@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.js

@@ -7,9 +7,8 @@
  * repository consumes this PORT so unit tests inject a stub and the production wiring stays in
  * one place.
  */
-import { HttpApiIdentityMode, } from '@wildo-ai/saas-models/external-data';
-import { ExternalProvider_ExchangeProtocol_Kind } from '@wildo-ai/external-connectors-models';
-import { ProviderProtocolRuntimeKind } from '@wildo-ai/external-connectors-private/backend';
+import { ExternalProvider_Connection_OwnerScope, ExternalProvider_ExchangeProtocol_Kind, ProviderProtocolRuntimeKind, } from '@wildo-ai/external-connectors-models';
+import { withEngineOwnedHeaders } from '../../../../security/outbound/outbound-request-headers.backend.utils.js';
 /**
  * Thrown when access CANNOT be resolved — always naming what is missing, because every branch
  * here is a configuration gap an operator must fix, never a transient.
@@ -23,8 +22,8 @@ export class HttpApiProviderAccessError extends Error {
 /**
  * The production resolver, over the provider registry.
  *
- * ## SERVICE_PRINCIPAL
- * Resolves the provider's `kind: 'rest'` runtime contract
+ * ## AN APPLICATION-OWNED CONNECTION
+ * Resolves the provider's `kind: ProviderProtocolRuntimeKind.REST` runtime contract
  * (`getProviderRuntimeContract(providerRef, REST_API)`) for the base URL and the auth-header
  * SHAPE, then the key VALUE through the secret machinery — `getProviderApiKey` (the provider
  * configuration's `authConfig.secretRef`) first, falling back to the contract's own
@@ -32,30 +31,114 @@ export class HttpApiProviderAccessError extends Error {
  * secrets, shape from the contract, and the consumer branches on the CONTRACT field, never the
  * provider ref.
  *
- * ## USER_DELEGATED
- * Measured 2026-08-27 (ten probes, recorded in the ETL plan): the engine has NO outbound
- * per-user token persistence — `OAuth2_CredentialSchema` exists as a model with no resource, no
- * store and no service behind it. Executing this mode therefore refuses naming the missing
- * subsystem. **Ruled by Paul 2026-08-27: slice 1 is SERVICE_PRINCIPAL-first** — the mode stays
- * declared so bindings need no reshape; this refusal lifts when the delegated-token subsystem
- * (its own workstream) exists.
+ * ## DELEGATED AND TENANT-OWNED CONNECTIONS
+ * This paragraph read "the engine has NO outbound per-user token persistence — `OAuth2_CredentialSchema`
+ * exists as a model with no resource, no store and no service behind it", measured 2026-08-27. That
+ * is retired (#333): the store exists, is bound, and serves the connection controller, so the
+ * refusal it justified is gone. A binding now declares WHOSE ACCOUNT it spends and on whose behalf
+ * (`ExternalProvider_ConnectionShape`), the call supplies which instance, and the two questions this
+ * resolver asks below — is the shape ADMISSIBLE for the provider, is this execution AUTHORIZED to
+ * act for that owner — are what decide it. Both still fail closed, and an unbound authorization port
+ * still refuses every non-application target.
  */
 export class ExternalProvidersHttpApiAccessResolver {
     externalProvidersRegistry;
-    constructor(externalProvidersRegistry) {
+    targetAuthorization;
+    constructor(externalProvidersRegistry, 
+    /**
+     * Absent until the membership check is wired. Its absence REFUSES every non-application target
+     * rather than admitting one, so the gate cannot be opened by forgetting to bind something.
+     */
+    targetAuthorization) {
         this.externalProvidersRegistry = externalProvidersRegistry;
+        this.targetAuthorization = targetAuthorization;
     }
-    resolveAccess(binding, _executionContext) {
-        if (binding.identityMode === HttpApiIdentityMode.USER_DELEGATED) {
-            throw new HttpApiProviderAccessError(`USER_DELEGATED identity toward provider '${binding.providerRef}' cannot be resolved: the engine has no outbound per-user token store `
-                + '(OAuth2_CredentialSchema is modeled but nothing persists or serves user tokens). Build the delegated-token subsystem, or declare '
-                + 'identityMode: SERVICE_PRINCIPAL on the binding.');
+    /**
+     * Two questions, in this order, and both must be answered before a secret is read.
+     *
+     * ADMISSIBLE — does this provider admit this owner scope at all? A provider that has recorded no
+     * decision admits only the floor, so asking for a tenant-owned connection against it refuses,
+     * naming the record to author. That is the fail-closed direction: the alternative is a per-tenant
+     * call that quietly runs on the application's account.
+     *
+     * AUTHORIZED — may this execution act for that owner? Only for a non-application target: an
+     * application-owned connection has exactly one instance and the application IS the caller, so
+     * there is no second party whose account might be spent. Every other target needs the port, and
+     * an unbound port REFUSES — a gate that opens when a wiring step is forgotten is not a gate.
+     */
+    async assertTargetIsAdmissibleAndAuthorized(providerRef, target, executionContext) {
+        const admissible = this.externalProvidersRegistry.getProviderAdmissibleConnections(providerRef);
+        const admitted = admissible.some((shape) => shape.ownerScope === target.ownerScope && shape.delegation === target.delegation);
+        if (!admitted) {
+            // Two different causes, repaired in two different files by two different people, so the
+            // refusal says WHICH. The vendor may never have had this capability recorded, or this
+            // application may have switched it off — and a message that always blamed the catalogue would
+            // send an operator to edit a decision record that is already correct.
+            // Optional call, and not defensiveness for its own sake: this runs INSIDE the construction of
+            // a refusal. A registry double that models only the method above would otherwise turn a clear,
+            // actionable error into a `TypeError` raised from the error path — the one place a failure is
+            // least recoverable and least legible. A collaborator that cannot answer simply yields the
+            // less specific message.
+            const catalogue = this.externalProvidersRegistry.getProviderCatalogueAdmissibleConnections?.(providerRef) ?? admissible;
+            const narrowedAway = catalogue.some((shape) => shape.ownerScope === target.ownerScope && shape.delegation === target.delegation);
+            const describe = (shapes) => shapes.length === 0 ? 'nothing' : shapes.map((shape) => `${shape.ownerScope} x ${shape.delegation}`).join(', ');
+            throw new HttpApiProviderAccessError(`Provider '${providerRef}' does not admit a ${target.ownerScope}-owned, ${target.delegation}-delegated connection. `
+                + `It admits: ${describe(admissible)}. `
+                + (narrowedAway
+                    ? `The VENDOR does admit it (${describe(catalogue)}); this APPLICATION excluded it. `
+                        + "Widen or remove `providers.connections['" + providerRef + "']` in the SaaS config — the provider's "
+                        + 'catalogue record is not at fault and editing it will not help.'
+                    : 'Whether a vendor can be connected this way is a recorded decision, not something read from its API — '
+                        + "record it in the provider's catalogue-record decisions file, or in its module if it is hand-authored."));
         }
+        if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION)
+            return;
+        if (!this.targetAuthorization) {
+            throw new HttpApiProviderAccessError(`Provider '${providerRef}': a ${target.ownerScope}-owned connection cannot be authorized — no target-authorization port is bound. `
+                + 'The call names an owner and something must decide whether this execution may act for it; with nothing bound, that decision '
+                + 'would be nobody\'s, so the call is refused rather than admitted.');
+        }
+        if (!await this.targetAuthorization.mayActFor(target, executionContext)) {
+            throw new HttpApiProviderAccessError(`Provider '${providerRef}': this execution may not act for ${target.ownerScope} '${target.ownerId}'.`);
+        }
+    }
+    /**
+     * ONE place a provider secret is read, and it always names the target.
+     *
+     * Before this existed the guard admitted a tenant-owned target and the read below then went to the
+     * deployment environment anyway — the call succeeded, spending the application's account while the
+     * caller believed it acted as the tenant. That is the substitution the whole subsystem exists to
+     * remove, and it survived the guard because a guard and a read are different code.
+     *
+     * Returns `undefined` only where the ABSENCE is a diagnosable application-level state, so the rich
+     * refusals below (an OAuth2 provider whose token is minted rather than authored, a provider with no
+     * `authConfig`) can still say the useful thing. A tenant-owned target never reaches them: its own
+     * refusal already names the tenant and the credential it lacks.
+     */
+    async readSecretForTarget(providerRef, target, secretRef) {
+        if (target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION) {
+            const resolved = await this.externalProvidersRegistry.resolveProviderSecretForTarget(target, providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, secretRef);
+            return {
+                value: resolved.value,
+                // Returned rather than remembered: this resolver is a SINGLETON, so a field holding "the
+                // last credential opened" would be read by whichever concurrent call happened to look next,
+                // and the row stamped would belong to a different tenant's request.
