npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.3 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1056) hide show

package/dist/esm/external-providers/operations/provider-operation-executor.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-operation-executor.backend.service.js","sourceRoot":"","sources":["../../../../../src/external-providers/operations/provider-operation-executor.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,sCAAsC,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAC3H,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gGAAgG,CAAC;AAG1I,OAAO,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAC3J,OAAO,EAAE,oCAAoC,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAEnH,2FAA2F;AAC3F,MAAM,CAAN,IAAY,kCASX;AATD,WAAY,kCAAkC;IAC5C,4FAA4F;IAC5F,6EAAuC,CAAA;IACvC,kFAAkF;IAClF,yGAAmE,CAAA;IACnE,8DAA8D;IAC9D,+FAAyD,CAAA;IACzD,uCAAuC;IACvC,qFAA+C,CAAA;AACjD,CAAC,EATW,kCAAkC,KAAlC,kCAAkC,QAS7C;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAGnC;IAFlB,YACE,OAAe,EACC,MAKf;QAED,KAAK,CAAC,OAAO,CAAC,CAAC;QAPC,WAAM,GAAN,MAAM,CAKrB;QAGD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAuGD,MAAM,OAAO,uCAAuC;IAS/B;IACA;IACA;IACA;IACA;IAKA;IAjBnB,8EAA8E;IAC7D,cAAc,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC7F,+DAA+D;IAC9C,WAAW,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzE,yGAAyG;IACxF,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAExD,YACmB,yBAAkE,EAClE,sBAAqD,EACrD,SAA4B,EAC5B,aAA8C,EAC9C,OAAkC,GAAG,EAAE,CAAC,SAAS;IAClE,iGAAiG;IACjG,4FAA4F;IAC5F,+FAA+F;IAC/F,gGAAgG;IAC/E,qBAAqD;QATrD,8BAAyB,GAAzB,yBAAyB,CAAyC;QAClE,2BAAsB,GAAtB,sBAAsB,CAA+B;QACrD,cAAS,GAAT,SAAS,CAAmB;QAC5B,kBAAa,GAAb,aAAa,CAAiC;QAC9C,SAAI,GAAJ,IAAI,CAA6C;QAKjD,0BAAqB,GAArB,qBAAqB,CAAgC;IACrE,CAAC;IAEJ;;;OAGG;IACK,cAAc,CAAC,WAAmB;QACxC,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAC/E,WAAW,EACX,sCAAsC,CAAC,QAAQ,CAChD,CAAC;QACF,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,IAAI,EAAE,CAAC;YAClF,MAAM,IAAI,4BAA4B,CACpC,aAAa,WAAW,sCAAsC;kBAC5D,WAAW,eAAe,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,wCAAwC,EACxH,EAAE,IAAI,EAAE,kCAAkC,CAAC,iBAAiB,EAAE,WAAW,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,MAAe;QAC7D,MAAM,QAAQ,GAAG,GAAG,WAAW,KAAK,MAAM,IAAI,GAAG,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACzB,MAAM,IAAI,4BAA4B,CACpC,aAAa,WAAW,0DAA0D;kBAChF,kGAAkG,EACpG,EAAE,IAAI,EAAE,kCAAkC,CAAC,+BAA+B,EAAE,WAAW,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,4BAA4B,CACtE,aAAa,WAAW,2CAA2C,MAAM,CAAC,CAAC,CAAC,gBAAgB,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;cAC5G,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC7D,EAAE,IAAI,EAAE,kCAAkC,CAAC,qBAAqB,EAAE,WAAW,EAAE,KAAK,EAAE,CACvF,CAAC;QAEF,IAAI,OAAgD,CAAC;QACrD,IAAI,CAAC;YACH,qFAAqF;YACrF,uFAAuF;YACvF,uFAAuF;YACvF,qFAAqF;YACrF,2FAA2F;YAC3F,mFAAmF;YACnF,oEAAoE;YACpE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC/C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4BAA4B;IACrB,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,WAAmB,EAAE,MAAe;QACrF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,IAAI,4BAA4B,CACpC,aAAa,WAAW,4BAA4B,WAAW,GAAG;kBAChE,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;kBACnH,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,EACjD,EAAE,IAAI,EAAE,kCAAkC,CAAC,0BAA0B,EAAE,WAAW,EAAE,WAAW,EAAE,CAClG,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,SAAS,CAAC,WAAmB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,SAAS,GAA8B,QAAQ,CAAC,mBAAmB,IAAI,oCAAoC,CAAC;QAClH,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/G,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iDAAiD;IACjD;;;;;;;;;;;;;;;;;;;;OAoBG;IACI,YAAY,CACjB,gBAAuC,EACvC,QAAgG;QAEhG,2FAA2F;QAC3F,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,8FAA8F;QAC9F,6DAA6D;QAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC/B,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,IAAI,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAC7G,gBAAgB,CACjB,CAAC;YACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,IAAgC,EAChC,gBAAuC;QAEvC,MAAM,MAAM,GAAsC,IAAI,CAAC,UAAU,IAAI;YACnE,UAAU,EAAE,sCAAsC,CAAC,WAAW;YAC9D,UAAU,EAAE,0CAA0C,CAAC,OAAO;SAC/D,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/F,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7E,4FAA4F;YAC5F,sFAAsF;YACtF,IAAI,CAAC,IAAI,CACP,uBAAuB,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,WAAW,iBAAiB;kBAC/E,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE;kBAC7G,GAAG,SAAS,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW,SAAS,CAAC,UAAU,CAAC,qBAAqB,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CACpH,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,IAAI,KAAK,GAAsC,QAAQ,CAAC;QACxD,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,6BAA6B,CACrC,uBAAuB,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,WAAW,KAAK;sBACnE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EACvG,EAAE,IAAI,EAAE,mCAAmC,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAChI,CAAC;YACJ,CAAC;YACD,KAAK,GAAG,MAAM,CAAC,IAA+B,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,+BAA+B,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7G,IAAI,CAAC;YACH,8FAA8F;YAC9F,6FAA6F;YAC7F,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAChG,8FAA8F;YAC9F,gGAAgG;YAChG,6FAA6F;YAC7F,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;YAEpG,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrH,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAkB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACpG,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,0FAA0F;gBAC1F,iFAAiF;gBACjF,MAAM,IAAI,6BAA6B,CACrC,aAAa,IAAI,CAAC,WAAW,eAAe,SAAS,CAAC,WAAW,mDAAmD;sBAClH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EACvG,EAAE,IAAI,EAAE,mCAAmC,CAAC,sBAAsB,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CACxI,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACxG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAI,KAAyD,CAAC,MAAM,CAAC;YACjF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE;gBACjE,MAAM,EAAE,MAAM,EAAE,MAAM;gBACtB,WAAW,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;aAC/E,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH;;;;;;;;;;;OAWG;IACK,uBAAuB,CAC7B,WAAmB,EACnB,MAAyC,EACzC,MAAgG,EAChG,OAAwD;QAExD,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAC/C,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO;QACxD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,KAAK,EAAE,mBAAmB,KAAK,UAAU;gBAAE,OAAO;YAC7D,KAAK,KAAK,CAAC,mBAAmB,CAAC;gBAC7B,cAAc,EAAE,MAAM,CAAC,OAAO;gBAC9B,WAAW;gBACX,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,OAAO;aACR,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;IAEO,MAAM,CACZ,WAAmB,EACnB,SAAgC,EAChC,MAAyC,EACzC,gBAAuC,EACvC,OAAkD;QAElD,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YAChD,IAAI,OAAO,gBAAgB,EAAE,wBAAwB,KAAK,UAAU;gBAAE,OAAO;YAC7E,MAAM,YAAY,GAAI,gBAAoF,CAAC,YAAY,CAAC;YACxH,KAAK,gBAAgB,CAAC,wBAAwB,CAAC;gBAC7C,WAAW;gBACX,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,oBAAoB,EAAE,MAAM,CAAC,UAAU;gBACvC,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9E,oBAAoB,EAAE,MAAM,CAAC,UAAU;gBACvC,eAAe,EAAE,YAAY,EAAE,MAAM;gBACrC,cAAc,EAAE,YAAY,EAAE,cAAc;gBAC5C,aAAa,EAAG,gBAA+C,CAAC,aAAa;gBAC7E,GAAG,OAAO;aACX,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;CACF","sourcesContent":["/*\n `ProviderOperationExecutorBackendService` — the ONE door through which an application executes a\n * provider-declared operation (S3a, #331; plan D4).\n \n A custom backend service names a provider and an operation; everything between that and the wire\n * lives here: resolving the provider's runtime contract, loading its catalogue on demand and\n * memoizing it, validating the caller's input against the operation's own schema, compiling the\n * request, resolving identity through the shared access port, executing under the provider's rate\n * budget and semantics, and parsing the answer.\n \n ## What it deliberately does NOT do\n \n - It does not resolve secrets. `HttpApiProviderAccessResolver` does, over the provider\n * registry — the same port the ETL lane uses. When #329 makes that registry the COMPOSED one, a\n * package-shipped provider's key arrives here with no edit. A second secret path would be a\n * second thing to get wrong.\n * - It does not decide IDENTITY. Whose account a call spends, and on whose behalf, is the\n * connection target the resolver is handed; a delegated target is served or refused THERE. This\n * read \"it does not implement `USER_DELEGATED` … the resolver refuses it by name today\" until\n * #333, which retired that mode for the two-axis `ExternalProvider_ConnectionShape` and lifted\n * the refusal — neither change reached this class, which is the point of asking the port.\n * - It does not page. `pagination` on an operation is a hint the caller reads.\n * - It does not AUDIT — yet, and this is the one gap worth stating loudly. The seam is built\n * and called on every outbound call (`ProviderOperationAuditResolver`, the lazily-resolved thunk\n * this repository uses for the same job in the HTTP-API repository), but the\n * `CoreAuditableEventType` member and the audit-logs method behind it belong to S3b, which the\n * plan's seam table requires to agree the event NAMES with S5a before either commits. So the\n * emission point exists and answers nothing until S3b writes the sink. That is a real hole, not\n * a design: an application calling a vendor on a user's behalf must leave a trail, and until\n * S3b lands it leaves none.\n \n ## Bound by FACTORY, not by decoration\n \n This class carried \"Not `@injectable`, on purpose\" and deferred registration to the slice that\n * needed it injected. That slice arrived: an application scopes a provider from the scraped\n * catalogue and a service of its own calls an operation, which it cannot do while the only door is a\n * class nothing binds.\n \n It is still a plain class. `SAAS_SERVICE_TYPES.ProviderOperationExecutorService` is bound with\n * `toDynamicValue`, so the lane's classes stay constructible with `new` — the repositories registry\n * builds its own resolver that way — and no injection token has to be invented for\n * `ConnectionTargetAuthorizationPort`, which nothing binds and whose absence is deliberately\n * fail-closed.\n \n Singleton, because this memoizes a catalogue per `(providerRef, domain)` and holds one rate-limit\n * window per provider. A transient would reload the catalogue per call and give every caller its own\n * window, which is not a rate limit.\n /\n\nimport { ExternalProvider_ExchangeProtocol_Kind, ProviderProtocolRuntimeKind } from '@wildo-ai/external-connectors-models';\nimport {\n ExternalProvider_Connection_DelegationMode,\n ExternalProvider_Connection_OwnerScope,\n} from '@wildo-ai/external-connectors-models';\nimport type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';\nimport type { ProviderOperationExecute, ProviderRestCallSemantics, ProviderRestOperation, ProviderRestOperationCatalogue } from '@wildo-ai/external-connectors-models';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { HttpApiFetchLike } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-transport.backend';\nimport type { HttpApiProviderAccessResolver } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-provider-access.backend';\nimport { resolveHttpApiResultPath } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-row-projection.backend';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\n\nimport { compileProviderOperationRequest, ProviderOperationRequestError, ProviderOperationRequestFailureKind } from './provider-operation-request.backend';\nimport { DEFAULT_PROVIDER_REST_CALL_SEMANTICS, ProviderRestCallClient } from './provider-rest-call-client.backend';\n\n/* Why an operation could not be reached at all — each member names a different remedy. /\nexport enum ProviderOperationLookupFailureKind {\n /* The provider declares no `rest` runtime contract; it may not even be a REST provider. /\n PROVIDER_NOT_REST = 'PROVIDER_NOT_REST',\n /* The provider is REST but declares no operation catalogue — nothing to call. /\n PROVIDER_DECLARES_NO_OPERATIONS = 'PROVIDER_DECLARES_NO_OPERATIONS',\n /* The catalogue loaded and holds no operation by that id. /\n OPERATION_NOT_IN_CATALOGUE = 'OPERATION_NOT_IN_CATALOGUE',\n /* The provider's own loader threw. /\n CATALOGUE_LOAD_FAILED = 'CATALOGUE_LOAD_FAILED',\n}\n\nexport class ProviderOperationLookupError extends Error {\n constructor(\n message: string,\n public readonly detail: {\n readonly kind: ProviderOperationLookupFailureKind;\n readonly providerRef: string;\n readonly operationId?: string;\n readonly cause?: unknown;\n },\n ) {\n super(message);\n this.name = 'ProviderOperationLookupError';\n }\n}\n\n/\n The audit seam — structural and lazily resolved, the pattern this repository already uses for\n * the HTTP-API read-through trail. The executor never holds the audit service, only a thunk; an\n * absent binding means no emission, and an emission failure never fails the call it observes.\n \n TODO(assurance-control): WILDO.AUDIT.ATTRIBUTION — an outbound provider call made on a user's\n * behalf must be recorded with the real initiating user. The sink behind this thunk is S3b's, and\n * the `CoreAuditableEventType` member it writes must be agreed with S5a first (plan seam table).\n /\n/\n The credential store, reached the way the audit sink is — through a thunk, so this class takes no\n * dependency on `security/connected-accounts` and a unit harness needs neither.\n \n Optional in both directions: a host that binds no store records nothing, and an APPLICATION-owned\n * call has no row to stamp.\n /\nexport type ProviderCredentialUseRecorder = () => {\n recordCredentialUse?: (use: {\n organizationId: string;\n providerRef: string;\n secretSlug: string;\n source: string;\n credentialId?: string;\n outcome?: { accepted: boolean; providerMessage?: string };\n }) => Promise<void>;\n} \| undefined;\n\nexport type ProviderOperationAuditResolver = () => {\n logProviderOperationCall?: (\n data: ProviderOperationAuditRecord,\n requestExecutionContext?: ExecutionContext<any>,\n ) => Promise<void>;\n} \| undefined;\n\n/\n What one outbound provider call is worth recording. Ids and shape only, never a payload.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records WHOSE third-party account an\n * outbound call spent, which the initiator's own ids cannot answer once one execution may spend\n * several.\n /\nexport interface ProviderOperationAuditRecord {\n providerRef: string;\n operationId: string;\n domain: string;\n method: string;\n /* READ or WRITE, as the operation declares it — the axis a reviewer filters on first. /\n classification: string;\n /\n WHOSE ACCOUNT the call spent — the first question of any provider incident, and one the\n * initiator's own ids cannot answer.\n \n Distinct from `organizationId` below, which records the tenant the REQUEST was scoped to. Those\n * are the same tenant in the ordinary case and different ones exactly where it matters: a user\n * action fanning out to every organization that user belongs to spends N accounts under one\n * initiating scope. A trail carrying only the initiator's organization would attribute every one\n * of those calls to the wrong tenant.\n /\n connectionOwnerScope: string;\n connectionOwnerId?: string;\n connectionDelegation: string;\n /* HTTP status of the answer; absent when the call never got one. /\n status?: number;\n /* Present when the call failed, naming the failure kind rather than the vendor's prose. /\n failureKind?: string;\n initiatorUserId?: string;\n organizationId?: string;\n executionType?: string;\n}\n\nexport interface ProviderOperationCallInput {\n providerRef: string;\n operationId: string;\n /\n The catalogue DOMAIN the operation belongs to, when the caller knows it. Passing it lets the\n * provider's loader answer one domain instead of every one — the whole point of the lazy loader\n * — and is what keeps a vendor with hundreds of operations from evaluating them all to run one.\n * Absent, the whole catalogue is loaded once and memoized.\n /\n domain?: string;\n input?: Readonly<Record<string, unknown>>;\n /\n WHOSE ACCOUNT this call spends. Defaults to the floor — the application's own, acting as itself.\n \n On the CALL rather than on the provider or the execution context, because one execution may\n * legitimately spend several tenants' accounts: a single user action pushing a message to every\n * organization that user belongs to issues N calls with N targets and one initiator. The context\n * still decides whether the execution MAY act for each named owner.\n /\n connection?: ExternalProvider_ConnectionTarget;\n}\n\nexport interface ProviderOperationCallResult<TOutput = unknown> {\n status: number;\n /* The payload at the operation's `resultPath`, parsed through `outputSchema` when declared. /\n output: TOutput;\n /* The whole parsed body, before `resultPath` and before validation. /\n rawBody: unknown;\n operation: ProviderRestOperation;\n}\n\nexport class ProviderOperationExecutorBackendService {\n /* Per `(providerRef, domain)`, exactly as the loader's contract promises. /\n private readonly catalogueCache = new Map<string, Promise<ProviderRestOperationCatalogue>>();\n /* Per provider, so the rate window survives between calls. /\n private readonly clientCache = new Map<string, ProviderRestCallClient>();\n /* Deprecation is logged once per operation, never per call — a log nobody can read is not a warning. /\n private readonly deprecationsWarned = new Set<string>();\n\n constructor(\n private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n private readonly providerAccessResolver: HttpApiProviderAccessResolver,\n private readonly fetchImpl?: HttpApiFetchLike,\n private readonly auditResolver?: ProviderOperationAuditResolver,\n private readonly warn: (message: string) => void = () => undefined,\n // APPENDED rather than slotted beside its sibling thunk: every parameter here is positional, and\n // inserting one silently reassigns whatever a caller passed after it. Measured — putting it\n // before `warn` handed the deprecation test's spy to this slot, so the warning was recorded by\n // nobody and a pin about vendor deprecation failed for a reason that had nothing to do with it.\n private readonly credentialUseRecorder?: ProviderCredentialUseRecorder,\n ) {}\n\n /\n The provider's `rest` runtime contract, refusing by NAME when there is none: every branch here\n * is an authoring or configuration gap someone must fix, never a transient.\n /\n private restContractOf(providerRef: string) {\n const runtimeContract = this.externalProvidersRegistry.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.REST_API,\n );\n if (!runtimeContract \|\| runtimeContract.kind !== ProviderProtocolRuntimeKind.REST) {\n throw new ProviderOperationLookupError(\n `Provider '${providerRef}' declares no REST runtime contract `\n + `(found: ${runtimeContract ? `kind '${String(runtimeContract.kind)}'` : 'none'}), so it has no operations to execute.`,\n { kind: ProviderOperationLookupFailureKind.PROVIDER_NOT_REST, providerRef },\n );\n }\n return runtimeContract;\n }\n\n /\n Load a catalogue once per `(providerRef, domain)`.\n \n The PROMISE is cached rather than its value, so two concurrent calls for the same pair share\n * one load instead of racing two — and a failed load is EVICTED, because caching a rejection\n * would make one bad moment permanent for the process's whole life.\n /\n public async loadCatalogue(providerRef: string, domain?: string): Promise<ProviderRestOperationCatalogue> {\n const cacheKey = `${providerRef}::${domain ?? ''}`;\n const cached = this.catalogueCache.get(cacheKey);\n if (cached) return cached;\n\n const contract = this.restContractOf(providerRef);\n if (!contract.operations) {\n throw new ProviderOperationLookupError(\n `Provider '${providerRef}' declares a REST contract but no operation catalogue — `\n + 'add `operations` to its rest runtime contract, or call it through an ETL httpApiBinding instead.',\n { kind: ProviderOperationLookupFailureKind.PROVIDER_DECLARES_NO_OPERATIONS, providerRef },\n );\n }\n\n const loadFailure = (cause: unknown) => new ProviderOperationLookupError(\n `Provider '${providerRef}' failed to load its operation catalogue${domain ? ` for domain '${domain}'` : ''}: `\n + `${cause instanceof Error ? cause.message : String(cause)}`,\n { kind: ProviderOperationLookupFailureKind.CATALOGUE_LOAD_FAILED, providerRef, cause },\n );\n\n let invoked: Promise<ProviderRestOperationCatalogue>;\n try {\n // A loader is the provider PACKAGE's own code, and its whole job is to `import()` or\n // `require()` an operation module lazily. That throws SYNCHRONOUSLY when the module is\n // absent or fails to evaluate — a missing dependency, a bad barrel — and a synchronous\n // throw never reaches `.catch`. Without this the two ways one loader can fail refuse\n // differently: a rejection is named `CATALOGUE_LOAD_FAILED` and a throw escapes as the raw\n // `Error`, past the vocabulary that exists so an operator can act on the sentence.\n // Nothing is cached yet on this path, so there is nothing to evict.