@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/external-providers/services/external-providers-registry.backend.service.d.ts

@@ -4,8 +4,25 @@
  * Provides runtime access to the backend provider registry and
  * their protocol configurations, secrets, and operations.
  */
+import type { Container } from 'inversify';
 import { External_Providers_Registry, External_Providers_RegistryItem, EngineCapability } from '@wildo-ai/saas-models';
-import { ExternalProvider_ExchangeProtocol_Kind, ExternalProvider_ExchangeProtocol_Configuration_Base, LLMProvider_OperationKey, DocumentExtractionProvider_OperationKey, EmbeddingsProvider_OperationKey } from '@wildo-ai/external-connectors-models';
+/**
+ * How the required-capability floor is evaluated on the calling host.
+ *
+ * `includeEngineFloor` — whether ENABLED members of
+ * `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` count as required. True on a host
+ * expected to SERVE those slots (the application backend, the platform services); false on a
+ * scope-filtered host such as a minion, whose registry legitimately resolves none of them.
+ * The application's own `required` flags are honoured on every host regardless.
+ */
+export interface RequiredCapabilityFloorOptions {
+    includeEngineFloor: boolean;
+}
+import { ExternalProvider_ExchangeProtocol_Kind, ExternalProvider_ExchangeProtocol_Configuration_Base, LLMProvider_OperationKey, DocumentExtractionProvider_OperationKey, EmbeddingsProvider_OperationKey, ExternalProvider_SecretScope } from '@wildo-ai/external-connectors-models';
+import type { OrganizationProviderCredentialResolverPort } from '../../security/connected-accounts/organization-provider-credential-resolver.port';
+import type { UserProviderCredentialResolverPort } from '../../security/connected-accounts/user-provider-credential-resolver.port';
+import { ProviderCredentialResolutionSource } from '@wildo-ai/saas-models';
+import type { ExternalProvider_ConnectionShape, ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';
 import type { LoggerService } from '../../monitoring/logger/services/logger.service';
 import type { AppConfigurationService } from '../../config/services/app-configuration.backend.service';
 import { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service';
@@ -45,8 +62,33 @@ export type RuntimeAgentClientProtocolProfile = {
         channel: 'session-config-option';
         configId: string;
     };
+    /**
+     * Semantic model id → this agent's own spelling, where the two differ.
+     *
+     * Absent, or absent for a given model, means the semantic id is sent
+     * unchanged — correct for every agent whose vocabulary already is Wildo's.
+     */
+    modelTransportIds?: Record<string, string>;
     /** Agent-vocabulary session-mode ids to prefer per ceiling; an optimisation, never the guarantee. */
     sessionModeIdsByPermissionCeiling?: Partial<Record<string, string[]>>;
+    /**
+     * The auth modes the PROVIDER declares its agent can actually use.
+     *
+     * Carried so an application-authored profile can be validated against it.
+     * The contract's list previously reached only the synthesized `default`
+     * profile, so an authored profile could declare any mode and nothing checked
+     * whether the agent supports it.
+     */
+    supportedAuthModes?: string[];
+    /**
+     * Host environment variables the AGENT ITSELF needs, declared by its provider.
+     *
+     * Distinct from the execution profile's list, which is application policy.
+     * This one is provider knowledge — which variable an agent reads to find its
+     * own credentials is not something an application can be expected to know —
+     * and it is UNIONED with the profile's rather than replaced by it.
+     */
+    inheritedEnvironmentVariables?: string[];
 };
 import { type ExternalProviderSelectionResolutionEvidence } from '../../external-providers/models/provider-selection-resolution-evidence.backend.definitions';
 /**
@@ -60,9 +102,9 @@ import { type ExternalProviderSelectionResolutionEvidence } from '../../external
  * Optional fields beyond the base also appear on this projection:
  *
  *   - `defaultExecutionProfileRef` / `executionProfiles` — set by
- *     `getDefaultProviderConfiguration` for `kind: 'agent-client-protocol'`
+ *     `getDefaultProviderConfiguration` for `kind: ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL`
  *     contracts, consumed by `getAgentClientProtocolProfile` and the ACP runner.
- *   - `endpoints` — set for `kind: 'webhook-originator'`.
+ *   - `endpoints` — set for `kind: ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR`.
  *
  * They stay typed as `unknown` here because their canonical schemas
  * live in `external-connectors-models`'s `AgentClientProtocol_Configuration` /
@@ -83,20 +125,134 @@ export type ResolvedProviderConfiguration = ExternalProvider_ExchangeProtocol_Co
      */
     endpoints?: ReadonlyArray<Hook_Endpoint>;
 };
+/**
+ * One declared secret slot of a provider, as a SCREEN needs it.
+ *
+ * Carries the slug so a form can name the field without anybody typing it, the environment variable
+ * so an operator knows exactly what to set, and `configured` so a missing one can be reported rather
+ * than discovered by pressing a button. It carries no VALUE, and there is no field for one.