+                provenance: { source: resolved.source, credentialId: resolved.credentialId, secretSlug: secretRef },
+            };
+        }
+        return {
+            value: this.externalProvidersRegistry.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, secretRef)
+                ?? process.env[secretRef],
+        };
+    }
+    async resolveAccess(providerRef, target, executionContext) {
+        const binding = { providerRef };
+        await this.assertTargetIsAdmissibleAndAuthorized(providerRef, target, executionContext);
         const runtimeContract = this.externalProvidersRegistry.getProviderRuntimeContract(binding.providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);
         if (!runtimeContract || runtimeContract.kind !== ProviderProtocolRuntimeKind.REST) {
-            throw new HttpApiProviderAccessError(`Provider '${binding.providerRef}' declares no 'rest' runtime contract for protocol '${ExternalProvider_ExchangeProtocol_Kind.REST_API}' `
+            throw new HttpApiProviderAccessError(`Provider '${binding.providerRef}' declares no REST runtime contract for protocol '${ExternalProvider_ExchangeProtocol_Kind.REST_API}' `
                 + `(found: ${runtimeContract ? `kind '${String(runtimeContract.kind)}'` : 'none'}). `
-                + "Declare a REST_API protocol binding with a { kind: 'rest', baseUrl, apiKey } runtime contract on the provider's backend module, "
+                + "Declare a REST_API protocol binding with a { kind: ProviderProtocolRuntimeKind.REST, baseUrl, apiKey } runtime contract on the provider's backend module, "
                 + 'or the binding cannot name its target.');
         }
         // EXACTLY ONE of baseUrl / baseUrlEnvVarName per the contract. Env wins nothing — it is the
@@ -70,8 +153,57 @@ export class ExternalProvidersHttpApiAccessResolver {
                 ? `Provider '${binding.providerRef}' resolves its base URL from the environment variable '${runtimeContract.baseUrlEnvVarName}', which is not set — author it in the deployment environment (it names YOUR ${binding.providerRef} instance).`
                 : `Provider '${binding.providerRef}' rest contract declares neither baseUrl nor baseUrlEnvVarName — the binding cannot name its target.`);
         }
-        const apiKeyValue = this.externalProvidersRegistry.getProviderApiKey(binding.providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API) ?? this.externalProvidersRegistry.getProviderSecret(binding.providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, runtimeContract.apiKey.secretRef);
+        // A signed provider's credential is TWO values and is applied to the compiled request rather
+        // than to this access, so it is resolved here and handed back untouched. Returning early also
+        // keeps the api-key diagnostics below from firing for a provider that legitimately has none.
+        if (runtimeContract.requestSigning) {
+            const signing = runtimeContract.requestSigning;
+            const readSecret = async (secretRef) => (await this.readSecretForTarget(providerRef, target, secretRef)).value;
+            const keyId = await readSecret(signing.keyIdSecretRef);
+            const secretKey = await readSecret(signing.secretKeySecretRef);
+            if (!keyId || !secretKey) {
+                throw new HttpApiProviderAccessError(`Provider '${binding.providerRef}' signs each request and needs BOTH halves of its credential: `
+                    + `'${signing.keyIdSecretRef}' (${keyId ? 'set' : 'MISSING'}) and '${signing.secretKeySecretRef}' (${secretKey ? 'set' : 'MISSING'}). `
+                    + 'A signature cannot be computed from one of them, and a partially configured signer fails identically to a wrong secret.');
+            }
+            return {
+                baseUrl: baseUrl.replace(/\/$/, ''),
+                headers: { ...runtimeContract.defaultHeaders },
+                requestSigning: {
+                    declaration: signing,
+                    credentials: {
+                        keyId,
+                        secretKey,
+                        ...(signing.sessionTokenSecretRef === undefined ? {} : { sessionToken: await readSecret(signing.sessionTokenSecretRef) }),
+                        ...(signing.regionEnvVarName === undefined ? {} : { region: process.env[signing.regionEnvVarName] }),
+                    },
+                },
+            };
+        }
+        // The provider CONFIGURATION's `authConfig.secretRef` is an env projection and therefore says
+        // something only about the application's own account, so it is consulted for an APPLICATION
+        // target and for no other. A tenant-owned target goes to the target resolver, which refuses by
+        // name rather than falling through to the deployment's credential.
+        const configuredApiKey = target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION
+            ? this.externalProvidersRegistry.getProviderApiKey(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API)
+            : undefined;
+        const resolvedSecret = configuredApiKey === undefined
+            ? await this.readSecretForTarget(providerRef, target, runtimeContract.apiKey.secretRef)
+            : { value: configuredApiKey };
+        const apiKeyValue = resolvedSecret.value;
         if (!apiKeyValue) {
+            // An OAuth2 provider's credential is MINTED, not pasted, so telling an operator to set an
+            // environment variable is telling them to do something the vendor does not support. The two
+            // failures are different situations and must not share one message: one is missing
+            // configuration, the other is an account that was never connected.
+            if (runtimeContract.oauth2) {
+                throw new HttpApiProviderAccessError(`Provider '${binding.providerRef}' authenticates with OAuth2 and no access token resolves. `
+                    + 'This credential is obtained by an authorization exchange, not by setting an environment variable: '
+                    + `authorize at ${runtimeContract.oauth2.authorizeUrl}, exchange at ${runtimeContract.oauth2.tokenUrl}`
+                    + `${runtimeContract.oauth2.clientIdSecretRef ? `, with the application registration in '${runtimeContract.oauth2.clientIdSecretRef}' and '${runtimeContract.oauth2.clientSecretSecretRef ?? '(client secret unset)'}'` : ''}. `
+                    + 'Connect an account for this provider, or supply a long-lived token in '
+                    + `'${runtimeContract.apiKey.secretRef}' if the vendor issues one.`);
+            }
             throw new HttpApiProviderAccessError(`No API key resolves for provider '${binding.providerRef}' (protocol '${ExternalProvider_ExchangeProtocol_Kind.REST_API}'): `
                 + `neither the provider configuration's authConfig.secretRef nor the runtime contract's apiKey.secretRef ('${runtimeContract.apiKey.secretRef}') `
                 + 'yields a value from the environment.');
@@ -89,16 +221,79 @@ export class ExternalProvidersHttpApiAccessResolver {
                 // No credential header: the target reads auth from the RPC args only.
                 headers: { ...runtimeContract.defaultHeaders },
                 jsonRpcInArgsCredentials: { db, login, apiKey: apiKeyValue },
+                ...(resolvedSecret.provenance === undefined ? {} : { credentialProvenance: resolvedSecret.provenance }),
             };
         }
         return {
             baseUrl: baseUrl.replace(/\/$/, ''),
-            headers: {
-                ...runtimeContract.defaultHeaders,
-                // The auth header wins on a name collision, per the contract's own JSDoc.
+            /*
+             * The auth header wins on a name collision, per the contract's own JSDoc — and as of
+             * 2026-09-09 that is enforced rather than merely asserted.
+             *
+             * Spreading `defaultHeaders` first does not deliver it. A harvested catalogue declaring
+             * `Authorization` against an `apiKey.headerName` of `authorization` produces two distinct
+             * object keys, which survive all the way to `fetch` and are COMBINED into one comma-joined
+             * field value — so the request authenticates with neither the catalogue's value nor the
+             * engine's. `withEngineOwnedHeaders` drops every spelling of the reserved name first.
+             */
+            headers: withEngineOwnedHeaders(runtimeContract.defaultHeaders, {
                 [runtimeContract.apiKey.headerName]: `${runtimeContract.apiKey.prefix ?? ''}${apiKeyValue}`,
-            },
+            }),
+            ...(resolvedSecret.provenance === undefined ? {} : { credentialProvenance: resolvedSecret.provenance }),
         };
     }
+    /**
+     * Resolve one operation out of the provider's catalogue, memoized per `(providerRef, domain)`.
+     *
+     * The PROMISE is cached rather than its value so two concurrent reads of the same binding share
+     * one load, and a FAILED load is evicted — a cached rejection would make one bad moment
+     * permanent for the process's whole life. Same discipline as the operation executor's cache,
+     * for the same reason; the two caches are separate because they live in different objects with
+     * different lifetimes, and sharing one would mean a third thing owning provider state.
+     */
+    operationCatalogueCache = new Map();
+    async resolveProviderOperation(providerRef, providerOperationId, domain) {
+        const cacheKey = `${providerRef}::${domain ?? '*'}`;
+        let loading = this.operationCatalogueCache.get(cacheKey);
+        if (!loading) {
+            const runtimeContract = this.externalProvidersRegistry.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);
+            if (!runtimeContract || runtimeContract.kind !== ProviderProtocolRuntimeKind.REST) {
+                throw new HttpApiProviderAccessError(`A binding references an operation of provider '${providerRef}', which declares no REST runtime contract `
+                    + `(found: ${runtimeContract ? `kind '${String(runtimeContract.kind)}'` : 'none'}).`);
+            }
+            if (!runtimeContract.operations) {
+                throw new HttpApiProviderAccessError(`A binding references operation '${providerOperationId}' of provider '${providerRef}', which declares no operation catalogue — `
+                    + 'add `operations` to its rest runtime contract, or state the operation inline on the binding.');
+            }
+            const loadFailure = (cause) => new HttpApiProviderAccessError(`Provider '${providerRef}' failed to load its operation catalogue${domain ? ` for domain '${domain}'` : ''}: `
+                + `${cause instanceof Error ? cause.message : String(cause)}`);
+            // Second of the TWO sites that invoke a provider's own catalogue loader (the other is
+            // `ProviderOperationExecutorBackendService.loadCatalogue`, which carries the argument). A
+            // loader typically `import()`s its operation module, which throws SYNCHRONOUSLY when that
+            // module is missing — and a synchronous throw bypasses `.catch`, so without this a binding
+            // reference would surface the raw module error instead of the named refusal an operator can
+            // act on. Nothing is cached on this path, so nothing needs evicting.