\n invoked = Promise.resolve(contract.operations(domain));\n } catch (cause) {\n throw loadFailure(cause);\n }\n\n const loading = invoked.catch((cause: unknown) => {\n this.catalogueCache.delete(cacheKey);\n throw loadFailure(cause);\n });\n this.catalogueCache.set(cacheKey, loading);\n return loading;\n }\n\n /** One operation, by id. /\n public async resolveOperation(providerRef: string, operationId: string, domain?: string): Promise<ProviderRestOperation> {\n const catalogue = await this.loadCatalogue(providerRef, domain);\n const operation = catalogue.operations[operationId];\n if (!operation) {\n const known = Object.keys(catalogue.operations);\n throw new ProviderOperationLookupError(\n `Provider '${providerRef}' declares no operation '${operationId}'`\n + `${domain ? ` in domain '${domain}'` : ''}. Declared${known.length > 20 ? ` (first 20 of ${known.length})` : ''}: `\n + `${known.slice(0, 20).join(', ') \|\| '(none)'}.`,\n { kind: ProviderOperationLookupFailureKind.OPERATION_NOT_IN_CATALOGUE, providerRef, operationId },\n );\n }\n return operation;\n }\n\n private clientFor(providerRef: string): ProviderRestCallClient {\n const cached = this.clientCache.get(providerRef);\n if (cached) return cached;\n const contract = this.restContractOf(providerRef);\n const semantics: ProviderRestCallSemantics = contract.remoteCallSemantics ?? DEFAULT_PROVIDER_REST_CALL_SEMANTICS;\n const client = new ProviderRestCallClient(providerRef, semantics, this.providerAccessResolver, this.fetchImpl);\n this.clientCache.set(providerRef, client);\n return client;\n }\n\n /* Execute one declared operation end to end. /\n /\n Adapt this executor to what a GENERATED TYPED CLIENT takes.\n \n `createSlackClient(execute)` wants `(providerRef, operationId, input) => Promise<unknown>` — no\n * execution context and no connection target, because the generated package must carry no runtime\n * dependency on the engine and cannot name either type. Those two are exactly what a call needs and\n * what only the caller knows, so they are bound HERE, once, by the service that has them:\n \n ```ts\n * const slack = createSlackClient(this.providerOperations.forExecution(executionContext));\n * await slack.slackPostMessage({ channel: 'C123', text: 'Deal closed' });\n * ```\n \n The `connection` default is the floor — the application's own account, acting as itself —\n * matching {@link execute}. A caller spending a tenant's account passes the target explicitly, and\n * the context still decides whether the execution may act for that owner.\n \n Returns `output` rather than the whole envelope, because that is what the typed client's\n * `Promise<unknown>` promises. A caller who needs the status or the raw body calls {@link execute}\n * directly — the adapter is ergonomics, never a narrower door.\n /\n public forExecution(\n executionContext: ExecutionContext<any>,\n defaults?: { readonly connection?: ExternalProvider_ConnectionTarget; readonly domain?: string },\n ): ProviderOperationExecute {\n // The per-CALL connection wins over the client's default, and that precedence is the whole\n // reason the parameter exists. A default binds one client to one owner, which is right for the\n // ordinary case and cannot express the one that forced the design: a single user action pushing\n // to every organization that user belongs to issues N calls through ONE client and names a\n // different owner each time. Reading only the default would make that unreachable through the\n // generated surface while the engine underneath supports it.\n return async (providerRef, operationId, input, connection) => {\n const result = await this.execute(\n { providerRef, operationId, input, connection: connection ?? defaults?.connection, domain: defaults?.domain },\n executionContext,\n );\n return result.output;\n };\n }\n\n public async execute<TOutput = unknown>(\n call: ProviderOperationCallInput,\n executionContext: ExecutionContext<any>,\n ): Promise<ProviderOperationCallResult<TOutput>> {\n const target: ExternalProvider_ConnectionTarget = call.connection ?? {\n ownerScope: ExternalProvider_Connection_OwnerScope.APPLICATION,\n delegation: ExternalProvider_Connection_DelegationMode.SERVICE,\n };\n const operation = await this.resolveOperation(call.providerRef, call.operationId, call.domain);\n\n if (operation.deprecated && !this.deprecationsWarned.has(`${call.providerRef}::${operation.operationId}`)) {\n this.deprecationsWarned.add(`${call.providerRef}::${operation.operationId}`);\n // Warn, never refuse: the vendor decides when a deprecated operation stops answering, and a\n // framework that refused first would break a working application ahead of the vendor.\n this.warn(\n `Provider operation '${call.providerRef}.${operation.operationId}' is deprecated`\n + `${operation.deprecated.since ? ` since ${operation.deprecated.since}` : ''}: ${operation.deprecated.reason}`\n + `${operation.deprecated.replacedByOperationId ? ` — use '${operation.deprecated.replacedByOperationId}'.` : '.'}`,\n );\n }\n\n const rawInput = call.input ?? {};\n let input: Readonly<Record<string, unknown>> = rawInput;\n if (operation.inputSchema) {\n const parsed = operation.inputSchema.safeParse(rawInput);\n if (!parsed.success) {\n throw new ProviderOperationRequestError(\n `Input rejected for '${call.providerRef}.${operation.operationId}': `\n + parsed.error.issues.map((issue) => `${issue.path.join('.') \|\| '(root)'} ${issue.message}`).join('; '),\n { kind: ProviderOperationRequestFailureKind.INPUT_REJECTED, operationId: operation.operationId, providerRef: call.providerRef },\n );\n }\n input = parsed.data as Record<string, unknown>;\n }\n\n const client = this.clientFor(call.providerRef);\n const access = await client.resolveAccess(target, executionContext);\n const request = compileProviderOperationRequest({ operation, providerRef: call.providerRef, input, access });\n\n try {\n // `access` is handed on so the client can SIGN, which only it can do last. Resolving it twice\n // would be a second read of the same secrets and, for a signed provider, a second timestamp.\n const response = await client.execute(request, operation.remoteCallSemantics, access);\n this.record(call.providerRef, operation, target, executionContext, { status: response.status });\n // A 2xx is the provider ACCEPTING the credential. Recording it is what moves a stored row off\n // UNVALIDATED — which is otherwise where every working credential stays forever, so an operator\n // reading the settings screen cannot tell a healthy integration from one that has never run.\n this.recordCredentialOutcome(call.providerRef, target, access, { accepted: response.status < 400 });\n\n const payload = operation.resultPath ? resolveHttpApiResultPath(response.json, operation.resultPath) : response.json;\n if (!operation.outputSchema) {\n return { status: response.status, output: payload as TOutput, rawBody: response.json, operation };\n }\n const parsed = operation.outputSchema.safeParse(payload);\n if (!parsed.success) {\n // A vendor answering a shape the declaration does not describe is a CONTRACT problem, and\n // the honest place to learn it is here rather than three frames into the caller.\n throw new ProviderOperationRequestError(\n `Provider '${call.providerRef}' answered '${operation.operationId}' with a body its declared outputSchema rejects: `\n + parsed.error.issues.map((issue) => `${issue.path.join('.') \|\| '(root)'} ${issue.message}`).join('; '),\n { kind: ProviderOperationRequestFailureKind.DECLARATION_INCOHERENT, operationId: operation.operationId, providerRef: call.providerRef },\n );\n }\n return { status: response.status, output: parsed.data as TOutput, rawBody: response.json, operation };\n } catch (error) {\n const detail = (error as { detail?: { status?: number; kind?: string } }).detail;\n this.record(call.providerRef, operation, target, executionContext, {\n status: detail?.status,\n failureKind: detail?.kind ?? (error instanceof Error ? error.name : 'UNKNOWN'),\n });\n throw error;\n }\n }\n\n /\n Record one outbound call. Fire-and-forget and feature-detected, per the house pattern: a\n * partial audit binding or a store failure must never fail the call it observes.\n \n Called on BOTH the success and the failure path deliberately — a refused or failed outbound\n * call is exactly what a reviewer wants to see, and a trail that records only what worked is a\n * trail that hides the attempts.\n /\n /\n Stamp the stored credential with what the provider said. Best-effort, and after the call.\n \n Fire-and-forget for the same reason the audit emit is: the outbound call has already happened, so\n * failing the caller because a bookkeeping write did not land would turn a successful integration\n * into an error. Nothing downstream reads the result, and the store logs its own failures with the\n * row named.\n \n Only a tenant's OWN credential has a row. An APPLICATION-owned resolution carries no provenance\n * and is skipped here rather than filtered later, so the deployment environment can never acquire a\n * row describing a credential the tenant never set.\n */\n private recordCredentialOutcome(\n providerRef: string,\n target: ExternalProvider_ConnectionTarget,\n access: { credentialProvenance?: { source: string; credentialId?: string; secretSlug: string } },\n outcome: { accepted: boolean; providerMessage?: string },\n ): void {\n const provenance = access.credentialProvenance;\n if (!provenance \|\| target.ownerId === undefined) return;\n try {\n const store = this.credentialUseRecorder?.();\n if (typeof store?.recordCredentialUse !== 'function') return;\n void store.recordCredentialUse({\n organizationId: target.ownerId,\n providerRef,\n secretSlug: provenance.secretSlug,\n source: provenance.source,\n credentialId: provenance.credentialId,\n outcome,\n }).catch(() => undefined);\n } catch {\n // A recorder that throws on resolution must not take the call down with it.\n }\n }\n\n private record(\n providerRef: string,\n operation: ProviderRestOperation,\n target: ExternalProvider_ConnectionTarget,\n executionContext: ExecutionContext<any>,\n outcome: { status?: number; failureKind?: string },\n ): void {\n try {\n const auditLogsService = this.auditResolver?.();\n if (typeof auditLogsService?.logProviderOperationCall !== 'function') return;\n const initiatorIds = (executionContext as { initiatorIds?: { userId?: string; organizationId?: string } }).initiatorIds;\n void auditLogsService.logProviderOperationCall({\n providerRef,\n operationId: operation.operationId,\n domain: operation.domain,\n method: operation.method,\n classification: operation.classification,\n connectionOwnerScope: target.ownerScope,\n ...(target.ownerId === undefined ? {} : { connectionOwnerId: target.ownerId }),\n connectionDelegation: target.delegation,\n initiatorUserId: initiatorIds?.userId,\n organizationId: initiatorIds?.organizationId,\n executionType: (executionContext as { executionType?: string }).executionType,\n ...outcome,\n }, executionContext)?.catch?.(() => undefined);\n } catch {\n // Observation only — never the reason a call fails.\n }\n }\n}\n"]}
1	+ {"version":3,"file":"provider-operation-executor.backend.service.js","sourceRoot":"","sources":["../../../../src/external-providers/operations/provider-operation-executor.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,sCAAsC,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAC3H,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GAGrB,MAAM,gFAAgF,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gGAAgG,CAAC;AAG1I,OAAO,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAC3J,OAAO,EAAE,oCAAoC,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAEnH,2FAA2F;AAC3F,MAAM,CAAN,IAAY,kCASX;AATD,WAAY,kCAAkC;IAC5C,4FAA4F;IAC5F,6EAAuC,CAAA;IACvC,kFAAkF;IAClF,yGAAmE,CAAA;IACnE,8DAA8D;IAC9D,+FAAyD,CAAA;IACzD,uCAAuC;IACvC,qFAA+C,CAAA;AACjD,CAAC,EATW,kCAAkC,KAAlC,kCAAkC,QAS7C;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAGnC;IAFlB,YACE,OAAe,EACC,MAKf;QAED,KAAK,CAAC,OAAO,CAAC,CAAC;QAPC,WAAM,GAAN,MAAM,CAKrB;QAGD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAgHD,MAAM,OAAO,uCAAuC;IA4B/B;IACA;IA5BnB,8EAA8E;IAC7D,cAAc,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC7F,+DAA+D;IAC9C,WAAW,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzE,yGAAyG;IACxF,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,SAAS,CAAoB;IAC7B,aAAa,CAAkC;IAC/C,IAAI,CAA4B;IAChC,eAAe,CAAuC;IACtD,MAAM,CAA8B;IAErD;;;;;;;;;;;;OAYG;IACH,YACmB,yBAAkE,EAClE,sBAAqD,EACtE,gBAAwD,EAAE;QAFzC,8BAAyB,GAAzB,yBAAyB,CAAyC;QAClE,2BAAsB,GAAtB,sBAAsB,CAA+B;QAGtE,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,aAAa,CAAC,eAAe,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;IACrC,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,WAAmB;QACxC,MAAM,eAAe,GAAG,IAAI,CAAC,yBAAyB,CAAC,0BAA0B,CAC/E,WAAW,EACX,sCAAsC,CAAC,QAAQ,CAChD,CAAC;QACF,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,IAAI,EAAE,CAAC;YAClF,MAAM,IAAI,4BAA4B,CACpC,aAAa,WAAW,sCAAsC;kBAC5D,WAAW,eAAe,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,wCAAwC,EACxH,EAAE,IAAI,EAAE,kCAAkC,CAAC,iBAAiB,EAAE,WAAW,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,MAAe;QAC7D,MAAM,QAAQ,GAAG,GAAG,WAAW,KAAK,MAAM,IAAI,GAAG,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACzB,MAAM,IAAI,4BAA4B,CACpC,aAAa,WAAW,0DAA0D;kBAChF,kGAAkG,EACpG,EAAE,IAAI,EAAE,kCAAkC,CAAC,+BAA+B,EAAE,WAAW,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,4BAA4B,CACtE,aAAa,WAAW,2CAA2C,MAAM,CAAC,CAAC,CAAC,gBAAgB,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;cAC5G,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC7D,EAAE,IAAI,EAAE,kCAAkC,CAAC,qBAAqB,EAAE,WAAW,EAAE,KAAK,EAAE,CACvF,CAAC;QAEF,IAAI,OAAgD,CAAC;QACrD,IAAI,CAAC;YACH,qFAAqF;YACrF,uFAAuF;YACvF,uFAAuF;YACvF,qFAAqF;YACrF,2FAA2F;YAC3F,mFAAmF;YACnF,oEAAoE;YACpE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC/C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4BAA4B;IACrB,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,WAAmB,EAAE,MAAe;QACrF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,IAAI,4BAA4B,CACpC,aAAa,WAAW,4BAA4B,WAAW,GAAG;kBAChE,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;kBACnH,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,EACjD,EAAE,IAAI,EAAE,kCAAkC,CAAC,0BAA0B,EAAE,WAAW,EAAE,WAAW,EAAE,CAClG,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,SAAS,CAAC,WAAmB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,SAAS,GAA8B,QAAQ,CAAC,mBAAmB,IAAI,oCAAoC,CAAC;QAClH,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/G,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iDAAiD;IACjD;;;;;;;;;;;;;;;;;;;;OAoBG;IACI,YAAY,CACjB,gBAAuC,EACvC,QAAgG;QAEhG,2FAA2F;QAC3F,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,8FAA8F;QAC9F,6DAA6D;QAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC/B,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,IAAI,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAC7G,gBAAgB,CACjB,CAAC;YACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,IAAgC,EAChC,gBAAuC;QAEvC,MAAM,MAAM,GAAsC,IAAI,CAAC,UAAU,IAAI;YACnE,UAAU,EAAE,sCAAsC,CAAC,WAAW;YAC9D,UAAU,EAAE,0CAA0C,CAAC,OAAO;SAC/D,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/F,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7E,4FAA4F;YAC5F,sFAAsF;YACtF,IAAI,CAAC,IAAI,CACP,uBAAuB,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,WAAW,iBAAiB;kBAC/E,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE;kBAC7G,GAAG,SAAS,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW,SAAS,CAAC,UAAU,CAAC,qBAAqB,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CACpH,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,IAAI,KAAK,GAAsC,QAAQ,CAAC;QACxD,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,6BAA6B,CACrC,uBAAuB,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC,WAAW,KAAK;sBACnE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EACvG,EAAE,IAAI,EAAE,mCAAmC,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAChI,CAAC;YACJ,CAAC;YACD,KAAK,GAAG,MAAM,CAAC,IAA+B,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,+BAA+B,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7G,IAAI,CAAC;YACH,8FAA8F;YAC9F,6FAA6F;YAC7F,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAChG,8FAA8F;YAC9F,gGAAgG;YAChG,6FAA6F;YAC7F,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;YAEpG,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrH,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAkB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACpG,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,0FAA0F;gBAC1F,iFAAiF;gBACjF,MAAM,IAAI,6BAA6B,CACrC,aAAa,IAAI,CAAC,WAAW,eAAe,SAAS,CAAC,WAAW,mDAAmD;sBAClH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EACvG,EAAE,IAAI,EAAE,mCAAmC,CAAC,sBAAsB,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CACxI,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACxG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAI,KAAyD,CAAC,MAAM,CAAC;YACjF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE;gBACjE,MAAM,EAAE,MAAM,EAAE,MAAM;gBACtB,WAAW,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;aAC/E,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,uBAAuB,CAC7B,WAAmB,EACnB,MAAyC,EACzC,MAAgF,EAChF,OAAwD;QAExD,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAC/C,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO;QACxD,0FAA0F;QAC1F,kGAAkG;QAClG,sFAAsF;QACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAA6E,CAAC;QACpG,oBAAoB,CAAC;YACnB,WAAW,EAAE,oBAAoB,CAAC,uBAAuB;YACzD,IAAI,EAAE,OAAO,QAAQ,CAAC,gCAAgC,KAAK,UAAU;gBACnE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gCAAiC,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC;gBAC5F,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE;SAC3F,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,MAAM,CACZ,WAAmB,EACnB,SAAgC,EAChC,MAAyC,EACzC,gBAAuC,EACvC,OAAkD;QAElD,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACxD,MAAM,YAAY,GAAI,gBAAoF,CAAC,YAAY,CAAC;QACxH,MAAM,IAAI,GAAG,gBAAgB,EAAE,wBAAwB,CAAC;QACxD,oBAAoB,CAAC;YACnB,WAAW,EAAE,oBAAoB,CAAC,uBAAuB;YACzD,IAAI,EAAE,OAAO,IAAI,KAAK,UAAU;gBAC9B,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;oBAClC,WAAW;oBACX,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,cAAc,EAAE,SAAS,CAAC,cAAc;oBACxC,oBAAoB,EAAE,MAAM,CAAC,UAAU;oBACvC,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9E,oBAAoB,EAAE,MAAM,CAAC,UAAU;oBACvC,eAAe,EAAE,YAAY,EAAE,MAAM;oBACrC,cAAc,EAAE,YAAY,EAAE,cAAc;oBAC5C,aAAa,EAAG,gBAA+C,CAAC,aAAa;oBAC7E,GAAG,OAAO;iBACX,EAAE,gBAAgB,CAAC;gBACpB,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,uBAAuB;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF","sourcesContent":["/*\n `ProviderOperationExecutorBackendService` — the ONE door through which an application executes a\n * provider-declared operation (S3a, #331; plan D4).\n \n A custom backend service names a provider and an operation; everything between that and the wire\n * lives here: resolving the provider's runtime contract, loading its catalogue on demand and\n * memoizing it, validating the caller's input against the operation's own schema, compiling the\n * request, resolving identity through the shared access port, executing under the provider's rate\n * budget and semantics, and parsing the answer.\n \n ## What it deliberately does NOT do\n \n - It does not resolve secrets. `HttpApiProviderAccessResolver` does, over the provider\n * registry — the same port the ETL lane uses. When #329 makes that registry the COMPOSED one, a\n * package-shipped provider's key arrives here with no edit. A second secret path would be a\n * second thing to get wrong.\n * - It does not decide IDENTITY. Whose account a call spends, and on whose behalf, is the\n * connection target the resolver is handed; a delegated target is served or refused THERE. This\n * read \"it does not implement `USER_DELEGATED` … the resolver refuses it by name today\" until\n * #333, which retired that mode for the two-axis `ExternalProvider_ConnectionShape` and lifted\n * the refusal — neither change reached this class, which is the point of asking the port.\n * - It does not page. `pagination` on an operation is a hint the caller reads.\n * - It does not OWN the trail, but it does emit one. Two observations leave here on every call —\n * the outbound-call row (`CoreAuditableEventType.PROVIDER_OPERATION_CALL`, through the lazily\n * resolved `ProviderOperationAuditResolver`) and the credential-use stamp (through the registry,\n * which knows which store the credential came from). Both are fire-and-forget and neither can fail\n * the call it observes; both are counted when they are lost, which is the half that was missing.\n \n Stated loudly because it was false for months and nothing said so: the two seams existed, were\n * called on every outbound call, and had NOTHING behind them — the container constructed this class\n * with two of its six parameters, so both resolvers were `undefined` for the process's whole life,\n * and one of the two sinks had never been written at all. An application calling a vendor on a\n * user's behalf left no trail whatsoever, and the code read as though it did.\n \n ## Bound by FACTORY, not by decoration\n \n This class carried \"Not `@injectable`, on purpose\" and deferred registration to the slice that\n * needed it injected. That slice arrived: an application scopes a provider from the scraped\n * catalogue and a service of its own calls an operation, which it cannot do while the only door is a\n * class nothing binds.\n \n It is still a plain class. `SAAS_SERVICE_TYPES.ProviderOperationExecutorService` is bound with\n * `toDynamicValue`, so the lane's classes stay constructible with `new` — the repositories registry\n * builds its own resolver that way — and no injection token has to be invented for\n * `ConnectionTargetAuthorizationPort`, which nothing binds and whose absence is deliberately\n * fail-closed.