+ */
+export interface ProviderSecretSlot {
+    readonly slug: string;
+    readonly envVarName: string;
+    readonly required: boolean;
+    readonly description: string;
+    readonly scope: ExternalProvider_SecretScope;
+    /** Whether the deployment environment supplies it. Never the value itself. */
+    readonly configured: boolean;
+}
 export declare class ExternalProvidersRegistryBackendService {
     protected readonly logger: LoggerService;
     protected readonly configService: AppConfigurationService;
     protected readonly errorBuilder: ErrorBuilderBackendService;
     protected readonly backendProviderRegistry: BackendProviderRegistryBackendService;
+    /**
+     * The container, used ONLY to resolve the per-organization credential store on demand
+     * ({@link resolveOrganizationCredentialResolver}). OPTIONAL, and appended LAST so no
+     * existing parameter position moves.
+     *
+     * **Deliberately NOT a constructor injection of
+     * {@link OrganizationProviderCredentialResolverPort}.** `@optional()` tolerates an ABSENT
+     * BINDING; it does not defer construction. So injecting the port directly made this
+     * configuration-tier registry construct the entire resource stack that stands behind the
+     * store — and that stack closes a cycle straight back here:
+     *
+     * ```
+     * SaaS.AuditLogSink → CompositeAuditLogSink → ExternalProvidersRegistryService
+     *   → OrganizationProviderCredentialResolver (the store)
+     *   → SystemAccessService / AuditLogsService → SaaS.AuditLogSink
+     * ```
+     *
+     * which InversifyJS reports as `Circular dependency found: (No dependency trace)` +
+     * `RangeError: Maximum call stack size exceeded` at BOOT — every platform service and every
+     * application backend, since `AuditLogsBackendService` injects the sink. The same edge
+     * poisons `LlmObservabilityAgentCallTraceSink`, which depends on this registry too.
+     *
+     * Resolving on demand is also what the port's own contract already assumed: this service is
+     * constructed at configuration tier, BEFORE repositories exist, while a tenant credential is
+     * only ever needed once a request is being served. Lazy-container is the pattern
+     * `AuthorizationsBackendService` and `WebSocketService` use to break their own cycles.
+     *
+     * When the container is absent (a unit harness) or the store is unbound (a minion resolving
+     * an LLM key), no tenant has its own credential here and resolution falls through to the
+     * deployment environment — the behaviour every caller had before the store existed.
+     */
+    protected readonly container?: Container;
     protected logDebug: (message: string, context?: Record<string, unknown>) => void;
     protected registry: External_Providers_Registry | null;
     protected isInitialized: boolean;
-    constructor(logger: LoggerService, configService: AppConfigurationService, errorBuilder: ErrorBuilderBackendService, backendProviderRegistry: BackendProviderRegistryBackendService);
+    constructor(logger: LoggerService, configService: AppConfigurationService, errorBuilder: ErrorBuilderBackendService, backendProviderRegistry: BackendProviderRegistryBackendService, 
+    /**
+     * The container, used ONLY to resolve the per-organization credential store on demand
+     * ({@link resolveOrganizationCredentialResolver}). OPTIONAL, and appended LAST so no
+     * existing parameter position moves.
+     *
+     * **Deliberately NOT a constructor injection of
+     * {@link OrganizationProviderCredentialResolverPort}.** `@optional()` tolerates an ABSENT
+     * BINDING; it does not defer construction. So injecting the port directly made this
+     * configuration-tier registry construct the entire resource stack that stands behind the
+     * store — and that stack closes a cycle straight back here:
+     *
+     * ```
+     * SaaS.AuditLogSink → CompositeAuditLogSink → ExternalProvidersRegistryService
+     *   → OrganizationProviderCredentialResolver (the store)
+     *   → SystemAccessService / AuditLogsService → SaaS.AuditLogSink
+     * ```
+     *
+     * which InversifyJS reports as `Circular dependency found: (No dependency trace)` +
+     * `RangeError: Maximum call stack size exceeded` at BOOT — every platform service and every
+     * application backend, since `AuditLogsBackendService` injects the sink. The same edge
+     * poisons `LlmObservabilityAgentCallTraceSink`, which depends on this registry too.
+     *
+     * Resolving on demand is also what the port's own contract already assumed: this service is
+     * constructed at configuration tier, BEFORE repositories exist, while a tenant credential is
+     * only ever needed once a request is being served. Lazy-container is the pattern
+     * `AuthorizationsBackendService` and `WebSocketService` use to break their own cycles.
+     *
+     * When the container is absent (a unit harness) or the store is unbound (a minion resolving
+     * an LLM key), no tenant has its own credential here and resolution falls through to the
+     * deployment environment — the behaviour every caller had before the store existed.
+     */
+    container?: Container);
     /**
      * Initialize by projecting first-class backend provider modules into the
      * runtime registry facade used by existing callers.
      */
     initialize(): Promise<void>;
+    /**
+     * @wildo_source:part:start saas.backend.providers.optional-runtime-peers facet:layer:backend facet:audience:app-developer
+     *
+     * Report a registered provider whose optional runtime peer is not installed (#438).
+     *
+     * **What this means for an application:** a provider may lazy-load a vendor SDK that is not a
+     * dependency of the engine or of your application. Declaring the provider in a scope does not
+     * install it. YOU install it, in the runtime that enables the provider — which is your own
+     * `backend-api`, not the engine package — and if you do not, the capability that provider serves
+     * quietly does not work.