+            let invoked;
+            try {
+                invoked = Promise.resolve(runtimeContract.operations(domain));
+            }
+            catch (cause) {
+                throw loadFailure(cause);
+            }
+            loading = invoked.catch((cause) => {
+                this.operationCatalogueCache.delete(cacheKey);
+                throw loadFailure(cause);
+            });
+            this.operationCatalogueCache.set(cacheKey, loading);
+        }
+        const catalogue = await loading;
+        const operation = catalogue.operations[providerOperationId];
+        if (!operation) {
+            const known = Object.keys(catalogue.operations);
+            throw new HttpApiProviderAccessError(`Provider '${providerRef}' declares no operation '${providerOperationId}'${domain ? ` in domain '${domain}'` : ''}. `
+                + `Declared${known.length > 20 ? ` (first 20 of ${known.length})` : ''}: ${known.slice(0, 20).join(', ') || '(none)'}.`);
+        }
+        return operation;
+    }
 }
 //# sourceMappingURL=http-api-provider-access.backend.js.map

package/dist/esm/base-classes/services/repositories/http-api/http-api-provider-access.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-provider-access.backend.js","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/http-api/http-api-provider-access.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,mBAAmB,GAEpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAwB5F;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AASD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,sCAAsC;IAE9B;IADnB,YACmB,yBAAkE;QAAlE,8BAAyB,GAAzB,yBAAyB,CAAyC;IAClF,CAAC;IAEJ,aAAa,CACX,OAAqE,EACrE,iBAAwC;QAExC,IAAI,OAAO,CAAC,YAAY,KAAK,mBAAmB,CAAC,cAAc,EAAE,CAAC;YAChE,MAAM,IAAI,0BAA0B,CAClC,4CAA4C,OAAO,CAAC,WAAW,wEAAwE;kBACrI,mIAAmI;kBACnI,iDAAiD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAC/E,OAAO,CAAC,WAAW,EACnB,sCAAsC,CAAC,QAAQ,CAChD,CAAC;QACF,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,IAAI,EAAE,CAAC;YAClF,MAAM,IAAI,0BAA0B,CAClC,aAAa,OAAO,CAAC,WAAW,uDAAuD,sCAAsC,CAAC,QAAQ,IAAI;kBACxI,WAAW,eAAe,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK;kBACnF,kIAAkI;kBAClI,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,4FAA4F;QAC5F,IAAI,eAAe,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC7F,MAAM,IAAI,0BAA0B,CAClC,aAAa,OAAO,CAAC,WAAW,mGAAmG,CACpI,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO;eAClC,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,eAAe,CAAC,iBAAiB;gBAC/B,CAAC,CAAC,aAAa,OAAO,CAAC,WAAW,0DAA0D,eAAe,CAAC,iBAAiB,gFAAgF,OAAO,CAAC,WAAW,aAAa;gBAC7O,CAAC,CAAC,aAAa,OAAO,CAAC,WAAW,sGAAsG,CAC3I,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAClE,OAAO,CAAC,WAAW,EACnB,sCAAsC,CAAC,QAAQ,CAChD,IAAI,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CACnD,OAAO,CAAC,WAAW,EACnB,sCAAsC,CAAC,QAAQ,EAC/C,eAAe,CAAC,MAAM,CAAC,SAAS,CACjC,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,0BAA0B,CAClC,qCAAqC,OAAO,CAAC,WAAW,gBAAgB,sCAAsC,CAAC,QAAQ,MAAM;kBAC3H,2GAA2G,eAAe,CAAC,MAAM,CAAC,SAAS,KAAK;kBAChJ,sCAAsC,CACzC,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,CAAC,iBAAiB,EAAE,CAAC;YACtC,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,eAAe,CAAC,iBAAiB,CAAC;YAC5E,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC3C,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,0BAA0B,CAClC,aAAa,OAAO,CAAC,WAAW,gCAAgC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,eAAe,GAAG,gBAAgB;sBAChI,gGAAgG,CACnG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACnC,sEAAsE;gBACtE,OAAO,EAAE,EAAE,GAAG,eAAe,CAAC,cAAc,EAAE;gBAC9C,wBAAwB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE;aAC7D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACnC,OAAO,EAAE;gBACP,GAAG,eAAe,CAAC,cAAc;gBACjC,0EAA0E;gBAC1E,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,WAAW,EAAE;aAC5F;SACF,CAAC;IACJ,CAAC;CACF","sourcesContent":["/**\n * Provider access for the HTTP-API repository — WHO the adapter is toward the target, resolved\n * per the binding's identity mode (ETL D9/R12, D7).\n *\n * Credentials are never authored on the binding: they resolve through the existing provider\n * machinery (`ExternalProvidersRegistryBackendService`), exactly as email/SMS/billing do. The\n * repository consumes this PORT so unit tests inject a stub and the production wiring stays in\n * one place.\n */\n\nimport {\n  HttpApiIdentityMode,\n  type HttpApiResourceBinding,\n} from '@wildo-ai/saas-models/external-data';\nimport { ExternalProvider_ExchangeProtocol_Kind } from '@wildo-ai/external-connectors-models';\nimport { ProviderProtocolRuntimeKind } from '@wildo-ai/external-connectors-private/backend';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\n\n/** Everything a remote call needs to leave the process: where, and as whom. */\nexport interface HttpApiProviderAccess {\n  /** Absolute base URL, no trailing slash. */\n  baseUrl: string;\n  /** Auth + default headers for every call under this access. */\n  headers: Record<string, string>;\n  /**\n   * Present when the provider contract declares IN-ARGS JSON-RPC auth (the Odoo shape): the\n   * credentials the adapter places INSIDE the RPC arguments. When present, `headers` carries no\n   * credential — the target reads none from headers, and a secret should not travel a channel\n   * nobody consumes.\n   */\n  jsonRpcInArgsCredentials?: {\n    db: string;\n    login: string;\n    apiKey: string;\n  };\n}\n\n/**\n * Thrown when access CANNOT be resolved — always naming what is missing, because every branch\n * here is a configuration gap an operator must fix, never a transient.\n */\nexport class HttpApiProviderAccessError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'HttpApiProviderAccessError';\n  }\n}\n\nexport interface HttpApiProviderAccessResolver {\n  resolveAccess(\n    binding: Pick<HttpApiResourceBinding, 'providerRef' | 'identityMode'>,\n    executionContext: ExecutionContext<any>,\n  ): HttpApiProviderAccess;\n}\n\n/**\n * The production resolver, over the provider registry.\n *\n * ## SERVICE_PRINCIPAL\n * Resolves the provider's `kind: 'rest'` runtime contract\n * (`getProviderRuntimeContract(providerRef, REST_API)`) for the base URL and the auth-header\n * SHAPE, then the key VALUE through the secret machinery — `getProviderApiKey` (the provider\n * configuration's `authConfig.secretRef`) first, falling back to the contract's own\n * `apiKey.secretRef` via `getProviderSecret`. Exactly the email-provider pattern: value from\n * secrets, shape from the contract, and the consumer branches on the CONTRACT field, never the\n * provider ref.\n *\n * ## USER_DELEGATED\n * Measured 2026-08-27 (ten probes, recorded in the ETL plan): the engine has NO outbound\n * per-user token persistence — `OAuth2_CredentialSchema` exists as a model with no resource, no\n * store and no service behind it. Executing this mode therefore refuses naming the missing\n * subsystem. **Ruled by Paul 2026-08-27: slice 1 is SERVICE_PRINCIPAL-first** — the mode stays\n * declared so bindings need no reshape; this refusal lifts when the delegated-token subsystem\n * (its own workstream) exists.\n */\nexport class ExternalProvidersHttpApiAccessResolver implements HttpApiProviderAccessResolver {\n  constructor(\n    private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n  ) {}\n\n  resolveAccess(\n    binding: Pick<HttpApiResourceBinding, 'providerRef' | 'identityMode'>,\n    _executionContext: ExecutionContext<any>,\n  ): HttpApiProviderAccess {\n    if (binding.identityMode === HttpApiIdentityMode.USER_DELEGATED) {\n      throw new HttpApiProviderAccessError(\n        `USER_DELEGATED identity toward provider '${binding.providerRef}' cannot be resolved: the engine has no outbound per-user token store `\n        + '(OAuth2_CredentialSchema is modeled but nothing persists or serves user tokens). Build the delegated-token subsystem, or declare '\n        + 'identityMode: SERVICE_PRINCIPAL on the binding.',\n      );\n    }\n\n    const runtimeContract = this.externalProvidersRegistry.getProviderRuntimeContract(\n      binding.providerRef,\n      ExternalProvider_ExchangeProtocol_Kind.REST_API,\n    );\n    if (!runtimeContract || runtimeContract.kind !== ProviderProtocolRuntimeKind.REST) {\n      throw new HttpApiProviderAccessError(\n        `Provider '${binding.providerRef}' declares no 'rest' runtime contract for protocol '${ExternalProvider_ExchangeProtocol_Kind.REST_API}' `\n        + `(found: ${runtimeContract ? `kind '${String(runtimeContract.kind)}'` : 'none'}). `\n        + \"Declare a REST_API protocol binding with a { kind: 'rest', baseUrl, apiKey } runtime contract on the provider's backend module, \"\n        + 'or the binding cannot name its target.',\n      );\n    }\n\n    // EXACTLY ONE of baseUrl / baseUrlEnvVarName per the contract. Env wins nothing — it is the\n    // only channel for a deployment-targeted URL; a module authoring both is a contract defect.\n    if (runtimeContract.baseUrl !== undefined && runtimeContract.baseUrlEnvVarName !== undefined) {\n      throw new HttpApiProviderAccessError(\n        `Provider '${binding.providerRef}' authors BOTH baseUrl and baseUrlEnvVarName on its rest contract — exactly one must be declared.`,\n      );\n    }\n    const baseUrl = runtimeContract.baseUrl\n      ?? (runtimeContract.baseUrlEnvVarName ? process.env[runtimeContract.baseUrlEnvVarName] : undefined);\n    if (!baseUrl) {\n      throw new HttpApiProviderAccessError(\n        runtimeContract.baseUrlEnvVarName\n          ? `Provider '${binding.providerRef}' resolves its base URL from the environment variable '${runtimeContract.baseUrlEnvVarName}', which is not set — author it in the deployment environment (it names YOUR ${binding.providerRef} instance).