReadOperationPath());\n return this.authJwtGuard.extractAuthenticatedUser(guardEc, req);\n }\n\n /**\n * One shape for every failure, and never the vendor's response body.\n *\n * A token endpoint's reply carries credentials even when it fails — several vendors echo the\n * submitted client secret back in a validation message — so the message is logged with its detail\n * and answered without it.\n */\n private handleControllerError(error: unknown, res: Response, action: string): void {\n this.logger.error?.(`[oauth2-connect] failed to ${action}`, { error: describeCaughtError(error) });\n if (isWildoBackendError(error) && error.type === ErrorType.AUTHENTICATION) {\n res.status(401).json({ error: 'UNAUTHENTICATED', message: 'Sign in and try again.' });\n return;\n }\n if (error instanceof ProviderRegistrationMissingError) {\n // 503, not 502. The deployment cannot service this request and an operator can fix it by\n // registering an application with the vendor — where 502 asserts an upstream failure and sends\n // that same operator to look at infrastructure that is working.\n //\n // The secret ref is NAMED because it is not a secret: it is the environment variable's NAME,\n // which is exactly what somebody needs in order to act, and withholding it would leave the\n // message true and useless.\n res.status(503).json({\n error: 'PROVIDER_REGISTRATION_MISSING',\n providerRef: error.providerRef,\n secretRef: error.secretRef,\n message: `This application has not registered with '${error.providerRef}'. Create an application at the vendor and set ${error.secretRef} (and its client-secret pair) in this deployment's environment.`,\n });\n return;\n }\n res.status(502).json({\n error: 'CONNECTION_FAILED',\n message: `Could not ${action}. The detail is in the application log.`,\n });\n }\n}\n\n"]}