\n \n Singleton, because this memoizes a catalogue per `(providerRef, domain)` and holds one rate-limit\n * window per provider. A transient would reload the catalogue per call and give every caller its own\n * window, which is not a rate limit.\n /\n\nimport { ExternalProvider_ExchangeProtocol_Kind, ProviderProtocolRuntimeKind } from '@wildo-ai/external-connectors-models';\nimport {\n ExternalProvider_Connection_DelegationMode,\n ExternalProvider_Connection_OwnerScope,\n} from '@wildo-ai/external-connectors-models';\nimport type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';\nimport type { ProviderOperationExecute, ProviderRestCallSemantics, ProviderRestOperation, ProviderRestOperationCatalogue } from '@wildo-ai/external-connectors-models';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { HttpApiFetchLike } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-transport.backend';\nimport type { HttpApiProviderAccess, HttpApiProviderAccessResolver } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-provider-access.backend';\nimport {\n AuditObservationKind,\n emitAuditObservation,\n type AuditObservationLossLogger,\n type AuditObservationLossMetricsResolver,\n} from '~wildo-backend-lib/monitoring/observability/audit-observation-emission.backend';\nimport { resolveHttpApiResultPath } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-row-projection.backend';\nimport type { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\n\nimport { compileProviderOperationRequest, ProviderOperationRequestError, ProviderOperationRequestFailureKind } from './provider-operation-request.backend';\nimport { DEFAULT_PROVIDER_REST_CALL_SEMANTICS, ProviderRestCallClient } from './provider-rest-call-client.backend';\n\n/* Why an operation could not be reached at all — each member names a different remedy. /\nexport enum ProviderOperationLookupFailureKind {\n /* The provider declares no `rest` runtime contract; it may not even be a REST provider. /\n PROVIDER_NOT_REST = 'PROVIDER_NOT_REST',\n /* The provider is REST but declares no operation catalogue — nothing to call. /\n PROVIDER_DECLARES_NO_OPERATIONS = 'PROVIDER_DECLARES_NO_OPERATIONS',\n /* The catalogue loaded and holds no operation by that id. /\n OPERATION_NOT_IN_CATALOGUE = 'OPERATION_NOT_IN_CATALOGUE',\n /* The provider's own loader threw. /\n CATALOGUE_LOAD_FAILED = 'CATALOGUE_LOAD_FAILED',\n}\n\nexport class ProviderOperationLookupError extends Error {\n constructor(\n message: string,\n public readonly detail: {\n readonly kind: ProviderOperationLookupFailureKind;\n readonly providerRef: string;\n readonly operationId?: string;\n readonly cause?: unknown;\n },\n ) {\n super(message);\n this.name = 'ProviderOperationLookupError';\n }\n}\n\n/\n The audit seam — structural and lazily resolved, the pattern this repository already uses for the\n * HTTP-API read-through trail. The executor never holds the audit service, only a thunk; an absent\n * binding means no emission, and an emission failure never fails the call it observes.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION — an outbound provider call made on a user's behalf is\n * recorded with the real initiating user. The sink is\n * `AuditLogsBackendService.logProviderOperationCall`, writing\n * `CoreAuditableEventType.PROVIDER_OPERATION_CALL`.\n \n The thunk's method stays OPTIONAL, and that is not laziness: a host may bind an older audit\n * service, and a partially-mocked double routinely has fewer methods than the real one. What is no\n * longer tolerated is the absence going unnoticed — the emission runs through\n * {@link emitAuditObservation}, so a missing sink is counted as\n * {@link AuditObservationLossReason.SERVICE_UNAVAILABLE} rather than silently doing nothing.\n /\nexport type ProviderOperationAuditResolver = () => {\n logProviderOperationCall?: (\n data: ProviderOperationAuditRecord,\n requestExecutionContext?: ExecutionContext<any>,\n ) => Promise<void>;\n} \| undefined;\n\n/\n What one outbound provider call is worth recording. Ids and shape only, never a payload.\n \n assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records WHOSE third-party account an\n * outbound call spent, which the initiator's own ids cannot answer once one execution may spend\n * several.\n /\nexport interface ProviderOperationAuditRecord {\n providerRef: string;\n operationId: string;\n domain: string;\n method: string;\n /* READ or WRITE, as the operation declares it — the axis a reviewer filters on first. /\n classification: string;\n /\n WHOSE ACCOUNT the call spent — the first question of any provider incident, and one the\n * initiator's own ids cannot answer.\n \n Distinct from `organizationId` below, which records the tenant the REQUEST was scoped to. Those\n * are the same tenant in the ordinary case and different ones exactly where it matters: a user\n * action fanning out to every organization that user belongs to spends N accounts under one\n * initiating scope. A trail carrying only the initiator's organization would attribute every one\n * of those calls to the wrong tenant.\n /\n connectionOwnerScope: string;\n connectionOwnerId?: string;\n connectionDelegation: string;\n /* HTTP status of the answer; absent when the call never got one. /\n status?: number;\n /* Present when the call failed, naming the failure kind rather than the vendor's prose. /\n failureKind?: string;\n initiatorUserId?: string;\n organizationId?: string;\n executionType?: string;\n}\n\nexport interface ProviderOperationCallInput {\n providerRef: string;\n operationId: string;\n /\n The catalogue DOMAIN the operation belongs to, when the caller knows it. Passing it lets the\n * provider's loader answer one domain instead of every one — the whole point of the lazy loader\n * — and is what keeps a vendor with hundreds of operations from evaluating them all to run one.\n * Absent, the whole catalogue is loaded once and memoized.\n /\n domain?: string;\n input?: Readonly<Record<string, unknown>>;\n /\n WHOSE ACCOUNT this call spends. Defaults to the floor — the application's own, acting as itself.\n \n On the CALL rather than on the provider or the execution context, because one execution may\n * legitimately spend several tenants' accounts: a single user action pushing a message to every\n * organization that user belongs to issues N calls with N targets and one initiator. The context\n * still decides whether the execution MAY act for each named owner.\n /\n connection?: ExternalProvider_ConnectionTarget;\n}\n\nexport interface ProviderOperationCallResult<TOutput = unknown> {\n status: number;\n /* The payload at the operation's `resultPath`, parsed through `outputSchema` when declared. /\n output: TOutput;\n /* The whole parsed body, before `resultPath` and before validation. /\n rawBody: unknown;\n operation: ProviderRestOperation;\n}\n\n/\n Everything the executor can be given beyond the two collaborators it cannot work without.\n \n Every field is optional and every one degrades to a documented behaviour rather than a failure:\n * no `fetchImpl` uses the platform's, no `auditResolver` counts the drop, no `warn` swallows the\n * deprecation notice, no `metricsResolver`/`logger` leaves the loss on the process-local total only.\n /\nexport interface ProviderOperationExecutorCollaborators {\n /* The transport. Absent, the platform `fetch` is used — a test substitutes here. /\n fetchImpl?: HttpApiFetchLike;\n /* The outbound-call trail's sink, lazily resolved. See {@link ProviderOperationAuditResolver}. /\n auditResolver?: ProviderOperationAuditResolver;\n /* Where a vendor deprecation notice goes. Once per operation, never per call. /\n warn?: (message: string) => void;\n /* The loss counter behind both observations. Consulted ONLY when there is a drop to record. /\n metricsResolver?: AuditObservationLossMetricsResolver;\n /* The always-available loss channel — one throttled `error` line per `(observation, reason)`. /\n logger?: AuditObservationLossLogger;\n}\n\nexport class ProviderOperationExecutorBackendService {\n /* Per `(providerRef, domain)`, exactly as the loader's contract promises. /\n private readonly catalogueCache = new Map<string, Promise<ProviderRestOperationCatalogue>>();\n /* Per provider, so the rate window survives between calls. /\n private readonly clientCache = new Map<string, ProviderRestCallClient>();\n /* Deprecation is logged once per operation, never per call — a log nobody can read is not a warning. /\n private readonly deprecationsWarned = new Set<string>();\n\n private readonly fetchImpl?: HttpApiFetchLike;\n private readonly auditResolver?: ProviderOperationAuditResolver;\n private readonly warn: (message: string) => void;\n private readonly metricsResolver?: AuditObservationLossMetricsResolver;\n private readonly logger?: AuditObservationLossLogger;\n\n /\n Two required collaborators, then a BAG — and the bag is a correction rather than a style choice.\n \n The optional tail used to be five positional parameters, and inserting one silently reassigned\n * whatever a caller had passed after it. That is measured, not hypothetical: adding the credential\n * recorder before `warn` handed the deprecation test's spy to the recorder slot, so the warning was\n * recorded by nobody and a pin about vendor deprecation failed for a reason that had nothing to do\n * with it. The comment left behind told the next author to APPEND — which works exactly until two\n * people append in parallel, and does nothing for a caller who miscounts `undefined`s.\n \n A bag removes the failure mode instead of documenting it: every collaborator is named at the call\n * site, and adding one cannot move another.\n /\n constructor(\n private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n private readonly providerAccessResolver: HttpApiProviderAccessResolver,\n collaborators: ProviderOperationExecutorCollaborators = {},\n ) {\n this.fetchImpl = collaborators.fetchImpl;\n this.auditResolver = collaborators.auditResolver;\n this.warn = collaborators.warn ?? (() => undefined);\n this.metricsResolver = collaborators.metricsResolver;\n this.logger = collaborators.logger;\n }\n\n /\n The provider's `rest` runtime contract, refusing by NAME when there is none: every branch here\n * is an authoring or configuration gap someone must fix, never a transient.\n /\n private restContractOf(providerRef: string) {\n const runtimeContract = this.externalProvidersRegistry.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.REST_API,\n );\n if (!runtimeContract \|\| runtimeContract.kind !== ProviderProtocolRuntimeKind.REST) {\n throw new ProviderOperationLookupError(\n `Provider '${providerRef}' declares no REST runtime contract `\n + `(found: ${runtimeContract ? `kind '${String(runtimeContract.kind)}'` : 'none'}), so it has no operations to execute.`,\n { kind: ProviderOperationLookupFailureKind.PROVIDER_NOT_REST, providerRef },\n );\n }\n return runtimeContract;\n }\n\n /\n Load a catalogue once per `(providerRef, domain)`.\n \n The PROMISE is cached rather than its value, so two concurrent calls for the same pair share\n * one load instead of racing two — and a failed load is EVICTED, because caching a rejection\n * would make one bad moment permanent for the process's whole life.\n /\n public async loadCatalogue(providerRef: string, domain?: string): Promise<ProviderRestOperationCatalogue> {\n const cacheKey = `${providerRef}::${domain ?? ''}`;\n const cached = this.catalogueCache.get(cacheKey);\n if (cached) return cached;\n\n const contract = this.restContractOf(providerRef);\n if (!contract.operations) {\n throw new ProviderOperationLookupError(\n `Provider '${providerRef}' declares a REST contract but no operation catalogue — `\n + 'add `operations` to its rest runtime contract, or call it through an ETL httpApiBinding instead.',\n { kind: ProviderOperationLookupFailureKind.PROVIDER_DECLARES_NO_OPERATIONS, providerRef },\n );\n }\n\n const loadFailure = (cause: unknown) => new ProviderOperationLookupError(\n `Provider '${providerRef}' failed to load its operation catalogue${domain ? ` for domain '${domain}'` : ''}: `\n + `${cause instanceof Error ? cause.message : String(cause)}`,\n { kind: ProviderOperationLookupFailureKind.CATALOGUE_LOAD_FAILED, providerRef, cause },\n );\n\n let invoked: Promise<ProviderRestOperationCatalogue>;\n try {\n // A loader is the provider PACKAGE's own code, and its whole job is to `import()` or\n // `require()` an operation module lazily. That throws SYNCHRONOUSLY when the module is\n // absent or fails to evaluate — a missing dependency, a bad barrel — and a synchronous\n // throw never reaches `.catch`. Without this the two ways one loader can fail refuse\n // differently: a rejection is named `CATALOGUE_LOAD_FAILED` and a throw escapes as the raw\n // `Error`, past the vocabulary that exists so an operator can act on the sentence.\n // Nothing is cached yet on this path, so there is nothing to evict.\n invoked = Promise.resolve(contract.operations(domain));\n } catch (cause) {\n throw loadFailure(cause);\n }\n\n const loading = invoked.catch((cause: unknown) => {\n this.catalogueCache.delete(cacheKey);\n throw loadFailure(cause);\n });\n this.catalogueCache.set(cacheKey, loading);\n return loading;\n }\n\n /** One operation, by id. /\n public async resolveOperation(providerRef: string, operationId: string, domain?: string): Promise<ProviderRestOperation> {\n const catalogue = await this.loadCatalogue(providerRef, domain);\n const operation = catalogue.operations[operationId];\n if (!operation) {\n const known = Object.keys(catalogue.operations);\n throw new ProviderOperationLookupError(\n `Provider '${providerRef}' declares no operation '${operationId}'`\n + `${domain ? ` in domain '${domain}'` : ''}. Declared${known.length > 20 ? ` (first 20 of ${known.length})` : ''}: `\n + `${known.slice(0, 20).join(', ') \|\| '(none)'}.`,\n { kind: ProviderOperationLookupFailureKind.OPERATION_NOT_IN_CATALOGUE, providerRef, operationId },\n );\n }\n return operation;\n }\n\n private clientFor(providerRef: string): ProviderRestCallClient {\n const cached = this.clientCache.get(providerRef);\n if (cached) return cached;\n const contract = this.restContractOf(providerRef);\n const semantics: ProviderRestCallSemantics = contract.remoteCallSemantics ?? DEFAULT_PROVIDER_REST_CALL_SEMANTICS;\n const client = new ProviderRestCallClient(providerRef, semantics, this.providerAccessResolver, this.fetchImpl);\n this.clientCache.set(providerRef, client);\n return client;\n }\n\n /* Execute one declared operation end to end. /\n /\n Adapt this executor to what a GENERATED TYPED CLIENT takes.\n \n `createSlackClient(execute)` wants `(providerRef, operationId, input) => Promise<unknown>` — no\n * execution context and no connection target, because the generated package must carry no runtime\n * dependency on the engine and cannot name either type. Those two are exactly what a call needs and\n * what only the caller knows, so they are bound HERE, once, by the service that has them:\n \n ```ts\n * const slack = createSlackClient(this.providerOperations.forExecution(executionContext));\n * await slack.slackPostMessage({ channel: 'C123', text: 'Deal closed' });\n * ```\n \n The `connection` default is the floor — the application's own account, acting as itself —\n * matching {@link execute}. A caller spending a tenant's account passes the target explicitly, and\n * the context still decides whether the execution may act for that owner.\n \n Returns `output` rather than the whole envelope, because that is what the typed client's\n * `Promise<unknown>` promises. A caller who needs the status or the raw body calls {@link execute}\n * directly — the adapter is ergonomics, never a narrower door.\n /\n public forExecution(\n executionContext: ExecutionContext<any>,\n defaults?: { readonly connection?: ExternalProvider_ConnectionTarget; readonly domain?: string },\n ): ProviderOperationExecute {\n // The per-CALL connection wins over the client's default, and that precedence is the whole\n // reason the parameter exists. A default binds one client to one owner, which is right for the\n // ordinary case and cannot express the one that forced the design: a single user action pushing\n // to every organization that user belongs to issues N calls through ONE client and names a\n // different owner each time. Reading only the default would make that unreachable through the\n // generated surface while the engine underneath supports it.\n return async (providerRef, operationId, input, connection) => {\n const result = await this.execute(\n { providerRef, operationId, input, connection: connection ?? defaults?.connection, domain: defaults?.domain },\n executionContext,\n );\n return result.output;\n };\n }\n\n public async execute<TOutput = unknown>(\n call: ProviderOperationCallInput,\n executionContext: ExecutionContext<any>,\n ): Promise<ProviderOperationCallResult<TOutput>> {\n const target: ExternalProvider_ConnectionTarget = call.connection ?? {\n ownerScope: ExternalProvider_Connection_OwnerScope.APPLICATION,\n delegation: ExternalProvider_Connection_DelegationMode.SERVICE,\n };\n const operation = await this.resolveOperation(call.providerRef, call.operationId, call.domain);\n\n if (operation.deprecated && !this.deprecationsWarned.has(`${call.providerRef}::${operation.operationId}`)) {\n this.deprecationsWarned.add(`${call.providerRef}::${operation.operationId}`);\n // Warn, never refuse: the vendor decides when a deprecated operation stops answering, and a\n // framework that refused first would break a working application ahead of the vendor.\n this.warn(\n `Provider operation '${call.providerRef}.${operation.operationId}' is deprecated`\n + `${operation.deprecated.since ? ` since ${operation.deprecated.since}` : ''}: ${operation.deprecated.reason}`\n + `${operation.deprecated.replacedByOperationId ? ` — use '${operation.deprecated.replacedByOperationId}'.` : '.'}`,\n );\n }\n\n const rawInput = call.input ?? {};\n let input: Readonly<Record<string, unknown>> = rawInput;\n if (operation.inputSchema) {\n const parsed = operation.inputSchema.safeParse(rawInput);\n if (!parsed.success) {\n throw new ProviderOperationRequestError(\n `Input rejected for '${call.providerRef}.${operation.operationId}': `\n + parsed.error.issues.map((issue) => `${issue.path.join('.') \|\| '(root)'} ${issue.message}`).join('; '),\n { kind: ProviderOperationRequestFailureKind.INPUT_REJECTED, operationId: operation.operationId, providerRef: call.providerRef },\n );\n }\n input = parsed.data as Record<string, unknown>;\n }\n\n const client = this.clientFor(call.providerRef);\n const access = await client.resolveAccess(target, executionContext);\n const request = compileProviderOperationRequest({ operation, providerRef: call.providerRef, input, access });\n\n try {\n // `access` is handed on so the client can SIGN, which only it can do last. Resolving it twice\n // would be a second read of the same secrets and, for a signed provider, a second timestamp.\n const response = await client.execute(request, operation.remoteCallSemantics, access);\n this.record(call.providerRef, operation, target, executionContext, { status: response.status });\n // A 2xx is the provider ACCEPTING the credential. Recording it is what moves a stored row off\n // UNVALIDATED — which is otherwise where every working credential stays forever, so an operator\n // reading the settings screen cannot tell a healthy integration from one that has never run.\n this.recordCredentialOutcome(call.providerRef, target, access, { accepted: response.status < 400 });\n\n const payload = operation.resultPath ? resolveHttpApiResultPath(response.json, operation.resultPath) : response.json;\n if (!operation.outputSchema) {\n return { status: response.status, output: payload as TOutput, rawBody: response.json, operation };\n }\n const parsed = operation.outputSchema.safeParse(payload);\n if (!parsed.success) {\n // A vendor answering a shape the declaration does not describe is a CONTRACT problem, and\n // the honest place to learn it is here rather than three frames into the caller.\n throw new ProviderOperationRequestError(\n `Provider '${call.providerRef}' answered '${operation.operationId}' with a body its declared outputSchema rejects: `\n + parsed.error.issues.map((issue) => `${issue.path.join('.') \|\| '(root)'} ${issue.message}`).join('; '),\n { kind: ProviderOperationRequestFailureKind.DECLARATION_INCOHERENT, operationId: operation.operationId, providerRef: call.providerRef },\n );\n }\n return { status: response.status, output: parsed.data as TOutput, rawBody: response.json, operation };\n } catch (error) {\n const detail = (error as { detail?: { status?: number; kind?: string } }).detail;\n this.record(call.providerRef, operation, target, executionContext, {\n status: detail?.status,\n failureKind: detail?.kind ?? (error instanceof Error ? error.name : 'UNKNOWN'),\n });\n throw error;\n }\n }\n\n /\n Stamp the stored credential with what the provider said. Best-effort, and after the call.\n \n Fire-and-forget for the reason the audit emit is: the outbound call has already happened, so\n * failing the caller because a bookkeeping write did not land would turn a successful integration\n * into an error. What is NEW is that a drop is now COUNTED — this seam spent its whole life behind\n * a constructor parameter the container never passed, so every outbound call found no recorder and\n * wrote nothing, and every credential that had in fact just worked still read as never tried. A\n * silence nobody counts is how that survives; {@link AuditObservationKind.PROVIDER_CREDENTIAL_USE}\n * is what ends it.