`\n          : `Provider '${binding.providerRef}' rest contract declares neither baseUrl nor baseUrlEnvVarName — the binding cannot name its target.`,\n      );\n    }\n\n    const apiKeyValue = this.externalProvidersRegistry.getProviderApiKey(\n      binding.providerRef,\n      ExternalProvider_ExchangeProtocol_Kind.REST_API,\n    ) ?? this.externalProvidersRegistry.getProviderSecret(\n      binding.providerRef,\n      ExternalProvider_ExchangeProtocol_Kind.REST_API,\n      runtimeContract.apiKey.secretRef,\n    );\n    if (!apiKeyValue) {\n      throw new HttpApiProviderAccessError(\n        `No API key resolves for provider '${binding.providerRef}' (protocol '${ExternalProvider_ExchangeProtocol_Kind.REST_API}'): `\n        + `neither the provider configuration's authConfig.secretRef nor the runtime contract's apiKey.secretRef ('${runtimeContract.apiKey.secretRef}') `\n        + 'yields a value from the environment.',\n      );\n    }\n\n    if (runtimeContract.jsonRpcInArgsAuth) {\n      const { dbEnvVarName, loginEnvVarName } = runtimeContract.jsonRpcInArgsAuth;\n      const db = process.env[dbEnvVarName];\n      const login = process.env[loginEnvVarName];\n      if (!db || !login) {\n        throw new HttpApiProviderAccessError(\n          `Provider '${binding.providerRef}' authenticates in-args, but ${!db ? `'${dbEnvVarName}'` : `'${loginEnvVarName}'`} is not set — `\n          + 'author it in the deployment environment (it names YOUR database/login on the target instance).',\n        );\n      }\n      return {\n        baseUrl: baseUrl.replace(/\\/$/, ''),\n        // No credential header: the target reads auth from the RPC args only.\n        headers: { ...runtimeContract.defaultHeaders },\n        jsonRpcInArgsCredentials: { db, login, apiKey: apiKeyValue },\n      };\n    }\n\n    return {\n      baseUrl: baseUrl.replace(/\\/$/, ''),\n      headers: {\n        ...runtimeContract.defaultHeaders,\n        // The auth header wins on a name collision, per the contract's own JSDoc.\n        [runtimeContract.apiKey.headerName]: `${runtimeContract.apiKey.prefix ?? ''}${apiKeyValue}`,\n      },\n    };\n  }\n}\n"]}
+{"version":3,"file":"http-api-provider-access.backend.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/http-api/http-api-provider-access.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EACL,sCAAsC,EACtC,sCAAsC,EACtC,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAa9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6EAA6E,CAAC;AA8CrH;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAuDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,sCAAsC;IAE9B;IAKA;IANnB,YACmB,yBAAkE;IACnF;;;OAGG;IACc,mBAAuD;QALvD,8BAAyB,GAAzB,yBAAyB,CAAyC;QAKlE,wBAAmB,GAAnB,mBAAmB,CAAoC;IACvE,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,qCAAqC,CACjD,WAAmB,EACnB,MAAyC,EACzC,gBAAuC;QAEvC,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAAC,gCAAgC,CAAC,WAAW,CAAC,CAAC;QAChG,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAC9B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAC5F,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,wFAAwF;YACxF,sFAAsF;YACtF,8FAA8F;YAC9F,sEAAsE;YACtE,8FAA8F;YAC9F,+FAA+F;YAC/F,8FAA8F;YAC9F,2FAA2F;YAC3F,yBAAyB;YACzB,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,yCAAyC,EAAE,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC;YACxH,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAC5F,CAAC;YACF,MAAM,QAAQ,GAAG,CAAC,MAAmD,EAAU,EAAE,CAC/E,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAElH,MAAM,IAAI,0BAA0B,CAClC,aAAa,WAAW,sBAAsB,MAAM,CAAC,UAAU,WAAW,MAAM,CAAC,UAAU,yBAAyB;kBAClH,cAAc,QAAQ,CAAC,UAAU,CAAC,IAAI;kBACtC,CAAC,YAAY;oBACb,CAAC,CAAC,6BAA6B,QAAQ,CAAC,SAAS,CAAC,mCAAmC;0BACjF,0CAA0C,GAAG,WAAW,GAAG,0CAA0C;0BACrG,gEAAgE;oBACpE,CAAC,CAAC,uGAAuG;0BACrG,uGAAuG,CAAC,CAC/G,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;YAAE,OAAO;QAErF,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,IAAI,0BAA0B,CAClC,aAAa,WAAW,QAAQ,MAAM,CAAC,UAAU,kFAAkF;kBACjI,6HAA6H;kBAC7H,kEAAkE,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,0BAA0B,CAClC,aAAa,WAAW,qCAAqC,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,OAAO,IAAI,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,mBAAmB,CAC/B,WAAmB,EACnB,MAAyC,EACzC,SAAiB;QAEjB,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,EAAE,CAAC;YAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,8BAA8B,CAClF,MAAM,EACN,WAAW,EACX,sCAAsC,CAAC,QAAQ,EAC/C,SAAS,CACV,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,yFAAyF;gBACzF,4FAA4F;gBAC5F,oEAAoE;gBACpE,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE;aACpG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,EAAE,SAAS,CAAC;mBAC3H,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,MAAyC,EACzC,gBAAuC;QAEvC,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,qCAAqC,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAExF,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAC/E,OAAO,CAAC,WAAW,EACnB,sCAAsC,CAAC,QAAQ,CAChD,CAAC;QACF,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,IAAI,EAAE,CAAC;YAClF,MAAM,IAAI,0BAA0B,CAClC,aAAa,OAAO,CAAC,WAAW,qDAAqD,sCAAsC,CAAC,QAAQ,IAAI;kBACtI,WAAW,eAAe,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK;kBACnF,4JAA4J;kBAC5J,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,4FAA4F;QAC5F,IAAI,eAAe,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC7F,MAAM,IAAI,0BAA0B,CAClC,aAAa,OAAO,CAAC,WAAW,mGAAmG,CACpI,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO;eAClC,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,eAAe,CAAC,iBAAiB;gBAC/B,CAAC,CAAC,aAAa,OAAO,CAAC,WAAW,0DAA0D,eAAe,CAAC,iBAAiB,gFAAgF,OAAO,CAAC,WAAW,aAAa;gBAC7O,CAAC,CAAC,aAAa,OAAO,CAAC,WAAW,sGAAsG,CAC3I,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,IAAI,eAAe,CAAC,cAAc,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,eAAe,CAAC,cAAc,CAAC;YAC/C,MAAM,UAAU,GAAG,KAAK,EAAE,SAAiB,EAA+B,EAAE,CAC1E,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;YACzE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,0BAA0B,CAClC,aAAa,OAAO,CAAC,WAAW,gEAAgE;sBAC9F,IAAI,OAAO,CAAC,cAAc,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,UAAU,OAAO,CAAC,kBAAkB,MAAM,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK;sBACrI,yHAAyH,CAC5H,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACnC,OAAO,EAAE,EAAE,GAAG,eAAe,CAAC,cAAc,EAAE;gBAC9C,cAAc,EAAE;oBACd,WAAW,EAAE,OAAO;oBACpB,WAAW,EAAE;wBACX,KAAK;wBACL,SAAS;wBACT,GAAG,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;wBACzH,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;qBACrG;iBACF;aACF,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,4FAA4F;QAC5F,+FAA+F;QAC/F,mEAAmE;QACnE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;YAC/F,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,CAAC;YAChH,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,cAAc,GAAG,gBAAgB,KAAK,SAAS;YACnD,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YACvF,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC;QACzC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,0FAA0F;YAC1F,4FAA4F;YAC5F,mFAAmF;YACnF,mEAAmE;YACnE,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,0BAA0B,CAClC,aAAa,OAAO,CAAC,WAAW,4DAA4D;sBAC1F,oGAAoG;sBACpG,gBAAgB,eAAe,CAAC,MAAM,CAAC,YAAY,iBAAiB,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE;sBACrG,GAAG,eAAe,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,2CAA2C,eAAe,CAAC,MAAM,CAAC,iBAAiB,UAAU,eAAe,CAAC,MAAM,CAAC,qBAAqB,IAAI,uBAAuB,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;sBAC9N,wEAAwE;sBACxE,IAAI,eAAe,CAAC,MAAM,CAAC,SAAS,6BAA6B,CACpE,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,qCAAqC,OAAO,CAAC,WAAW,gBAAgB,sCAAsC,CAAC,QAAQ,MAAM;kBAC3H,2GAA2G,eAAe,CAAC,MAAM,CAAC,SAAS,KAAK;kBAChJ,sCAAsC,CACzC,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,CAAC,iBAAiB,EAAE,CAAC;YACtC,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,eAAe,CAAC,iBAAiB,CAAC;YAC5E,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC3C,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,0BAA0B,CAClC,aAAa,OAAO,CAAC,WAAW,gCAAgC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,eAAe,GAAG,gBAAgB;sBAChI,gGAAgG,CACnG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACnC,sEAAsE;gBACtE,OAAO,EAAE,EAAE,GAAG,eAAe,CAAC,cAAc,EAAE;gBAC9C,wBAAwB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE;gBAC5D,GAAG,CAAC,cAAc,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC;aACxG,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACnC;;;;;;;;;eASG;YACH,OAAO,EAAE,sBAAsB,CAAC,eAAe,CAAC,cAAc,EAAE;gBAC9D,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,WAAW,EAAE;aAC5F,CAAC;YACF,GAAG,CAAC,cAAc,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC;SACxG,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACc,uBAAuB,GAAG,IAAI,GAAG,EAAmD,CAAC;IAE/F,KAAK,CAAC,wBAAwB,CACnC,WAAmB,EACnB,mBAA2B,EAC3B,MAAe;QAEf,MAAM,QAAQ,GAAG,GAAG,WAAW,KAAK,MAAM,IAAI,GAAG,EAAE,CAAC;QACpD,IAAI,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAC/E,WAAW,EACX,sCAAsC,CAAC,QAAQ,CAChD,CAAC;YACF,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,IAAI,EAAE,CAAC;gBAClF,MAAM,IAAI,0BAA0B,CAClC,kDAAkD,WAAW,6CAA6C;sBACxG,WAAW,eAAe,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CACrF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;gBAChC,MAAM,IAAI,0BAA0B,CAClC,mCAAmC,mBAAmB,kBAAkB,WAAW,6CAA6C;sBAC9H,8FAA8F,CACjG,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,0BAA0B,CACpE,aAAa,WAAW,2CAA2C,MAAM,CAAC,CAAC,CAAC,gBAAgB,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;kBAC5G,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;YAEF,sFAAsF;YACtF,0FAA0F;YAC1F,0FAA0F;YAC1F,2FAA2F;YAC3F,4FAA4F;YAC5F,qEAAqE;YACrE,IAAI,OAAgD,CAAC;YACrD,IAAI,CAAC;gBACH,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YAED,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACzC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC;QAChC,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,IAAI,0BAA0B,CAClC,aAAa,WAAW,4BAA4B,mBAAmB,IAAI,MAAM,CAAC,CAAC,CAAC,eAAe,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;kBACnH,WAAW,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CACxH,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF","sourcesContent":["/**\n * Provider access for the HTTP-API repository — WHO the adapter is toward the target, resolved\n * per the binding's identity mode (ETL D9/R12, D7).