package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.d.ts ADDED Viewed

@@ -0,0 +1,99 @@
+/**
+ * The port the provider registry consults for an organization's OWN credential.
+ *
+ * ## Why a port and not the store itself
+ *
+ * `ExternalProvidersRegistryBackendService` is a configuration-tier singleton constructed early in
+ * startup, before repositories exist. Giving it a repository would invert that order and make every
+ * unit harness of every protocol consumer need a database to construct one. A narrow port keeps the
+ * registry's dependency to a type: it knows there is somewhere to ask, and nothing about where.
+ *
+ * ## Why the registry owns the ORDER and the port does not
+ *
+ * The port answers exactly one question — "does this organization have its own credential for this
+ * provider and slug?" — and returns `undefined` when it does not. It never falls back to the
+ * environment and never refuses.
+ *
+ * The ORDER (organization first, deployment environment second, refuse by name third) lives in the
+ * registry because the registry is the only place that can see both halves. Splitting it would give
+ * two components a partial view of the resolution and let them disagree about what "no credential"
+ * means — which is precisely how an empty string reaches a vendor.
+ */
+import type { ProviderCredentialResolutionSource } from '@wildo-ai/saas-models';
+/** Which credential is being asked for. Every field is required — there is no wildcard lookup. */
+export interface OrganizationProviderCredentialQuery {
+    /**
+     * The tenant. Supplied by the CALLER from a trusted execution scope, never parsed out of a
+     * request payload — the port has no way to verify it, so the guarantee has to hold upstream.
+     */
+    organizationId: string;
+    providerRef: string;
+    /** The slug in the provider's `secretsContract`, the same identifier the env projection names. */
+    secretSlug: string;
+}
+/** A credential that was found, opened, and is spendable. */
+export interface OrganizationProviderCredentialResolution {
+    /** The plaintext credential. Never logged, never stored, never returned to a client. */
+    value: string;
+    /** The row it came from, for the audit trail. */
+    credentialId: string;
+}
+export interface OrganizationProviderCredentialResolverPort {
+    /**
+     * The organization's own credential, or `undefined` when the tenant has not set one.
+     *
+     * `undefined` means "this tenant has no credential here" — a normal, expected state that the
+     * registry answers by falling back to the deployment environment. Anything that is NOT that
+     * — a row that exists but cannot be opened, a row whose envelope was tampered with — THROWS,
+     * because silently treating an unopenable credential as an absent one would make the tenant fall
+     * back to the shared deployment principal without anyone noticing. That substitution is the exact
+     * defect this subsystem exists to remove, so it must never be reachable by accident.
+     */
+    resolveOrganizationCredential(query: OrganizationProviderCredentialQuery): Promise<OrganizationProviderCredentialResolution | undefined>;
+    /**
+     * Stamp the row that was just spent with what the provider said about it.
+     *
+     * ## Why this is on the RESOLVER's port rather than somewhere of its own
+     *
+     * Because the invariant that matters is *the store that was READ is the store that is STAMPED*,
+     * and the only way to make that structural is to give one port both halves. A separate recording
+     * port would be a second thing to bind, and a host that bound one and not the other would resolve
+     * credentials it could never record the use of — silently, since nothing downstream reads the
+     * result.
+     *
+     * ## Why it is REQUIRED rather than optional
+     *
+     * This whole seam existed for months as a feature-detected `recordCredentialUse?:` behind a thunk
+     * nothing supplied, so every outbound call found no sink and wrote nothing, and every credential
+     * that had in fact just worked still read as never tried. An optional method here would leave that
+     * failure representable. Required, the absence of a sink is a compile error rather than a silence.
+     *
+     * Best-effort in its IMPLEMENTATION — the outbound call has already happened and a bookkeeping
+     * write must never fail it — but not optional in its CONTRACT.
+     */
+    recordCredentialUse(use: {
+        organizationId: string;
+        providerRef: string;
+        secretSlug: string;
+        /**
+         * WHERE the value came from. The implementation decides what to do with each: a tenant's OWN
+         * credential has a row to stamp, and a deployment-environment fallback has none — but is still
+         * worth an audit row, because "this tenant is silently acting as the shared principal" is the
+         * condition a reviewer most wants to see and it is invisible if only the interesting case is
+         * recorded.
+         */
+        source: ProviderCredentialResolutionSource;
+        credentialId?: string;
+        /** What the provider said. Absent means the outcome is not yet known to the caller. */
+        outcome?: {
+            accepted: boolean;
+            providerMessage?: string;
+        };
+    }): Promise<void>;
+}
+/**
+ * Re-exported for the registry's own signatures so a consumer reading the resolution result does not
+ * have to reach into the models package for the one enum that describes it.
+ */
+export type { ProviderCredentialResolutionSource };
+//# sourceMappingURL=organization-provider-credential-resolver.port.d.ts.map

package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"organization-provider-credential-resolver.port.d.ts","sourceRoot":"","sources":["../../../../src/security/connected-accounts/organization-provider-credential-resolver.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAEhF,kGAAkG;AAClG,MAAM,WAAW,mCAAmC;IAClD;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,wCAAwC;IACvD,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0CAA0C;IACzD;;;;;;;;;OASG;IACH,6BAA6B,CAC3B,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,wCAAwC,GAAG,SAAS,CAAC,CAAC;IAEjE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,mBAAmB,CAAC,GAAG,EAAE;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;WAMG;QACH,MAAM,EAAE,kCAAkC,CAAC;QAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,uFAAuF;QACvF,OAAO,CAAC,EAAE;YAAE,QAAQ,EAAE,OAAO,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3D,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED;;;GAGG;AACH,YAAY,EAAE,kCAAkC,EAAE,CAAC"}