\n \n ## Why the REGISTRY and not a store\n \n Because the executor cannot route this correctly and must not try. `target.ownerId` is a USER id\n * whenever `ownerScope` is `USER` (#333's two-axis connection shape), so a recorder typed with an\n * `organizationId` — which is exactly what the dead parameter was — would have stamped a tenant row\n * that does not exist and emitted an organization audit event naming a user id as the organization.\n * `recordProviderSecretUseForTarget` dispatches by the same rule, in the same order, as the\n * resolution that produced this credential, so the store that was read is the store that is\n stamped* is a property of one function rather than an agreement between two.\n \n Only a call whose credential came from a STORE has a row: an APPLICATION-owned resolution carries\n * no provenance and is skipped here rather than filtered later, so the deployment environment can\n * never acquire a row describing a credential the tenant never set.\n /\n private recordCredentialOutcome(\n providerRef: string,\n target: ExternalProvider_ConnectionTarget,\n access: { credentialProvenance?: HttpApiProviderAccess['credentialProvenance'] },\n outcome: { accepted: boolean; providerMessage?: string },\n ): void {\n const provenance = access.credentialProvenance;\n if (!provenance \|\| target.ownerId === undefined) return;\n // Feature-detected on the METHOD, not the object: a registry double built with `as never`\n // (several proof harnesses are) is truthy and may model only what the call path needed. Detecting\n // here reports the honest SERVICE_UNAVAILABLE instead of an EMISSION_THREW TypeError.\n const registry = this.externalProvidersRegistry as Partial<ExternalProvidersRegistryBackendService>;\n emitAuditObservation({\n observation: AuditObservationKind.PROVIDER_CREDENTIAL_USE,\n emit: typeof registry.recordProviderSecretUseForTarget === 'function'\n ? () => registry.recordProviderSecretUseForTarget!(target, providerRef, provenance, outcome)\n : undefined,\n metricsResolver: this.metricsResolver,\n logger: this.logger,\n context: { providerRef, ownerScope: target.ownerScope, secretSlug: provenance.secretSlug },\n });\n }\n\n /\n Record one outbound call. Fire-and-forget and feature-detected, per the house pattern: a partial\n * audit binding or a store failure must never fail the call it observes.\n \n Called on BOTH the success and the failure path deliberately — a refused or failed outbound call\n * is exactly what a reviewer wants to see, and a trail that records only what worked is a trail\n * that hides the attempts.\n \n Routed through {@link emitAuditObservation} so that an absent sink is COUNTED. That matters more\n * here than almost anywhere: an empty outbound trail reads as \"this deployment integrates with\n * nothing\", which is a sentence somebody will believe.\n \n assurance-control: WILDO.AUDIT.ATTRIBUTION\n /\n private record(\n providerRef: string,\n operation: ProviderRestOperation,\n target: ExternalProvider_ConnectionTarget,\n executionContext: ExecutionContext<any>,\n outcome: { status?: number; failureKind?: string },\n ): void {\n const auditLogsService = this.resolveAuditLogsService();\n const initiatorIds = (executionContext as { initiatorIds?: { userId?: string; organizationId?: string } }).initiatorIds;\n const emit = auditLogsService?.logProviderOperationCall;\n emitAuditObservation({\n observation: AuditObservationKind.PROVIDER_OPERATION_CALL,\n emit: typeof emit === 'function'\n ? () => emit.call(auditLogsService, {\n providerRef,\n operationId: operation.operationId,\n domain: operation.domain,\n method: operation.method,\n classification: operation.classification,\n connectionOwnerScope: target.ownerScope,\n ...(target.ownerId === undefined ? {} : { connectionOwnerId: target.ownerId }),\n connectionDelegation: target.delegation,\n initiatorUserId: initiatorIds?.userId,\n organizationId: initiatorIds?.organizationId,\n executionType: (executionContext as { executionType?: string }).executionType,\n ...outcome,\n }, executionContext)\n : undefined,\n metricsResolver: this.metricsResolver,\n logger: this.logger,\n context: { providerRef, operationId: operation.operationId },\n });\n }\n\n /\n The audit service, or `undefined` when nothing is bound.\n \n Its own `try`: resolving a container binding may throw, and that throw must be a\n * SERVICE_UNAVAILABLE loss rather than an exception on the outbound call's own path.\n */\n private resolveAuditLogsService(): ReturnType<ProviderOperationAuditResolver> {\n try {\n return this.auditResolver?.();\n } catch {\n return undefined;\n }\n }\n}\n"]}

package/dist/esm/external-providers/operations/provider-operation-request.backend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-operation-request.backend.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/external-providers/operations/provider-operation-request.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAAkE,KAAK,qBAAqB,EAAuC,MAAM,sCAAsC,CAAC;AAEvL,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,2FAA2F,CAAC;AAEnG,6EAA6E;AAC7E,oBAAY,mCAAmC;IAC7C,iFAAiF;IACjF,cAAc,mBAAmB;IACjC,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,mGAAmG;IACnG,sBAAsB,2BAA2B;CAClD;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAGpC,MAAM,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;QACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B;gBALD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;QACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B;CAKJ;AAmBD,qGAAqG;AACrG,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAEtF;AAaD,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,qBAAqB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzC,4EAA4E;IAC5E,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CAC9D;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CAiK7G"}
1	+ {"version":3,"file":"provider-operation-request.backend.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/operations/provider-operation-request.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAAkE,KAAK,qBAAqB,EAAuC,MAAM,sCAAsC,CAAC;AAEvL,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,2FAA2F,CAAC;AAEnG,6EAA6E;AAC7E,oBAAY,mCAAmC;IAC7C,iFAAiF;IACjF,cAAc,mBAAmB;IACjC,+FAA+F;IAC/F,gBAAgB,qBAAqB;IACrC,mGAAmG;IACnG,sBAAsB,2BAA2B;CAClD;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAGpC,MAAM,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;QACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B;gBALD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE;QACtB,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;QACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B;CAKJ;AAmBD,qGAAqG;AACrG,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAEtF;AAaD,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,qBAAqB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzC,4EAA4E;IAC5E,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CAC9D;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CAiK7G"}

package/dist/esm/external-providers/operations/provider-operation-request.backend.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-operation-request.backend.js","sourceRoot":"","sources":["../../../../../src/external-providers/operations/provider-operation-request.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE;;;;;;;;GAQG;AACH,OAAO,EAAE,6BAA6B,EAAE,+BAA+B,EAAmE,MAAM,sCAAsC,CAAC;AAEvL,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GAGjC,MAAM,2FAA2F,CAAC;AAEnG,6EAA6E;AAC7E,MAAM,CAAN,IAAY,mCAOX;AAPD,WAAY,mCAAmC;IAC7C,iFAAiF;IACjF,wEAAiC,CAAA;IACjC,+FAA+F;IAC/F,4EAAqC,CAAA;IACrC,mGAAmG;IACnG,wFAAiD,CAAA;AACnD,CAAC,EAPW,mCAAmC,KAAnC,mCAAmC,QAO9C;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAGpC;IAFlB,YACE,OAAe,EACC,MAIf;QAED,KAAK,CAAC,OAAO,CAAC,CAAC;QANC,WAAM,GAAN,MAAM,CAIrB;QAGD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAqC,IAAI,GAAG,CAAC;IACnE,cAAc,CAAC,GAAG;IAClB,cAAc,CAAC,IAAI;IACnB,cAAc,CAAC,OAAO;IACtB,cAAc,CAAC,GAAG;IAClB,cAAc,CAAC,MAAM;CACtB,CAAC,CAAC;AAEH,qGAAqG;AACrG,MAAM,UAAU,4BAA4B,CAAC,SAAgC;IAC3E,OAAO,SAAS,CAAC,UAAU,IAAI,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,gGAAgG;AAChG,SAAS,YAAY,CAAC,SAAyC;IAC7D,OAAO,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAoC;IAClF,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,IAAyC,EAAE,OAAe,EAAS,EAAE;QACnF,MAAM,IAAI,6BAA6B,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9G,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC;IAC9C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,MAAM,QAAQ,GAAG,CAAC,SAAyC,EAAW,EAAE;QACtE,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,aAAa,CAAC;QAC1E,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,8EAA8E;IAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,6BAA6B,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CACtI,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,KAAa,EAAE,EAAE;QAChF,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,4FAA4F;YAC5F,OAAO,MAAM,CACX,mCAAmC,CAAC,sBAAsB,EAC1D,cAAc,SAAS,CAAC,WAAW,0BAA0B,KAAK,4CAA4C,KAAK,IAAI,CACxH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,MAAM,CACX,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,YAAY,YAAY,CAAC,SAAS,CAAC,0BAA0B,KAAK,4CAA4C,CAClJ,CAAC;QACJ,CAAC;QACD,OAAO,kBAAkB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,EAAE,KAAK,6BAA6B,CAAC,KAAK;YAAE,SAAS;QACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,CACJ,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,eAAe,SAAS,CAAC,IAAI,yEAAyE,CAC1I,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QACD,wFAAwF;QACxF,yFAAyF;QACzF,kEAAkE;QAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,KAAK;gBAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1F,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,EAAE,KAAK,6BAA6B,CAAC,MAAM;YAAE,SAAS;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,CACJ,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,eAAe,SAAS,CAAC,IAAI,gEAAgE,CACjI,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAsC,CAAC;IAC3C,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,KAAK,SAAS;YAC5C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzG,QAAQ,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC7B,KAAK,+BAA+B,CAAC,IAAI;gBACvC,IAAI,GAAG,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;gBACvE,MAAM;YACR,KAAK,+BAA+B,CAAC,eAAe,CAAC,CAAC,CAAC;gBACrD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACpD,MAAM,CACJ,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,iDAAiD,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,wBAAwB,CACvJ,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAA2B,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;oBAChF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;wBAAE,SAAS;oBACpD,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;gBACrC,CAAC;gBACD,IAAI,GAAG,EAAE,QAAQ,EAAE,4BAA4B,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACjF,MAAM;YACR,CAAC;YACD,KAAK,+BAA+B,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC/C,IAAI,CAAC,CAAC,OAAO,YAAY,QAAQ,CAAC,EAAE,CAAC;oBACnC,uFAAuF;oBACvF,uFAAuF;oBACvF,2DAA2D;oBAC3D,MAAM,CACJ,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,+DAA+D;0BAChG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,yBAAyB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,GAAG,CAC/H,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,EAAE,QAAQ,EAAE,4BAA4B,CAAC,SAAS,EAAE,KAAK,EAAE,OAAmB,EAAE,CAAC;gBACxF,MAAM;YACR,CAAC;YACD,KAAK,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAChC,MAAM,CACJ,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,wDAAwD;0BACzF,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,yBAAyB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,GAAG,CAC/H,CAAC;gBACJ,CAAC;gBACD,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC1C,MAAM,CACJ,mCAAmC,CAAC,sBAAsB,EAC1D,cAAc,SAAS,CAAC,WAAW,0GAA0G,CAC9I,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,OAAiB,EAAE,WAAW,EAAE,WAAW,CAAC,WAAqB,EAAE,CAAC;gBACjI,MAAM;YACR,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,eAAe,GAAU,WAAW,CAAC,QAAQ,CAAC;gBACpD,OAAO,eAAe,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChC,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACrE,OAAO;QACP,IAAI;QACJ,2FAA2F;QAC3F,8FAA8F;QAC9F,2EAA2E;QAC3E,gGAAgG;QAChG,+EAA+E;QAC/E,EAAE;QACF,6FAA6F;QAC7F,4FAA4F;QAC5F,gBAAgB,EAAE,gCAAgC,CAAC,IAAI;QACvD,SAAS,EAAE,4BAA4B,CAAC,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC","sourcesContent":["/*\n Compiling a declared provider operation + a caller's input into ONE transport request (S3a,\n * #331).\n \n Deliberately a pure function over data, with no registry, no secrets and no I/O: an operation\n * declaration and an input go in, an {@link HttpApiTransportRequest} comes out. That is what makes\n * the interesting half — which input field lands in the path, which in the query, which in the\n * body, and whether the call may be retried — testable without a network, a provider or a\n * container.\n \n What this does NOT do, on purpose: it never PAGES. `pagination` on an operation is a hint the\n * caller reads; an executor that paged on its own would decide a caller's memory budget for it.\n /\n\nimport { API_HttpMethod } from '@wildo-ai/external-connectors-models';\n/\n * `./backend` is the door that exists on `test`. #330 is splitting the private package by\n * AUDIENCE — `./backend-runtime` for what executes, `./backend` for tooling that enumerates every\n * engine-shipped provider — and has already moved backend-lib's runtime imports across in its own\n * work. This file was new and not in that sweep; #330 landed the split and moved this specifier with\n * the others, so the operations lane no longer pulls the eager registry into a running host. A\n * guard in `backend-provider-loader.module-graph.test.ts` now refuses any value import of the eager\n * barrel from this package's source, which is what stops the next new file re-introducing it.\n /\nimport { ProviderRestParameterLocation, ProviderRestRequestBodyEncoding, type ProviderRestOperation, type ProviderRestOperationParameter } from '@wildo-ai/external-connectors-models';\n\nimport {\n HttpApiTransportBodyEncoding,\n HttpApiTransportResponseDecoding,\n type HttpApiTransportBody,\n type HttpApiTransportRequest,\n} from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-transport.backend';\n\n/* What went wrong while turning a declaration + an input into a request. /\nexport enum ProviderOperationRequestFailureKind {\n /* The caller's input does not satisfy the operation's declared input schema. /\n INPUT_REJECTED = 'INPUT_REJECTED',\n /* A required value is absent — a path token with nothing to fill it, a required parameter. /\n INPUT_INCOMPLETE = 'INPUT_INCOMPLETE',\n /* The DECLARATION is inconsistent — a path token no parameter declares, a body with no source. /\n DECLARATION_INCOHERENT = 'DECLARATION_INCOHERENT',\n}\n\nexport class ProviderOperationRequestError extends Error {\n constructor(\n message: string,\n public readonly detail: {\n readonly kind: ProviderOperationRequestFailureKind;\n readonly operationId: string;\n readonly providerRef: string;\n },\n ) {\n super(message);\n this.name = 'ProviderOperationRequestError';\n }\n}\n\n/\n Methods whose repetition is safe.\n * spec-cite: RFC 9110 §9.2.2 — \"PUT, DELETE, and the safe request methods are idempotent\";\n * §9.2.1 names GET, HEAD, OPTIONS and TRACE as the safe ones.\n \n This is only the DEFAULT: an operation may declare `idempotent` and override it in either\n * direction — `true` on a POST the vendor documents behind an idempotency key, `false` on a PUT\n * whose target is not really a resource replacement.\n /\nconst IDEMPOTENT_METHODS: ReadonlySet<`${API_HttpMethod}`> = new Set([\n API_HttpMethod.GET,\n API_HttpMethod.HEAD,\n API_HttpMethod.OPTIONS,\n API_HttpMethod.PUT,\n API_HttpMethod.DELETE,\n]);\n\n/* Whether re-sending this operation is safe — the value that reaches the transport's retry gate. /\nexport function providerOperationIsRetrySafe(operation: ProviderRestOperation): boolean {\n return operation.idempotent ?? IDEMPOTENT_METHODS.has(operation.method);\n}\n\nconst PATH_TOKEN = /\\{([^}]+)\\}/g;\n\n/* The input field feeding a parameter: its own `from`, or the wire name when the two agree. /\nfunction inputFieldOf(parameter: ProviderRestOperationParameter): string {\n return parameter.from ?? parameter.name;\n}\n\nfunction asWireValue(value: unknown): string {\n return typeof value === 'string' ? value : String(value);\n}\n\nexport interface CompileProviderOperationInput {\n operation: ProviderRestOperation;\n providerRef: string;\n /* Already validated against `operation.inputSchema` by the executor when one is declared. /\n input: Readonly<Record<string, unknown>>;\n /* Base URL and auth/default headers, from the provider access resolver. /\n access: { baseUrl: string; headers: Record<string, string> };\n}\n\n/\n Build the request. Reads in one direction — path, then query, then headers, then body — and\n * records which input fields were consumed on the way, because the body's default source is\n * \"everything not consumed\" and that set can only be known after the parameters are placed.\n */\nexport function compileProviderOperationRequest(input: CompileProviderOperationInput): HttpApiTransportRequest {\n const { operation, providerRef, access } = input;\n const refuse = (kind: ProviderOperationRequestFailureKind, message: string): never => {\n throw new ProviderOperationRequestError(message, { kind, operationId: operation.operationId, providerRef });\n };\n\n const parameters = operation.parameters ?? [];\n const consumedInputFields = new Set<string>();\n\n const valueFor = (parameter: ProviderRestOperationParameter): unknown => {\n if (parameter.constantValue !== undefined) return parameter.constantValue;\n const field = inputFieldOf(parameter);\n consumedInputFields.add(field);\n return input.input[field];\n };\n\n // ── path ───────────────────────────────────────────────────────────────────\n const pathParameters = new Map(\n parameters.filter((parameter) => parameter.in === ProviderRestParameterLocation.PATH).map((parameter) => [parameter.name, parameter]),\n );\n const path = operation.pathTemplate.replace(PATH_TOKEN, (_match, token: string) => {\n const parameter = pathParameters.get(token);\n if (!parameter) {\n // The declaration is wrong, not the call: a path template cannot have a hole nothing fills.\n return refuse(\n ProviderOperationRequestFailureKind.DECLARATION_INCOHERENT,\n `Operation '${operation.operationId}' has the path token '{${token}}' and declares no PATH parameter named '${token}'.`,\n );\n }\n const value = valueFor(parameter);\n if (value === undefined \|\| value === null \|\| value === '') {\n return refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' needs '${inputFieldOf(parameter)}' for the path token '{${token}}', and the input carries no value for it.`,\n );\n }\n return encodeURIComponent(asWireValue(value));\n });\n\n // ── query ──────────────────────────────────────────────────────────────────\n const search = new URLSearchParams();\n for (const parameter of parameters) {\n if (parameter.in !== ProviderRestParameterLocation.QUERY) continue;\n const value = valueFor(parameter);\n if (value === undefined \|\| value === null) {\n if (parameter.required) {\n refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' declares '${parameter.name}' as a required query parameter, and the input carries no value for it.`,\n );\n }\n continue;\n }\n // An array becomes REPEATED parameters (`?tag=a&tag=b`), the only encoding every target\n // accepts. A vendor wanting a joined list declares one field and the caller joins it — a\n // guess here would silently send the wrong thing to half of them.\n if (Array.isArray(value)) {\n for (const entry of value) search.append(parameter.name, asWireValue(entry));\n continue;\n }\n search.append(parameter.name, asWireValue(value));\n }\n\n // ── headers ────────────────────────────────────────────────────────────────\n const headers: Record<string, string> = { Accept: 'application/json', ...access.headers };\n for (const parameter of parameters) {\n if (parameter.in !== ProviderRestParameterLocation.HEADER) continue;\n const value = valueFor(parameter);\n if (value === undefined \|\| value === null) {\n if (parameter.required) {\n refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' declares '${parameter.name}' as a required header, and the input carries no value for it.`,\n );\n }\n continue;\n }\n headers[parameter.name] = asWireValue(value);\n }\n\n // ── body ───────────────────────────────────────────────────────────────────\n let body: HttpApiTransportBody \| undefined;\n if (operation.requestBody) {\n const declaration = operation.requestBody;\n const payload = declaration.from !== undefined\n ? input.input[declaration.from]\n : Object.fromEntries(Object.entries(input.input).filter(([field]) => !consumedInputFields.has(field)));\n switch (declaration.encoding) {\n case ProviderRestRequestBodyEncoding.JSON:\n body = { encoding: HttpApiTransportBodyEncoding.JSON, value: payload };\n break;\n case ProviderRestRequestBodyEncoding.FORM_URLENCODED: {\n if (payload === null \|\| typeof payload !== 'object') {\n refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' sends a form body and the input resolves to ${payload === null ? 'null' : typeof payload} instead of an object.`,\n );\n }\n const fields: Record<string, string> = {};\n for (const [field, value] of Object.entries(payload as Record<string, unknown>)) {\n if (value === undefined \|\| value === null) continue;\n fields[field] = asWireValue(value);\n }\n body = { encoding: HttpApiTransportBodyEncoding.FORM_URLENCODED, value: fields };\n break;\n }\n case ProviderRestRequestBodyEncoding.MULTIPART: {\n if (!(payload instanceof FormData)) {\n // Deliberately NOT built from a plain object here: a multipart part carries a filename\n // and a media type the caller knows and this layer does not, and inventing them is how\n // an upload arrives as `blob` with the wrong content type.\n refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' sends a multipart body, so its input must supply a FormData`\n + `${declaration.from ? ` in '${declaration.from}'` : ''}; the caller supplied ${payload === null ? 'null' : typeof payload}.`,\n );\n }\n body = { encoding: HttpApiTransportBodyEncoding.MULTIPART, value: payload as FormData };\n break;\n }\n case ProviderRestRequestBodyEncoding.TEXT: {\n if (typeof payload !== 'string') {\n refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' sends a text body, so its input must supply a string`\n + `${declaration.from ? ` in '${declaration.from}'` : ''}; the caller supplied ${payload === null ? 'null' : typeof payload}.`,\n );\n }\n if (declaration.contentType === undefined) {\n refuse(\n ProviderOperationRequestFailureKind.DECLARATION_INCOHERENT,\n `Operation '${operation.operationId}' sends a text body and declares no contentType — a text body without its media type is not addressable.`,\n );\n }\n body = { encoding: HttpApiTransportBodyEncoding.TEXT, value: payload as string, contentType: declaration.contentType as string };\n break;\n }\n default: {\n const exhaustiveCheck: never = declaration.encoding;\n return exhaustiveCheck;\n }\n }\n }\n\n const query = search.toString();\n return {\n method: operation.method,\n url: `${access.baseUrl}${path}${query.length > 0 ? `?${query}` : ''}`,\n headers,\n body,\n // ALWAYS JSON, and stated rather than left to the transport's default so the limitation is\n // visible at the site that imposes it: the operation declaration has no way to say the vendor\n // answers `text/csv` or answers nothing at all. The transport carries both\n // (`HttpApiTransportResponseDecoding.TEXT` / `.NONE`) and the request body already speaks TEXT,\n // so this is an asymmetry rather than a design — filed, not deferred silently.\n //\n // An earlier revision wrote `outputSchema \|\| resultPath ? JSON : undefined`, which implied a\n // distinction that does not exist: absent means JSON too, so both arms were the same value.\n responseDecoding: HttpApiTransportResponseDecoding.JSON,\n retrySafe: providerOperationIsRetrySafe(operation),\n };\n}\n"]}