+     *
+     * The startup warning names the provider and the missing packages, so read it as an
+     * installation instruction rather than as noise.
+     *
+     * `requiredPackages` declares the npm packages a provider LAZY-LOADS — a vendor SDK that is
+     * never an engine or application dependency, installed only in a runtime that enables the
+     * provider. Two providers declare it (immudb -> `immudb-node`, posthog -> `posthog-node`), and
+     * until 2026-09-08 the field had NO READER anywhere: no start-up check, no installation step,
+     * no diagnostic. A provider could be registered with its SDK absent and the first sign was the
+     * feature quietly not working.
+     *
+     * A REPORT, never a refusal, and the asymmetry is deliberate: a declared provider may
+     * legitimately never be reached (a fan-out audit sink in an environment that emits nothing),
+     * so an absent optional peer is information rather than a misconfiguration. The capability
+     * DISAGREEMENT check in `define-saas-config` refuses, because a wrong declaration is wrong
+     * whatever happens next.
+     *
+     * Resolution is attempted from the RUNNING APPLICATION first and from this module second. The
+     * peer is installed in the application's own `backend-api`, not in the engine package, so
+     * resolving only from here would report a false absence — and a diagnostic that cries wolf is
+     * worse than the silence it replaces.
+     */
+    private reportMissingProviderRuntimePeers;
+    /** @wildo_source:part:end saas.backend.providers.optional-runtime-peers */
     private buildRuntimeRegistryFromProviderModules;
     getExternalProvidersRegistry(): External_Providers_Registry;
     getProviderTypes(): string[];
@@ -116,7 +272,10 @@ export declare class ExternalProvidersRegistryBackendService {
      * Resolve the provider ref(s) that should be ACTIVE for a capability,
      * honouring its declared `EngineCapabilityResolutionMode`:
      *   - `SELECT_ONE` (the default — billing, email, observability, …): the
-     *     single primary (fallbacks tried on failure), as a 0- or 1-element list.
+     *     single primary, as a 0- or 1-element list. A declared `whenUnavailable` entry
+     *     only orders the candidate list ahead of this call — it substitutes for a
+     *     primary that is not AVAILABLE, and nothing tries a second provider when a
+     *     call to the first one FAILS.
      *   - `FAN_OUT` (e.g. `COMPLIANCE_AUDIT_TRAIL`): EVERY declared + available
      *     provider — all active simultaneously (no primary, no failover).
      *
@@ -150,11 +309,18 @@ export declare class ExternalProvidersRegistryBackendService {
      * Audit (`COMPLIANCE_AUDIT_TRAIL`, when marked required) is the FIRST user, not
      * a special case: this generalizes the coherence to EVERY capability.
      */
-    getRequiredCapabilitiesWithoutProvider(): EngineCapability[];
+    getRequiredCapabilitiesWithoutProvider(options?: RequiredCapabilityFloorOptions): EngineCapability[];
+    /**
+     * The floor as a single fail-closed door (#328): every host that serves the application
+     * calls this after its registry is ready — the application backend, and the platform
+     * services after `refreshFromConfig()` — so "required with nothing serving it" cannot pass
+     * one host's boot because the check happened to live on another's branch.
+     */
+    assertRequiredCapabilityFloor(options?: RequiredCapabilityFloorOptions): void;
     /**
      * Per-environment external-provider selection override, read once from
      * `process.env.WILDO_PROVIDER_SELECTION_OVERRIDES` (a JSON map of
-     * `EngineCapability -> { primary, fallbacks? }`). Projected by the Wildo
+     * `EngineCapability -> { primary, whenUnavailable? }`). Projected by the Wildo
      * CLI's `env-vars-builder` from `wildo.infra.<env>.config.ts > providerSelection`.
      * Read as a string literal (not via a `platform-config-lib` import) to
      * preserve the engine → platform dependency direction — mirrors how
@@ -183,6 +349,49 @@ export declare class ExternalProvidersRegistryBackendService {
     getProviderConfiguration(providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind): ResolvedProviderConfiguration | undefined;
     private mergeProviderConfiguration;
     private deepMergeRecord;
+    /**
+     * WHAT a declared secret identifies — the integration, or an account.
+     *
+     * DECLARED wins; otherwise DERIVED, and the derivation is deliberately narrow. A ref the REST
+     * runtime contract names as the OAuth2 client id or client secret is a REGISTRATION. Everything
+     * else answers CREDENTIAL.
+     *
+     * The fallback exists because the field arrived after 689 provider packages had been emitted,
+     * from catalogues that live outside this repository — a mark that only worked once every package
+     * had been re-emitted would enforce nothing until then, which for a guard is the same as not
+     * existing.
+     *
+     * It is a FLOOR, not a complete answer, and the direction of its error matters. Deriving
+     * CREDENTIAL for a registration secret the contract does not name in those two slots is the
+     * permissive mistake: such a secret would still be storable as a tenant's own. That is exactly
+     * the case a provider must declare explicitly, and it is why `scope` is authorable at all rather
+     * than purely computed.