\n *\n * Credentials are never authored on the binding: they resolve through the existing provider\n * machinery (`ExternalProvidersRegistryBackendService`), exactly as email/SMS/billing do. The\n * repository consumes this PORT so unit tests inject a stub and the production wiring stays in\n * one place.\n */\n\nimport {\n  type HttpApiResourceBinding,\n} from '@wildo-ai/saas-models/external-data';\nimport {\n  ExternalProvider_Connection_OwnerScope,\n  ExternalProvider_ExchangeProtocol_Kind,\n  ProviderProtocolRuntimeKind,\n} from '@wildo-ai/external-connectors-models';\nimport type { ExternalProvider_ConnectionTarget,\n  ExternalProvider_ConnectionShape,\n} from '@wildo-ai/external-connectors-models';\nimport type { ProviderCredentialResolutionSource } from '@wildo-ai/saas-models';\nimport type { ProviderRestRequestSigning } from '@wildo-ai/external-connectors-models';\nimport type { ProviderRestOperation, ProviderRestOperationCatalogue } from '@wildo-ai/external-connectors-models';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\n\n/** Everything a remote call needs to leave the process: where, and as whom. */\nimport type { ProviderSigningCredentials } from '~wildo-backend-lib/external-providers/operations/provider-request-signing.backend';\nimport { withEngineOwnedHeaders } from '~wildo-backend-lib/security/outbound/outbound-request-headers.backend.utils';\n\nexport interface HttpApiProviderAccess {\n  /** Absolute base URL, no trailing slash. */\n  baseUrl: string;\n  /** Auth + default headers for every call under this access. */\n  headers: Record<string, string>;\n  /**\n   * Present when the provider contract declares IN-ARGS JSON-RPC auth (the Odoo shape): the\n   * credentials the adapter places INSIDE the RPC arguments. When present, `headers` carries no\n   * credential — the target reads none from headers, and a secret should not travel a channel\n   * nobody consumes.\n   */\n  /**\n   * Present when the provider signs each request (AWS SigV4, Azure shared key). When present,\n   * `headers` carries NO credential: the signature is computed by the caller from the fully\n   * compiled request, because it covers the bytes and anything added afterwards invalidates it.\n   */\n  requestSigning?: {\n    declaration: ProviderRestRequestSigning;\n    credentials: ProviderSigningCredentials;\n  };\n  jsonRpcInArgsCredentials?: {\n    db: string;\n    login: string;\n    apiKey: string;\n  };\n  /**\n   * WHERE the credential came from, carried out so the caller can stamp the row it used.\n   *\n   * The store can record that a tenant's credential was accepted or rejected, and until this existed\n   * it could not be told: the resolver knew which row it opened and threw that away, so\n   * `validationState` stayed UNVALIDATED for every credential that had in fact just worked, and\n   * `lastUsedAt` never moved. An operator reading the screen saw a credential that might be dead.\n   *\n   * Absent for an APPLICATION-owned resolution, which has no row to stamp — inventing one for the\n   * deployment environment would create a credential the tenant never set.\n   */\n  credentialProvenance?: {\n    source: ProviderCredentialResolutionSource;\n    credentialId?: string;\n    /** The secrets-contract slug the value satisfies — the row's third identity component. */\n    secretSlug: string;\n  };\n}\n\n/**\n * Thrown when access CANNOT be resolved — always naming what is missing, because every branch\n * here is a configuration gap an operator must fix, never a transient.\n */\nexport class HttpApiProviderAccessError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'HttpApiProviderAccessError';\n  }\n}\n\n/**\n * May THIS execution act for THAT owner — the authorization half of a connection target.\n *\n * The call NAMES the owner and this decides whether it may. Supplying and authorizing are different\n * jobs and must not be the same read: a resolver that took the owner from the execution context\n * would be verifying a target it had itself invented, and could not express the case that forces\n * the split — one user action pushing to every organization that user belongs to, where the target\n * varies per call while the initiator does not.\n *\n * Membership, not current scope. The fan-out above runs with ONE ambient organization and legitimately\n * spends several tenants' accounts, so an equality check against the initiator's own organization\n * would refuse the very case this design exists to serve.\n */\nexport interface ConnectionTargetAuthorizationPort {\n  mayActFor(\n    target: ExternalProvider_ConnectionTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<boolean>;\n}\n\n/** A secret and, when it came from a stored row, which row — so the caller can stamp it. */\ninterface ResolvedProviderSecret {\n  value: string | undefined;\n  provenance?: HttpApiProviderAccess['credentialProvenance'];\n}\n\nexport interface HttpApiProviderAccessResolver {\n  resolveAccess(\n    providerRef: string,\n    target: ExternalProvider_ConnectionTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<HttpApiProviderAccess>;\n\n  /**\n   * One operation out of the provider's own `rest.operations` catalogue, for a binding whose read\n   * member is a REFERENCE rather than an inline spec (S3a, #331).\n   *\n   * On this port, and OPTIONAL, for two reasons that are both about not inventing a second\n   * authority. It is the same question about the same object: `resolveAccess` reads baseUrl and\n   * apiKey off the provider's `rest` runtime contract, and this reads `operations` off that same\n   * contract — a separate port would mean a second thing holding the registry and a second place\n   * to get provider resolution wrong. And it is optional so that every existing stub of this\n   * interface (unit harnesses, partial containers) keeps satisfying it; a binding that authors a\n   * reference against a resolver that does not implement it is refused BY NAME, which is a state\n   * an operator can act on, rather than by a `TypeError` three frames down.\n   */\n  resolveProviderOperation?(\n    providerRef: string,\n    providerOperationId: string,\n    domain?: string,\n  ): Promise<ProviderRestOperation>;\n}\n\n/**\n * The production resolver, over the provider registry.\n *\n * ## AN APPLICATION-OWNED CONNECTION\n * Resolves the provider's `kind: ProviderProtocolRuntimeKind.REST` runtime contract\n * (`getProviderRuntimeContract(providerRef, REST_API)`) for the base URL and the auth-header\n * SHAPE, then the key VALUE through the secret machinery — `getProviderApiKey` (the provider\n * configuration's `authConfig.secretRef`) first, falling back to the contract's own\n * `apiKey.secretRef` via `getProviderSecret`. Exactly the email-provider pattern: value from\n * secrets, shape from the contract, and the consumer branches on the CONTRACT field, never the\n * provider ref.\n *\n * ## DELEGATED AND TENANT-OWNED CONNECTIONS\n * This paragraph read \"the engine has NO outbound per-user token persistence — `OAuth2_CredentialSchema`\n * exists as a model with no resource, no store and no service behind it\", measured 2026-08-27. That\n * is retired (#333): the store exists, is bound, and serves the connection controller, so the\n * refusal it justified is gone. A binding now declares WHOSE ACCOUNT it spends and on whose behalf\n * (`ExternalProvider_ConnectionShape`), the call supplies which instance, and the two questions this\n * resolver asks below — is the shape ADMISSIBLE for the provider, is this execution AUTHORIZED to\n * act for that owner — are what decide it. Both still fail closed, and an unbound authorization port\n * still refuses every non-application target.\n */\nexport class ExternalProvidersHttpApiAccessResolver implements HttpApiProviderAccessResolver {\n  constructor(\n    private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n    /**\n     * Absent until the membership check is wired. Its absence REFUSES every non-application target\n     * rather than admitting one, so the gate cannot be opened by forgetting to bind something.\n     */\n    private readonly targetAuthorization?: ConnectionTargetAuthorizationPort,\n  ) {}\n\n  /**\n   * Two questions, in this order, and both must be answered before a secret is read.\n   *\n   * ADMISSIBLE — does this provider admit this owner scope at all? A provider that has recorded no\n   * decision admits only the floor, so asking for a tenant-owned connection against it refuses,\n   * naming the record to author. That is the fail-closed direction: the alternative is a per-tenant\n   * call that quietly runs on the application's account.\n   *\n   * AUTHORIZED — may this execution act for that owner? Only for a non-application target: an\n   * application-owned connection has exactly one instance and the application IS the caller, so\n   * there is no second party whose account might be spent. Every other target needs the port, and\n   * an unbound port REFUSES — a gate that opens when a wiring step is forgotten is not a gate.