1	+ {"version":3,"file":"provider-operation-request.backend.js","sourceRoot":"","sources":["../../../../src/external-providers/operations/provider-operation-request.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE;;;;;;;;GAQG;AACH,OAAO,EAAE,6BAA6B,EAAE,+BAA+B,EAAmE,MAAM,sCAAsC,CAAC;AAEvL,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GAGjC,MAAM,2FAA2F,CAAC;AAEnG,6EAA6E;AAC7E,MAAM,CAAN,IAAY,mCAOX;AAPD,WAAY,mCAAmC;IAC7C,iFAAiF;IACjF,wEAAiC,CAAA;IACjC,+FAA+F;IAC/F,4EAAqC,CAAA;IACrC,mGAAmG;IACnG,wFAAiD,CAAA;AACnD,CAAC,EAPW,mCAAmC,KAAnC,mCAAmC,QAO9C;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAGpC;IAFlB,YACE,OAAe,EACC,MAIf;QAED,KAAK,CAAC,OAAO,CAAC,CAAC;QANC,WAAM,GAAN,MAAM,CAIrB;QAGD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAqC,IAAI,GAAG,CAAC;IACnE,cAAc,CAAC,GAAG;IAClB,cAAc,CAAC,IAAI;IACnB,cAAc,CAAC,OAAO;IACtB,cAAc,CAAC,GAAG;IAClB,cAAc,CAAC,MAAM;CACtB,CAAC,CAAC;AAEH,qGAAqG;AACrG,MAAM,UAAU,4BAA4B,CAAC,SAAgC;IAC3E,OAAO,SAAS,CAAC,UAAU,IAAI,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,gGAAgG;AAChG,SAAS,YAAY,CAAC,SAAyC;IAC7D,OAAO,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAoC;IAClF,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,IAAyC,EAAE,OAAe,EAAS,EAAE;QACnF,MAAM,IAAI,6BAA6B,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9G,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC;IAC9C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,MAAM,QAAQ,GAAG,CAAC,SAAyC,EAAW,EAAE;QACtE,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,aAAa,CAAC;QAC1E,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,8EAA8E;IAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,6BAA6B,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CACtI,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,KAAa,EAAE,EAAE;QAChF,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,4FAA4F;YAC5F,OAAO,MAAM,CACX,mCAAmC,CAAC,sBAAsB,EAC1D,cAAc,SAAS,CAAC,WAAW,0BAA0B,KAAK,4CAA4C,KAAK,IAAI,CACxH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,MAAM,CACX,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,YAAY,YAAY,CAAC,SAAS,CAAC,0BAA0B,KAAK,4CAA4C,CAClJ,CAAC;QACJ,CAAC;QACD,OAAO,kBAAkB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,EAAE,KAAK,6BAA6B,CAAC,KAAK;YAAE,SAAS;QACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,CACJ,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,eAAe,SAAS,CAAC,IAAI,yEAAyE,CAC1I,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QACD,wFAAwF;QACxF,yFAAyF;QACzF,kEAAkE;QAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,KAAK;gBAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,8EAA8E;IAC9E,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1F,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,EAAE,KAAK,6BAA6B,CAAC,MAAM;YAAE,SAAS;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,CACJ,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,eAAe,SAAS,CAAC,IAAI,gEAAgE,CACjI,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAsC,CAAC;IAC3C,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,KAAK,SAAS;YAC5C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzG,QAAQ,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC7B,KAAK,+BAA+B,CAAC,IAAI;gBACvC,IAAI,GAAG,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;gBACvE,MAAM;YACR,KAAK,+BAA+B,CAAC,eAAe,CAAC,CAAC,CAAC;gBACrD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACpD,MAAM,CACJ,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,iDAAiD,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,wBAAwB,CACvJ,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAA2B,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;oBAChF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;wBAAE,SAAS;oBACpD,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;gBACrC,CAAC;gBACD,IAAI,GAAG,EAAE,QAAQ,EAAE,4BAA4B,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACjF,MAAM;YACR,CAAC;YACD,KAAK,+BAA+B,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC/C,IAAI,CAAC,CAAC,OAAO,YAAY,QAAQ,CAAC,EAAE,CAAC;oBACnC,uFAAuF;oBACvF,uFAAuF;oBACvF,2DAA2D;oBAC3D,MAAM,CACJ,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,+DAA+D;0BAChG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,yBAAyB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,GAAG,CAC/H,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,EAAE,QAAQ,EAAE,4BAA4B,CAAC,SAAS,EAAE,KAAK,EAAE,OAAmB,EAAE,CAAC;gBACxF,MAAM;YACR,CAAC;YACD,KAAK,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAChC,MAAM,CACJ,mCAAmC,CAAC,gBAAgB,EACpD,cAAc,SAAS,CAAC,WAAW,wDAAwD;0BACzF,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,yBAAyB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,GAAG,CAC/H,CAAC;gBACJ,CAAC;gBACD,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC1C,MAAM,CACJ,mCAAmC,CAAC,sBAAsB,EAC1D,cAAc,SAAS,CAAC,WAAW,0GAA0G,CAC9I,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,EAAE,QAAQ,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,OAAiB,EAAE,WAAW,EAAE,WAAW,CAAC,WAAqB,EAAE,CAAC;gBACjI,MAAM;YACR,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,eAAe,GAAU,WAAW,CAAC,QAAQ,CAAC;gBACpD,OAAO,eAAe,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChC,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACrE,OAAO;QACP,IAAI;QACJ,2FAA2F;QAC3F,8FAA8F;QAC9F,2EAA2E;QAC3E,gGAAgG;QAChG,+EAA+E;QAC/E,EAAE;QACF,6FAA6F;QAC7F,4FAA4F;QAC5F,gBAAgB,EAAE,gCAAgC,CAAC,IAAI;QACvD,SAAS,EAAE,4BAA4B,CAAC,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC","sourcesContent":["/*\n Compiling a declared provider operation + a caller's input into ONE transport request (S3a,\n * #331).\n \n Deliberately a pure function over data, with no registry, no secrets and no I/O: an operation\n * declaration and an input go in, an {@link HttpApiTransportRequest} comes out. That is what makes\n * the interesting half — which input field lands in the path, which in the query, which in the\n * body, and whether the call may be retried — testable without a network, a provider or a\n * container.\n \n What this does NOT do, on purpose: it never PAGES. `pagination` on an operation is a hint the\n * caller reads; an executor that paged on its own would decide a caller's memory budget for it.\n /\n\nimport { API_HttpMethod } from '@wildo-ai/external-connectors-models';\n/\n * `./backend` is the door that exists on `test`. #330 is splitting the private package by\n * AUDIENCE — `./backend-runtime` for what executes, `./backend` for tooling that enumerates every\n * engine-shipped provider — and has already moved backend-lib's runtime imports across in its own\n * work. This file was new and not in that sweep; #330 landed the split and moved this specifier with\n * the others, so the operations lane no longer pulls the eager registry into a running host. A\n * guard in `backend-provider-loader.module-graph.test.ts` now refuses any value import of the eager\n * barrel from this package's source, which is what stops the next new file re-introducing it.\n /\nimport { ProviderRestParameterLocation, ProviderRestRequestBodyEncoding, type ProviderRestOperation, type ProviderRestOperationParameter } from '@wildo-ai/external-connectors-models';\n\nimport {\n HttpApiTransportBodyEncoding,\n HttpApiTransportResponseDecoding,\n type HttpApiTransportBody,\n type HttpApiTransportRequest,\n} from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-transport.backend';\n\n/* What went wrong while turning a declaration + an input into a request. /\nexport enum ProviderOperationRequestFailureKind {\n /* The caller's input does not satisfy the operation's declared input schema. /\n INPUT_REJECTED = 'INPUT_REJECTED',\n /* A required value is absent — a path token with nothing to fill it, a required parameter. /\n INPUT_INCOMPLETE = 'INPUT_INCOMPLETE',\n /* The DECLARATION is inconsistent — a path token no parameter declares, a body with no source. /\n DECLARATION_INCOHERENT = 'DECLARATION_INCOHERENT',\n}\n\nexport class ProviderOperationRequestError extends Error {\n constructor(\n message: string,\n public readonly detail: {\n readonly kind: ProviderOperationRequestFailureKind;\n readonly operationId: string;\n readonly providerRef: string;\n },\n ) {\n super(message);\n this.name = 'ProviderOperationRequestError';\n }\n}\n\n/\n Methods whose repetition is safe.\n * spec-cite: RFC 9110 §9.2.2 — \"PUT, DELETE, and the safe request methods are idempotent\";\n * §9.2.1 names GET, HEAD, OPTIONS and TRACE as the safe ones.\n \n This is only the DEFAULT: an operation may declare `idempotent` and override it in either\n * direction — `true` on a POST the vendor documents behind an idempotency key, `false` on a PUT\n * whose target is not really a resource replacement.\n /\nconst IDEMPOTENT_METHODS: ReadonlySet<`${API_HttpMethod}`> = new Set([\n API_HttpMethod.GET,\n API_HttpMethod.HEAD,\n API_HttpMethod.OPTIONS,\n API_HttpMethod.PUT,\n API_HttpMethod.DELETE,\n]);\n\n/* Whether re-sending this operation is safe — the value that reaches the transport's retry gate. /\nexport function providerOperationIsRetrySafe(operation: ProviderRestOperation): boolean {\n return operation.idempotent ?? IDEMPOTENT_METHODS.has(operation.method);\n}\n\nconst PATH_TOKEN = /\\{([^}]+)\\}/g;\n\n/* The input field feeding a parameter: its own `from`, or the wire name when the two agree. /\nfunction inputFieldOf(parameter: ProviderRestOperationParameter): string {\n return parameter.from ?? parameter.name;\n}\n\nfunction asWireValue(value: unknown): string {\n return typeof value === 'string' ? value : String(value);\n}\n\nexport interface CompileProviderOperationInput {\n operation: ProviderRestOperation;\n providerRef: string;\n /* Already validated against `operation.inputSchema` by the executor when one is declared. /\n input: Readonly<Record<string, unknown>>;\n /* Base URL and auth/default headers, from the provider access resolver. /\n access: { baseUrl: string; headers: Record<string, string> };\n}\n\n/\n Build the request. Reads in one direction — path, then query, then headers, then body — and\n * records which input fields were consumed on the way, because the body's default source is\n * \"everything not consumed\" and that set can only be known after the parameters are placed.\n */\nexport function compileProviderOperationRequest(input: CompileProviderOperationInput): HttpApiTransportRequest {\n const { operation, providerRef, access } = input;\n const refuse = (kind: ProviderOperationRequestFailureKind, message: string): never => {\n throw new ProviderOperationRequestError(message, { kind, operationId: operation.operationId, providerRef });\n };\n\n const parameters = operation.parameters ?? [];\n const consumedInputFields = new Set<string>();\n\n const valueFor = (parameter: ProviderRestOperationParameter): unknown => {\n if (parameter.constantValue !== undefined) return parameter.constantValue;\n const field = inputFieldOf(parameter);\n consumedInputFields.add(field);\n return input.input[field];\n };\n\n // ── path ───────────────────────────────────────────────────────────────────\n const pathParameters = new Map(\n parameters.filter((parameter) => parameter.in === ProviderRestParameterLocation.PATH).map((parameter) => [parameter.name, parameter]),\n );\n const path = operation.pathTemplate.replace(PATH_TOKEN, (_match, token: string) => {\n const parameter = pathParameters.get(token);\n if (!parameter) {\n // The declaration is wrong, not the call: a path template cannot have a hole nothing fills.\n return refuse(\n ProviderOperationRequestFailureKind.DECLARATION_INCOHERENT,\n `Operation '${operation.operationId}' has the path token '{${token}}' and declares no PATH parameter named '${token}'.`,\n );\n }\n const value = valueFor(parameter);\n if (value === undefined \|\| value === null \|\| value === '') {\n return refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' needs '${inputFieldOf(parameter)}' for the path token '{${token}}', and the input carries no value for it.`,\n );\n }\n return encodeURIComponent(asWireValue(value));\n });\n\n // ── query ──────────────────────────────────────────────────────────────────\n const search = new URLSearchParams();\n for (const parameter of parameters) {\n if (parameter.in !== ProviderRestParameterLocation.QUERY) continue;\n const value = valueFor(parameter);\n if (value === undefined \|\| value === null) {\n if (parameter.required) {\n refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' declares '${parameter.name}' as a required query parameter, and the input carries no value for it.`,\n );\n }\n continue;\n }\n // An array becomes REPEATED parameters (`?tag=a&tag=b`), the only encoding every target\n // accepts. A vendor wanting a joined list declares one field and the caller joins it — a\n // guess here would silently send the wrong thing to half of them.\n if (Array.isArray(value)) {\n for (const entry of value) search.append(parameter.name, asWireValue(entry));\n continue;\n }\n search.append(parameter.name, asWireValue(value));\n }\n\n // ── headers ────────────────────────────────────────────────────────────────\n const headers: Record<string, string> = { Accept: 'application/json', ...access.headers };\n for (const parameter of parameters) {\n if (parameter.in !== ProviderRestParameterLocation.HEADER) continue;\n const value = valueFor(parameter);\n if (value === undefined \|\| value === null) {\n if (parameter.required) {\n refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' declares '${parameter.name}' as a required header, and the input carries no value for it.`,\n );\n }\n continue;\n }\n headers[parameter.name] = asWireValue(value);\n }\n\n // ── body ───────────────────────────────────────────────────────────────────\n let body: HttpApiTransportBody \| undefined;\n if (operation.requestBody) {\n const declaration = operation.requestBody;\n const payload = declaration.from !== undefined\n ? input.input[declaration.from]\n : Object.fromEntries(Object.entries(input.input).filter(([field]) => !consumedInputFields.has(field)));\n switch (declaration.encoding) {\n case ProviderRestRequestBodyEncoding.JSON:\n body = { encoding: HttpApiTransportBodyEncoding.JSON, value: payload };\n break;\n case ProviderRestRequestBodyEncoding.FORM_URLENCODED: {\n if (payload === null \|\| typeof payload !== 'object') {\n refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' sends a form body and the input resolves to ${payload === null ? 'null' : typeof payload} instead of an object.`,\n );\n }\n const fields: Record<string, string> = {};\n for (const [field, value] of Object.entries(payload as Record<string, unknown>)) {\n if (value === undefined \|\| value === null) continue;\n fields[field] = asWireValue(value);\n }\n body = { encoding: HttpApiTransportBodyEncoding.FORM_URLENCODED, value: fields };\n break;\n }\n case ProviderRestRequestBodyEncoding.MULTIPART: {\n if (!(payload instanceof FormData)) {\n // Deliberately NOT built from a plain object here: a multipart part carries a filename\n // and a media type the caller knows and this layer does not, and inventing them is how\n // an upload arrives as `blob` with the wrong content type.\n refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' sends a multipart body, so its input must supply a FormData`\n + `${declaration.from ? ` in '${declaration.from}'` : ''}; the caller supplied ${payload === null ? 'null' : typeof payload}.`,\n );\n }\n body = { encoding: HttpApiTransportBodyEncoding.MULTIPART, value: payload as FormData };\n break;\n }\n case ProviderRestRequestBodyEncoding.TEXT: {\n if (typeof payload !== 'string') {\n refuse(\n ProviderOperationRequestFailureKind.INPUT_INCOMPLETE,\n `Operation '${operation.operationId}' sends a text body, so its input must supply a string`\n + `${declaration.from ? ` in '${declaration.from}'` : ''}; the caller supplied ${payload === null ? 'null' : typeof payload}.`,\n );\n }\n if (declaration.contentType === undefined) {\n refuse(\n ProviderOperationRequestFailureKind.DECLARATION_INCOHERENT,\n `Operation '${operation.operationId}' sends a text body and declares no contentType — a text body without its media type is not addressable.`,\n );\n }\n body = { encoding: HttpApiTransportBodyEncoding.TEXT, value: payload as string, contentType: declaration.contentType as string };\n break;\n }\n default: {\n const exhaustiveCheck: never = declaration.encoding;\n return exhaustiveCheck;\n }\n }\n }\n\n const query = search.toString();\n return {\n method: operation.method,\n url: `${access.baseUrl}${path}${query.length > 0 ? `?${query}` : ''}`,\n headers,\n body,\n // ALWAYS JSON, and stated rather than left to the transport's default so the limitation is\n // visible at the site that imposes it: the operation declaration has no way to say the vendor\n // answers `text/csv` or answers nothing at all. The transport carries both\n // (`HttpApiTransportResponseDecoding.TEXT` / `.NONE`) and the request body already speaks TEXT,\n // so this is an asymmetry rather than a design — filed, not deferred silently.\n //\n // An earlier revision wrote `outputSchema \|\| resultPath ? JSON : undefined`, which implied a\n // distinction that does not exist: absent means JSON too, so both arms were the same value.\n responseDecoding: HttpApiTransportResponseDecoding.JSON,\n retrySafe: providerOperationIsRetrySafe(operation),\n };\n}\n"]}

package/dist/esm/external-providers/operations/provider-request-signing.backend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-request-signing.backend.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/external-providers/operations/provider-request-signing.backend.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAElH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2FAA2F,CAAC;~~AAEzI~~;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,mGAAmG;AACnG,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAcD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,0BAA0B,CAAC;IACjD,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,uBAAuB,CAY5F;~~AAuLD~~,oGAAoG;AACpG,eAAO,MAAM,0CAA0C,IAAoC,CAAC"}
1	+ {"version":3,"file":"provider-request-signing.backend.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/operations/provider-request-signing.backend.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAElH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2FAA2F,CAAC;AAGzI;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,mGAAmG;AACnG,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAcD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,0BAA0B,CAAC;IACjD,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,uBAAuB,CAY5F;AAyMD,oGAAoG;AACpG,eAAO,MAAM,0CAA0C,IAAoC,CAAC"}

package/dist/esm/external-providers/operations/provider-request-signing.backend.js CHANGED Viewed

@@ -1,5 +1,6 @@
 import { createHash, createHmac } from 'node:crypto';
 import { ProviderRestSigningScheme } from '@wildo-ai/external-connectors-models';
+import { withEngineOwnedHeaders } from '../../security/outbound/outbound-request-headers.backend.utils.js';
 /**
  * Per-request request signing — the credential a vendor COMPUTES rather than reads (#373).
