npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.8 → 1.1.9 - Mend

@wildo-ai/saas-backend-lib 1.1.8 → 1.1.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (174) hide show

package/dist/esm/external-providers/services/external-providers-registry.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"external-providers-registry.backend.service.js","sourceRoot":"","sources":["../../../../../src/external-providers/services/external-providers-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,EAAE,sCAAsC,EAAE,MAAM,gDAAgD,CAAC;AAExG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EACH,+BAA+B,EAC/B,+BAA+B,GAElC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACH,gCAAgC,EAChC,qCAAqC,GAGxC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAGH,gBAAgB,EAChB,8BAA8B,EAC9B,qDAAqD,EACrD,iCAAiC,EACjC,wCAAwC,GAC3C,MAAM,uBAAuB,CAAC;AAc/B,OAAO,EACL,sCAAsC,EAEtC,wBAAwB,EACxB,uCAAuC,EACvC,+BAA+B,EAC/B,uBAAuB,EACvB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EACH,4BAA4B,EAC5B,0CAA0C,EAC1C,sCAAsC,GAEzC,MAAM,4FAA4F,CAAC;AAEpG,OAAO,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAOpG,OAAO,EAAE,qCAAqC,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAChI,OAAO,EACH,4BAA4B,EAC5B,0CAA0C,EAC1C,gDAAgD,EAChD,qCAAqC,EACrC,8BAA8B,EAC9B,0CAA0C,EAC1C,wBAAwB,GAG3B,MAAM,sCAAsC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,8CAA8C,GAA6C;IAC7F,aAAa,EAAE,wBAAwB,CAAC,eAAe;CAC1D,CAAC;AAgEF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACH,sCAAsC,EACtC,uCAAuC,GAE1C,MAAM,yGAAyG,CAAC;AAwCjH,MAAM,6BAA6B,GAAG;IAClC,uBAAuB,CAAC,WAAW;IACnC,uBAAuB,CAAC,OAAO;IAC/B,uBAAuB,CAAC,UAAU;CACrC,CAAC;AAEF,SAAS,6BAA6B,CAAC,WAAmB;IACtD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,OAAO,UAAU,KAAK,WAAW;WAC1B,UAAU,KAAK,qBAAqB;WACpC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,2CAA2C,GAA6C;IAC1F,YAAY,EAAE,wBAAwB,CAAC,aAAa;IACpD,UAAU,EAAE,wBAAwB,CAAC,WAAW;IAChD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,kBAAkB,EAAE,wBAAwB,CAAC,mBAAmB;IAChE,gBAAgB,EAAE,wBAAwB,CAAC,iBAAiB;IAC5D,8EAA8E;IAC9E,sEAAsE;CACzE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kDAAkD,GAAoD;IACxG,UAAU,EAAE,+BAA+B,CAAC,WAAW;CAC1D,CAAC;AAEF;;;;GAIG;AACH,MAAM,2DAA2D,GAA4D;IACzH,mBAAmB,EAAE,uCAAuC,CAAC,qBAAqB;CACrF,CAAC;AAeF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,wCAAwC,GAAgD;IAC1F,EAAE,UAAU,EAAE,sCAAsC,CAAC,WAAW,EAAE,UAAU,EAAE,0CAA0C,CAAC,OAAO,EAAE;CACrI,CAAC;AAwCF;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC3D,OAAO,uCAAuC,UAAU,0EAA0E;UAC5H,mEAAmE,CAAC;AAC9E,CAAC;AAGM,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAOU;IACU;IACG;IACW;IAgC1B;IAzC9C,QAAQ,CAA+D;IACvE,QAAQ,GAAuC,IAAI,CAAC;IAEpD,aAAa,GAAG,KAAK,CAAC;IAEhC,YAC0D,MAAqB,EACX,aAAsC,EACnC,YAAwC,EAC7B,uBAA8D,EAgCxF,SAAqB;QAnCnB,WAAM,GAAN,MAAM,CAAe;QACX,kBAAa,GAAb,aAAa,CAAyB;QACnC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAgCxF,cAAS,GAAT,SAAS,CAAY;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAElF,IAAI,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,mCAAmC;IACnC,wBAAwB;IACxB,mCAAmC;IAEnC;;;OAGG;IACI,KAAK,CAAC,UAAU;QACnB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YACvD,OAAO;QACX,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;QAEhE,IAAI,CAAC,iCAAiC,EAAE,CAAC;QAEzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC;YACD,IAAI,CAAC,+BAA+B,EAAE,CAAC;YACvC,IAAI,CAAC,+BAA+B,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,qGAAqG;YACrG,iDAAiD;YACjD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,uEAAuE,EAAE;YACnF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;SAC/C,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACK,iCAAiC;QACrC,MAAM,SAAS,GAAG;YACd,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5G,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE;SAC3F,CAAC,MAAM,CAAC,CAAC,QAAQ,EAA2B,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnE,MAAM,YAAY,GAAG,CAAC,WAAmB,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC/E,IAAI,CAAC;gBACD,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC9B,OAAO,IAAI,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,SAAS;YACb,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;gBACrF,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG;gBAClC,eAAe,EAAE,OAAO;gBACxB,MAAM,EAAE,sGAAsG;sBACxG,uGAAuG;aAChH,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,2EAA2E;IAEnE,uCAAuC;QAC3C,MAAM,QAAQ,GAAgC,EAAE,CAAC;QACjD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,oBAAoB;iBACnD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,wCAAwC,CAAC,UAAU,CAAC,CAAC;iBACzE,MAAM,CAAC,CAAC,UAAU,EAAkC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAEjF,QAAQ,CAAC,WAAW,CAAC,GAAG;gBACpB,WAAW;gBACX,SAAS;gBACT,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACpD,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,sCAAsC,CAAC,UAAU,CAAC,IAAI,SAAS;aACrG,CAAC;QACN,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,mCAAmC;IACnC,iBAAiB;IACjB,mCAAmC;IAE5B,4BAA4B;QAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC;IAC1B,CAAC;IAEM,gBAAgB;QACnB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACI,OAAO;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAEM,+BAA+B,CAAC,UAA4B;QAC/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,CAAC;YAC9E,IAAI,UAAU,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC/B,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,iBAAiB,GAAG,YAAY,EAAE,SAAS;YAC7C,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE;YAC1D,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAS,CAAC;aACnD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;aACtE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;aACvC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;YACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,SAAS,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;YACzD,OAAO,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;mBAClC,CAAC,SAAS,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEP,sEAAsE;QACtE,6EAA6E;QAC7E,wEAAwE;QACxE,yEAAyE;QACzE,wDAAwD;QACxD,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,yEAAyE;QACzE,+EAA+E;QAC/E,uEAAuE;QACvE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,sBAAsB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC;eACrE,YAAY,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,iCAAiC,CAAC,UAAU,CAAC,KAAK,8BAA8B,CAAC,OAAO;YACrG,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,sBAAsB,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;iBACxE,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACvE,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3G,OAAO,CAAC,GAAG,iBAAiB,EAAE,GAAG,aAAa,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3C,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,cAAc,GAAG,eAAe,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,qCAAqC,CAAC,UAA4B;QACrE,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,oCAAoC,CAAC,UAA4B;QACpE,IAAI,iCAAiC,CAAC,UAAU,CAAC,KAAK,8BAA8B,CAAC,OAAO,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IAEM,2BAA2B,CAAC,UAA4B;QAC3D,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;OAWG;IACI,yBAAyB,CAAC,UAA4B;QACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACxF,CAAC;IAED;;;;;;;;;;OAUG;IACI,sCAAsC,CACzC,UAA0C,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAEtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,mFAAmF;YACnF,mFAAmF;YACnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,OAAO,EAAE,mFAAmF;0BACtF,qDAAqD;iBAC9D;aACJ,CAAC,CAAC;QACP,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACvE,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,2BAA2B;QAC3B,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,qBAAqB,GAAG,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAC;YAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,kBAAkB;mBAC5C,UAAU,EAAE,OAAO,KAAK,IAAI;mBAC5B,qDAAqD,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7E,IACI,CAAC,qBAAqB,IAAI,gBAAgB,CAAC;mBACxC,IAAI,CAAC,oCAAoC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EACvE,CAAC;gBACC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7B,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAwC;QACzE,MAAM,2BAA2B,GAAG,IAAI,CAAC,sCAAsC,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,2BAA2B,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EACH,6DAA6D,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;sBACtG,oGAAoG;sBACpG,2FAA2F;sBAC3F,qFAAqF;gBAC3F,2BAA2B;aAC9B;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,+BAA+B,CAAsF;IACrH,yCAAyC,GAAG,KAAK,CAAC;IACzC,mCAAmC,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE3E,4BAA4B,CAChC,UAA4B;QAE5B,IAAI,IAAI,CAAC,+BAA+B,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;oBAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjE,IAAI,CAAC,+BAA+B,GAAG,MAA4F,CAAC;oBACxI,CAAC;yBAAM,CAAC;wBACJ,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;wBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;oBAC1D,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE;wBAC3F,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBACpC,CAAC,CAAC;oBACH,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;oBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;gBAC1D,CAAC;YACL,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAClE,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IACI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;eACjC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;eAC7B,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS,IAAI,CAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;mBACrC,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAC9G,CAAC,EACJ,CAAC;YACC,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACI,sCAAsC,CAAC,UAA4B;QACtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QACvF,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,iBAAiB,GAAG,IAAI,CAAC,yCAAyC,IAAI,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrI,OAAO,MAAM,CAAC,MAAM,CAAC;YACjB,aAAa,EAAE,oBAAoB;gBAC/B,CAAC,CAAC,sCAAsC,CAAC,oBAAoB;gBAC7D,CAAC,CAAC,gBAAgB;oBACd,CAAC,CAAC,sCAAsC,CAAC,4BAA4B;oBACrE,CAAC,CAAC,sCAAsC,CAAC,kBAAkB;YACnE,cAAc,EAAE,iBAAiB;gBAC7B,CAAC,CAAC,uCAAuC,CAAC,SAAS;gBACnD,CAAC,CAAC,oBAAoB;oBAClB,CAAC,CAAC,uCAAuC,CAAC,OAAO;oBACjD,CAAC,CAAC,uCAAuC,CAAC,MAAM;YACxD,6BAA6B,EAAE,gBAAgB,EAAE,OAAO,IAAI,IAAI;YAChE,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YAChG,6BAA6B,EAAE,oBAAoB,EAAE,OAAO,IAAI,IAAI;YACpE,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YACpG,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,0CAA0C,EAAE;SAC3F,CAAC,CAAC;IACP,CAAC;IAEO,6BAA6B;QACjC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAG,OAAQ,IAAI,CAAC,aAA0C,CAAC,WAAW,KAAK,QAAQ;YAChG,CAAC,CAAE,IAAI,CAAC,aAA0C,CAAC,WAAY;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,SAAS,IAAI,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,SAAiC,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,CAAC,OAA2C,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACI,wBAAwB,CAC3B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5C,MAAM,eAAe,GAAG,SAAS,CAAC,sBAAsB,IAAI,EAAE,CAAC;YAE/D,MAAM,aAAa,GAAG,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACtF,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAClE,IAAI,YAAY,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,yCAAyC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBACtF,OAAO,IAAI,CAAC,0BAA0B,CAClC,aAAa,EACb,YAA6C,CAChD,CAAC;YACN,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,mCAAmC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,aAAa,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,4DAA4D;YAC5D,qEAAqE;YACrE,6DAA6D;YAC7D,6DAA6D;YAC7D,2DAA2D;YAC3D,4DAA4D;YAC5D,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE;gBAC3E,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;IAEO,0BAA0B,CAC9B,aAAwD,EACxD,YAA2C;QAE3C,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC;QACxB,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,uDAAuD;QACvD,+DAA+D;QAC/D,wDAAwD;QACxD,2DAA2D;QAC3D,6DAA6D;QAC7D,EAAE;QACF,6DAA6D;QAC7D,4DAA4D;QAC5D,2DAA2D;QAC3D,6DAA6D;QAC7D,6DAA6D;QAC7D,yDAAyD;QACzD,6DAA6D;QAC7D,6DAA6D;QAC7D,SAAS;QACT,MAAM,WAAW,GAAG,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC;QACxD,MAAM,UAAU,GAAG,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC;QACtD,IAAI,WAAW,IAAI,UAAU,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,OAAO,EAAE,kGAAkG;oBAC3G,WAAW;oBACX,UAAU;iBACb;aACJ,CACJ,CAAC;QACN,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,eAAe,CAC9C,aAAa,CAAC,eAAsD,EACpE,YAAY,CAAC,eAAsD,CACtE,CAAC;QAEF,OAAO;YACH,GAAG,aAAa;YAChB,GAAG,YAAY;YACf,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,kEAAkE;YAClE,oEAAoE;YACpE,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,YAAY,CAAC,iBAAiB;gBACjE,CAAC,CAAC;oBACE,iBAAiB,EAAE;wBACf,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,EAAE,CAAC;wBAC1C,GAAG,CAAC,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC;qBAC5C;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;YACT,UAAU,EAAE,IAAI,CAAC,eAAe,CAC5B,aAAa,CAAC,UAAU,EACxB,YAAY,CAAC,UAAU,CACqB;YAChD,kFAAkF;YAClF,8EAA8E;YAC9E,6EAA6E;YAC7E,oCAAoC;YACpC,eAAe,EAAE,qBAAoE;SACxF,CAAC;IACN,CAAC;IAEO,eAAe,CACnB,YAAqB,EACrB,WAAoB;QAEpB,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACpD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACnF,OAAO,WAAkD,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,OAAO,YAAuC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAA4B;YACpC,GAAI,YAAwC;SAC/C,CAAC;QACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpD,SAAS;YACb,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ;mBACf,OAAO,QAAQ,KAAK,QAAQ;mBAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;mBACxB,KAAK;mBACL,OAAO,KAAK,KAAK,QAAQ;mBACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;gBACvC,CAAC,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAGD;;;;;;;;;;;;;;;;;OAiBG;IACH;;;;;;;;;;;;;;OAcG;IACI,sBAAsB,CAAC,WAAmB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QACxF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI;YACJ,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,IAAI,CAAC;YACrD,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,UAAU,EAAE,OAAO,CACf,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;mBACnG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAChG;SACJ,CAAC,CAAC,CAAC;IACR,CAAC;IAEM,sBAAsB,CACzB,WAAmB,EACnB,SAAiB;QAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC;QACvB,CAAC;QAED,0FAA0F;QAC1F,wFAAwF;QACxF,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,aAAa,GAAG,KAAK,EAAE,UAAU,IAAI,SAAS,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,iBAAiB,GAAG,MAAM,KAAK,SAAS;eACvC,CAAC,MAAM,CAAC,iBAAiB,KAAK,aAAa,IAAI,MAAM,CAAC,qBAAqB,KAAK,aAAa,CAAC,CAAC;QAEtG,OAAO,iBAAiB;YACpB,CAAC,CAAC,4BAA4B,CAAC,YAAY;YAC3C,CAAC,CAAC,4BAA4B,CAAC,UAAU,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QACxF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;;OAQG;IACK,uBAAuB,CAAC,WAAmB,EAAE,SAAiB;QAClE,2FAA2F;QAC3F,6FAA6F;QAC7F,6FAA6F;QAC7F,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QAC3F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,kGAAkG;QAClG,+FAA+F;QAC/F,oGAAoG;QACpG,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5D,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACI,uBAAuB,CAAC,WAAmB,EAAE,SAAiB;QACjE,OAAO,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACI,8BAA8B,CAAC,WAAmB;QACrD,OAAO,4BAA4B,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,WAAmB;QAC7C,OAAO,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACI,2BAA2B,CAAC,WAAmB;QAClD,OAAO,+BAA+B,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACK,yBAAyB;QAC7B,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QACnH,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,WAAmB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,QAAQ,EAAE,aAAa,IAAI,WAAW,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;QACjH,IAAI,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3G,OAAO;YACH,aAAa;YACb,WAAW;YACX,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY,EAAE,QAAQ;YACtB,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,KAAK,IAAI;SACxD,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,yBAAyB,CAAC,WAAmB;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QACnF,MAAM,OAAO,GAAoC,EAAE,CAAC;QACpD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YAC7G,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/J,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;YACtD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;gBACjG,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,uBAAuB,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YAC5J,CAAC;QACL,CAAC;QACD,OAAO,qCAAqC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED;;;;OAIG;IACI,mCAAmC,CAAC,WAAmB,EAAE,WAAmB;QAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,oBAAoB,IAAI,EAAE,CAAC;QACrG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,WAAW;eAC5F,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACI,gCAAgC,CAAC,WAAmB,EAAE,WAAmB,EAAE,aAAgC;QAC9G,MAAM,OAAO,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,UAAU,GAAG,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC5E,OAAO;YACH,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW;YACX,WAAW;YACX,iBAAiB,EAAE,UAAU,CAAC,WAAW;YACzC,0BAA0B,EAAE,UAAU,CAAC,oBAAoB;YAC3D,mBAAmB,EAAE,UAAU,CAAC,aAAa;SAChD,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACI,wCAAwC,CAAC,MAAsC;QAMlF,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;YACnE,OAAO;gBACH,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,qBAAqB;gBACtC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;oBACjD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACtH,YAAY,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;oBACzD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE,qBAAqB,CAAC;aAC7H,CAAC;QACN,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,UAAU,CAAC,CAAC;QACxH,IAAI,MAAM,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QACvE,MAAM,qBAAqB,GAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,aAAa,CAClG,EAAE,CAAC,sCAAsC,CAAC,UAAU,CAAwH,CAAC;QACjL,MAAM,QAAQ,GAAG,qBAAqB,EAAE,UAAU,EAAE,QAAQ;eACrD,qBAAqB,EAAE,QAAQ;eAC/B,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAuB,CAAC,CAAC;QAClJ,MAAM,eAAe,GAAG,qBAAqB,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,CAAC,eAAe,CAAC;QAC/F,OAAO;YACH,WAAW,EAAE,0BAA0B,MAAM,CAAC,aAAa,IAAI,sCAAsC,CAAC,UAAU,WAAW;YAC3H,eAAe;YACf,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,UAAU,EAAE,eAAe,CAAC;SACjI,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,+BAA+B;QACnC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACzF,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YACvH,IAAI,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI;gBAAE,SAAS;YAClE,2GAA2G;YAC3G,sFAAsF;YACtF,OAAO,CAAC,IAAI,CAAC,GAAG,iCAAiC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;iBAClI,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC;YAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,qCAAqC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/H,2GAA2G;YAC3G,sGAAsG;YACtG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChG,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,cAAc,IAAI,EAAE,EAAE,CAAC;gBAC9E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,6CAA6C,QAAQ,2CAA2C,CAAC,CAAC;gBACnK,wGAAwG;gBACxG,0EAA0E;gBAC1E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxE,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,gEAAgE,QAAQ,GAAG,CAAC,CAAC;gBACrH,CAAC;YACL,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,oEAAoE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE;SAC5H,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACK,+BAA+B;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACrD,IAAI,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/E,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YACvG,OAAO,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,+BAA+B,CAAC;YAC5C,WAAW;YACX,2BAA2B,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;YACzF,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,SAAS;YAC9E,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACnC,OAAO;oBACH,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACtE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;iBACjJ,CAAC;YACN,CAAC;YACD,wBAAwB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ;YAC7G,mBAAmB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC7B,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,sCAAsC,CAAC,UAAU,CAAC,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU;SACnJ,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,2DAA2D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC1F,OAAO;aACV;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;OAOG;IACI,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;QAClE,OAAO;YACH,aAAa,EAAE,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC;YAC/D,UAAU,EAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC;SACnE,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,4BAA4B,CAAC,WAAmB,EAAE,gBAAwB;QAC7E,IAAI,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACzE,OAAO,4BAA4B,CAAC,qBAAqB,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,gBAAgB,CAAC,KAAK,gBAAgB;YACnF,CAAC,CAAC,4BAA4B,CAAC,OAAO;YACtC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,6BAA6B,CAAC,WAAmB,EAAE,UAAkB;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,CAAC,wBAAwB,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,UAAU,CAAC,KAAK,4BAA4B,CAAC,UAAU,EAAE,CAAC;YACnG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,CAAC,4BAA4B,EAAE,CAAC;QACzG,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC;IACrF,CAAC;IAEM,2BAA2B,CAAC,WAAmB;QAClD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,YAAY,CACtD,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,GAAG,EAAE,CAAC;YAC5D,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACI,kCAAkC,CAAC,WAAmB;QACzD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,mBAAmB,CAC7D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU,EAAE,CAAC;YACnE,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kDAAkD,CAAC,SAAS,CAAC,CAAC;aACjF,MAAM,CAAC,CAAC,SAAS,EAAgD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACtG,CAAC;IAGD;;;;;;OAMG;IACI,0CAA0C,CAAC,WAAmB;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,4BAA4B,CACtE,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