\n   */\n  private async assertTargetIsAdmissibleAndAuthorized(\n    providerRef: string,\n    target: ExternalProvider_ConnectionTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<void> {\n    const admissible = this.externalProvidersRegistry.getProviderAdmissibleConnections(providerRef);\n    const admitted = admissible.some(\n      (shape) => shape.ownerScope === target.ownerScope && shape.delegation === target.delegation,\n    );\n    if (!admitted) {\n      // Two different causes, repaired in two different files by two different people, so the\n      // refusal says WHICH. The vendor may never have had this capability recorded, or this\n      // application may have switched it off — and a message that always blamed the catalogue would\n      // send an operator to edit a decision record that is already correct.\n      // Optional call, and not defensiveness for its own sake: this runs INSIDE the construction of\n      // a refusal. A registry double that models only the method above would otherwise turn a clear,\n      // actionable error into a `TypeError` raised from the error path — the one place a failure is\n      // least recoverable and least legible. A collaborator that cannot answer simply yields the\n      // less specific message.\n      const catalogue = this.externalProvidersRegistry.getProviderCatalogueAdmissibleConnections?.(providerRef) ?? admissible;\n      const narrowedAway = catalogue.some(\n        (shape) => shape.ownerScope === target.ownerScope && shape.delegation === target.delegation,\n      );\n      const describe = (shapes: readonly ExternalProvider_ConnectionShape[]): string =>\n        shapes.length === 0 ? 'nothing' : shapes.map((shape) => `${shape.ownerScope} x ${shape.delegation}`).join(', ');\n\n      throw new HttpApiProviderAccessError(\n        `Provider '${providerRef}' does not admit a ${target.ownerScope}-owned, ${target.delegation}-delegated connection. `\n        + `It admits: ${describe(admissible)}. `\n        + (narrowedAway\n          ? `The VENDOR does admit it (${describe(catalogue)}); this APPLICATION excluded it. `\n            + \"Widen or remove `providers.connections['\" + providerRef + \"']` in the SaaS config — the provider's \"\n            + 'catalogue record is not at fault and editing it will not help.'\n          : 'Whether a vendor can be connected this way is a recorded decision, not something read from its API — '\n            + \"record it in the provider's catalogue-record decisions file, or in its module if it is hand-authored.\"),\n      );\n    }\n\n    if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION) return;\n\n    if (!this.targetAuthorization) {\n      throw new HttpApiProviderAccessError(\n        `Provider '${providerRef}': a ${target.ownerScope}-owned connection cannot be authorized — no target-authorization port is bound. `\n        + 'The call names an owner and something must decide whether this execution may act for it; with nothing bound, that decision '\n        + 'would be nobody\\'s, so the call is refused rather than admitted.',\n      );\n    }\n    if (!await this.targetAuthorization.mayActFor(target, executionContext)) {\n      throw new HttpApiProviderAccessError(\n        `Provider '${providerRef}': this execution may not act for ${target.ownerScope} '${target.ownerId}'.`,\n      );\n    }\n  }\n\n  /**\n   * ONE place a provider secret is read, and it always names the target.\n   *\n   * Before this existed the guard admitted a tenant-owned target and the read below then went to the\n   * deployment environment anyway — the call succeeded, spending the application's account while the\n   * caller believed it acted as the tenant. That is the substitution the whole subsystem exists to\n   * remove, and it survived the guard because a guard and a read are different code.\n   *\n   * Returns `undefined` only where the ABSENCE is a diagnosable application-level state, so the rich\n   * refusals below (an OAuth2 provider whose token is minted rather than authored, a provider with no\n   * `authConfig`) can still say the useful thing. A tenant-owned target never reaches them: its own\n   * refusal already names the tenant and the credential it lacks.\n   */\n  private async readSecretForTarget(\n    providerRef: string,\n    target: ExternalProvider_ConnectionTarget,\n    secretRef: string,\n  ): Promise<ResolvedProviderSecret> {\n    if (target.ownerScope !== ExternalProvider_Connection_OwnerScope.APPLICATION) {\n      const resolved = await this.externalProvidersRegistry.resolveProviderSecretForTarget(\n        target,\n        providerRef,\n        ExternalProvider_ExchangeProtocol_Kind.REST_API,\n        secretRef,\n      );\n      return {\n        value: resolved.value,\n        // Returned rather than remembered: this resolver is a SINGLETON, so a field holding \"the\n        // last credential opened\" would be read by whichever concurrent call happened to look next,\n        // and the row stamped would belong to a different tenant's request.\n        provenance: { source: resolved.source, credentialId: resolved.credentialId, secretSlug: secretRef },\n      };\n    }\n    return {\n      value: this.externalProvidersRegistry.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, secretRef)\n        ?? process.env[secretRef],\n    };\n  }\n\n  async resolveAccess(\n    providerRef: string,\n    target: ExternalProvider_ConnectionTarget,\n    executionContext: ExecutionContext<any>,\n  ): Promise<HttpApiProviderAccess> {\n    const binding = { providerRef };\n    await this.assertTargetIsAdmissibleAndAuthorized(providerRef, target, executionContext);\n\n    const runtimeContract = this.externalProvidersRegistry.getProviderRuntimeContract(\n      binding.providerRef,\n      ExternalProvider_ExchangeProtocol_Kind.REST_API,\n    );\n    if (!runtimeContract || runtimeContract.kind !== ProviderProtocolRuntimeKind.REST) {\n      throw new HttpApiProviderAccessError(\n        `Provider '${binding.providerRef}' declares no REST runtime contract for protocol '${ExternalProvider_ExchangeProtocol_Kind.REST_API}' `\n        + `(found: ${runtimeContract ? `kind '${String(runtimeContract.kind)}'` : 'none'}). `\n        + \"Declare a REST_API protocol binding with a { kind: ProviderProtocolRuntimeKind.REST, baseUrl, apiKey } runtime contract on the provider's backend module, \"\n        + 'or the binding cannot name its target.',\n      );\n    }\n\n    // EXACTLY ONE of baseUrl / baseUrlEnvVarName per the contract. Env wins nothing — it is the\n    // only channel for a deployment-targeted URL; a module authoring both is a contract defect.\n    if (runtimeContract.baseUrl !== undefined && runtimeContract.baseUrlEnvVarName !== undefined) {\n      throw new HttpApiProviderAccessError(\n        `Provider '${binding.providerRef}' authors BOTH baseUrl and baseUrlEnvVarName on its rest contract — exactly one must be declared.`,\n      );\n    }\n    const baseUrl = runtimeContract.baseUrl\n      ?? (runtimeContract.baseUrlEnvVarName ? process.env[runtimeContract.baseUrlEnvVarName] : undefined);\n    if (!baseUrl) {\n      throw new HttpApiProviderAccessError(\n        runtimeContract.baseUrlEnvVarName\n          ? `Provider '${binding.providerRef}' resolves its base URL from the environment variable '${runtimeContract.baseUrlEnvVarName}', which is not set — author it in the deployment environment (it names YOUR ${binding.providerRef} instance).`\n          : `Provider '${binding.providerRef}' rest contract declares neither baseUrl nor baseUrlEnvVarName — the binding cannot name its target.`,\n      );\n    }\n\n    // A signed provider's credential is TWO values and is applied to the compiled request rather\n    // than to this access, so it is resolved here and handed back untouched. Returning early also\n    // keeps the api-key diagnostics below from firing for a provider that legitimately has none.\n    if (runtimeContract.requestSigning) {\n      const signing = runtimeContract.requestSigning;\n      const readSecret = async (secretRef: string): Promise<string | undefined> =>\n        (await this.readSecretForTarget(providerRef, target, secretRef)).value;\n      const keyId = await readSecret(signing.keyIdSecretRef);\n      const secretKey = await readSecret(signing.secretKeySecretRef);\n      if (!keyId || !secretKey) {\n        throw new HttpApiProviderAccessError(\n          `Provider '${binding.providerRef}' signs each request and needs BOTH halves of its credential: `\n          + `'${signing.keyIdSecretRef}' (${keyId ? 'set' : 'MISSING'}) and '${signing.secretKeySecretRef}' (${secretKey ? 'set' : 'MISSING'}). `\n          + 'A signature cannot be computed from one of them, and a partially configured signer fails identically to a wrong secret.',\n        );\n      }\n      return {\n        baseUrl: baseUrl.replace(/\\/$/, ''),\n        headers: { ...runtimeContract.defaultHeaders },\n        requestSigning: {\n          declaration: signing,\n          credentials: {\n            keyId,\n            secretKey,\n            ...(signing.sessionTokenSecretRef === undefined ? {} : { sessionToken: await readSecret(signing.sessionTokenSecretRef) }),\n            ...