  *
@@ -106,15 +107,31 @@ function signAwsSigV4(input) {
     ].join('\n');
     const signingKey = ['aws4_request'].reduce((key, step) => hmac(key, step), [region, service].reduce((key, step) => hmac(key, step), hmac(`AWS4${credentials.secretKey}`, dateStamp)));
     const signature = hmac(signingKey, stringToSign).toString('hex');
+    /*
+     * The signature headers are the engine's, and a catalogue-declared spelling cannot dilute them.
+     *
+     * `request.headers` carries the provider catalogue's `defaultHeaders`, so a catalogue naming
+     * `authorization` or `x-amz-date` against the canonical spellings written here would produce two
+     * object keys per header — combined by `fetch` into one comma-joined value, which AWS rejects as
+     * a malformed signature rather than as the header collision it is.
+     *
+     * Filtering is safe against the signature specifically because `signedHeaders` is computed from
+     * the CLOSED `headersToSign` set above (host, x-amz-date, x-amz-security-token, content-type) and
+     * never from `request.headers` at large — so no header being dropped here was ever signed.
+     * `content-type` is not engine-owned at this merge and is therefore left exactly as the caller
+     * set it, which is what keeps it agreeing with the value that WAS signed.
+     *
+     * The session token is reserved even when the engine has none: absent credentials must not be
+     * satisfiable by a value a provider catalogue supplied.
+     */
     return {
         ...request,
-        headers: {
-            ...request.headers,
+        headers: withEngineOwnedHeaders(request.headers, {
             'X-Amz-Date': amzDate,
-            ...(credentials.sessionToken === undefined ? {} : { 'X-Amz-Security-Token': credentials.sessionToken }),
+            'X-Amz-Security-Token': credentials.sessionToken,
             'X-Amz-Content-Sha256': payloadHash,
             Authorization: `AWS4-HMAC-SHA256 Credential=${credentials.keyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
-        },
+        }),
     };
 }
 /**
@@ -159,14 +176,16 @@ function signAzureSharedKey(input) {
         canonicalizedHeaders + canonicalizedResource,
     ].join('\n');
     const signature = createHmac('sha256', Buffer.from(credentials.secretKey, 'base64')).update(stringToSign, 'utf8').digest('base64');
+    // Same reasoning as the SigV4 twin: `canonicalizedHeaders` above is a fixed literal, so nothing
+    // dropped here was signed, and reserving the names stops a catalogue-declared spelling being
+    // combined with the engine's on the wire.
     return {
         ...request,
-        headers: {
-            ...request.headers,
+        headers: withEngineOwnedHeaders(request.headers, {
             'x-ms-date': date,
             'x-ms-version': '2021-12-02',
             Authorization: `SharedKey ${credentials.keyId}:${signature}`,
-        },
+        }),
     };
 }
 /**

package/dist/esm/external-providers/operations/provider-request-signing.backend.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-request-signing.backend.js","sourceRoot":"","sources":["../../../../../src/external-providers/operations/provider-request-signing.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,yBAAyB,EAAmC,MAAM,sCAAsC,CAAC;AAIlH;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAWD;;;;;;;;;GASG;AACH,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAU5C,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,yBAAyB,CAAC,SAAS;YACtC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,yBAAyB,CAAC,gBAAgB;YAC7C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC,MAAM,CAAC;YACzC,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,KAA+B;IACnD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,2BAA2B,CACnC,4GAA4G;cAC1G,oGAAoG,MAAM,IAAI,OAAO,cAAc,OAAO,IAAI,OAAO,IAAI,CAC5J,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvE,mGAAmG;IACnG,+FAA+F;IAC/F,gBAAgB;IAChB,MAAM,aAAa,GAA2B;QAC5C,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,OAAO;QACrB,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;QACvG,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,EAAE,CAAC;KACpJ,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9F,MAAM,gBAAgB,GAAG,iBAAiB;SACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAE,CAAE,CAAC,IAAI,CAAC;SAC9J,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElD,MAAM,gBAAgB,GAAG;QACvB,OAAO,CAAC,MAAM;QACd,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,gBAAgB;QAChB,aAAa;QACb,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,OAAO,eAAe,CAAC;IAC/D,MAAM,YAAY,GAAG;QACnB,kBAAkB;QAClB,OAAO;QACP,KAAK;QACL,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,UAAU,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CACxC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAC9B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC,CAC1G,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEjE,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE;YACP,GAAG,OAAO,CAAC,OAAO;YAClB,YAAY,EAAE,OAAO;YACrB,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;YACvG,sBAAsB,EAAE,WAAW;YACnC,aAAa,EAAE,+BAA+B,WAAW,CAAC,KAAK,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS,EAAE;SACnI;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,KAA+B;IACzD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAE7F,MAAM,oBAAoB,GAAG,aAAa,IAAI,6BAA6B,CAAC;IAC5E,MAAM,qBAAqB,GAAG;QAC5B,IAAI,WAAW,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QACpD,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;aAC5B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;aAC/B,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;KAC3E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,YAAY,GAAG;QACnB,OAAO,CAAC,MAAM;QACd,EAAE,EAAE,mBAAmB;QACvB,EAAE,EAAE,mBAAmB;QACvB,aAAa;QACb,EAAE,EAAE,cAAc;QAClB,WAAW;QACX,EAAE,EAAE,iDAAiD;QACrD,EAAE,EAAE,oBAAoB;QACxB,EAAE,EAAE,WAAW;QACf,EAAE,EAAE,gBAAgB;QACpB,EAAE,EAAE,sBAAsB;QAC1B,EAAE,EAAE,QAAQ;QACZ,oBAAoB,GAAG,qBAAqB;KAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEnI,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE;YACP,GAAG,OAAO,CAAC,OAAO;YAClB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,YAAY;YAC5B,aAAa,EAAE,aAAa,WAAW,CAAC,KAAK,IAAI,SAAS,EAAE;SAC7D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAChC,OAAO,QAAQ;SACZ,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;SAC9J,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,8FAA8F;AAC9F,SAAS,cAAc,CAAC,MAAuB;IAC7C,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAU,CAAC;SAC1E,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjH,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAChI,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,IAAI,CAAC,GAAoB,EAAE,IAAY;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,IAAqC;IAC1D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,0CAA0C,GAAG,iCAAiC,CAAC","sourcesContent":["import { createHash, createHmac } from 'node:crypto';\n\nimport { ProviderRestSigningScheme, type ProviderRestRequestSigning } from '@wildo-ai/external-connectors-models';\n\nimport type { HttpApiTransportRequest } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-transport.backend';\n\n/*\n Per-request request signing — the credential a vendor COMPUTES rather than reads (#373).\n \n Signing is the LAST thing that happens to a request, and that ordering is not a preference: a\n * signature covers the bytes. The method, the canonical path, the sorted query, the payload hash and\n * a subset of the headers are all inputs, so anything that edits the request after signing — adding\n * a header, re-encoding a body, appending a query parameter — invalidates it, and the vendor answers\n * a 403 that names nothing.\n \n There is NO vendor branch here. The scheme is a contract field and this dispatches on it\n * exhaustively, the same discipline the rest of the provider lane keeps.\n \n ## Why the failures are named\n \n A signature that is wrong is rejected identically however it was wrong: AWS answers\n * `SignatureDoesNotMatch` whether the region was wrong, the service was wrong, the clock was skewed\n * or the secret was stale. Those are four different remedies and one message, so the conditions this\n * code CAN see — a missing credential, a clock far from the vendor's, an unsupported request shape —\n * are reported here with their own words rather than left to become an opaque vendor rejection.\n /\n\nexport class ProviderRequestSigningError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'ProviderRequestSigningError';\n }\n}\n\n/* The two-or-three values a signing scheme needs, resolved from the environment by the caller. /\nexport interface ProviderSigningCredentials {\n readonly keyId: string;\n readonly secretKey: string;\n readonly sessionToken?: string;\n /* Overrides the declaration's region when a deployment names its own. /\n readonly region?: string;\n}\n\n/\n The clock tolerance every one of these schemes shares.\n \n AWS rejects a request whose `X-Amz-Date` is more than five minutes from its own clock, and Azure\n * uses fifteen. This is not enforced here — only the vendor knows its clock — but the number is what\n * makes a skew diagnosable: a host drifting past it fails EVERY signed request while every unsigned\n * one succeeds, which is a confusing symptom until someone names it.\n * spec-cite: AWS General Reference, \"Elements of an AWS API request signature\" — the five-minute\n * window is stated there; the Azure figure is from \"Authorize with Shared Key\".\n /\nconst SIGNATURE_CLOCK_TOLERANCE_MINUTES = 5;\n\nexport interface SignProviderRequestInput {\n readonly request: HttpApiTransportRequest;\n readonly signing: ProviderRestRequestSigning;\n readonly credentials: ProviderSigningCredentials;\n /* Injected so a test can pin a signature against a published vector. /\n readonly now?: Date;\n}\n\n/* Returns the request with its signature headers added. Never mutates the input. /\nexport function signProviderRequest(input: SignProviderRequestInput): HttpApiTransportRequest {\n const { signing } = input;\n switch (signing.scheme) {\n case ProviderRestSigningScheme.AWS_SIGV4:\n return signAwsSigV4(input);\n case ProviderRestSigningScheme.AZURE_SHARED_KEY:\n return signAzureSharedKey(input);\n default: {\n const exhaustive: never = signing.scheme;\n return exhaustive;\n }\n }\n}\n\n/\n AWS Signature Version 4.\n \n spec-cite: AWS General Reference, \"Create a signed AWS API request\" — the canonical request, the\n * string to sign, the derived key chain and the Authorization header are all defined there.\n \n The payload hash is computed over the body EXACTLY as it will be sent, and an empty body hashes to\n * the SHA-256 of the empty string rather than being omitted — a distinction that costs one line and,\n * got wrong, makes every GET fail with a message about a signature mismatch.\n /\nfunction signAwsSigV4(input: SignProviderRequestInput): HttpApiTransportRequest {\n const { request, signing, credentials } = input;\n const region = credentials.region ?? signing.region;\n const service = signing.service;\n if (region === undefined \|\| service === undefined) {\n throw new ProviderRequestSigningError(\n 'AWS SigV4 needs both a region and a service: they scope the DERIVED KEY, so a wrong or absent value fails '\n + `authentication rather than routing. Declare them on the provider's requestSigning block (region: ${region ?? 'unset'}, service: ${service ?? 'unset'}).`,\n );\n }\n\n const url = new URL(request.url);\n const now = input.now ?? new Date();\n const amzDate = `${now.toISOString().replace(/[-:]/g, '').slice(0, 15)}Z`;\n const dateStamp = amzDate.slice(0, 8);\n\n const payload = bodyToPayload(request.body);\n const payloadHash = createHash('sha256').update(payload).digest('hex');\n\n // `host` is required in the signature and is not in the request's own headers — the transport adds\n // it. Signing what will actually be sent means adding it here, in the same order the canonical\n // form demands.\n const headersToSign: Record<string, string> = {\n host: url.host,\n 'x-amz-date': amzDate,\n ...(credentials.sessionToken === undefined ? {} : { 'x-amz-security-token': credentials.sessionToken }),\n ...(request.body === undefined ? {} : { 'content-type': request.headers['Content-Type'] ?? request.headers['content-type'] ?? 'application/json' }),\n };\n const signedHeaderNames = Object.keys(headersToSign).map((name) => name.toLowerCase()).sort();\n const canonicalHeaders = signedHeaderNames\n .map((name) => `${name}:${collapseWhitespace(headersToSign[name] ?? headersToSign[Object.keys(headersToSign).find((key) => key.toLowerCase() === name)!]!)}\\n`)\n .join('');\n const signedHeaders = signedHeaderNames.join(';');\n\n const canonicalRequest = [\n request.method,\n canonicalUri(url.pathname),\n canonicalQuery(url.searchParams),\n canonicalHeaders,\n signedHeaders,\n payloadHash,\n ].join('\\n');\n\n const scope = `${dateStamp}/${region}/${service}/aws4_request`;\n const stringToSign = [\n 'AWS4-HMAC-SHA256',\n amzDate,\n scope,\n createHash('sha256').update(canonicalRequest).digest('hex'),\n ].join('\\n');\n\n const signingKey = ['aws4_request'].reduce(\n (key, step) => hmac(key, step),\n [region, service].reduce((key, step) => hmac(key, step), hmac(`AWS4${credentials.secretKey}`, dateStamp)),\n );\n const signature = hmac(signingKey, stringToSign).toString('hex');\n\n return {\n ...request,\n headers: {\n ...request.headers,\n 'X-Amz-Date': amzDate,\n ...(credentials.sessionToken === undefined ? {} : { 'X-Amz-Security-Token': credentials.sessionToken }),\n 'X-Amz-Content-Sha256': payloadHash,\n Authorization: `AWS4-HMAC-SHA256 Credential=${credentials.keyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,\n },\n };\n}\n\n/\n Azure Storage shared key.\n \n spec-cite: Azure Storage REST, \"Authorize with Shared Key\" — the canonicalized headers and\n * canonicalized resource, and the `SharedKey <account>:<signature>` header, are defined there.\n \n Deliberately the FULL scheme rather than SharedKeyLite: the two differ in which fields the string\n * to sign carries, and a service that expects one rejects the other with the same opaque message a\n * wrong key produces.\n /\nfunction signAzureSharedKey(input: SignProviderRequestInput): HttpApiTransportRequest {\n const { request, credentials } = input;\n const url = new URL(request.url);\n const now = input.now ?? new Date();\n const date = now.toUTCString();\n const payload = bodyToPayload(request.body);\n const contentLength = payload.length === 0 ? '' : String(payload.length);\n const contentType = request.headers['Content-Type'] ?? request.headers['content-type'] ?? '';\n\n const canonicalizedHeaders = `x-ms-date:${date}\\nx-ms-version:2021-12-02\\n`;\n const canonicalizedResource = [\n `/${credentials.keyId}${canonicalUri(url.pathname)}`,\n ...[...url.searchParams.keys()]\n .map((key) => key.toLowerCase())\n .sort()\n .map((key) => `${key}:${url.searchParams.getAll(key).sort().join(',')}`),\n ].join('\\n');\n\n const stringToSign = [\n request.method,\n '', // Content-Encoding\n '', // Content-Language\n contentLength,\n '', // Content-MD5\n contentType,\n '', // Date — empty because x-ms-date is used instead\n '', // If-Modified-Since\n '', // If-Match\n '', // If-None-Match\n '', // If-Unmodified-Since\n '', // Range\n canonicalizedHeaders + canonicalizedResource,\n ].join('\\n');\n\n const signature = createHmac('sha256', Buffer.from(credentials.secretKey, 'base64')).update(stringToSign, 'utf8').digest('base64');\n\n return {\n ...request,\n headers: {\n ...request.headers,\n 'x-ms-date': date,\n 'x-ms-version': '2021-12-02',\n Authorization: `SharedKey ${credentials.keyId}:${signature}`,\n },\n };\n}\n\n/\n The canonical URI: each path segment URI-encoded, and the encoding applied ONCE for most services.\n * S3 is the documented exception (it does not double-encode), and since every service this contract\n * reaches declares its own `service`, the single-encoding form is what is implemented — the double\n * encoding other services expect is a documented difference, not a bug, and belongs with the first\n * provider that needs it rather than guessed at now.\n /\nfunction canonicalUri(pathname: string): string {\n if (pathname === '') return '/';\n return pathname\n .split('/')\n .map((segment) => encodeURIComponent(decodeURIComponent(segment)).replace(/[!'()]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`))\n .join('/');\n}\n\n/** Sorted by name then value, each component encoded, joined — the canonical query string. /\nfunction canonicalQuery(params: URLSearchParams): string {\n const pairs: Array<[string, string]> = [];\n params.forEach((value, key) => pairs.push([key, value]));\n return pairs\n .map(([key, value]) => [encodeRfc3986(key), encodeRfc3986(value)] as const)\n .sort((left, right) => (left[0] === right[0] ? left[1].localeCompare(right[1]) : left[0].localeCompare(right[0])))\n .map(([key, value]) => `${key}=${value}`)\n .join('&');\n}\n\nfunction encodeRfc3986(value: string): string {\n return encodeURIComponent(value).replace(/[!'()]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);\n}\n\nfunction collapseWhitespace(value: string): string {\n return value.trim().replace(/\\s+/g, ' ');\n}\n\nfunction hmac(key: string \| Buffer, data: string): Buffer {\n return createHmac('sha256', key).update(data, 'utf8').digest();\n}\n\n/** The bytes that will actually be sent, as a string — what the payload hash must cover. /\nfunction bodyToPayload(body: HttpApiTransportRequest['body']): string {\n if (body === undefined) return '';\n if (typeof body === 'string') return body;\n return JSON.stringify(body);\n}\n\n/* Exported for the diagnostic that names a clock skew rather than letting it read as a bad key. */\nexport const PROVIDER_SIGNATURE_CLOCK_TOLERANCE_MINUTES = SIGNATURE_CLOCK_TOLERANCE_MINUTES;\n"]}