,mBAAmB,EAAE,CAAC;YAC5E,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2DAA2D,CAAC,SAAS,CAAC,CAAC;aAC1F,MAAM,CAAC,CAAC,SAAS,EAAwD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC9G,CAAC;IAGM,mCAAmC,CAAC,WAAmB;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CACxC,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QACF,OAAO,MAAuD,CAAC;IACnE,CAAC;IAEM,6BAA6B,CAAC,WAAmB;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;YAC9E,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,eAAe,GAAG;YACpB,GAAG,CAAC,eAAe,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;QACF,OAAO;YACH,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,SAAS,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACjD,sBAAsB,EAAE,eAAe,CAAC,UAAU;iBAC7C,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8CAA8C,CAAC,SAAS,CAAC,CAAC;iBAC7E,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;YAC1F,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YAC9C,yBAAyB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,yBAAyB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,GAAG,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,GAAG,CAAC,eAAe,CAAC,mDAAmD;gBACnE,CAAC,CAAC,EAAE,mDAAmD,EAAE,eAAe,CAAC,mDAAmD,EAAE;gBAC9H,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,eAAe,CAAC,iBAAiB;gBACjC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,GAAG,eAAe,CAAC,iBAAiB,EAAE,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,6BAA6B;gBAC7C,CAAC,CAAC,EAAE,6BAA6B,EAAE,CAAC,GAAG,eAAe,CAAC,6BAA6B,CAAC,EAAE;gBACvF,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,mEAAmE;YACnE,oEAAoE;YACpE,0DAA0D;YAC1D,kBAAkB,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpF,GAAG,CAAC,eAAe,CAAC,iCAAiC;gBACjD,CAAC,CAAC;oBACE,iCAAiC,EAAE,MAAM,CAAC,WAAW,CACjD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAC,GAAG,CACjE,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAC1D,CACJ;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACI,sCAAsC,CACzC,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,aAAa,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,aAAa,EAAE,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,yBAAyB,mBAAmB,kBAAkB,WAAW,EAAE,CAAC,CAAC;YAC3F,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC;YACD,OAAO,0CAA0C,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,WAAW;oBACX,mBAAmB;oBACnB,OAAO,EAAE,qFAAqF;oBAC9F,eAAe,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAC9C;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAEM,4CAA4C,CAC/C,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,sCAAsC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACvG,IACI,CAAC,gBAAgB;eACd,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;eACnF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;YACC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB;YACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5F,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAEO,uBAAuB,CAAC,UAA6B;QACzD,OAAO,UAAU;aACZ,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2CAA2C,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;aACvF,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,CAC1D,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,SAAqC,CAAC,CAC1F,CAAC,CAAC;IACX,CAAC;IAEO,+BAA+B,CACnC,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAEnG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,+BAA+B,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAC5E,OAAO,SAAS,CAAC;YACrB,CAAC;YAGD,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;gBAC7E,MAAM,0BAA0B,GAAG,SAAS,CAAC;gBAC7C,MAAM,wBAAwB,GAAG,OAAO,CACpC,eAAe,CAAC,SAAS;uBACtB,eAAe,CAAC,gBAAgB;uBAChC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CACpE,CAAC;gBACF,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,0BAA0B;oBAC1B,iBAAiB,EAAE;wBACf,CAAC,0BAA0B,CAAC,EAAE;4BAC1B,UAAU,EAAE,8BAA8B,CAAC,kBAAkB;4BAC7D,OAAO,EAAE,eAAe,CAAC,YAAY;4BACrC,IAAI,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;4BAC5C,6BAA6B,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;4BACzF,QAAQ,EAAE,wBAAwB;gCAC9B,CAAC,CAAC,4BAA4B,CAAC,wBAAwB;gCACvD,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;oCAChD,CAAC,CAAC,4BAA4B,CAAC,YAAY;oCAC3C,CAAC,CAAC,4BAA4B,CAAC,IAAI;4BAC3C,GAAG,CAAC,wBAAwB;gCACxB,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,EAAE;gCAC9F,CAAC,CAAC,EAAE,CAAC;4BACT,6DAA6D;4BAC7D,wDAAwD;4BACxD,yDAAyD;4BACzD,6DAA6D;4BAC7D,4DAA4D;4BAC5D,2BAA2B;4BAC3B,8BAA8B,EAAE,CAAC,uBAAuB,CAAC,WAAW,CAAC;4BACrE,sBAAsB,EAAE,0CAA0C,CAAC,cAAc;4BACjF,2DAA2D;4BAC3D,6DAA6D;4BAC7D,8BAA8B;4BAC9B,iBAAiB,EAAE,qCAAqC,CAAC,aAAa;4BACtE,4BAA4B,EAAE,gDAAgD,CAAC,kBAAkB;4BACjG,GAAG,CAAC,eAAe,CAAC,qBAAqB;gCACrC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE;gCAClE,CAAC,CAAC,EAAE,CAAC;yBACZ;qBACJ;oBACD,eAAe;iBAClB,CAAC;YACN,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,2BAA2B,CAAC,eAAe,CAAC,CAAC;YACpE,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS;oBACT,CAAC,CAAC;wBACE,UAAU,EAAE;4BACR,QAAQ,EAAE,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC;4BAC1D,SAAS;yBACZ;qBACJ;oBACD,CAAC,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,kBAAkB;oBACvE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE;oBAC5D,CAAC,CAAC,EAAE,CAAC;gBACT,eAAe;aAClB,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,wDAAwD;YACxD,2DAA2D;YAC3D,mDAAmD;YACnD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE;gBAC1D,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,2BAA2B,CAAC,eAAgD;QAChF,QAAQ,eAAe,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,2BAA2B,CAAC,KAAK;gBAClC,wDAAwD;gBACxD,yDAAyD;gBACzD,wDAAwD;gBACxD,2DAA2D;gBAC3D,2DAA2D;gBAC3D,OAAO,eAAe,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7F,KAAK,2BAA2B,CAAC,GAAG;gBAChC,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,2BAA2B,CAAC,KAAK;gBAClC,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,2BAA2B,CAAC,UAAU;gBACvC,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,2BAA2B,CAAC,mBAAmB;gBAChD,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,2BAA2B,CAAC,UAAU;gBACvC,OAAO,eAAe,CAAC,eAAe,CAAC;YAC3C,KAAK,2BAA2B,CAAC,OAAO,CAAC;YACzC,KAAK,2BAA2B,CAAC,kBAAkB;gBAC/C,OAAO,eAAe,CAAC,SAAS,CAAC;YACrC,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,KAAK,2BAA2B,CAAC,aAAa;gBAC1C,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YAC1C,KAAK,2BAA2B,CAAC,IAAI;gBACjC,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,KAAK,2BAA2B,CAAC,qBAAqB;gBAClD,yDAAyD;gBACzD,+DAA+D;gBAC/D,uDAAuD;gBACvD,OAAO,eAAe,CAAC,SAAS,CAAC;YACrC,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,eAAe,GAAU,eAAe,CAAC;gBAC/C,OAAO,eAAe,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,0BAA0B,CAC9B,eAAgD;QAEhD,QAAQ,eAAe,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,KAAK,2BAA2B,CAAC,KAAK,CAAC;YACvC,KAAK,2BAA2B,CAAC,UAAU,CAAC;YAC5C,qFAAqF;YACrF,mFAAmF;YACnF,gFAAgF;YAChF,KAAK,2BAA2B,CAAC,mBAAmB,CAAC;YACrD,KAAK,2BAA2B,CAAC,KAAK,CAAC;YACvC,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,8FAA8F;YAC9F,KAAK,2BAA2B,CAAC,aAAa,CAAC;YAC/C,KAAK,2BAA2B,CAAC,OAAO,CAAC;YACzC,sFAAsF;YACtF,gFAAgF;YAChF,KAAK,2BAA2B,CAAC,IAAI;gBACjC,OAAO,0BAA0B,CAAC,OAAO,CAAC;YAC9C,KAAK,2BAA2B,CAAC,kBAAkB;gBAC/C,OAAO,0BAA0B,CAAC,cAAc,CAAC;YACrD,KAAK,2BAA2B,CAAC,UAAU;gBACvC,OAAO,0BAA0B,CAAC,MAAM,CAAC;YAC7C,KAAK,2BAA2B,CAAC,qBAAqB;gBAClD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;oBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;oBACpG,OAAO,EAAE;wBACL,OAAO,EAAE,mGAAmG;8BACtG,oEAAoE;qBAC7E;iBACJ,CACJ,CAAC;YACN,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,eAAe,GAAU,eAAe,CAAC;gBAC/C,OAAO,eAAe,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,qBAAqB,CACzB,eAA0H;QAE1H,OAAO,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,GAAG,QAAQ;YACX,eAAe,EAAE;gBACb,GAAG,QAAQ,CAAC,eAAe;gBAC3B,UAAU,EAAE,eAAe,CAAC,mBAAmB;aAClD;YACD,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC;SACvC,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,iBAAiB,CACpB,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC1F,MAAM,kBAAkB,GAAG,UAAU,IAAI,SAAS,CAAC;YAEnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACpD,OAAO,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,2BAA2B,CAC/B,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;YAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;YAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;uBAChF,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAC7C,CAAC;oBACC,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,CAAC;YACL,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAChF,IAAI,cAAc,EAAE,UAAU,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/C,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAChC,WAAmB,EACnB,YAAoD;QAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjI,OAAO,UAAU;YACb,CAAC,CAAC,gBAAgB,UAAU,KAAK,WAAW,KAAK,YAAY,MAAM,4BAA4B,CAAC,UAAU,CAAC,EAAE;YAC7G,CAAC,CAAC,GAAG,WAAW,4BAA4B,YAAY,qCAAqC,CAAC;IACtG,CAAC;IAEM,8BAA8B,CACjC,WAAmB,EACnB,YAAoD;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;IACzC,CAAC;IAIM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,qCAAqC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAClF,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,UAAU,SAAS,kBAAkB,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE;gBAC5C,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACI,gCAAgC,CAAC,WAAmB;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;QAC9F,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC7D,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,QAAQ,CAAC;QAEf,OAAO,IAAI,CAAC,mCAAmC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;OAQG;IACI,yCAAyC,CAAC,WAAmB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;QAC9F,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAClD,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,QAAQ,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,mCAAmC,CACvC,WAAmB,EACnB,SAAsD;QAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC;QAC9F,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAC7C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAClG,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACI,KAAK,CAAC,8BAA8B,CACvC,MAAyC,EACzC,WAAmB,EACnB,YAAoD,EACpD,SAAiB;IACjB;;;;;OAKG;IACH,OAA+D;QAW/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,4FAA4F;QAC5F,2FAA2F;QAC3F,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,4FAA4F;QAC5F,0EAA0E;QAC1E,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;eACrE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,uCAAuC,MAAM,CAAC,eAAe,uDAAuD;kBAClH,oHAAoH;kBACpH,6BAA6B,CAClC,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACpE,sFAAsF;YACtF,yFAAyF;YACzF,sFAAsF;YACtF,yDAAyD;YACzD,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,yFAAyF;sBACvF,0DAA0D,CAC/D,CAAC;YACN,CAAC;YACD,iGAAiG;YACjG,uFAAuF;YACvF,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC/H,+FAA+F;YAC/F,6FAA6F;YAC7F,kFAAkF;YAClF,MAAM,eAAe,GAAG,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,KAAK,4BAA4B,CAAC,OAAO,CAAC;YAChI,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,qBAAqB,CAAC;gBACvF,MAAM,EAAE,MAAM,CAAC,OAAQ;gBACvB,WAAW;gBACX,aAAa,EAAE,iBAAiB;gBAChC,UAAU,EAAE,cAAc;gBAC1B,