(signing.regionEnvVarName === undefined ? {} : { region: process.env[signing.regionEnvVarName] }),\n          },\n        },\n      };\n    }\n\n    // The provider CONFIGURATION's `authConfig.secretRef` is an env projection and therefore says\n    // something only about the application's own account, so it is consulted for an APPLICATION\n    // target and for no other. A tenant-owned target goes to the target resolver, which refuses by\n    // name rather than falling through to the deployment's credential.\n    const configuredApiKey = target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n      ? this.externalProvidersRegistry.getProviderApiKey(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API)\n      : undefined;\n    const resolvedSecret = configuredApiKey === undefined\n      ? await this.readSecretForTarget(providerRef, target, runtimeContract.apiKey.secretRef)\n      : { value: configuredApiKey };\n    const apiKeyValue = resolvedSecret.value;\n    if (!apiKeyValue) {\n      // An OAuth2 provider's credential is MINTED, not pasted, so telling an operator to set an\n      // environment variable is telling them to do something the vendor does not support. The two\n      // failures are different situations and must not share one message: one is missing\n      // configuration, the other is an account that was never connected.\n      if (runtimeContract.oauth2) {\n        throw new HttpApiProviderAccessError(\n          `Provider '${binding.providerRef}' authenticates with OAuth2 and no access token resolves. `\n          + 'This credential is obtained by an authorization exchange, not by setting an environment variable: '\n          + `authorize at ${runtimeContract.oauth2.authorizeUrl}, exchange at ${runtimeContract.oauth2.tokenUrl}`\n          + `${runtimeContract.oauth2.clientIdSecretRef ? `, with the application registration in '${runtimeContract.oauth2.clientIdSecretRef}' and '${runtimeContract.oauth2.clientSecretSecretRef ?? '(client secret unset)'}'` : ''}. `\n          + 'Connect an account for this provider, or supply a long-lived token in '\n          + `'${runtimeContract.apiKey.secretRef}' if the vendor issues one.`,\n        );\n      }\n      throw new HttpApiProviderAccessError(\n        `No API key resolves for provider '${binding.providerRef}' (protocol '${ExternalProvider_ExchangeProtocol_Kind.REST_API}'): `\n        + `neither the provider configuration's authConfig.secretRef nor the runtime contract's apiKey.secretRef ('${runtimeContract.apiKey.secretRef}') `\n        + 'yields a value from the environment.',\n      );\n    }\n\n    if (runtimeContract.jsonRpcInArgsAuth) {\n      const { dbEnvVarName, loginEnvVarName } = runtimeContract.jsonRpcInArgsAuth;\n      const db = process.env[dbEnvVarName];\n      const login = process.env[loginEnvVarName];\n      if (!db || !login) {\n        throw new HttpApiProviderAccessError(\n          `Provider '${binding.providerRef}' authenticates in-args, but ${!db ? `'${dbEnvVarName}'` : `'${loginEnvVarName}'`} is not set — `\n          + 'author it in the deployment environment (it names YOUR database/login on the target instance).',\n        );\n      }\n      return {\n        baseUrl: baseUrl.replace(/\\/$/, ''),\n        // No credential header: the target reads auth from the RPC args only.\n        headers: { ...runtimeContract.defaultHeaders },\n        jsonRpcInArgsCredentials: { db, login, apiKey: apiKeyValue },\n        ...(resolvedSecret.provenance === undefined ? {} : { credentialProvenance: resolvedSecret.provenance }),\n      };\n    }\n\n    return {\n      baseUrl: baseUrl.replace(/\\/$/, ''),\n      /*\n       * The auth header wins on a name collision, per the contract's own JSDoc — and as of\n       * 2026-09-09 that is enforced rather than merely asserted.\n       *\n       * Spreading `defaultHeaders` first does not deliver it. A harvested catalogue declaring\n       * `Authorization` against an `apiKey.headerName` of `authorization` produces two distinct\n       * object keys, which survive all the way to `fetch` and are COMBINED into one comma-joined\n       * field value — so the request authenticates with neither the catalogue's value nor the\n       * engine's. `withEngineOwnedHeaders` drops every spelling of the reserved name first.\n       */\n      headers: withEngineOwnedHeaders(runtimeContract.defaultHeaders, {\n        [runtimeContract.apiKey.headerName]: `${runtimeContract.apiKey.prefix ?? ''}${apiKeyValue}`,\n      }),\n      ...(resolvedSecret.provenance === undefined ? {} : { credentialProvenance: resolvedSecret.provenance }),\n    };\n  }\n\n  /**\n   * Resolve one operation out of the provider's catalogue, memoized per `(providerRef, domain)`.\n   *\n   * The PROMISE is cached rather than its value so two concurrent reads of the same binding share\n   * one load, and a FAILED load is evicted — a cached rejection would make one bad moment\n   * permanent for the process's whole life. Same discipline as the operation executor's cache,\n   * for the same reason; the two caches are separate because they live in different objects with\n   * different lifetimes, and sharing one would mean a third thing owning provider state.\n   */\n  private readonly operationCatalogueCache = new Map<string, Promise<ProviderRestOperationCatalogue>>();\n\n  public async resolveProviderOperation(\n    providerRef: string,\n    providerOperationId: string,\n    domain?: string,\n  ): Promise<ProviderRestOperation> {\n    const cacheKey = `${providerRef}::${domain ?? '*'}`;\n    let loading = this.operationCatalogueCache.get(cacheKey);\n    if (!loading) {\n      const runtimeContract = this.externalProvidersRegistry.getProviderRuntimeContract(\n        providerRef,\n        ExternalProvider_ExchangeProtocol_Kind.REST_API,\n      );\n      if (!runtimeContract || runtimeContract.kind !== ProviderProtocolRuntimeKind.REST) {\n        throw new HttpApiProviderAccessError(\n          `A binding references an operation of provider '${providerRef}', which declares no REST runtime contract `\n          + `(found: ${runtimeContract ? `kind '${String(runtimeContract.kind)}'` : 'none'}).`,\n        );\n      }\n      if (!runtimeContract.operations) {\n        throw new HttpApiProviderAccessError(\n          `A binding references operation '${providerOperationId}' of provider '${providerRef}', which declares no operation catalogue — `\n          + 'add `operations` to its rest runtime contract, or state the operation inline on the binding.',\n        );\n      }\n      const loadFailure = (cause: unknown) => new HttpApiProviderAccessError(\n        `Provider '${providerRef}' failed to load its operation catalogue${domain ? ` for domain '${domain}'` : ''}: `\n        + `${cause instanceof Error ? cause.message : String(cause)}`,\n      );\n\n      // Second of the TWO sites that invoke a provider's own catalogue loader (the other is\n      // `ProviderOperationExecutorBackendService.loadCatalogue`, which carries the argument). A\n      // loader typically `import()`s its operation module, which throws SYNCHRONOUSLY when that\n      // module is missing — and a synchronous throw bypasses `.catch`, so without this a binding\n      // reference would surface the raw module error instead of the named refusal an operator can\n      // act on. Nothing is cached on this path, so nothing needs evicting.\n      let invoked: Promise<ProviderRestOperationCatalogue>;\n      try {\n        invoked = Promise.resolve(runtimeContract.operations(domain));\n      } catch (cause) {\n        throw loadFailure(cause);\n      }\n\n      loading = invoked.catch((cause: unknown) => {\n        this.operationCatalogueCache.delete(cacheKey);\n        throw loadFailure(cause);\n      });\n      this.operationCatalogueCache.set(cacheKey, loading);\n    }\n\n    const catalogue = await loading;\n    const operation = catalogue.operations[providerOperationId];\n    if (!operation) {\n      const known = Object.keys(catalogue.operations);\n      throw new HttpApiProviderAccessError(\n        `Provider '${providerRef}' declares no operation '${providerOperationId}'${domain ? ` in domain '${domain}'` : ''}. `\n        + `Declared${known.length > 20 ? ` (first 20 of ${known.length})` : ''}: ${known.slice(0, 20).join(', ') || '(none)'}.`,\n      );\n    }\n    return operation;\n  }\n}\n"]}

package/dist/esm/base-classes/services/repositories/http-api/http-api-query.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-query.backend.d.ts","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/http-api/http-api-query.backend.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAElE,8FAA8F;AAC9F,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,0BAA0B;AAC1B,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IAEtB,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAE9B;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,IAAI,EAAE,cAAc,EAAE,CAAC;IAEvB,mGAAmG;IACnG,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"http-api-query.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/http-api/http-api-query.backend.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAElE,8FAA8F;AAC9F,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,0BAA0B;AAC1B,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IAEtB,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAE9B;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,IAAI,EAAE,cAAc,EAAE,CAAC;IAEvB,mGAAmG;IACnG,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.d.ts

@@ -3,7 +3,7 @@
  * (partial-resource paper, PR-29): provider-access resolution, transport execution (timeout /
  * bounded retry / rate budget), the per-dialect wire framing (OData GET, REST_JSON GET/POST +
  * JSON-RPC envelope semantics, Odoo `execute_kw` with the `common.authenticate` handshake and
- * the instance-cached uid), and the 404-as-null read tolerance.