package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.js ADDED Viewed

@@ -0,0 +1,22 @@
+/**
+ * The port the provider registry consults for an organization's OWN credential.
+ *
+ * ## Why a port and not the store itself
+ *
+ * `ExternalProvidersRegistryBackendService` is a configuration-tier singleton constructed early in
+ * startup, before repositories exist. Giving it a repository would invert that order and make every
+ * unit harness of every protocol consumer need a database to construct one. A narrow port keeps the
+ * registry's dependency to a type: it knows there is somewhere to ask, and nothing about where.
+ *
+ * ## Why the registry owns the ORDER and the port does not
+ *
+ * The port answers exactly one question — "does this organization have its own credential for this
+ * provider and slug?" — and returns `undefined` when it does not. It never falls back to the
+ * environment and never refuses.
+ *
+ * The ORDER (organization first, deployment environment second, refuse by name third) lives in the
+ * registry because the registry is the only place that can see both halves. Splitting it would give
+ * two components a partial view of the resolution and let them disagree about what "no credential"
+ * means — which is precisely how an empty string reaches a vendor.
+ */
+//# sourceMappingURL=organization-provider-credential-resolver.port.js.map

package/dist/esm/security/connected-accounts/organization-provider-credential-resolver.port.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"organization-provider-credential-resolver.port.js","sourceRoot":"","sources":["../../../../src/security/connected-accounts/organization-provider-credential-resolver.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG","sourcesContent":["/**\n * The port the provider registry consults for an organization's OWN credential.\n *\n * ## Why a port and not the store itself\n *\n * `ExternalProvidersRegistryBackendService` is a configuration-tier singleton constructed early in\n * startup, before repositories exist. Giving it a repository would invert that order and make every\n * unit harness of every protocol consumer need a database to construct one. A narrow port keeps the\n * registry's dependency to a type: it knows there is somewhere to ask, and nothing about where.\n *\n * ## Why the registry owns the ORDER and the port does not\n *\n * The port answers exactly one question — \"does this organization have its own credential for this\n * provider and slug?\" — and returns `undefined` when it does not. It never falls back to the\n * environment and never refuses.\n *\n * The ORDER (organization first, deployment environment second, refuse by name third) lives in the\n * registry because the registry is the only place that can see both halves. Splitting it would give\n * two components a partial view of the resolution and let them disagree about what \"no credential\"\n * means — which is precisely how an empty string reaches a vendor.\n */\n\nimport type { ProviderCredentialResolutionSource } from '@wildo-ai/saas-models';\n\n/** Which credential is being asked for. Every field is required — there is no wildcard lookup. */\nexport interface OrganizationProviderCredentialQuery {\n /**\n * The tenant. Supplied by the CALLER from a trusted execution scope, never parsed out of a\n * request payload — the port has no way to verify it, so the guarantee has to hold upstream.\n */\n organizationId: string;\n providerRef: string;\n /** The slug in the provider's `secretsContract`, the same identifier the env projection names. */\n secretSlug: string;\n}\n\n/** A credential that was found, opened, and is spendable. */\nexport interface OrganizationProviderCredentialResolution {\n /** The plaintext credential. Never logged, never stored, never returned to a client. */\n value: string;\n /** The row it came from, for the audit trail. */\n credentialId: string;\n}\n\nexport interface OrganizationProviderCredentialResolverPort {\n /**\n * The organization's own credential, or `undefined` when the tenant has not set one.\n *\n * `undefined` means \"this tenant has no credential here\" — a normal, expected state that the\n * registry answers by falling back to the deployment environment. Anything that is NOT that\n * — a row that exists but cannot be opened, a row whose envelope was tampered with — THROWS,\n * because silently treating an unopenable credential as an absent one would make the tenant fall\n * back to the shared deployment principal without anyone noticing. That substitution is the exact\n * defect this subsystem exists to remove, so it must never be reachable by accident.\n */\n resolveOrganizationCredential(\n query: OrganizationProviderCredentialQuery,\n ): Promise<OrganizationProviderCredentialResolution | undefined>;\n\n /**\n * Stamp the row that was just spent with what the provider said about it.\n *\n * ## Why this is on the RESOLVER's port rather than somewhere of its own\n *\n * Because the invariant that matters is *the store that was READ is the store that is STAMPED*,\n * and the only way to make that structural is to give one port both halves. A separate recording\n * port would be a second thing to bind, and a host that bound one and not the other would resolve\n * credentials it could never record the use of — silently, since nothing downstream reads the\n * result.\n *\n * ## Why it is REQUIRED rather than optional\n *\n * This whole seam existed for months as a feature-detected `recordCredentialUse?:` behind a thunk\n * nothing supplied, so every outbound call found no sink and wrote nothing, and every credential\n * that had in fact just worked still read as never tried. An optional method here would leave that\n * failure representable. Required, the absence of a sink is a compile error rather than a silence.\n *\n * Best-effort in its IMPLEMENTATION — the outbound call has already happened and a bookkeeping\n * write must never fail it — but not optional in its CONTRACT.\n */\n recordCredentialUse(use: {\n organizationId: string;\n providerRef: string;\n secretSlug: string;\n /**\n * WHERE the value came from. The implementation decides what to do with each: a tenant's OWN\n * credential has a row to stamp, and a deployment-environment fallback has none — but is still\n * worth an audit row, because \"this tenant is silently acting as the shared principal\" is the\n * condition a reviewer most wants to see and it is invisible if only the interesting case is\n * recorded.\n */\n source: ProviderCredentialResolutionSource;\n credentialId?: string;\n /** What the provider said. Absent means the outcome is not yet known to the caller. */\n outcome?: { accepted: boolean; providerMessage?: string };\n }): Promise<void>;\n}\n\n/**\n * Re-exported for the registry's own signatures so a consumer reading the resolution result does not\n * have to reach into the models package for the one enum that describes it.\n */\nexport type { ProviderCredentialResolutionSource };\n"]}