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aAC7E,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,sCAAsC,CAAC,IAAI,EAAE,GAAG,EAAE,CACpK,YAAY,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;gBACpH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,EAAE,CACvG,YAAY,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC9G,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,mBAAmB;sBACjB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;wBACxB,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,wBAAwB,SAAS,KAAK;wBAC/D,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,4BAA4B,SAAS,mDAAmD;8BAC3G,GAAG,0CAA0C,CAAC,YAAY,CAAC,GAAG,CAAC;sBACvE,iHAAiH;sBACjH,kFAAkF,CACvF,CAAC;YACN,CAAC;YACD,OAAO;gBACH,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,MAAM,EAAE,kCAAkC,CAAC,eAAe;gBAC1D,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,GAAG,CAAC,WAAW,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC;gBACtG,GAAG,CAAC,WAAW,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC;aACnG,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,EAAE,CAAC;YAC3E,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,sDAAsD,OAAO,CAAC,QAAQ,CAAC,EAAE,2CAA2C;sBAClH,oHAAoH,CACzH,CAAC;YACN,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACrF,IAAI,eAAe,EAAE,CAAC;gBAClB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,kCAAkC,CAAC,sBAAsB,EAAE,CAAC;YACzG,CAAC;YACD,MAAM,uBAAuB,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;YACpH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,yCAAyC,SAAS,yBAAyB,uBAAuB,kCAAkC,CACvI,CAAC;QACN,CAAC;QAED,qFAAqF;QACrF,0FAA0F;QAC1F,kFAAkF;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,iGAAiG;kBAC/F,0DAA0D,CAC/D,CAAC;QACN,CAAC;QACD,6FAA6F;QAC7F,MAAM,EAAE,aAAa,EAAE,yBAAyB,EAAE,UAAU,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC/I,8EAA8E;QAC9E,MAAM,uBAAuB,GAAG,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,sBAAsB,CAAC,KAAK,4BAA4B,CAAC,OAAO,CAAC;QAChJ,MAAM,KAAK,GAAG,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,6BAA6B,CAAC;YAC7F,cAAc,EAAE,MAAM,CAAC,OAAQ;YAC/B,WAAW;YACX,aAAa,EAAE,yBAAyB;YACxC,UAAU,EAAE,sBAAsB;YAClC,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,YAAY,EAAE,GAAG,EAAE,CAC5L,QAAQ,CAAC,qBAAqB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;YAChI,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAC/G,QAAQ,CAAC,qBAAqB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAClH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,mBAAmB;kBACjB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;oBACxB,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,4BAA4B,SAAS,KAAK;oBAC3E,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,4BAA4B,SAAS,mDAAmD;0BACnH,GAAG,0CAA0C,CAAC,YAAY,CAAC,GAAG,CAAC;kBACvE,gHAAgH;kBAChH,iDAAiD,CACtD,CAAC;QACN,CAAC;QACD,OAAO;YACH,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,kCAAkC,CAAC,uBAAuB;YAClE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YACxF,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1F,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;SACvF,CAAC;IACN,CAAC;IACD,4FAA4F;IAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,KAAK,CAAC,gCAAgC,CACzC,MAAyC,EACzC,WAAmB,EACnB,UAAqI,EACrI,OAAyD;QAEzD,iGAAiG;QACjG,sGAAsG;QACtG,8FAA8F;QAC9F,uGAAuG;QACvG,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1F,0GAA0G;QAC1G,yEAAyE;QACzE,MAAM,aAAa,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;QACvE,yGAAyG;QACzG,MAAM,mBAAmB,GAAG,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,qFAAqF;YACrF,sFAAsF;YACtF,yDAAyD;YACzD,OAAO;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACpE,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,yFAAyF;YACzF,yFAAyF;YACzF,sFAAsF;YACtF,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY;gBAAE,OAAO;YACtD,MAAM,YAAY,CAAC,mBAAmB,CAAC;gBACnC,MAAM,EAAE,MAAM,CAAC,OAAO;gBACtB,WAAW;gBACX,aAAa;gBACb,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;gBACrE,UAAU,EAAE,gBAAgB;gBAC5B,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;YAAE,OAAO;QAEtF,MAAM,QAAQ,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,0FAA0F;QAC1F,6FAA6F;QAC7F,4FAA4F;QAC5F,wDAAwD;QACxD,MAAM,QAAQ,CAAC,mBAAmB,CAAC;YAC/B,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,WAAW;YACX,aAAa;YACb,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;YACrE,UAAU,EAAE,gBAAgB;YAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;YAC3F,GAAG,CAAC,UAAU,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACtH,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAChD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACK,0BAA0B,CAC9B,WAAmB;IACnB,yFAAyF;IACzF,kBAAsC,EACtC,UAAkD,EAClD,qBAAuD;QAEvD,OAAO,sCAAsC,CAAC;YAC1C,QAAQ,EAAE,IAAI;YACd,WAAW;YACX,kBAAkB;YAClB,qBAAqB;YACrB,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kFAAkF,EAAE;gBAC7H,WAAW;gBACX,UAAU;gBACV,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC;SACL,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,8BAA8B,CACxC,WAAmB,EACnB,aAAqB,EACrB,qBAAuD;QAEvD,IAAI,aAAa,KAAK,WAAW;YAAE,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iCAAiC,WAAW,gDAAgD;kBACxH,IAAI,aAAa,4EAA4E,aAAa,KAAK,CAAC;QAC1H,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAAC,WAAmB,EAAE,MAAc;QAC9D,OAAO,IAAI,sCAAsC,CAAC,aAAa,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,6FAA6F;IAC7F,4CAA4C;IAC5C,EAAE;IACF,4EAA4E;IAC5E,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,2DAA2D;IAC3D,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,EAAE;IACF,kDAAkD;IAClD,EAAE;IACF,yCAAyC;IACzC,wDAAwD;IACxD,uBAAuB;IACvB,EAAE;IACF,uFAAuF;IACvF,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,wFAAwF;IACxF,mCAAmC;IACnC,EAAE;IACF,6FAA6F;IAC7F,wDAAwD;IACxD,6FAA6F;IAE7F;;;;;;;OAOG;IACO,qCAAqC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1G,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACrB,kBAAkB,CAAC,sCAAsC,CAC5D,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACO,6BAA6B;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC;YAAE,OAAO,SAAS,CAAC;QAClG,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACrB,kBAAkB,CAAC,8BAA8B,CACpD,CAAC;IACN,CAAC;IAGM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,OAAO,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;gBACnD,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,eAAe,GAA2B,EAAE,CAAC;YACnD,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAChF,MAAM,iBAAiB,GAAG,cAAc,EAAE,UAAU,EAAE,SAAS,CAAC;YAChE,IAAI,iBAAiB,EAAE,CAAC;gBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBACzF,IAAI,WAAW,EAAE,CAAC;oBACd,eAAe,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC;gBACrD,CAAC;YACL,CAAC;YAED,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;gBAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;gBAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;oBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;2BAChF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;oBAClG,IAAI,WAAW,EAAE,CAAC;wBACd,eAAe,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;oBAC9D,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,iBAAiB;QAC1B,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;YAEhE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAE1B,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;gBACjF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;aAC/C,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACpD,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBACpC;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,uBAAuB;IACvB,mCAAmC;IAEzB,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;aACvG,CACJ,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AA3yEY,uCAAuC;IADnD,UAAU,EAAE;IAQJ,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAgCzD,WAAA,MAAM,CAAC,WAAW,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;yDAjCiD,0BAA0B;GATtG,uCAAuC,CA2yEnD","sourcesContent":["/*\n External Providers Registry Backend Service\n \n Provides runtime access to the backend provider registry and\n * their protocol configurations, secrets, and operations.\n /\n\nimport { ExternalProviderConnectionRefusedError } from './external-provider-connection-refusal.backend';\nimport type { ProviderConnectionFacts, ProviderCredentialAddress, ProviderSharedConnections } from '@wildo-ai/saas-models';\nimport { resolveProviderConnectionRef } from '@wildo-ai/saas-models';\nimport {\n findSharedConnectionBootDefects,\n resolveDeclaredSharedConnection,\n type ResolvedProviderSharedConnection,\n} from './provider-shared-connection.backend';\nimport {\n classifyProviderConnectionScopes,\n computeProviderConnectionScopeCeiling,\n type ProviderConnectionScopeCeiling,\n type ProviderConnectionScopeSource,\n} from './provider-connection-scope-ceiling.backend';\nimport type { ProviderScopeReauthorizationOffer } from '@wildo-ai/saas-models';\nimport { createRequire } from 'node:module';\nimport { join } from 'node:path';\nimport { injectable, inject, optional } from 'inversify';\nimport type { Container } from 'inversify';\nimport {\n External_Providers_Registry,\n External_Providers_RegistryItem,\n EngineCapability,\n EngineCapabilityResolutionMode,\n ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED,\n getEngineCapabilityResolutionMode,\n PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY,\n} from '@wildo-ai/saas-models';\n\n/\n How the required-capability floor is evaluated on the calling host.\n \n `includeEngineFloor` — whether ENABLED members of\n * `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` count as required. True on a host\n * expected to SERVE those slots (the application backend, the platform services); false on a\n * scope-filtered host such as a minion, whose registry legitimately resolves none of them.\n * The application's own `required` flags are honoured on every host regardless.