1	+ {"version":3,"file":"provider-request-signing.backend.js","sourceRoot":"","sources":["../../../../src/external-providers/operations/provider-request-signing.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,yBAAyB,EAAmC,MAAM,sCAAsC,CAAC;AAGlH,OAAO,EAAE,sBAAsB,EAAE,MAAM,6EAA6E,CAAC;AAErH;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAWD;;;;;;;;;GASG;AACH,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAU5C,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,yBAAyB,CAAC,SAAS;YACtC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,yBAAyB,CAAC,gBAAgB;YAC7C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC,MAAM,CAAC;YACzC,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,KAA+B;IACnD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,2BAA2B,CACnC,4GAA4G;cAC1G,oGAAoG,MAAM,IAAI,OAAO,cAAc,OAAO,IAAI,OAAO,IAAI,CAC5J,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvE,mGAAmG;IACnG,+FAA+F;IAC/F,gBAAgB;IAChB,MAAM,aAAa,GAA2B;QAC5C,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,OAAO;QACrB,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;QACvG,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,EAAE,CAAC;KACpJ,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9F,MAAM,gBAAgB,GAAG,iBAAiB;SACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAE,CAAE,CAAC,IAAI,CAAC;SAC9J,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElD,MAAM,gBAAgB,GAAG;QACvB,OAAO,CAAC,MAAM;QACd,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,gBAAgB;QAChB,aAAa;QACb,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,OAAO,eAAe,CAAC;IAC/D,MAAM,YAAY,GAAG;QACnB,kBAAkB;QAClB,OAAO;QACP,KAAK;QACL,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,UAAU,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CACxC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAC9B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC,CAC1G,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEjE;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE;YAC/C,YAAY,EAAE,OAAO;YACrB,sBAAsB,EAAE,WAAW,CAAC,YAAY;YAChD,sBAAsB,EAAE,WAAW;YACnC,aAAa,EAAE,+BAA+B,WAAW,CAAC,KAAK,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS,EAAE;SACnI,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,KAA+B;IACzD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAE7F,MAAM,oBAAoB,GAAG,aAAa,IAAI,6BAA6B,CAAC;IAC5E,MAAM,qBAAqB,GAAG;QAC5B,IAAI,WAAW,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QACpD,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;aAC5B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;aAC/B,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;KAC3E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,YAAY,GAAG;QACnB,OAAO,CAAC,MAAM;QACd,EAAE,EAAE,mBAAmB;QACvB,EAAE,EAAE,mBAAmB;QACvB,aAAa;QACb,EAAE,EAAE,cAAc;QAClB,WAAW;QACX,EAAE,EAAE,iDAAiD;QACrD,EAAE,EAAE,oBAAoB;QACxB,EAAE,EAAE,WAAW;QACf,EAAE,EAAE,gBAAgB;QACpB,EAAE,EAAE,sBAAsB;QAC1B,EAAE,EAAE,QAAQ;QACZ,oBAAoB,GAAG,qBAAqB;KAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEnI,gGAAgG;IAChG,6FAA6F;IAC7F,0CAA0C;IAC1C,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE;YAC/C,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,YAAY;YAC5B,aAAa,EAAE,aAAa,WAAW,CAAC,KAAK,IAAI,SAAS,EAAE;SAC7D,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAChC,OAAO,QAAQ;SACZ,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;SAC9J,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,8FAA8F;AAC9F,SAAS,cAAc,CAAC,MAAuB;IAC7C,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAU,CAAC;SAC1E,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjH,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAChI,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,IAAI,CAAC,GAAoB,EAAE,IAAY;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,IAAqC;IAC1D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,0CAA0C,GAAG,iCAAiC,CAAC","sourcesContent":["import { createHash, createHmac } from 'node:crypto';\n\nimport { ProviderRestSigningScheme, type ProviderRestRequestSigning } from '@wildo-ai/external-connectors-models';\n\nimport type { HttpApiTransportRequest } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-transport.backend';\nimport { withEngineOwnedHeaders } from '~wildo-backend-lib/security/outbound/outbound-request-headers.backend.utils';\n\n/*\n Per-request request signing — the credential a vendor COMPUTES rather than reads (#373).\n \n Signing is the LAST thing that happens to a request, and that ordering is not a preference: a\n * signature covers the bytes. The method, the canonical path, the sorted query, the payload hash and\n * a subset of the headers are all inputs, so anything that edits the request after signing — adding\n * a header, re-encoding a body, appending a query parameter — invalidates it, and the vendor answers\n * a 403 that names nothing.\n \n There is NO vendor branch here. The scheme is a contract field and this dispatches on it\n * exhaustively, the same discipline the rest of the provider lane keeps.\n \n ## Why the failures are named\n \n A signature that is wrong is rejected identically however it was wrong: AWS answers\n * `SignatureDoesNotMatch` whether the region was wrong, the service was wrong, the clock was skewed\n * or the secret was stale. Those are four different remedies and one message, so the conditions this\n * code CAN see — a missing credential, a clock far from the vendor's, an unsupported request shape —\n * are reported here with their own words rather than left to become an opaque vendor rejection.\n /\n\nexport class ProviderRequestSigningError extends Error {\n constructor(message: string) {\n super(message);\n this.name = 'ProviderRequestSigningError';\n }\n}\n\n/* The two-or-three values a signing scheme needs, resolved from the environment by the caller. /\nexport interface ProviderSigningCredentials {\n readonly keyId: string;\n readonly secretKey: string;\n readonly sessionToken?: string;\n /* Overrides the declaration's region when a deployment names its own. /\n readonly region?: string;\n}\n\n/\n The clock tolerance every one of these schemes shares.\n \n AWS rejects a request whose `X-Amz-Date` is more than five minutes from its own clock, and Azure\n * uses fifteen. This is not enforced here — only the vendor knows its clock — but the number is what\n * makes a skew diagnosable: a host drifting past it fails EVERY signed request while every unsigned\n * one succeeds, which is a confusing symptom until someone names it.\n * spec-cite: AWS General Reference, \"Elements of an AWS API request signature\" — the five-minute\n * window is stated there; the Azure figure is from \"Authorize with Shared Key\".\n /\nconst SIGNATURE_CLOCK_TOLERANCE_MINUTES = 5;\n\nexport interface SignProviderRequestInput {\n readonly request: HttpApiTransportRequest;\n readonly signing: ProviderRestRequestSigning;\n readonly credentials: ProviderSigningCredentials;\n /* Injected so a test can pin a signature against a published vector. /\n readonly now?: Date;\n}\n\n/* Returns the request with its signature headers added. Never mutates the input. /\nexport function signProviderRequest(input: SignProviderRequestInput): HttpApiTransportRequest {\n const { signing } = input;\n switch (signing.scheme) {\n case ProviderRestSigningScheme.AWS_SIGV4:\n return signAwsSigV4(input);\n case ProviderRestSigningScheme.AZURE_SHARED_KEY:\n return signAzureSharedKey(input);\n default: {\n const exhaustive: never = signing.scheme;\n return exhaustive;\n }\n }\n}\n\n/\n AWS Signature Version 4.\n \n spec-cite: AWS General Reference, \"Create a signed AWS API request\" — the canonical request, the\n * string to sign, the derived key chain and the Authorization header are all defined there.\n \n The payload hash is computed over the body EXACTLY as it will be sent, and an empty body hashes to\n * the SHA-256 of the empty string rather than being omitted — a distinction that costs one line and,\n * got wrong, makes every GET fail with a message about a signature mismatch.\n /\nfunction signAwsSigV4(input: SignProviderRequestInput): HttpApiTransportRequest {\n const { request, signing, credentials } = input;\n const region = credentials.region ?? signing.region;\n const service = signing.service;\n if (region === undefined \|\| service === undefined) {\n throw new ProviderRequestSigningError(\n 'AWS SigV4 needs both a region and a service: they scope the DERIVED KEY, so a wrong or absent value fails '\n + `authentication rather than routing. Declare them on the provider's requestSigning block (region: ${region ?? 'unset'}, service: ${service ?? 'unset'}).`,\n );\n }\n\n const url = new URL(request.url);\n const now = input.now ?? new Date();\n const amzDate = `${now.toISOString().replace(/[-:]/g, '').slice(0, 15)}Z`;\n const dateStamp = amzDate.slice(0, 8);\n\n const payload = bodyToPayload(request.body);\n const payloadHash = createHash('sha256').update(payload).digest('hex');\n\n // `host` is required in the signature and is not in the request's own headers — the transport adds\n // it. Signing what will actually be sent means adding it here, in the same order the canonical\n // form demands.\n const headersToSign: Record<string, string> = {\n host: url.host,\n 'x-amz-date': amzDate,\n ...(credentials.sessionToken === undefined ? {} : { 'x-amz-security-token': credentials.sessionToken }),\n ...(request.body === undefined ? {} : { 'content-type': request.headers['Content-Type'] ?? request.headers['content-type'] ?? 'application/json' }),\n };\n const signedHeaderNames = Object.keys(headersToSign).map((name) => name.toLowerCase()).sort();\n const canonicalHeaders = signedHeaderNames\n .map((name) => `${name}:${collapseWhitespace(headersToSign[name] ?? headersToSign[Object.keys(headersToSign).find((key) => key.toLowerCase() === name)!]!)}\\n`)\n .join('');\n const signedHeaders = signedHeaderNames.join(';');\n\n const canonicalRequest = [\n request.method,\n canonicalUri(url.pathname),\n canonicalQuery(url.searchParams),\n canonicalHeaders,\n signedHeaders,\n payloadHash,\n ].join('\\n');\n\n const scope = `${dateStamp}/${region}/${service}/aws4_request`;\n const stringToSign = [\n 'AWS4-HMAC-SHA256',\n amzDate,\n scope,\n createHash('sha256').update(canonicalRequest).digest('hex'),\n ].join('\\n');\n\n const signingKey = ['aws4_request'].reduce(\n (key, step) => hmac(key, step),\n [region, service].reduce((key, step) => hmac(key, step), hmac(`AWS4${credentials.secretKey}`, dateStamp)),\n );\n const signature = hmac(signingKey, stringToSign).toString('hex');\n\n /\n * The signature headers are the engine's, and a catalogue-declared spelling cannot dilute them.\n \n `request.headers` carries the provider catalogue's `defaultHeaders`, so a catalogue naming\n * `authorization` or `x-amz-date` against the canonical spellings written here would produce two\n * object keys per header — combined by `fetch` into one comma-joined value, which AWS rejects as\n * a malformed signature rather than as the header collision it is.\n \n Filtering is safe against the signature specifically because `signedHeaders` is computed from\n * the CLOSED `headersToSign` set above (host, x-amz-date, x-amz-security-token, content-type) and\n * never from `request.headers` at large — so no header being dropped here was ever signed.\n * `content-type` is not engine-owned at this merge and is therefore left exactly as the caller\n * set it, which is what keeps it agreeing with the value that WAS signed.\n \n The session token is reserved even when the engine has none: absent credentials must not be\n * satisfiable by a value a provider catalogue supplied.\n /\n return {\n ...request,\n headers: withEngineOwnedHeaders(request.headers, {\n 'X-Amz-Date': amzDate,\n 'X-Amz-Security-Token': credentials.sessionToken,\n 'X-Amz-Content-Sha256': payloadHash,\n Authorization: `AWS4-HMAC-SHA256 Credential=${credentials.keyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,\n }),\n };\n}\n\n/\n Azure Storage shared key.\n \n spec-cite: Azure Storage REST, \"Authorize with Shared Key\" — the canonicalized headers and\n * canonicalized resource, and the `SharedKey <account>:<signature>` header, are defined there.\n \n Deliberately the FULL scheme rather than SharedKeyLite: the two differ in which fields the string\n * to sign carries, and a service that expects one rejects the other with the same opaque message a\n * wrong key produces.\n /\nfunction signAzureSharedKey(input: SignProviderRequestInput): HttpApiTransportRequest {\n const { request, credentials } = input;\n const url = new URL(request.url);\n const now = input.now ?? new Date();\n const date = now.toUTCString();\n const payload = bodyToPayload(request.body);\n const contentLength = payload.length === 0 ? '' : String(payload.length);\n const contentType = request.headers['Content-Type'] ?? request.headers['content-type'] ?? '';\n\n const canonicalizedHeaders = `x-ms-date:${date}\\nx-ms-version:2021-12-02\\n`;\n const canonicalizedResource = [\n `/${credentials.keyId}${canonicalUri(url.pathname)}`,\n ...[...url.searchParams.keys()]\n .map((key) => key.toLowerCase())\n .sort()\n .map((key) => `${key}:${url.searchParams.getAll(key).sort().join(',')}`),\n ].join('\\n');\n\n const stringToSign = [\n request.method,\n '', // Content-Encoding\n '', // Content-Language\n contentLength,\n '', // Content-MD5\n contentType,\n '', // Date — empty because x-ms-date is used instead\n '', // If-Modified-Since\n '', // If-Match\n '', // If-None-Match\n '', // If-Unmodified-Since\n '', // Range\n canonicalizedHeaders + canonicalizedResource,\n ].join('\\n');\n\n const signature = createHmac('sha256', Buffer.from(credentials.secretKey, 'base64')).update(stringToSign, 'utf8').digest('base64');\n\n // Same reasoning as the SigV4 twin: `canonicalizedHeaders` above is a fixed literal, so nothing\n // dropped here was signed, and reserving the names stops a catalogue-declared spelling being\n // combined with the engine's on the wire.\n return {\n ...request,\n headers: withEngineOwnedHeaders(request.headers, {\n 'x-ms-date': date,\n 'x-ms-version': '2021-12-02',\n Authorization: `SharedKey ${credentials.keyId}:${signature}`,\n }),\n };\n}\n\n/\n The canonical URI: each path segment URI-encoded, and the encoding applied ONCE for most services.\n * S3 is the documented exception (it does not double-encode), and since every service this contract\n * reaches declares its own `service`, the single-encoding form is what is implemented — the double\n * encoding other services expect is a documented difference, not a bug, and belongs with the first\n * provider that needs it rather than guessed at now.\n /\nfunction canonicalUri(pathname: string): string {\n if (pathname === '') return '/';\n return pathname\n .split('/')\n .map((segment) => encodeURIComponent(decodeURIComponent(segment)).replace(/[!'()]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`))\n .join('/');\n}\n\n/** Sorted by name then value, each component encoded, joined — the canonical query string. /\nfunction canonicalQuery(params: URLSearchParams): string {\n const pairs: Array<[string, string]> = [];\n params.forEach((value, key) => pairs.push([key, value]));\n return pairs\n .map(([key, value]) => [encodeRfc3986(key), encodeRfc3986(value)] as const)\n .sort((left, right) => (left[0] === right[0] ? left[1].localeCompare(right[1]) : left[0].localeCompare(right[0])))\n .map(([key, value]) => `${key}=${value}`)\n .join('&');\n}\n\nfunction encodeRfc3986(value: string): string {\n return encodeURIComponent(value).replace(/[!'()]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);\n}\n\nfunction collapseWhitespace(value: string): string {\n return value.trim().replace(/\\s+/g, ' ');\n}\n\nfunction hmac(key: string \| Buffer, data: string): Buffer {\n return createHmac('sha256', key).update(data, 'utf8').digest();\n}\n\n/** The bytes that will actually be sent, as a string — what the payload hash must cover. /\nfunction bodyToPayload(body: HttpApiTransportRequest['body']): string {\n if (body === undefined) return '';\n if (typeof body === 'string') return body;\n return JSON.stringify(body);\n}\n\n/* Exported for the diagnostic that names a clock skew rather than letting it read as a bad key. */\nexport const PROVIDER_SIGNATURE_CLOCK_TOLERANCE_MINUTES = SIGNATURE_CLOCK_TOLERANCE_MINUTES;\n"]}

package/dist/esm/external-providers/operations/provider-rest-call-client.backend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-rest-call-client.backend.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/external-providers/operations/provider-rest-call-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC9B,MAAM,2FAA2F,CAAC;AAGnG,OAAO,KAAK,EACV,qBAAqB,EACrB,6BAA6B,EAC9B,MAAM,iGAAiG,CAAC;AAEzG;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,EAAE,yBAGlD,CAAC;AAEF,qBAAa,sBAAsB;IAI/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAN5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;gBAG5B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,yBAAyB,EACpC,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,GAAE,gBAAsC;IAOpE;;;;;;;OAOG;IACI,aAAa,CAClB,MAAM,EAAE,iCAAiC,EACzC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAIjC;;;;;;;OAOG;IACU,OAAO,CAClB,OAAO,EAAE,uBAAuB,EAChC,iBAAiB,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,EACtD,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,wBAAwB,CAAC;CAYrC"}
1	+ {"version":3,"file":"provider-rest-call-client.backend.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/operations/provider-rest-call-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC9B,MAAM,2FAA2F,CAAC;AAGnG,OAAO,KAAK,EACV,qBAAqB,EACrB,6BAA6B,EAC9B,MAAM,iGAAiG,CAAC;AAEzG;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,EAAE,yBAGlD,CAAC;AAEF,qBAAa,sBAAsB;IAI/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAN5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;gBAG5B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,yBAAyB,EACpC,sBAAsB,EAAE,6BAA6B,EACrD,SAAS,GAAE,gBAAsC;IAOpE;;;;;;;OAOG;IACI,aAAa,CAClB,MAAM,EAAE,iCAAiC,EACzC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,qBAAqB,CAAC;IAIjC;;;;;;;OAOG;IACU,OAAO,CAClB,OAAO,EAAE,uBAAuB,EAChC,iBAAiB,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,EACtD,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,wBAAwB,CAAC;CAYrC"}