+ * the credential-keyed cached uid), and the 404-as-null read tolerance.
  *
  * TWO consumers, by design: the VIRTUAL repository (`http-api-resource-repository`) and the
  * pipeline extraction source (P-2). The declaration layer is split on purpose — a pipeline is
@@ -32,15 +32,58 @@ export declare class HttpApiReadClient {
     private readonly fetchImpl;
     private readonly rateBudget;
     /**
-     * The authenticated uid for this binding's credentials, resolved once per client instance
-     * through the documented `common.authenticate(db, login, api_key, {})` handshake and cached —
-     * clients are constructed once per consumer and the credential set is instance-stable. A
-     * credential rotation therefore needs a process restart in slice 1 (recorded; an invalidation
-     * hook belongs with the runtime-proof work, measured against real session-expiry behavior).
+     * The authenticated uid, KEYED ON the credential it was minted under rather than merely
+     * remembered against this instance.
+     *
+     * The uid comes from the documented `common.authenticate(db, login, api_key, {})` handshake and
+     * is worth caching: the virtual repository builds ONE client per binding and keeps it for the
+     * process lifetime (`http-api-resource-repository.backend.service.ts:163`), so re-authenticating
+     * per call would double every read's round trips.
+     *
+     * What it must never do is outlive the credential. `resolveAccess` runs on EVERY call and reads
+     * the secret afresh (environment, provider registry, or a tenant credential row), so a rotation
+     * genuinely reaches this class — and a uid remembered against the instance would then be an
+     * identity minted under the retired credential, presented on every subsequent `execute_kw`.
+     *
+     * Keying the cache on the credential is what makes that unrepresentable, and it is deliberately
+     * preferred over an `invalidate()` some rotation path has to remember to call: there is no
+     * enumeration of rotation sites to get wrong, because a changed credential simply misses. Note
+     * the key includes `baseUrl` — a uid is a `res.users` row id on ONE database on ONE instance, so
+     * repointing the binding at another host must not reuse it either.
+     *
+     * The key is a SHA-256 of the tuple rather than the tuple itself, so the API key is not held
+     * alive on a long-lived field beyond the call that resolved it. The hash is per `execute_kw`
+     * call and costs microseconds against a network round trip.
+     *
+     * ONE slot, not a map. A map would save a handshake when a credential the client has already
+     * seen comes back, at the cost of accumulating one secret-derived entry per retired credential
+     * for the lifetime of the process — an unbounded set, to avoid a round trip nobody has measured.
+     * A binding names one credential at a time, so the slot is single and a rollback re-authenticates.
+     *
+     * The single slot stays SAFE now that an Odoo binding MAY name a tenant-owned target (#333, which
+     * widened `connectionTargetForBinding` from the `APPLICATION` pin it used to hold). Alternating
+     * tenants each miss the key and pay a handshake — slower, and never one tenant acting under
+     * another tenant's uid, which is what an instance-remembered uid would have become the moment the
+     * scope widened. The key is the credential, so the widening cost a round trip and no correctness.
+     *
+     * This replaces the slice-1 note that said a rotation needs a process restart, and with it the
+     * owed work to "measure against real session-expiry behavior". That measurement was owed for an
+     * invalidation TRIGGER, and this design needs no trigger. It also has nothing to expire against:
+     * `execute_kw` below re-presents `db` + `uid` + `apiKey` in the args of every single call, so
+     * there is no server-side session here whose lifetime we could be racing — the only thing that
+     * can retire the uid is the credential (or the instance) it names, which is exactly the key.
      */
-    private odooAuthenticatedUid?;
+    private odooAuthenticatedIdentity?;
     constructor(binding: HttpApiResourceBinding, providerAccessResolver: HttpApiProviderAccessResolver, fetchImpl?: HttpApiFetchLike);
-    resolveAccess(executionContext: ExecutionContext<any>): HttpApiProviderAccess;
+    /**
+     * `async`, so a target this execution cannot satisfy REJECTS rather than throwing synchronously.
+     *
+     * `connectionTargetForBinding` refuses before the port is reached, and a synchronous throw out of
+     * a `Promise`-returning method escapes every `.catch()` a caller attaches — the failure would land
+     * as an unhandled exception in whichever frame happened to call it without `await`. The keyword is
+     * the whole fix.
+     */
+    resolveAccess(executionContext: ExecutionContext<any>): Promise<HttpApiProviderAccess>;
     odataGet(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown>;
     odataGetOrNull(executionContext: ExecutionContext<any>, compiled: ODataCompiledRequest): Promise<unknown | null>;
     /**
@@ -69,6 +112,15 @@ export declare class HttpApiReadClient {
     restJsonReadOrNull(executionContext: ExecutionContext<any>, compiled: RestJsonCompiledRequest): Promise<unknown | null>;
     private buildRestJsonRequest;
     odooExecuteKw(executionContext: ExecutionContext<any>, call: OdooCompiledCall): Promise<unknown>;
+    /**
+     * The identity a cached uid belongs to: the instance it was minted on, and the exact credential
+     * it was minted with.
+     *
+     * `JSON.stringify` over the tuple rather than a joined string because JSON escapes each member,
+     * so no combination of separators inside a db name, a login or a key can make two different
+     * tuples produce one key.
+     */
+    private static odooCredentialKey;
     private executeOdooRpc;
     /** OData's canonical `DELETE /EntitySet(key)`; a 404 is the row already gone (idempotent). */
     odataDeleteByPath(executionContext: ExecutionContext<any>, path: string): Promise<void>;

package/dist/esm/base-classes/services/repositories/http-api/http-api-read-client.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-read-client.backend.d.ts","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/http-api/http-api-read-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACvB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAKxE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EACnC,MAAM,oCAAoC,CAAC;AAE5C,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,gBAGjC,CAAC;AAEF,qBAAa,iBAAiB;IAa1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAd5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAE/C;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB,CAAC,CAAS;gBAGnB,OAAO,EAAE,sBAAsB,EAC/B,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,GAAE,gBAAsC;IAK7D,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,qBAAqB;IAMvE,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAQnG,cAAc,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAS7H;;;;OAIG;IACU,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlG;;;;;;;;OAQG;IACU,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc/F,OAAO,CAAC,iBAAiB;IAaZ,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBnH;;;;OAIG;IACU,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBpI,OAAO,CAAC,oBAAoB;IA6Bf,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAqC/F,cAAc;IA6B5B,8FAA8F;IACjF,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASpG;;;;OAIG;IACU,uBAAuB,CAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,QAAQ,EAAE,8BAA8B,GACvC,OAAO,CAAC,IAAI,CAAC;IAuBhB,sEAAsE;IACzD,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOxE,0FAA0F;IAC7E,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;CAQtF"}
+{"version":3,"file":"http-api-read-client.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/http-api/http-api-read-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH,OAAO,KAAK,EACV,sBAAsB,EACvB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAClH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAKxE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EACnC,MAAM,oCAAoC,CAAC;AAE5C,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,gBAOjC,CAAC;AAoEF,qBAAa,iBAAiB;IAgD1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAjD5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,yBAAyB,CAAC,CAAyC;gBAGxD,OAAO,EAAE,sBAAsB,EAC/B,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,GAAE,gBAAsC;IAKpE;;;;;;;OAOG;IACU,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAUtF,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAQnG,cAAc,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAS7H;;;;OAIG;IACU,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWlG;;;;;;;;OAQG;IACU,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA2B/F,OAAO,CAAC,iBAAiB;IAcZ,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBnH;;;;OAIG;IACU,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAiBpI,OAAO,CAAC,oBAAoB;IAmCf,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAmD7G;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;YASlB,cAAc;IAiC5B,8FAA8F;IACjF,iBAAiB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpG;;;;OAIG;IACU,uBAAuB,CAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,QAAQ,EAAE,8BAA8B,GACvC,OAAO,CAAC,IAAI,CAAC;IA0BhB,sEAAsE;IACzD,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOxE,0FAA0F;IAC7E,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;CAQtF"}