\n /\nexport interface RequiredCapabilityFloorOptions {\n includeEngineFloor: boolean;\n}\nimport {\n ExternalProvider_ExchangeProtocol_Kind,\n ExternalProvider_ExchangeProtocol_Configuration_Base,\n LLMProvider_OperationKey,\n DocumentExtractionProvider_OperationKey,\n EmbeddingsProvider_OperationKey,\n APPLICATION_ENVIRONMENT,\n ProviderProtocolRuntimeKind,\n ExternalProvider_SecretScope,\n} from '@wildo-ai/external-connectors-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { OrganizationProviderCredentialResolverPort } from '~wildo-backend-lib/security/connected-accounts/organization-provider-credential-resolver.port';\nimport type {\n UserProviderCredentialResolverPort,\n} from '~wildo-backend-lib/security/connected-accounts/user-provider-credential-resolver.port';\nimport type { ProviderOAuth2RefreshAudience } from '~wildo-backend-lib/security/connected-accounts/provider-oauth2-refresher.port';\nimport {\n StoredCredentialSlotStanding,\n describeCredentialsStoredUnderRetiredSlots,\n findCredentialsStoredUnderRetiredSlots,\n requireCredentialsStoredUnderRetiredSlots,\n} from '~wildo-backend-lib/security/connected-accounts/utils/retired-credential-slot.backend.utils';\nimport type { StorableCredentialSlot } from '~wildo-backend-lib/security/connected-accounts/utils/retired-credential-slot.backend.utils';\nimport { ProviderCredentialResolutionSource, ProviderCredentialSlotWriteRefusal } from '@wildo-ai/saas-models';\nimport {\n ExternalProvider_Connection_DelegationMode,\n ExternalProvider_Connection_OwnerScope,\n} from '@wildo-ai/external-connectors-models';\nimport type {\n ExternalProvider_ConnectionShape,\n ExternalProvider_ConnectionTarget,\n} from '@wildo-ai/external-connectors-models';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError } from '@wildo-ai/saas-models';\nimport type { BackendProviderRegistryBackendService } from './backend-provider-registry.backend.service';\nimport type { ProviderProtocolRuntimeContract,\n SecretsContractEntry,\n CodingAgentHostLoginContract,\n} from '@wildo-ai/external-connectors-private/backend';\nimport type { Hook_Endpoint, ProviderRestOAuth2 } from '@wildo-ai/external-connectors-models';\nimport { describeProviderOAuth2AudienceDefects, describeProviderRateBudgetDefects } from '@wildo-ai/external-connectors-models';\nimport {\n AgentClientProtocol_AuthMode,\n AgentClientProtocol_ExecutionProfileSchema,\n AgentClientProtocol_HostConfigurationInheritance,\n AgentClientProtocol_PermissionCeiling,\n AgentClientProtocol_RunnerHost,\n AgentClientProtocol_WorkingDirectoryPolicy,\n CodingAgent_OperationKey,\n type AgentClientProtocol_Configuration,\n type AgentClientProtocol_ExecutionProfile,\n} from '@wildo-ai/external-connectors-models';\n\n/\n Provider-contract operation literal → the semantic coding operation key. The\n * contract package uses short literals so it need not depend on the operation\n * family that consumes it; this map is the single translation.\n /\nconst RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION: Record<string, CodingAgent_OperationKey> = {\n runCodingTask: CodingAgent_OperationKey.RUN_CODING_TASK,\n};\n\n/\n The runtime projection of an ACP provider's transport capability.\n \n Far smaller than a request/response protocol's, because ACP agents advertise\n * their own capabilities, modes and commands during `initialize` /\n * `session/new`. Re-declaring any of that in authored configuration would\n * create a second source of truth that drifts the first time the agent is\n * upgraded — so what remains is only what the HOST must know before it opens a\n * connection.\n /\nexport type RuntimeAgentClientProtocolProfile = {\n /* How the provider says to START its agent — the authority an application inherits. /\n agentCommand: string;\n agentArgs: string[];\n supportedOperationKeys: CodingAgent_OperationKey[];\n supportedModels: string[];\n supportedProtocolVersions: number[];\n sessionMetaExtensions?: Record<string, unknown>;\n /* How this agent expresses each isolation posture; an absent posture is refused, never substituted. /\n sessionMetaExtensionsByHostConfigurationInheritance?: Partial<Record<string, Record<string, unknown>>>;\n /\n How the selected model reaches this agent. Absent means the provider\n * declared none, and a run that selected a model is refused rather than\n * started with the choice silently dropped.\n /\n modelDelivery?:\n \| { channel: 'environment-variable'; environmentVariableName: string }\n \| { channel: 'session-config-option'; configId: string };\n /\n Semantic model id → this agent's own spelling, where the two differ.\n \n Absent, or absent for a given model, means the semantic id is sent\n * unchanged — correct for every agent whose vocabulary already is Wildo's.\n /\n modelTransportIds?: Record<string, string>;\n /* Agent-vocabulary session-mode ids to prefer per ceiling; an optimisation, never the guarantee. /\n sessionModeIdsByPermissionCeiling?: Partial<Record<string, string[]>>;\n /\n The auth modes the PROVIDER declares its agent can actually use.\n \n Carried so an application-authored profile can be validated against it.\n * The contract's list previously reached only the synthesized `default`\n * profile, so an authored profile could declare any mode and nothing checked\n * whether the agent supports it.\n /\n supportedAuthModes?: string[];\n /\n Host environment variables the AGENT ITSELF needs, declared by its provider.\n \n Distinct from the execution profile's list, which is application policy.\n * This one is provider knowledge — which variable an agent reads to find its\n * own credentials is not something an application can be expected to know —\n * and it is UNIONED with the profile's rather than replaced by it.\n /\n inheritedEnvironmentVariables?: string[];\n /\n How to ask the host whether this agent's operator is signed in, without a model call — the\n * provider's declaration, carried so a runtime can refuse a dispatch to a signed-out agent before\n * spawning it rather than discover the login on the first prompt (#1637).\n /\n hostLogin?: CodingAgentHostLoginContract;\n};\nimport { ExternalProvider_Auth_Kind } from '@wildo-ai/external-connectors-models';\nimport {\n ExternalProviderSelectionAuthorityKind,\n ExternalProviderSelectionOverrideStatus,\n type ExternalProviderSelectionResolutionEvidence,\n} from '~wildo-backend-lib/external-providers/models/provider-selection-resolution-evidence.backend.definitions';\n\n/\n F-6 (2026-05-06) — runtime-side projection of a resolved provider\n * configuration. The base schema (`ExternalProvider_ExchangeProtocol_Configuration_Base`)\n * lives in `external-connectors-models` (which can't import the\n * backend-only discriminated union); we extend it here at the consumer\n * boundary so callers narrow on `runtimeContract.kind` instead of\n * casting through `as any`.\n \n Optional fields beyond the base also appear on this projection:\n \n - `defaultExecutionProfileRef` / `executionProfiles` — set by\n * `getDefaultProviderConfiguration` for `kind: ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL`\n * contracts, consumed by `getAgentClientProtocolProfile` and the ACP runner.\n * - `endpoints` — set for `kind: ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR`.\n \n They stay typed as `unknown` here because their canonical schemas\n * live in `external-connectors-models`'s `AgentClientProtocol_Configuration` /\n * webhook surfaces and are narrowed at consumer sites already.\n /\nexport type ResolvedProviderConfiguration =\n & ExternalProvider_ExchangeProtocol_Configuration_Base\n & {\n runtimeContract?: ProviderProtocolRuntimeContract;\n defaultExecutionProfileRef?: string;\n executionProfiles?: Record<string, unknown>;\n /\n Webhook-originator endpoint descriptors emitted by\n * `buildWebhookEndpoints` 2026-05-06: now matches the canonical\n * `Hook_Endpoint` shape (with the optional `displayName` field).\n * The dead extras (`providerRef`, `path`, `secretBinding`) that\n * previously polluted the emit have been removed; their values\n * were redundant with information already carried by other\n * fields (controller loop key, route convention, `authConfig.secretRef`).\n /\n endpoints?: ReadonlyArray<Hook_Endpoint>;\n };\n\n\nconst DEFAULT_IDENTITY_ENVIRONMENTS = [\n APPLICATION_ENVIRONMENT.DEVELOPMENT,\n APPLICATION_ENVIRONMENT.STAGING,\n APPLICATION_ENVIRONMENT.PRODUCTION,\n];\n\nfunction isCompanionRuntimeServiceName(serviceName: string): boolean {\n const normalized = serviceName.trim().toLowerCase();\n return normalized === 'companion'\n \|\| normalized === 'wildo-dev-companion'\n \|\| normalized.endsWith('-companion');\n}\n\nconst RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION: Record<string, LLMProvider_OperationKey> = {\n generateText: LLMProvider_OperationKey.GENERATE_TEXT,\n streamText: LLMProvider_OperationKey.STREAM_TEXT,\n chatCompletion: LLMProvider_OperationKey.CHAT_COMPLETION,\n chatMultimodal: LLMProvider_OperationKey.CHAT_MULTIMODAL,\n generateStructured: LLMProvider_OperationKey.GENERATE_STRUCTURED,\n streamStructured: LLMProvider_OperationKey.STREAM_STRUCTURED,\n // The `Thinking` runtime operation names were RETIRED 2026-07-17 — reasoning\n // depth is the `reasoningEffort` PARAMETER, not a separate operation.\n};\n\n/*\n The embeddings protocol's OWN runtime-op → semantic-key map (RAG plan DL2/H4 surface 1):\n * embeddings operations never enter {@link RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION}, whose\n * `toSemanticOperationKeys` filter would silently DROP any key outside `LLMProvider_OperationKey`\n * — the exact fall-through a sixth LLM operation key would have died in. Disjoint kind, disjoint map.\n /\nconst RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION: Record<string, EmbeddingsProvider_OperationKey> = {\n embedTexts: EmbeddingsProvider_OperationKey.EMBED_TEXTS,\n};\n\n/\n The document-extraction protocol's OWN runtime-op → semantic-key map, for the same reason its\n * embeddings sibling above has one: each protocol kind owns a disjoint operation vocabulary, so a\n * key never falls through a foreign filter and silently disappears.\n /\nconst RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION: Record<string, DocumentExtractionProvider_OperationKey> = {\n extractDocumentText: DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT,\n};\n\ninterface RuntimeProviderScopeSelection {\n engineCapabilities?: EngineCapability[];\n}\n\ninterface RuntimeProviderScope {\n providers?: Record<string, RuntimeProviderScopeSelection \| undefined>;\n selection?: Partial<Record<EngineCapability, {\n primary: string;\n whenUnavailable?: string[];\n }>>;\n}\n\n\n/\n What a provider admits when NOBODY HAS JUDGED IT — the SAFETY NET, not the answer.\n \n Named and stated once because it was previously an anonymous literal inlined at two call sites,\n * and a value that applies to most of the catalogue should be readable as the decision it is.\n \n ONE row, and it is the conservative end deliberately. APPLICATION x SERVICE is the deployment's\n * own credential, authored in the environment by the operator — the only claim that needs no\n * knowledge of the vendor whatsoever.\n \n It was briefly widened to include ORGANIZATION x SERVICE, with a careful argument that a tenant\n * bringing its own key is a fact about Wildo's tenancy model rather than about any vendor. The\n * argument holds and the change was still wrong: it made a blanket rule decide for 688 vendors at\n * once, which is precisely the per-vendor judgement this framework refuses to shortcut. A default\n * that carries the whole catalogue is not a fallback — it is mass management with a justification\n * attached, and the justification is what makes it hard to notice.\n \n So a provider earns every row beyond this one by somebody ANALYSING it and recording why, as a registry\n * provider's own `admissibleConnections` does (`providers-registry/asana/`), and as the archived catalogue's\n * `_code_archive/providers/catalogue-record/decisions/slack.json` did. The population that needs that judgement\n * is far smaller than the catalogue: 99 of the 689 transposed vendors declare an OAuth2 contract,\n * and only those have a connection flow to admit anybody to.\n /\nconst UNJUDGED_PROVIDER_ADMISSIBLE_CONNECTIONS: readonly ExternalProvider_ConnectionShape[] = [\n { ownerScope: ExternalProvider_Connection_OwnerScope.APPLICATION, delegation: ExternalProvider_Connection_DelegationMode.SERVICE },\n];\n\n/\n One declared secret slot of a provider, as a SCREEN needs it.