+     */
+    /**
+     * A provider's declared secret slots, each classified and each answered as configured or not.
+     *
+     * The contract already says everything a screen needs — the slug, the environment variable, the
+     * operator-facing description, whether it is required — and nothing was reading it. So a person
+     * connecting an account typed a `secretSlug` into a free-text field, and an operator learned that
+     * `ASANA_CLIENT_ID` was missing only when somebody pressed Connect and got a 502.
+     *
+     * NEVER the value, only whether one is present. The whole point is to make a missing secret
+     * REPORTABLE on a screen, and a report that carried the secret would be the one thing that must
+     * not leave the backend.
+     *
+     * Scope comes from {@link getProviderSecretScope}, so this and the connect leg's refusal cannot
+     * disagree about which slot is a registration and which is an account.
+     */
+    getProviderSecretSlots(providerRef: string): readonly ProviderSecretSlot[];
+    getProviderSecretScope(providerRef: string, secretRef: string): ExternalProvider_SecretScope;
+    /**
+     * The contract entry for a ref, found by ENV-VAR NAME or by SLUG.
+     *
+     * Both are real addresses for the same thing and callers use both: the map key is the authoring
+     * slug (`accessToken`), while runtime contracts reference the env-var name (`SLACK_API_KEY`).
+     * Matching only one would leave half the callers unable to find an entry that is plainly there.
+     */
+    private findSecretsContractEntry;
     getProviderRuntimeContract(providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind): ProviderProtocolRuntimeContract | undefined;
     getLLMSemanticOperationKeys(providerRef: string): LLMProvider_OperationKey[];
     /**
@@ -286,6 +495,203 @@ export declare class ExternalProvidersRegistryBackendService {
     private getProviderSecretEnvVarName;
     getConfiguredProviderSecretRef(providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind): string | undefined;
     getProviderApiKey(providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind): string | undefined;
+    /**
+     * WHICH connections this provider admits — the recorded decision, or the FLOOR.
+     *
+     * The floor is an APPLICATION-owned, undelegated connection and nothing else, and it is what a
+     * provider that has recorded no decision gets. It is not a permissive default: it is the one
+     * answer always available (an operator can author an environment variable) and the one that
+     * cannot produce a cross-tenant mistake (it has exactly one instance).
+     *
+     * Never derived here from a provider's auth shape. Whether a vendor can be connected per tenant
+     * is a fact about that vendor's product and about what somebody verified — see the catalogue
+     * record for a generated provider, or the module itself for a hand-authored one.
+     */
+    getProviderAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[];
+    /**
+     * What the VENDOR admits, before this application's policy narrows it.
+     *
+     * Exists so a refusal can name the right cause. Once a policy can subtract, "this provider does
+     * not admit that connection" has two meanings — nobody recorded the vendor's capability, or this
+     * application switched it off — and they are repaired in different files by different people.
+     * A diagnostic that always blamed the catalogue would send an operator to edit a decision record
+     * that is already correct.
+     */
+    getProviderCatalogueAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[];
+    /**
+     * Intersect what the VENDOR admits with what THIS application permits.
+     *
+     * Two layers answering different questions, and the intersection is what makes them composable:
+     * the catalogue record says an organization-owned Slack connection is possible because Slack is
+     * installed per workspace, while `providers.connections.slack` says whether this product offers
+     * one. A vendor opening a capability and a product deciding to use it are different events, and
+     * a single list would make them look identical.
+     *
+     * NARROWING ONLY, and that direction is the guarantee rather than a convention. An application
+     * cannot declare a connection the vendor does not support into existence — the connect leg would
+     * build an authorize URL the vendor rejects, or store a grant nothing can spend — so a policy
+     * entry naming an unadmitted shape contributes nothing instead of granting it.
+     *
+     * An ABSENT policy means "everything the catalogue admits", never "nothing". Most applications
+     * will never author one, and reading their silence as a refusal would switch off the whole
+     * connect surface for every product that has not yet thought about it.
+     *
+     * An intersection that empties is a legitimate outcome, not a misconfiguration: it is how an
+     * application switches a provider's connect surface off without removing the provider, which it
+     * may still need for its own application-scope credential.
+     */
+    private narrowToApplicationConnectionPolicy;
+    /**
+     * One provider secret for ONE connection target — strictly, with no substitution.
+     *
+     * ## Why this exists beside `resolveProviderSecretForOrganization` rather than extending it
+     *
+     * That method FALLS BACK: an organization with no credential of its own silently spends the
+     * deployment's. This one does not, and the difference is not a tightening of the same idea —
+     * it is the opposite policy. A fallback means the vendor sees the application's identity while
+     * the application believes it acted as the tenant, so every artifact the call leaves behind —
+     * a message, a record, a line in the vendor's own audit log — is attributed to the wrong party,
+     * and nothing downstream can detect it.
+     *
+     * An application that wants "the tenant's key when they have connected one, otherwise ours"
+     * still has it: it names an APPLICATION target for that usage, in its own code, where the
+     * choice is visible. What is removed is the engine performing the swap underneath a call that
+     * asked for a tenant.