package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.d.ts ADDED Viewed

@@ -0,0 +1,44 @@
+/**
+ * Renewing an expiring grant — the port a credential store consults.
+ *
+ * ## Why the store calls OUT rather than the refresher calling in
+ *
+ * Renewal is two jobs that belong to different owners. Talking to the vendor needs the provider
+ * contract, the application's client registration and an HTTP client, none of which a store has.
+ * Writing the renewed grant back needs the table, the envelope key and the scope map, none of which
+ * a refresher should have. So the store asks for a new grant and persists it itself: each half stays
+ * where its inputs are, and the refresher never learns how a credential is stored.
+ *
+ * ## Why it is OPTIONAL, and what its absence means
+ *
+ * A store constructed without one still resolves every credential that is not an expiring grant —
+ * which is the whole pasted-credential population and every non-expiring token. An expiring grant
+ * with no refresher REFUSES, naming the missing subsystem rather than the credential, because the
+ * alternative is sending a stale token and having the vendor's 401 recorded as "this person's
+ * credential is bad" when it is merely old.
+ */
+import type { ProviderOAuth2Grant } from '@wildo-ai/saas-models';
+import type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';
+export interface ProviderOAuth2RefreshRequest {
+    readonly providerRef: string;
+    readonly secretSlug: string;
+    /** Whose connection this is. Used only to key the single-flight, never to authorize. */
+    readonly target: ExternalProvider_ConnectionTarget;
+    readonly grant: ProviderOAuth2Grant;
+    /**
+     * Values for the endpoints' `{placeholders}`. Needed AGAIN at refresh: a templated token URL is
+     * still templated an hour later, and 21 of the 96 vendors with recovered endpoints carry one.
+     */
+    readonly connectionParameters?: Readonly<Record<string, string>>;
+}
+export interface ProviderOAuth2RefresherPort {
+    /**
+     * A renewed grant, or a throw naming why renewal is impossible.
+     *
+     * Never returns the OLD grant on failure. A caller that received one could not tell renewal from
+     * a no-op, and would persist an unchanged grant while believing it had refreshed — turning a loud
+     * failure into a silent loop that repeats on every call until the token expires for real.
+     */
+    refreshGrant(request: ProviderOAuth2RefreshRequest): Promise<ProviderOAuth2Grant>;
+}
+//# sourceMappingURL=provider-oauth2-refresher.port.d.ts.map