\n \n Carries the slug so a form can name the field without anybody typing it, the environment variable\n * so an operator knows exactly what to set, and `configured` so a missing one can be reported rather\n * than discovered by pressing a button. It carries no VALUE, and there is no field for one.\n /\n/\n The OAuth client a connect, refresh or revocation must use — see\n * `ExternalProvidersRegistryBackendService.getConnectionOAuth2Client` (#1725).\n /\nexport interface ProviderConnectionOAuth2Client {\n /* The connection's identity: the declared base, or the ref itself when undeclared. /\n readonly connectionRef: string;\n /* The ref the flow came through. Recorded and audited; never the client's owner for a member. /\n readonly providerRef: string;\n /* The OWNER's REST OAuth2 block — endpoints, scopes, allowances, audiences. /\n readonly oauth2: ProviderRestOAuth2;\n /* The owner's REST contract, for the deployment base URL and the deployment-configured hosts. /\n readonly restContract: Extract<ProviderProtocolRuntimeContract, { kind: typeof ProviderProtocolRuntimeKind.REST }>;\n /* The client is the owner's sign-in registration (`sharedWithSignIn`) rather than its connected-account one. /\n readonly sharedWithSignIn: boolean;\n}\n\nexport interface ProviderSecretSlot {\n readonly slug: string;\n readonly envVarName: string;\n readonly required: boolean;\n readonly description: string;\n readonly scope: ExternalProvider_SecretScope;\n /* Whether the deployment environment supplies it. Never the value itself. /\n readonly configured: boolean;\n /* Present when the contract marks the slot as holding a deployment host (see `SecretsContractEntry.holdsDeploymentHost`). /\n readonly holdsDeploymentHost?: true;\n /* Present when the contract marks the slot as holding a vendor value made for browsers (see `SecretsContractEntry.holdsBrowserPublicValue`). /\n readonly holdsBrowserPublicValue?: true;\n}\n\n/\n How an operator provides an application-owned provider secret (#1637) — one wording for every refusal\n * that reaches a person because a key is missing, so each names the same door: `wildo secrets set`, or\n * the workbench's Secrets section, which runs it.\n /\nexport function describeProviderSecretRemedy(envVarName: string): string {\n return `Provide it with \\`wildo secrets set ${envVarName}\\` (add \\`--env <environment>\\` for a remote one) or in the workbench's `\n + 'Secrets section; the runtimes that read it restart to pick it up.';\n}\n\n@injectable()\nexport class ExternalProvidersRegistryBackendService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n protected registry: External_Providers_Registry \| null = null;\n\n protected isInitialized = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) protected readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) protected readonly configService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) protected readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) protected readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n /\n The container, used ONLY to resolve the per-organization credential store on demand\n * ({@link resolveOrganizationCredentialResolver}). OPTIONAL, and appended LAST so no\n * existing parameter position moves.\n \n *Deliberately NOT a constructor injection of\n {@link OrganizationProviderCredentialResolverPort}.** `@optional()` tolerates an ABSENT\n * BINDING; it does not defer construction. So injecting the port directly made this\n * configuration-tier registry construct the entire resource stack that stands behind the\n * store — and that stack closes a cycle straight back here:\n \n ```\n * SaaS.AuditLogSink → CompositeAuditLogSink → ExternalProvidersRegistryService\n * → OrganizationProviderCredentialResolver (the store)\n * → SystemAccessService / AuditLogsService → SaaS.AuditLogSink\n * ```\n \n which InversifyJS reports as `Circular dependency found: (No dependency trace)` +\n * `RangeError: Maximum call stack size exceeded` at BOOT — every platform service and every\n * application backend, since `AuditLogsBackendService` injects the sink. The same edge\n * poisons `LlmObservabilityAgentCallTraceSink`, which depends on this registry too.\n \n Resolving on demand is also what the port's own contract already assumed: this service is\n * constructed at configuration tier, BEFORE repositories exist, while a tenant credential is\n * only ever needed once a request is being served. Lazy-container is the pattern\n * `AuthorizationsBackendService` and `WebSocketService` use to break their own cycles.\n \n When the container is absent (a unit harness) or the store is unbound (a minion resolving\n * an LLM key), no tenant has its own credential here and resolution falls through to the\n * deployment environment — the behaviour every caller had before the store existed.\n /\n @inject('Container') @optional() protected readonly container?: Container,\n ) {\n this.logDebug = this.logger.debugByType('ExternalProvidersRegistryBackendService');\n this.logger.setDebugTypeLogging('ExternalProvidersRegistryBackendService', false);\n\n this.logDebug('External providers registry service created (not yet initialized)');\n }\n\n // ================================\n // Initialization Method\n // ================================\n\n /\n Initialize by projecting first-class backend provider modules into the\n * runtime registry facade used by existing callers.\n /\n public async initialize(): Promise<void> {\n if (this.isInitialized) {\n this.logDebug('Service already initialized, skipping');\n return;\n }\n\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.reportMissingProviderRuntimePeers();\n\n this.registry = registry;\n\n this.isInitialized = true;\n try {\n this.assertSharedConnectionsCoherent();\n this.assertDeclaredAudiencesCoherent();\n } catch (error) {\n // A host that refused its shared connections is not initialized: nothing may resolve a grant through\n // a declaration this boot has just proven wrong.\n this.isInitialized = false;\n this.registry = null;\n throw error;\n }\n this.logDebug('External providers registry initialized from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n }\n\n /\n @wildo_source:part:start saas.backend.providers.optional-runtime-peers facet:layer:backend facet:audience:app-developer\n \n Report a registered provider whose optional runtime peer is not installed (#438).\n \n What this means for an application: a provider may lazy-load a vendor SDK that is not a\n * dependency of the engine or of your application. Declaring the provider in a scope does not\n * install it. YOU install it, in the runtime that enables the provider — which is your own\n * `backend-api`, not the engine package — and if you do not, the capability that provider serves\n * quietly does not work.\n \n The startup warning names the provider and the missing packages, so read it as an\n * installation instruction rather than as noise.\n \n `requiredPackages` declares the npm packages a provider LAZY-LOADS — a vendor SDK that is\n * never an engine or application dependency, installed only in a runtime that enables the\n * provider. Two providers declare it (immudb -> `immudb-node`, posthog -> `posthog-node`), and\n * until 2026-09-08 the field had NO READER anywhere: no start-up check, no installation step,\n * no diagnostic. A provider could be registered with its SDK absent and the first sign was the\n * feature quietly not working.\n \n A REPORT, never a refusal, and the asymmetry is deliberate: a declared provider may\n * legitimately never be reached (a fan-out audit sink in an environment that emits nothing),\n * so an absent optional peer is information rather than a misconfiguration. The capability\n * DISAGREEMENT check in `define-saas-config` refuses, because a wrong declaration is wrong\n * whatever happens next.\n \n Resolution is attempted from the RUNNING APPLICATION first and from this module second. The\n * peer is installed in the application's own `backend-api`, not in the engine package, so\n * resolving only from here would report a false absence — and a diagnostic that cries wolf is\n * worse than the silence it replaces.\n /\n private reportMissingProviderRuntimePeers(): void {\n const resolvers = [\n (() => { try { return createRequire(join(process.cwd(), 'package.json')); } catch { return undefined; } })(),\n (() => { try { return createRequire(import.meta.url); } catch { return undefined; } })(),\n ].filter((resolver): resolver is NodeRequire => Boolean(resolver));\n\n const isResolvable = (packageName: string): boolean => resolvers.some((resolver) => {\n try {\n resolver.resolve(packageName);\n return true;\n } catch {\n return false;\n }\n });\n\n for (const provider of this.backendProviderRegistry.getRegistry().modules.values()) {\n const declaredPackages = provider.requiredPackages ?? [];\n const missing = declaredPackages.filter((packageName) => !isResolvable(packageName));\n if (missing.length === 0) {\n continue;\n }\n this.logger.warn('Provider is registered without its declared optional runtime peer(s)', {\n providerRef: provider.metadata.ref,\n missingPackages: missing,\n detail: 'The provider lazy-loads these and degrades without them, so the capability it serves will not work. '\n + 'Install them in the runtime that enables this provider, or stop declaring the provider in that scope.',\n });\n }\n }\n /* @wildo_source:part:end saas.backend.providers.optional-runtime-peers /\n\n private buildRuntimeRegistryFromProviderModules(): External_Providers_Registry {\n const registry: External_Providers_Registry = {};\n for (const provider of this.backendProviderRegistry.getRegistry().modules.values()) {\n const providerRef = provider.metadata.ref;\n const protocols = this.backendProviderRegistry.getProtocolKinds(providerRef);\n const engineCapabilities = provider.providerCapabilities\n .map((capability) => PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability])\n .filter((capability): capability is EngineCapability => Boolean(capability));\n\n registry[providerRef] = {\n providerRef,\n protocols,\n engineCapabilities: [...new Set(engineCapabilities)],\n supportsOAuth2: protocols.includes(ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2) \|\| undefined,\n };\n }\n return registry;\n }\n\n // ================================\n // Access Methods\n // ================================\n\n public getExternalProvidersRegistry(): External_Providers_Registry {\n this.ensureInitialized();\n return this.registry!;\n }\n\n public getProviderTypes(): string[] {\n this.ensureInitialized();\n return Object.keys(this.registry!);\n }\n\n public getProvider(providerRef: string): External_Providers_RegistryItem \| undefined {\n this.ensureInitialized();\n return this.registry![providerRef];\n }\n\n public hasProvider(providerRef: string): boolean {\n this.ensureInitialized();\n return providerRef in (this.registry \|\| {});\n }\n\n /\n Public, NON-throwing readiness probe — whether `initialize()` has run.