+     *
+     * `resolveProviderSecretForOrganization` is superseded and is removed once its remaining
+     * consumers move; it is left standing only because its test currently carries another session's
+     * uncommitted work.
+     */
+    resolveProviderSecretForTarget(target: ExternalProvider_ConnectionTarget, providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind, secretRef: string): Promise<{
+        value: string;
+        source: ProviderCredentialResolutionSource;
+        credentialId?: string;
+    }>;
+    /**
+     * Record that the credential {@link resolveProviderSecretForTarget} just handed out was SPENT,
+     * and what the provider thought of it.
+     *
+     * ## Why the recording lives HERE, beside the resolution
+     *
+     * Because the two must never disagree about which store they are talking about. This method
+     * dispatches on `target.ownerScope` in exactly the same order and by exactly the same rule as
+     * the resolution above, so *the store that was read is the store that is stamped* is a property
+     * of one function rather than an agreement between two.
+     *
+     * The alternative — the caller routing for itself — was tried and is the defect this replaces.
+     * The provider-operation executor held a thunk to A store, typed with an `organizationId` field,
+     * and `target.ownerId` is a USER id whenever `ownerScope` is `USER` (#333's two-axis connection
+     * shape). Wired as it stood, a person-owned call would have stamped a tenant row that does not
+     * exist and emitted an organization audit event naming a user id as the organization. The
+     * caller cannot route this correctly, because the ORDER is this class's knowledge — the same
+     * argument `OrganizationProviderCredentialResolverPort`'s own docstring makes for why the order
+     * does not live on the port.
+     *
+     * ## Fire-and-forget is the CALLER's decision, not this method's
+     *
+     * This returns a promise and lets a store failure reject. The outbound call has already happened
+     * by the time anybody calls this, so the caller must not fail its own request on a bookkeeping
+     * write — but swallowing here would also hide the rejection from the caller's loss counter, and
+     * an observation nobody counts is the shape this whole change exists to remove. The executor
+     * routes it through `emitAuditObservation`, which counts a rejection and never rethrows.
+     *
+     * @param provenance Exactly what {@link resolveProviderSecretForTarget} returned for this call,
+     *   carried through the access resolver. Passing anything else describes a row that was not the
+     *   one spent.
+     */
+    recordProviderSecretUseForTarget(target: ExternalProvider_ConnectionTarget, providerRef: string, provenance: {
+        source: ProviderCredentialResolutionSource;
+        credentialId?: string;
+        secretSlug: string;
+    }, outcome?: {
+        accepted: boolean;
+        providerMessage?: string;
+    }): Promise<void>;
+    /** One shape for every connection refusal, so an operator reads the same sentence everywhere. */
+    private buildConnectionRefusal;
+    /**
+     * Lazy getter for the per-organization credential store — see the `container` constructor
+     * param's JSDoc for why this cannot be a constructor injection.
+     *
+     * `isBound` is what preserves the old `@optional()` semantics: a host that binds no store
+     * (a minion, a unit harness) resolves nothing here and falls through to the deployment
+     * environment, exactly as it did before the store existed.
+     */
+    protected resolveOrganizationCredentialResolver(): OrganizationProviderCredentialResolverPort | undefined;
+    /**
+     * Lazy getter for the per-user credential store — same mechanics as the organization one above,
+     * and the OPPOSITE meaning when it resolves nothing.
+     *
+     * An unbound organization store falls through to the deployment environment, because a tenant
+     * legitimately may not have its own credential. An unbound USER store REFUSES, because there is
+     * nothing a person's credential could fall through to: spending the deployment's shared
+     * principal on someone's behalf would attribute the act to the wrong party at the vendor. So a
+     * host that forgot to bind this gets a refusal naming the wiring fault, never a silent
+     * substitution.
+     */
+    protected resolveUserCredentialResolver(): UserProviderCredentialResolverPort | undefined;
+    /**
+     * @wildo_source:part:start saas.backend.providers.per-tenant-credential-resolution facet:layer:backend facet:audience:app-developer
+     *
+     * Resolve one provider secret FOR A TENANT, or refuse naming what is missing.
+     *
+     * Reached as `ExternalProvidersRegistryBackendService` from `@wildo-ai/saas-backend-lib`, through
+     * the container token `SAAS_SERVICE_TYPES.ExternalProvidersRegistryService`.
+     *
+     * ## Why an application reaches for this instead of a provider secret
+     *
+     * A provider's `SecretsContract` names an ENVIRONMENT VARIABLE, so a secret resolved that way is
+     * per-process and per-deployment. One application serving many organizations therefore has ONE
+     * Slack token for all of them — and the failure is silent in the worst direction: the operator
+     * sets one key and every tenant thereafter acts as the SAME third-party principal, with nothing
+     * anywhere saying so. `organizationProviderCredentials` is the resource that lets a tenant's own
+     * administrator supply its own token, and this method is how a call on that tenant's behalf finds
+     * it.