package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"provider-oauth2-refresher.port.d.ts","sourceRoot":"","sources":["../../../../src/security/connected-accounts/provider-oauth2-refresher.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAE9F,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;;;OAMG;IACH,YAAY,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACnF"}

package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.js ADDED Viewed

@@ -0,0 +1,20 @@
+/**
+ * Renewing an expiring grant — the port a credential store consults.
+ *
+ * ## Why the store calls OUT rather than the refresher calling in
+ *
+ * Renewal is two jobs that belong to different owners. Talking to the vendor needs the provider
+ * contract, the application's client registration and an HTTP client, none of which a store has.
+ * Writing the renewed grant back needs the table, the envelope key and the scope map, none of which
+ * a refresher should have. So the store asks for a new grant and persists it itself: each half stays
+ * where its inputs are, and the refresher never learns how a credential is stored.
+ *
+ * ## Why it is OPTIONAL, and what its absence means
+ *
+ * A store constructed without one still resolves every credential that is not an expiring grant —
+ * which is the whole pasted-credential population and every non-expiring token. An expiring grant
+ * with no refresher REFUSES, naming the missing subsystem rather than the credential, because the
+ * alternative is sending a stale token and having the vendor's 401 recorded as "this person's
+ * credential is bad" when it is merely old.
+ */
+//# sourceMappingURL=provider-oauth2-refresher.port.js.map

package/dist/esm/security/connected-accounts/provider-oauth2-refresher.port.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"provider-oauth2-refresher.port.js","sourceRoot":"","sources":["../../../../src/security/connected-accounts/provider-oauth2-refresher.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG","sourcesContent":["/**\n * Renewing an expiring grant — the port a credential store consults.\n *\n * ## Why the store calls OUT rather than the refresher calling in\n *\n * Renewal is two jobs that belong to different owners. Talking to the vendor needs the provider\n * contract, the application's client registration and an HTTP client, none of which a store has.\n * Writing the renewed grant back needs the table, the envelope key and the scope map, none of which\n * a refresher should have. So the store asks for a new grant and persists it itself: each half stays\n * where its inputs are, and the refresher never learns how a credential is stored.\n *\n * ## Why it is OPTIONAL, and what its absence means\n *\n * A store constructed without one still resolves every credential that is not an expiring grant —\n * which is the whole pasted-credential population and every non-expiring token. An expiring grant\n * with no refresher REFUSES, naming the missing subsystem rather than the credential, because the\n * alternative is sending a stale token and having the vendor's 401 recorded as \"this person's\n * credential is bad\" when it is merely old.\n */\n\nimport type { ProviderOAuth2Grant } from '@wildo-ai/saas-models';\nimport type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';\n\nexport interface ProviderOAuth2RefreshRequest {\n readonly providerRef: string;\n readonly secretSlug: string;\n /** Whose connection this is. Used only to key the single-flight, never to authorize. */\n readonly target: ExternalProvider_ConnectionTarget;\n readonly grant: ProviderOAuth2Grant;\n /**\n * Values for the endpoints' `{placeholders}`. Needed AGAIN at refresh: a templated token URL is\n * still templated an hour later, and 21 of the 96 vendors with recovered endpoints carry one.\n */\n readonly connectionParameters?: Readonly<Record<string, string>>;\n}\n\nexport interface ProviderOAuth2RefresherPort {\n /**\n * A renewed grant, or a throw naming why renewal is impossible.\n *\n * Never returns the OLD grant on failure. A caller that received one could not tell renewal from\n * a no-op, and would persist an unchanged grant while believing it had refreshed — turning a loud\n * failure into a silent loop that repeats on every call until the token expires for real.\n */\n refreshGrant(request: ProviderOAuth2RefreshRequest): Promise<ProviderOAuth2Grant>;\n}\n"]}