package/dist/esm/external-providers/operations/provider-rest-call-client.backend.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-rest-call-client.backend.js","sourceRoot":"","sources":["~~../../../../../~~src/external-providers/operations/provider-rest-call-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,EACL,iBAAiB,EACjB,2BAA2B,GAI5B,MAAM,2FAA2F,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6FAA6F,CAAC;AAClI,OAAO,EAAE,mBAAmB,EAAE,MAAM,mFAAmF,CAAC;AAMxH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA8B;IAC7E,SAAS,EAAE,MAAM;IACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;CAC1C,CAAC;AAEF,MAAM,OAAO,sBAAsB;IAId;IACA;IACA;IACA;IANF,UAAU,CAAoB;IAE/C,YACmB,WAAmB,EACnB,SAAoC,EACpC,sBAAqD,EACrD,YAA8B,mBAAmB;QAHjD,gBAAW,GAAX,WAAW,CAAQ;QACnB,cAAS,GAAT,SAAS,CAA2B;QACpC,2BAAsB,GAAtB,sBAAsB,CAA+B;QACrD,cAAS,GAAT,SAAS,CAAwC;QAElE,8FAA8F;QAC9F,2FAA2F;QAC3F,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;OAOG;IACI,aAAa,CAClB,MAAyC,EACzC,gBAAuC;QAEvC,OAAO,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/F,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,OAAO,CAClB,OAAgC,EAChC,iBAAsD,EACtD,MAA8B;QAE9B,MAAM,SAAS,GAAG,iBAAiB;YACjC,CAAC,CAAC;gBACA,SAAS,EAAE,iBAAiB,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS;gBAClE,KAAK,EAAE,iBAAiB,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK;aACvD;YACD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,EAAE,cAAc;YACrC,CAAC,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YAC9H,CAAC,CAAC,OAAO,CAAC;QACZ,OAAO,2BAA2B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3F,CAAC;CACF","sourcesContent":["/*\n `ProviderRestCallClient` — the BINDING-FREE wire client for provider operations (S3a, #331).\n \n `HttpApiReadClient` is constructed per resource BINDING and reads `binding.remoteCallSemantics`,\n * `binding.providerRef` and `binding.entityRef`. A provider operation has none of those: it is\n * addressed by `(providerRef, operationId)` and belongs to no resource. So this is a sibling, not\n * a subclass and not a widening of that class — widening it would have meant giving every ETL\n * consumer a binding-shaped hole to work around.\n \n What is NOT duplicated is everything that matters: the transport, the rate budget and the\n * provider-access resolver are the SAME modules the read client uses. This class owns only the\n * three facts that differ — whose semantics apply, which rate window is drawn from, and that\n * there is no dialect framing to do because the operation declared its own request.\n \n The single-authority drift pin (`http-api-read-client.single-authority.test.ts`) knows about\n * this second invoker BY NAME; adding a third reddens it.\n /\n\nimport type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';\nimport type { ProviderRestCallSemantics } from '@wildo-ai/external-connectors-models';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n HttpApiRateBudget,\n executeHttpApiTransportCall,\n type HttpApiFetchLike,\n type HttpApiTransportRequest,\n type HttpApiTransportResponse,\n} from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-transport.backend';\nimport { defaultHttpApiFetch } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-read-client.backend';\nimport { signProviderRequest } from '~wildo-backend-lib/external-providers/operations/provider-request-signing.backend';\nimport type {\n HttpApiProviderAccess,\n HttpApiProviderAccessResolver,\n} from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-provider-access.backend';\n\n/\n The semantics a provider gets when it declares none. Chosen to be unremarkable rather than\n * clever: a 30s ceiling is longer than any interactive request should take and short enough that\n * a hung vendor does not hold a connection for a request lifetime, and two attempts on a\n * retry-safe call absorb a single transient without turning one user action into a burst.\n /\nexport const DEFAULT_PROVIDER_REST_CALL_SEMANTICS: ProviderRestCallSemantics = {\n timeoutMs: 30_000,\n retry: { maxAttempts: 2, backoffMs: 250 },\n};\n\nexport class ProviderRestCallClient {\n private readonly rateBudget: HttpApiRateBudget;\n\n constructor(\n private readonly providerRef: string,\n private readonly semantics: ProviderRestCallSemantics,\n private readonly providerAccessResolver: HttpApiProviderAccessResolver,\n private readonly fetchImpl: HttpApiFetchLike = defaultHttpApiFetch,\n ) {\n // One window per client instance, so the executor's per-provider cache is also what makes the\n // rate ceiling mean anything: a client rebuilt per call would reset the window every time.\n this.rateBudget = new HttpApiRateBudget(semantics.maxRequestsPerMinute);\n }\n\n /\n WHOSE ACCOUNT this call spends, through the same port the ETL lane uses.\n \n The target is an argument rather than something read from the execution context, and that is\n * the whole point: one execution may legitimately spend several tenants' accounts — a single user\n * action pushing to every organization that user belongs to — so an ambient answer could not vary\n * where it has to. The context still decides whether the execution MAY act for the named owner.\n /\n public resolveAccess(\n target: ExternalProvider_ConnectionTarget,\n executionContext: ExecutionContext<any>,\n ): Promise<HttpApiProviderAccess> {\n return this.providerAccessResolver.resolveAccess(this.providerRef, target, executionContext);\n }\n\n /\n One call, under this provider's semantics unless the operation narrowed them.\n \n SIGNING HAPPENS HERE, and it is the last thing done to the request before it leaves. A signature\n * covers the bytes — method, canonical path, sorted query, payload hash, a subset of headers — so\n * anything that edits the request afterwards invalidates it and the vendor answers a 403 that\n * names nothing. Signing at the send site is the only placement where nothing can follow.\n */\n public async execute(\n request: HttpApiTransportRequest,\n semanticsOverride?: Partial<ProviderRestCallSemantics>,\n access?: HttpApiProviderAccess,\n ): Promise<HttpApiTransportResponse> {\n const semantics = semanticsOverride\n ? {\n timeoutMs: semanticsOverride.timeoutMs ?? this.semantics.timeoutMs,\n retry: semanticsOverride.retry ?? this.semantics.retry,\n }\n : this.semantics;\n const outbound = access?.requestSigning\n ? signProviderRequest({ request, signing: access.requestSigning.declaration, credentials: access.requestSigning.credentials })\n : request;\n return executeHttpApiTransportCall(outbound, semantics, this.fetchImpl, this.rateBudget);\n }\n}\n"]}
1	+ {"version":3,"file":"provider-rest-call-client.backend.js","sourceRoot":"","sources":["../../../../src/external-providers/operations/provider-rest-call-client.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,EACL,iBAAiB,EACjB,2BAA2B,GAI5B,MAAM,2FAA2F,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6FAA6F,CAAC;AAClI,OAAO,EAAE,mBAAmB,EAAE,MAAM,mFAAmF,CAAC;AAMxH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA8B;IAC7E,SAAS,EAAE,MAAM;IACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;CAC1C,CAAC;AAEF,MAAM,OAAO,sBAAsB;IAId;IACA;IACA;IACA;IANF,UAAU,CAAoB;IAE/C,YACmB,WAAmB,EACnB,SAAoC,EACpC,sBAAqD,EACrD,YAA8B,mBAAmB;QAHjD,gBAAW,GAAX,WAAW,CAAQ;QACnB,cAAS,GAAT,SAAS,CAA2B;QACpC,2BAAsB,GAAtB,sBAAsB,CAA+B;QACrD,cAAS,GAAT,SAAS,CAAwC;QAElE,8FAA8F;QAC9F,2FAA2F;QAC3F,IAAI,CAAC,UAAU,GAAG,IAAI,iBAAiB,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;OAOG;IACI,aAAa,CAClB,MAAyC,EACzC,gBAAuC;QAEvC,OAAO,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/F,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,OAAO,CAClB,OAAgC,EAChC,iBAAsD,EACtD,MAA8B;QAE9B,MAAM,SAAS,GAAG,iBAAiB;YACjC,CAAC,CAAC;gBACA,SAAS,EAAE,iBAAiB,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS;gBAClE,KAAK,EAAE,iBAAiB,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK;aACvD;YACD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,EAAE,cAAc;YACrC,CAAC,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YAC9H,CAAC,CAAC,OAAO,CAAC;QACZ,OAAO,2BAA2B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3F,CAAC;CACF","sourcesContent":["/*\n `ProviderRestCallClient` — the BINDING-FREE wire client for provider operations (S3a, #331).\n \n `HttpApiReadClient` is constructed per resource BINDING and reads `binding.remoteCallSemantics`,\n * `binding.providerRef` and `binding.entityRef`. A provider operation has none of those: it is\n * addressed by `(providerRef, operationId)` and belongs to no resource. So this is a sibling, not\n * a subclass and not a widening of that class — widening it would have meant giving every ETL\n * consumer a binding-shaped hole to work around.\n \n What is NOT duplicated is everything that matters: the transport, the rate budget and the\n * provider-access resolver are the SAME modules the read client uses. This class owns only the\n * three facts that differ — whose semantics apply, which rate window is drawn from, and that\n * there is no dialect framing to do because the operation declared its own request.\n \n The single-authority drift pin (`http-api-read-client.single-authority.test.ts`) knows about\n * this second invoker BY NAME; adding a third reddens it.\n /\n\nimport type { ExternalProvider_ConnectionTarget } from '@wildo-ai/external-connectors-models';\nimport type { ProviderRestCallSemantics } from '@wildo-ai/external-connectors-models';\n\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n HttpApiRateBudget,\n executeHttpApiTransportCall,\n type HttpApiFetchLike,\n type HttpApiTransportRequest,\n type HttpApiTransportResponse,\n} from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-transport.backend';\nimport { defaultHttpApiFetch } from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-read-client.backend';\nimport { signProviderRequest } from '~wildo-backend-lib/external-providers/operations/provider-request-signing.backend';\nimport type {\n HttpApiProviderAccess,\n HttpApiProviderAccessResolver,\n} from '~wildo-backend-lib/base-classes/services/repositories/http-api/http-api-provider-access.backend';\n\n/\n The semantics a provider gets when it declares none. Chosen to be unremarkable rather than\n * clever: a 30s ceiling is longer than any interactive request should take and short enough that\n * a hung vendor does not hold a connection for a request lifetime, and two attempts on a\n * retry-safe call absorb a single transient without turning one user action into a burst.\n /\nexport const DEFAULT_PROVIDER_REST_CALL_SEMANTICS: ProviderRestCallSemantics = {\n timeoutMs: 30_000,\n retry: { maxAttempts: 2, backoffMs: 250 },\n};\n\nexport class ProviderRestCallClient {\n private readonly rateBudget: HttpApiRateBudget;\n\n constructor(\n private readonly providerRef: string,\n private readonly semantics: ProviderRestCallSemantics,\n private readonly providerAccessResolver: HttpApiProviderAccessResolver,\n private readonly fetchImpl: HttpApiFetchLike = defaultHttpApiFetch,\n ) {\n // One window per client instance, so the executor's per-provider cache is also what makes the\n // rate ceiling mean anything: a client rebuilt per call would reset the window every time.\n this.rateBudget = new HttpApiRateBudget(semantics.maxRequestsPerMinute);\n }\n\n /\n WHOSE ACCOUNT this call spends, through the same port the ETL lane uses.\n \n The target is an argument rather than something read from the execution context, and that is\n * the whole point: one execution may legitimately spend several tenants' accounts — a single user\n * action pushing to every organization that user belongs to — so an ambient answer could not vary\n * where it has to. The context still decides whether the execution MAY act for the named owner.\n /\n public resolveAccess(\n target: ExternalProvider_ConnectionTarget,\n executionContext: ExecutionContext<any>,\n ): Promise<HttpApiProviderAccess> {\n return this.providerAccessResolver.resolveAccess(this.providerRef, target, executionContext);\n }\n\n /\n One call, under this provider's semantics unless the operation narrowed them.\n \n SIGNING HAPPENS HERE, and it is the last thing done to the request before it leaves. A signature\n * covers the bytes — method, canonical path, sorted query, payload hash, a subset of headers — so\n * anything that edits the request afterwards invalidates it and the vendor answers a 403 that\n * names nothing. Signing at the send site is the only placement where nothing can follow.\n */\n public async execute(\n request: HttpApiTransportRequest,\n semanticsOverride?: Partial<ProviderRestCallSemantics>,\n access?: HttpApiProviderAccess,\n ): Promise<HttpApiTransportResponse> {\n const semantics = semanticsOverride\n ? {\n timeoutMs: semanticsOverride.timeoutMs ?? this.semantics.timeoutMs,\n retry: semanticsOverride.retry ?? this.semantics.retry,\n }\n : this.semantics;\n const outbound = access?.requestSigning\n ? signProviderRequest({ request, signing: access.requestSigning.declaration, credentials: access.requestSigning.credentials })\n : request;\n return executeHttpApiTransportCall(outbound, semantics, this.fetchImpl, this.rateBudget);\n }\n}\n"]}

package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mock-external-providers-registry.service.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/external-providers/services/__tests__/mock-external-providers-registry.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EACL,sCAAsC,EACtC,wBAAwB,EACxB,mBAAmB,EAEpB,MAAM,sCAAsC,CAAC;AAG9C,qBACa,2CAA2C;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IAEnE,0BAA0B;;;;OAUvB;IAEH,2BAA2B,2EAExB;IAEH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAIvE,KAAK,IAAI,IAAI;CAKd"}
1	+ {"version":3,"file":"mock-external-providers-registry.service.d.ts","sourceRoot":"","sources":["../../../../../src/external-providers/services/__tests__/mock-external-providers-registry.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EACL,sCAAsC,EACtC,wBAAwB,EACxB,mBAAmB,EAEpB,MAAM,sCAAsC,CAAC;AAG9C,qBACa,2CAA2C;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IAEnE,0BAA0B;;;;OAUvB;IAEH,2BAA2B,2EAExB;IAEH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAIvE,KAAK,IAAI,IAAI;CAKd"}

package/dist/esm/external-providers/services/__tests__/mock-external-providers-registry.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mock-external-providers-registry.service.js","sourceRoot":"","sources":["~~../../../../../../~~src/external-providers/services/__tests__/mock-external-providers-registry.service.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EACL,sCAAsC,EACtC,wBAAwB,EAExB,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAGrB,IAAM,2CAA2C,GAAjD,MAAM,2CAA2C;IACrC,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEnE,0BAA0B,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,WAAmB,EAAE,IAA4C,EAAE,EAAE;QACvG,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,OAAO,IAAI,IAAI,KAAK,sCAAsC,CAAC,YAAY,EAAE,CAAC;YAC5E,OAAO;gBACL,IAAI,EAAE,2BAA2B,CAAC,GAAG;gBACrC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;gBACtD,UAAU,EAAE,CAAC,wBAAwB,CAAC,aAAa,CAAC;aACrD,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,2BAA2B,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,WAAmB,EAAE,EAAE,CAAC,CAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/E,CAAC,CAAC;IAEH,cAAc,CAAC,WAAmB,EAAE,OAA4B;QAC9D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;CACF,CAAA;AA5BY,2CAA2C;IADvD,UAAU,EAAE;GACA,2CAA2C,CA4BvD","sourcesContent":["/*\n Vitest-oriented mock external providers registry for backend tests.\n \n Naming: `mock-.service.ts` — canonical mock module, not a test suite.\n Plain `.ts` keeps it barrel-compilable, and Vitest also excludes these files\n * explicitly as a defensive guard.\n */\nimport 'reflect-metadata';\nimport { injectable } from 'inversify';\nimport {\n ExternalProvider_ExchangeProtocol_Kind,\n LLMProvider_OperationKey,\n LLMProvider_Profile,\n ProviderProtocolRuntimeKind,\n} from '@wildo-ai/external-connectors-models';\nimport { vi } from 'vitest';\n\n@injectable()\nexport class MockExternalProvidersRegistryBackendService {\n private readonly profiles = new Map<string, LLMProvider_Profile>();\n\n getProviderRuntimeContract = vi.fn((providerRef: string, kind: ExternalProvider_ExchangeProtocol_Kind) => {\n const profile = this.profiles.get(providerRef);\n if (profile && kind === ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER) {\n return {\n kind: ProviderProtocolRuntimeKind.LLM,\n promptFormatPreference: profile.promptFormatPreference,\n operations: [LLMProvider_OperationKey.GENERATE_TEXT],\n };\n }\n return undefined;\n });\n\n getLLMSemanticOperationKeys = vi.fn((providerRef: string) => (\n this.profiles.has(providerRef) ? [LLMProvider_OperationKey.GENERATE_TEXT] : []\n ));\n\n setMockProfile(providerRef: string, profile: LLMProvider_Profile): void {\n this.profiles.set(providerRef, profile);\n }\n\n reset(): void {\n this.profiles.clear();\n this.getProviderRuntimeContract.mockClear();\n this.getLLMSemanticOperationKeys.mockClear();\n }\n}\n"]}
1	+ {"version":3,"file":"mock-external-providers-registry.service.js","sourceRoot":"","sources":["../../../../../src/external-providers/services/__tests__/mock-external-providers-registry.service.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EACL,sCAAsC,EACtC,wBAAwB,EAExB,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAGrB,IAAM,2CAA2C,GAAjD,MAAM,2CAA2C;IACrC,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEnE,0BAA0B,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,WAAmB,EAAE,IAA4C,EAAE,EAAE;QACvG,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,OAAO,IAAI,IAAI,KAAK,sCAAsC,CAAC,YAAY,EAAE,CAAC;YAC5E,OAAO;gBACL,IAAI,EAAE,2BAA2B,CAAC,GAAG;gBACrC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;gBACtD,UAAU,EAAE,CAAC,wBAAwB,CAAC,aAAa,CAAC;aACrD,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,2BAA2B,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,WAAmB,EAAE,EAAE,CAAC,CAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/E,CAAC,CAAC;IAEH,cAAc,CAAC,WAAmB,EAAE,OAA4B;QAC9D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;CACF,CAAA;AA5BY,2CAA2C;IADvD,UAAU,EAAE;GACA,2CAA2C,CA4BvD","sourcesContent":["/*\n Vitest-oriented mock external providers registry for backend tests.\n \n Naming: `mock-.service.ts` — canonical mock module, not a test suite.\n Plain `.ts` keeps it barrel-compilable, and Vitest also excludes these files\n * explicitly as a defensive guard.\n */\nimport 'reflect-metadata';\nimport { injectable } from 'inversify';\nimport {\n ExternalProvider_ExchangeProtocol_Kind,\n LLMProvider_OperationKey,\n LLMProvider_Profile,\n ProviderProtocolRuntimeKind,\n} from '@wildo-ai/external-connectors-models';\nimport { vi } from 'vitest';\n\n@injectable()\nexport class MockExternalProvidersRegistryBackendService {\n private readonly profiles = new Map<string, LLMProvider_Profile>();\n\n getProviderRuntimeContract = vi.fn((providerRef: string, kind: ExternalProvider_ExchangeProtocol_Kind) => {\n const profile = this.profiles.get(providerRef);\n if (profile && kind === ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER) {\n return {\n kind: ProviderProtocolRuntimeKind.LLM,\n promptFormatPreference: profile.promptFormatPreference,\n operations: [LLMProvider_OperationKey.GENERATE_TEXT],\n };\n }\n return undefined;\n });\n\n getLLMSemanticOperationKeys = vi.fn((providerRef: string) => (\n this.profiles.has(providerRef) ? [LLMProvider_OperationKey.GENERATE_TEXT] : []\n ));\n\n setMockProfile(providerRef: string, profile: LLMProvider_Profile): void {\n this.profiles.set(providerRef, profile);\n }\n\n reset(): void {\n this.profiles.clear();\n this.getProviderRuntimeContract.mockClear();\n this.getLLMSemanticOperationKeys.mockClear();\n }\n}\n"]}

package/dist/esm/external-providers/services/backend-provider-loader.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"backend-provider-loader.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/external-providers/services/backend-provider-loader.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAKL,KAAK,uBAAuB,EAC5B,KAAK,+BAA+B,EAErC,MAAM,uDAAuD,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;CAC7E;AAED,+JAA+J;AAC/J,qDAAqD;AACrD,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,wBAAwB,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,+BAA+B,CAAC;IAC/D;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB;IACxC,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClD;AAmFD;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,yBAAyB,CAAC,CA4DpC"}
1	+ {"version":3,"file":"backend-provider-loader.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/services/backend-provider-loader.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAKL,KAAK,uBAAuB,EAC5B,KAAK,+BAA+B,EAErC,MAAM,uDAAuD,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;CAC7E;AAED,+JAA+J;AAC/J,qDAAqD;AACrD,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,wBAAwB,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,+BAA+B,CAAC;IAC/D;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB;IACxC,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClD;AAmFD;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,yBAAyB,CAAC,CA4DpC"}