+     *
+     * Note what this does NOT change: provider SELECTION — which module fills an engine capability —
+     * is still per capability and per scope, application-wide. You cannot route one tenant's email
+     * through one vendor and another's through a second. What is per tenant is the CREDENTIAL used
+     * when calling the one selected provider.
+     *
+     * ## The order, and the two refusals that differ
+     *
+     * 1. the organization's own credential, if it has one for this `(providerRef, secretSlug)` pair;
+     * 2. otherwise the deployment environment variable — the shared credential every tenant uses;
+     * 3. otherwise it THROWS, naming both places it looked, so an operator is told either to have the
+     *    tenant's administrator set a credential or to set the environment variable for everyone.
+     *
+     * That third step is the difference from the ordinary secret lookup, which is deliberately
+     * forgiving and returns nothing when a key is absent. Here an absent credential is a refusal, so
+     * a per-tenant call cannot proceed without knowing whose identity is on the wire.
+     *
+     * **A tenant credential that cannot be OPENED is not a fall-through either.** The envelope failure
+     * is deliberately not caught, because falling back to the deployment's shared credential is
+     * exactly the silent cross-principal action this resource exists to remove — and it would present
+     * to the operator as "the integration works" while the wrong identity is acting.
+     *
+     * @param organizationId the tenant on whose behalf the call will be made. Must come from a
+     *   trusted execution scope — this method cannot verify it, and the envelope binding is what
+     *   keeps a mistake here from becoming a cross-tenant disclosure.
+     */
+    resolveProviderSecretForOrganization(organizationId: string, providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind, secretRef: string): Promise<{
+        value: string;
+        source: ProviderCredentialResolutionSource;
+        credentialId?: string;
+    }>;
+    /** @wildo_source:part:end saas.backend.providers.per-tenant-credential-resolution */
+    /**
+     * The tenant-aware sibling of `getProviderApiKey` — the provider's configured `authConfig`
+     * secret, resolved for one organization.
+     *
+     * Refuses rather than returning `undefined` when the provider declares NO `authConfig.secretRef`
+     * at all, because that is a different fault from an unset value and an operator fixing it edits
+     * a different file: the provider module, not the environment.
+     */
+    resolveProviderApiKeyForOrganization(organizationId: string, providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind): Promise<{
+        value: string;
+        source: ProviderCredentialResolutionSource;
+        credentialId?: string;
+    }>;
     isProviderEnabled(providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind): boolean;
     getProviderProtocolSecrets(providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind): Record<string, string> | undefined;
     /**

package/dist/esm/external-providers/services/external-providers-registry.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/external-providers/services/external-providers-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACH,2BAA2B,EAC3B,+BAA+B,EAC/B,gBAAgB,EAInB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACH,sCAAsC,EACtC,oDAAoD,EACpD,wBAAwB,EACxB,uCAAuC,EACvC,+BAA+B,EAElC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACzG,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAOH,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,oCAAoC,EAC5C,MAAM,sCAAsC,CAAC;AAW9C;;;;;;;;;GASG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC5C,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sBAAsB,EAAE,wBAAwB,EAAE,CAAC;IACnD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD,wGAAwG;IACxG,mDAAmD,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvG;;;;OAIG;IACH,aAAa,CAAC,EACR;QAAE,OAAO,EAAE,sBAAsB,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAA;KAAE,GACpE;QAAE,OAAO,EAAE,uBAAuB,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,qGAAqG;IACrG,iCAAiC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;CACzE,CAAC;AAEF,OAAO,EAGH,KAAK,2CAA2C,EACnD,MAAM,yGAAyG,CAAC;AAEjH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,6BAA6B,GACrC,oDAAoD,GACpD;IACA,eAAe,CAAC,EAAE,+BAA+B,CAAC;IAClD,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAC1C,CAAC;AA0DJ,qBACa,uCAAuC;IAOT,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IAC9B,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,uBAAuB;IACtD,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,0BAA0B;IAChD,SAAS,CAAC,QAAQ,CAAC,uBAAuB,EAAE,qCAAqC;IAThJ,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjF,SAAS,CAAC,QAAQ,EAAE,2BAA2B,GAAG,IAAI,CAAQ;IAE9D,SAAS,CAAC,aAAa,UAAS;gBAG0B,MAAM,EAAE,aAAa,EACX,aAAa,EAAE,uBAAuB,EACnC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC;IAYhJ;;;OAGG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBxC,OAAO,CAAC,uCAAuC;IAuBxC,4BAA4B,IAAI,2BAA2B;IAK3D,gBAAgB,IAAI,MAAM,EAAE;IAK5B,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,+BAA+B,GAAG,SAAS;IAK7E,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAKhD;;;;;;OAMG;IACI,OAAO,IAAI,OAAO;IAIlB,+BAA+B,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,EAAE;IAiEvE,qCAAqC,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS;IAI9F;;;;;;;;;;;OAWG;IACI,oCAAoC,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,EAAE;IAQ5E,2BAA2B,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO;IAIzE;;;;;;;;;;;OAWG;IACI,yBAAyB,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO;IAQvE;;;;;;;;;;OAUG;IACI,sCAAsC,IAAI,gBAAgB,EAAE;IAkBnE;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,+BAA+B,CAAC,CAA+E;IACvH,OAAO,CAAC,yCAAyC,CAAS;IAC1D,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAA+B;IAEnF,OAAO,CAAC,4BAA4B;IA2CpC;;;;OAIG;IACI,sCAAsC,CAAC,UAAU,EAAE,gBAAgB,GAAG,2CAA2C;IAwBxH,OAAO,CAAC,6BAA6B;IAoBrC;;;OAGG;IACI,wBAAwB,CAC3B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,6BAA6B,GAAG,SAAS;IA0C5C,OAAO,CAAC,0BAA0B;IAgFlC,OAAO,CAAC,eAAe;IAkChB,0BAA0B,CAC7B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,+BAA+B,GAAG,SAAS;IAIvC,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,wBAAwB,EAAE;IAanF;;;;;OAKG;IACI,kCAAkC,CAAC,WAAW,EAAE,MAAM,GAAG,+BAA+B,EAAE;IAgBjG;;;;;;OAMG;IACI,0CAA0C,CAAC,WAAW,EAAE,MAAM,GAAG,uCAAuC,EAAE;IAgB1G,mCAAmC,CAAC,WAAW,EAAE,MAAM,GAAG,iCAAiC,GAAG,SAAS;IAQvG,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,iCAAiC,GAAG,SAAS;IAuCxG;;;;;;;;;OASG;IACI,sCAAsC,CACzC,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,MAAM,GAC5B,oCAAoC,GAAG,SAAS;IA8B5C,4CAA4C,CAC/C,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,MAAM,GAC5B,MAAM,GAAG,SAAS;IAuBrB,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,+BAA+B;IA2FvC,OAAO,CAAC,2BAA2B;IAsCnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,0BAA0B;IAyClC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;;;;;;;;;;;;OAgBG;IACI,iBAAiB,CACpB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,EACpD,SAAS,EAAE,MAAM,GAClB,MAAM,GAAG,SAAS;IAarB,OAAO,CAAC,2BAA2B;IAyB5B,8BAA8B,CACjC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,MAAM,GAAG,SAAS;IAOd,iBAAiB,CACpB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,MAAM,GAAG,SAAS;IAwBd,iBAAiB,CACpB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,OAAO;IA4BH,0BAA0B,CAC7B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS;IAoCrC;;;;;OAKG;IACU,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmC/C,SAAS,CAAC,iBAAiB,IAAI,IAAI;CAWtC"}
+{"version":3,"file":"external-providers-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/services/external-providers-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACH,2BAA2B,EAC3B,+BAA+B,EAC/B,gBAAgB,EAKnB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,WAAW,8BAA8B;IAC3C,kBAAkB,EAAE,OAAO,CAAC;CAC/B;AACD,OAAO,EACL,sCAAsC,EACtC,oDAAoD,EACpD,wBAAwB,EACxB,uCAAuC,EACvC,+BAA+B,EAG/B,4BAA4B,EAC7B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,+FAA+F,CAAC;AAChK,OAAO,KAAK,EACR,kCAAkC,EACrC,MAAM,uFAAuF,CAAC;AAC/F,OAAO,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAK3E,OAAO,KAAK,EACV,gCAAgC,EAChC,iCAAiC,EAClC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACzG,OAAO,KAAK,EAAE,+BAA+B,EAE5C,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAOH,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,oCAAoC,EAC5C,MAAM,sCAAsC,CAAC;AAW9C;;;;;;;;;GASG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC5C,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sBAAsB,EAAE,wBAAwB,EAAE,CAAC;IACnD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD,wGAAwG;IACxG,mDAAmD,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvG;;;;OAIG;IACH,aAAa,CAAC,EACR;QAAE,OAAO,EAAE,sBAAsB,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAA;KAAE,GACpE;QAAE,OAAO,EAAE,uBAAuB,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,qGAAqG;IACrG,iCAAiC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACtE;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5C,CAAC;AAEF,OAAO,EAGH,KAAK,2CAA2C,EACnD,MAAM,yGAAyG,CAAC;AAEjH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,6BAA6B,GACrC,oDAAoD,GACpD;IACA,eAAe,CAAC,EAAE,+BAA+B,CAAC;IAClD,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAC1C,CAAC;AAqFJ;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;IAC7C,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAChC;AAED,qBACa,uCAAuC;IAOT,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IAC9B,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,uBAAuB;IACtD,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,0BAA0B;IAChD,SAAS,CAAC,QAAQ,CAAC,uBAAuB,EAAE,qCAAqC;IAC5I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAC8B,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS;IAzC7E,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjF,SAAS,CAAC,QAAQ,EAAE,2BAA2B,GAAG,IAAI,CAAQ;IAE9D,SAAS,CAAC,aAAa,UAAS;gBAG0B,MAAM,EAAE,aAAa,EACX,aAAa,EAAE,uBAAuB,EACnC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC;IAC5I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACiD,SAAS,CAAC,EAAE,SAAS;IAY7E;;;OAGG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsBxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,iCAAiC;IA6BzC,2EAA2E;IAE3E,OAAO,CAAC,uCAAuC;IAuBxC,4BAA4B,IAAI,2BAA2B;IAK3D,gBAAgB,IAAI,MAAM,EAAE;IAK5B,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,+BAA+B,GAAG,SAAS;IAK7E,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAKhD;;;;;;OAMG;IACI,OAAO,IAAI,OAAO;IAIlB,+BAA+B,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,EAAE;IAiEvE,qCAAqC,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS;IAI9F;;;;;;;;;;;;;;OAcG;IACI,oCAAoC,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,EAAE;IAQ5E,2BAA2B,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO;IAIzE;;;;;;;;;;;OAWG;IACI,yBAAyB,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO;IAQvE;;;;;;;;;;OAUG;IACI,sCAAsC,CACzC,OAAO,GAAE,8BAA6D,GACvE,gBAAgB,EAAE;IAmCrB;;;;;OAKG;IACI,6BAA6B,CAAC,OAAO,CAAC,EAAE,8BAA8B,GAAG,IAAI;IAgBpF;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,+BAA+B,CAAC,CAAqF;IAC7H,OAAO,CAAC,yCAAyC,CAAS;IAC1D,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAA+B;IAEnF,OAAO,CAAC,4BAA4B;IA2CpC;;;;OAIG;IACI,sCAAsC,CAAC,UAAU,EAAE,gBAAgB,GAAG,2CAA2C;IAwBxH,OAAO,CAAC,6BAA6B;IAoBrC;;;OAGG;IACI,wBAAwB,CAC3B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,6BAA6B,GAAG,SAAS;IA0C5C,OAAO,CAAC,0BAA0B;IAgFlC,OAAO,CAAC,eAAe;IAkCvB;;;;;;;;;;;;;;;;;OAiBG;IACH;;;;;;;;;;;;;;OAcG;IACI,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,kBAAkB,EAAE;IAgB1E,sBAAsB,CACzB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAClB,4BAA4B;IAqB/B;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAYzB,0BAA0B,CAC7B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,+BAA+B,GAAG,SAAS;IAIvC,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,wBAAwB,EAAE;IAanF;;;;;OAKG;IACI,kCAAkC,CAAC,WAAW,EAAE,MAAM,GAAG,+BAA+B,EAAE;IAgBjG;;;;;;OAMG;IACI,0CAA0C,CAAC,WAAW,EAAE,MAAM,GAAG,uCAAuC,EAAE;IAgB1G,mCAAmC,CAAC,WAAW,EAAE,MAAM,GAAG,iCAAiC,GAAG,SAAS;IAQvG,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,iCAAiC,GAAG,SAAS;IAiDxG;;;;;;;;;OASG;IACI,sCAAsC,CACzC,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,MAAM,GAC5B,oCAAoC,GAAG,SAAS;IA8B5C,4CAA4C,CAC/C,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,MAAM,GAC5B,MAAM,GAAG,SAAS;IAuBrB,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,+BAA+B;IA2FvC,OAAO,CAAC,2BAA2B;IAsCnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,0BAA0B;IAyClC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,qBAAqB;IAa7B;;;;;;;;;;;;;;;;OAgBG;IACI,iBAAiB,CACpB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,EACpD,SAAS,EAAE,MAAM,GAClB,MAAM,GAAG,SAAS;IAarB,OAAO,CAAC,2BAA2B;IAyB5B,8BAA8B,CACjC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,MAAM,GAAG,SAAS;IAOd,iBAAiB,CACpB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,MAAM,GAAG,SAAS;IAwBrB;;;;;;;;;;;OAWG;IACI,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,gCAAgC,EAAE;IASzG;;;;;;;;OAQG;IACI,yCAAyC,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,gCAAgC,EAAE;IAOlH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,mCAAmC;IAa3C;;;;;;;;;;;;;;;;;;;;OAoBG;IACU,8BAA8B,CACvC,MAAM,EAAE,iCAAiC,EACzC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,EACpD,SAAS,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kCAAkC,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAsFhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACU,gCAAgC,CACzC,MAAM,EAAE,iCAAiC,EACzC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE;QAAE,MAAM,EAAE,kCAAkC,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EACrG,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1D,OAAO,CAAC,IAAI,CAAC;IA0ChB,iGAAiG;IACjG,OAAO,CAAC,sBAAsB;IAmC9B;;;;;;;OAOG;IACH,SAAS,CAAC,qCAAqC,IAAI,0CAA0C,GAAG,SAAS;IAOzG;;;;;;;;;;OAUG;IACH,SAAS,CAAC,6BAA6B,IAAI,kCAAkC,GAAG,SAAS;IAOzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACU,oCAAoC,CAC7C,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,EACpD,SAAS,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kCAAkC,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAuDhG,qFAAqF;IAErF;;;;;;;OAOG;IACU,oCAAoC,CAC7C,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kCAAkC,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BzF,iBAAiB,CACpB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,OAAO;IA4BH,0BAA0B,CAC7B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sCAAsC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS;IAoCrC;;;;;OAKG;IACU,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmC/C,SAAS,CAAC,iBAAiB,IAAI,IAAI;CAWtC"}