\n * Lets lazy consumers (e.g. `CompositeAuditLogSink`) distinguish the expected\n * pre-startup window (skip silently, retry later) from a genuine post-init\n * resolution fault (which must be surfaced, not swallowed) — without tripping\n * the `ensureInitialized()` throw just to probe.\n /\n public isReady(): boolean {\n return this.isInitialized;\n }\n\n public getProvidersForEngineCapability(capability: EngineCapability): string[] {\n this.ensureInitialized();\n if (this.configService.isInitialized()) {\n const activation = this.configService.config.engineCapabilities?.[capability];\n if (activation?.enabled !== true) {\n return [];\n }\n }\n\n const runtimeScope = this.getActiveRuntimeProviderScope();\n if (this.configService.isInitialized() && !runtimeScope) {\n return [];\n }\n\n const scopeProviderRefs = runtimeScope?.providers\n ? new Set(Object.keys(runtimeScope.providers))\n : undefined;\n const configuredProviders = this.configService.isInitialized()\n ? (this.configService.config.providerConfigurations ?? {})\n : {};\n\n const availableProviders = Object.values(this.registry!)\n .filter((provider) => provider.engineCapabilities.includes(capability))\n .map((provider) => provider.providerRef)\n .filter((providerRef) => {\n if (!scopeProviderRefs) {\n return true;\n }\n\n const selection = runtimeScope?.providers?.[providerRef];\n return scopeProviderRefs.has(providerRef)\n && (selection?.engineCapabilities ?? []).includes(capability);\n });\n\n // A FAN_OUT capability ignores any `selection` policy: every declared\n // provider is active, so primary/substitute ordering is meaningless (and the\n // config validator rejects authoring one). Guarding here is defense-in-\n // depth — a stray selection on a fan-out cap from a legacy/hand-authored\n // artifact never reorders or truncates the fan-out set.\n // Per-environment selection override (WILDO_PROVIDER_SELECTION_OVERRIDES,\n // authored in `wildo.infra.<env>.config.ts > providerSelection`) wins over\n // the app-wide `wildo.saas.config.ts` selection for a SELECT_ONE capability.\n // It only REORDERS — the availability/enabled filtering above is unchanged,\n // so undeclared or capability-disabled refs are skipped, never admitted.\n // Remaining eligible refs are appended after the eligible primary/substitutes;\n // an invalid primary therefore does not empty a nonempty eligible set.\n // This ordering does not test credentials or retry a failed vendor call.\n // FAN_OUT ignores it (same rule as the SaaS-side selection).\n const selectionForCapability = this.getProviderSelectionOverride(capability)\n ?? runtimeScope?.selection?.[capability];\n const policy = getEngineCapabilityResolutionMode(capability) === EngineCapabilityResolutionMode.FAN_OUT\n ? undefined\n : selectionForCapability;\n if (policy) {\n const orderedPolicyRefs = [policy.primary, ...(policy.whenUnavailable ?? [])]\n .filter((providerRef) => availableProviders.includes(providerRef));\n const remainingRefs = availableProviders.filter((providerRef) => !orderedPolicyRefs.includes(providerRef));\n return [...orderedPolicyRefs, ...remainingRefs];\n }\n\n return availableProviders.sort((left, right) => {\n const leftConfigured = configuredProviders[left] ? 0 : 1;\n const rightConfigured = configuredProviders[right] ? 0 : 1;\n return leftConfigured - rightConfigured \|\| left.localeCompare(right);\n });\n }\n\n public getPrimaryProviderForEngineCapability(capability: EngineCapability): string \| undefined {\n return this.getProvidersForEngineCapability(capability)[0];\n }\n\n /\n Resolve the provider ref(s) that should be ACTIVE for a capability,\n * honouring its declared `EngineCapabilityResolutionMode`:\n * - `SELECT_ONE` (the default — billing, email, observability, …): the\n * single primary, as a 0- or 1-element list. A declared `whenUnavailable` entry\n * only orders the candidate list ahead of this call — it substitutes for a\n * primary that is not AVAILABLE, and nothing tries a second provider when a\n * call to the first one FAILS.\n * - `FAN_OUT` (e.g. `COMPLIANCE_AUDIT_TRAIL`): EVERY declared + available\n * provider — all active simultaneously (no primary, no failover).\n \n The single entry point a fan-out consumer (the `CompositeAuditLogSink`)\n * uses, so the resolution mode is honoured centrally rather than each\n * consumer choosing `getPrimary…` vs `getProviders…` by convention.\n /\n public getResolvedProviderRefsForCapability(capability: EngineCapability): string[] {\n if (getEngineCapabilityResolutionMode(capability) === EngineCapabilityResolutionMode.FAN_OUT) {\n return this.getProvidersForEngineCapability(capability);\n }\n const primary = this.getPrimaryProviderForEngineCapability(capability);\n return primary ? [primary] : [];\n }\n\n public isEngineCapabilityAvailable(capability: EngineCapability): boolean {\n return this.getProvidersForEngineCapability(capability).length > 0;\n }\n\n /\n G4 (audit Phase 5) — fail-open reconcile support. Whether a capability is\n * switched ON in `engineCapabilities` config (`activation.enabled === true`),\n * INDEPENDENT of whether any provider resolves to serve it. Distinct from:\n * - `isEngineCapabilityAvailable` — a provider is DECLARED (says nothing about\n * the operator's config intent), and\n * - `getRequiredCapabilitiesWithoutProvider` — a HARD requirement is unmet\n * (throws at boot; F5).\n * The G4 warn pairs this (\"the operator turned audit on\") with a zero-resolved-\n * provider check (\"but nothing is delivering it\") to flag a SILENT Layer-2\n * fan-out — a warn, never a throw.\n /\n public isEngineCapabilityEnabled(capability: EngineCapability): boolean {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n return false;\n }\n return this.configService.config.engineCapabilities?.[capability]?.enabled === true;\n }\n\n /\n F5 (audit Phase 5) — boot-guard support. Returns every capability the app\n * marked `activation.required === true` that resolves to ZERO active providers\n * (respecting the capability's resolution mode — SELECT_ONE needs a primary,\n * FAN_OUT needs ≥1 declared; a `required` capability left `enabled: false`\n * resolves to none and is therefore also caught). A non-empty result means a\n * misconfigured deployment — a HARD requirement with nothing to serve it — and\n * `StartApplicationBackendService.initialize()` throws CONFIGURATION on any.\n * Audit (`COMPLIANCE_AUDIT_TRAIL`, when marked required) is the FIRST user, not\n * a special case: this generalizes the coherence to EVERY capability.\n /\n public getRequiredCapabilitiesWithoutProvider(\n options: RequiredCapabilityFloorOptions = { includeEngineFloor: true },\n ): EngineCapability[] {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n // Used to answer `[]` here, which read as \"nothing missing\" on a host whose config\n // had never loaded — a floor that cannot see its inputs must refuse, not reassure.\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'The required-capability floor was evaluated before the application configuration '\n + 'was initialized; it cannot decide what is required.',\n },\n });\n }\n const activations = this.configService.config.engineCapabilities ?? {};\n const missing: EngineCapability[] = [];\n // Swept over the ENUM, not over the authored keys (#328), so the population and its order\n // are the engine's. Requiredness itself always needs an activation entry — an absent key is\n // neither `enabled` nor `required` — so this is about which list is authoritative, not about\n // catching an omitted key.\n for (const capability of Object.values(EngineCapability)) {\n const activation = activations[capability];\n const requiredByApplication = activation?.required === true;\n const requiredByEngine = options.includeEngineFloor\n && activation?.enabled === true\n && ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED.has(capability);\n if (\n (requiredByApplication \|\| requiredByEngine)\n && this.getResolvedProviderRefsForCapability(capability).length === 0\n ) {\n missing.push(capability);\n }\n }\n return missing;\n }\n\n /\n The floor as a single fail-closed door (#328): every host that serves the application\n * calls this after its registry is ready — the application backend, and the platform\n * services after `refreshFromConfig()` — so \"required with nothing serving it\" cannot pass\n * one host's boot because the check happened to live on another's branch.\n /\n public assertRequiredCapabilityFloor(options?: RequiredCapabilityFloorOptions): void {\n const missingRequiredCapabilities = this.getRequiredCapabilitiesWithoutProvider(options);\n if (missingRequiredCapabilities.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Required engine capabilities resolve no active provider: [${missingRequiredCapabilities.join(', ')}]. `\n + 'Each is either marked `required` in engineCapabilities or is an engine flow that needs a provider '\n + 'the moment it is enabled (EMAIL_TRANSACTIONAL, BILLING, SMS) — declare a provider for it '\n + '(SELECT_ONE needs a primary; FAN_OUT needs ≥1 declared), or disable the capability.',\n missingRequiredCapabilities,\n },\n });\n }\n\n /\n Per-environment external-provider selection override, read once from\n * `process.env.WILDO_PROVIDER_SELECTION_OVERRIDES` (a JSON map of\n * `EngineCapability -> { primary, whenUnavailable? }`). Projected by the Wildo\n * CLI's `env-vars-builder` from `wildo.infra.<env>.config.ts > providerSelection`.\n * Read as a string literal (not via a `platform-config-lib` import) to\n * preserve the engine → platform dependency direction — mirrors how\n * `LoggerService` reads `LOG_LEVEL` and `otel-preload` reads `OTEL_ENABLED`.\n \n Memoized on first read: env vars are fixed for a process lifetime, and\n * `getProvidersForEngineCapability` is a hot path. A malformed value is\n * tolerated (logged + ignored) so a bad override degrades to the SaaS-config\n * selection rather than breaking provider resolution.\n /\n private providerSelectionOverridesCache?: Partial<Record<EngineCapability, { primary: string; whenUnavailable?: string[] }>>;\n private providerSelectionOverridePayloadMalformed = false;\n private readonly malformedProviderSelectionOverrides = new Set<EngineCapability>();\n\n private getProviderSelectionOverride(\n capability: EngineCapability,\n ): { primary: string; whenUnavailable?: string[] } \| undefined {\n if (this.providerSelectionOverridesCache === undefined) {\n const raw = process.env.WILDO_PROVIDER_SELECTION_OVERRIDES;\n if (!raw) {\n this.providerSelectionOverridesCache = {};\n } else {\n try {\n const parsed = JSON.parse(raw) as unknown;\n if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n this.providerSelectionOverridesCache = parsed as Partial<Record<EngineCapability, { primary: string; whenUnavailable?: string[] }>>;\n } else {\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n } catch (error) {\n this.logDebug('Failed to parse WILDO_PROVIDER_SELECTION_OVERRIDES; ignoring per-env override', {\n error: describeCaughtError(error),\n });\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n }\n }\n const override = this.providerSelectionOverridesCache[capability];\n // Guard the shape defensively — a hand-crafted env var could carry a\n // non-conforming entry that upstream Zod validation never saw.\n if (override === undefined) return undefined;\n if (\n typeof override.primary !== 'string'\n \|\| override.primary.length === 0\n \|\| (override.whenUnavailable !== undefined && (\n !Array.isArray(override.whenUnavailable)\n \|\| !override.whenUnavailable.every((substitute) => typeof substitute === 'string' && substitute.length > 0)\n ))\n ) {\n this.malformedProviderSelectionOverrides.add(capability);\n return undefined;\n }\n return override;\n }\n\n /\n Sanitized provenance for the effective provider selection. This exposes\n * neither environment bytes nor provider configuration; it only preserves\n * which authority won and the generated artifact identities behind it.\n /\n public getProviderSelectionResolutionEvidence(capability: EngineCapability): ExternalProviderSelectionResolutionEvidence {\n this.ensureInitialized();\n const runtimeSelection = this.getActiveRuntimeProviderScope()?.selection?.[capability];\n const environmentSelection = this.getProviderSelectionOverride(capability);\n const overrideMalformed = this.providerSelectionOverridePayloadMalformed \|\| this.malformedProviderSelectionOverrides.has(capability);\n return Object.freeze({\n authorityKind: environmentSelection\n ? ExternalProviderSelectionAuthorityKind.ENVIRONMENT_OVERRIDE\n : runtimeSelection\n ? ExternalProviderSelectionAuthorityKind.APPLICATION_RUNTIME_ARTIFACT\n : ExternalProviderSelectionAuthorityKind.DEFAULT_RESOLUTION,\n overrideStatus: overrideMalformed\n ? ExternalProviderSelectionOverrideStatus.MALFORMED\n : environmentSelection\n ? ExternalProviderSelectionOverrideStatus.APPLIED\n : ExternalProviderSelectionOverrideStatus.ABSENT,\n applicationPrimaryProviderRef: runtimeSelection?.primary ?? null,\n applicationSubstituteProviderRefs: Object.freeze([...(runtimeSelection?.whenUnavailable ?? [])]),\n environmentPrimaryProviderRef: environmentSelection?.primary ?? null,\n environmentSubstituteProviderRefs: Object.freeze([...(environmentSelection?.whenUnavailable ?? [])]),\n providerRuntimeArtifact: this.configService.getProviderRuntimeArtifactEvidenceMetadata(),\n });\n }\n\n private getActiveRuntimeProviderScope(): RuntimeProviderScope \| undefined {\n if (!this.configService.isInitialized()) {\n return undefined;\n }\n\n const scopes = this.configService.config.providers?.scopes;\n if (!scopes) {\n return undefined;\n }\n\n const serviceName = typeof (this.configService as { serviceName?: string }).serviceName === 'string'\n ? (this.configService as { serviceName?: string }).serviceName!\n : '';\n if (scopes.companion && isCompanionRuntimeServiceName(serviceName)) {\n return scopes.companion as RuntimeProviderScope;\n }\n\n return scopes.backend as RuntimeProviderScope \| undefined;\n }\n\n /\n Get provider configuration for a specific protocol.\n * Falls back to default configuration from cached provider definitions if not overridden.\n /\n public getProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n this.ensureInitialized();\n try {\n if (!this.configService.isInitialized()) {\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n const appConfig = this.configService.config;\n const providerConfigs = appConfig.providerConfigurations \|\| {};\n\n const defaultConfig = this.getDefaultProviderConfiguration(providerRef, protocolKind);\n const customConfig = providerConfigs[providerRef]?.[protocolKind];\n if (customConfig) {\n this.logDebug(`Using merged custom configuration for ${providerRef}.${protocolKind}`);\n return this.mergeProviderConfiguration(\n defaultConfig,\n customConfig as ResolvedProviderConfiguration,\n );\n }\n\n if (defaultConfig) {\n this.logDebug(`Using default configuration for ${providerRef}.${protocolKind}`);\n }\n return defaultConfig;\n } catch (error) {\n // Programmer-error / contract-violation paths (cross-`kind`\n // merge guard, authKind misuse on `agent-client-protocol`) throw via\n // `errorBuilder.buildError`, producing `WildoError_Backend`.\n // Those MUST surface — they signal projection drift that the\n // silent fallback would mask. Only network/runtime hiccups\n // (the original intent of this catch) fall back to default.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting provider configuration, falling back to default', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n }\n\n private mergeProviderConfiguration(\n defaultConfig: ResolvedProviderConfiguration \| undefined,\n customConfig: ResolvedProviderConfiguration\n ): ResolvedProviderConfiguration {\n if (!defaultConfig) {\n return customConfig;\n }\n\n // Fail-closed cross-`kind` guard. Both inputs are looked up by\n // the same `(providerRef, protocolKind)` pair upstream, so the\n // discriminated-union `kind` MUST match if both contracts are\n // present. A mismatch here would silently corrupt the merged\n // result into a type-broken union member; we throw via\n // `errorBuilder.buildError` so the WildoError_Backend instance\n // is detected by `getProviderConfiguration`'s catch and\n // re-thrown past the default-fallback path (the catch only\n // swallows generic runtime errors, not contract violations).\n //\n // Note on scope: this guard fires against cross-`kind` drift\n // between `getDefaultProviderConfiguration`'s emit (carries\n // `runtimeContract`) and any caller-provided override that\n // ALSO carries `runtimeContract`. App-developer authoring of\n // `providerConfigurations.<providerRef>.<protocolKind>` does\n // not include `runtimeContract` (the backend module owns\n // that), so today the guard primarily defends against future\n // refactors of the merge call site rather than user-authored\n // input.\n const defaultKind = defaultConfig.runtimeContract?.kind;\n const customKind = customConfig.runtimeContract?.kind;\n if (defaultKind && customKind && defaultKind !== customKind) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message: `[external-providers-registry] mergeProviderConfiguration received contracts with mismatched kind`,\n defaultKind,\n customKind,\n },\n },\n );\n }\n\n const mergedRuntimeContract = this.deepMergeRecord(\n defaultConfig.runtimeContract as Record<string, unknown> \| undefined,\n customConfig.runtimeContract as Record<string, unknown> \| undefined,\n );\n\n return {\n ...defaultConfig,\n ...customConfig,\n // `executionProfiles` is a MAP OF NAMED PROFILES, so the top-level\n // spread above would drop every profile the provider synthesized\n // (including `default`, which existing consumers still resolve) as\n // soon as an application authors one profile of its own. Merge by\n // ref instead — and replace a same-named profile WHOLE rather than\n // deep-merging it: a deep merge would let an override inherit\n // `secretRef`/`secretEnvVarName` from the synthesized default and\n // silently turn a host-managed profile into a secret-injecting one.\n ...(defaultConfig.executionProfiles \|\| customConfig.executionProfiles\n ? {\n executionProfiles: {\n ...(defaultConfig.executionProfiles ?? {}),\n ...(customConfig.executionProfiles ?? {}),\n },\n }\n : {}),\n authConfig: this.deepMergeRecord(\n defaultConfig.authConfig,\n customConfig.authConfig,\n ) as ResolvedProviderConfiguration['authConfig'],\n // The deep-merge result is loosely typed (`Record<string, unknown> \| undefined`).\n // Cast back through `ProviderProtocolRuntimeContract`: the cross-`kind` guard\n // above ensures both inputs share the same `kind`, so the merged result is a\n // valid discriminated-union member.\n runtimeContract: mergedRuntimeContract as ProviderProtocolRuntimeContract \| undefined,\n };\n }\n\n private deepMergeRecord(\n defaultValue: unknown,\n customValue: unknown\n ): Record<string, unknown> \| undefined {\n if (!defaultValue && !customValue) return undefined;\n if (!defaultValue \|\| typeof defaultValue !== 'object' \|\| Array.isArray(defaultValue)) {\n return customValue as Record<string, unknown> \| undefined;\n }\n if (!customValue \|\| typeof customValue !== 'object' \|\| Array.isArray(customValue)) {\n return defaultValue as Record<string, unknown>;\n }\n\n const merged: Record<string, unknown> = {\n ...(defaultValue as Record<string, unknown>),\n };\n for (const [key, value] of Object.entries(customValue as Record<string, unknown>)) {\n const previous = merged[key];\n if (Array.isArray(previous) && Array.isArray(value)) {\n merged[key] = [...new Set([...previous, ...value])];\n continue;\n }\n merged[key] = previous\n && typeof previous === 'object'\n && !Array.isArray(previous)\n && value\n && typeof value === 'object'\n && !Array.isArray(value)\n ? this.deepMergeRecord(previous, value)\n : value;\n }\n return merged;\n }\n\n\n /\n WHAT a declared secret identifies — the integration, or an account.\n \n DECLARED wins; otherwise DERIVED, and the derivation is deliberately narrow. A ref the REST\n * runtime contract names as the OAuth2 client id or client secret is a REGISTRATION. Everything\n * else answers CREDENTIAL.\n \n The fallback exists because the field arrived after 689 provider packages had been emitted,\n * from catalogues that live outside this repository — a mark that only worked once every package\n * had been re-emitted would enforce nothing until then, which for a guard is the same as not\n * existing.\n \n It is a FLOOR, not a complete answer, and the direction of its error matters. Deriving\n * CREDENTIAL for a registration secret the contract does not name in those two slots is the\n * permissive mistake: such a secret would still be storable as a tenant's own. That is exactly\n * the case a provider must declare explicitly, and it is why `scope` is authorable at all rather\n * than purely computed.\n /\n /\n A provider's declared secret slots, each classified and each answered as configured or not.\n \n The contract already says everything a screen needs — the slug, the environment variable, the\n * operator-facing description, whether it is required — and nothing was reading it. So a person\n * connecting an account typed a `secretSlug` into a free-text field, and an operator learned that\n * `ASANA_CLIENT_ID` was missing only when somebody pressed Connect and got a 502.\n \n NEVER the value, only whether one is present. The whole point is to make a missing secret\n * REPORTABLE on a screen, and a report that carried the secret would be the one thing that must\n * not leave the backend.\n \n Scope comes from {@link getProviderSecretScope}, so this and the connect leg's refusal cannot\n * disagree about which slot is a registration and which is an account.\n /\n public getProviderSecretSlots(providerRef: string): readonly ProviderSecretSlot[] {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract;\n if (contract === undefined) return [];\n return Object.entries(contract).map(([slug, entry]) => ({\n slug,\n envVarName: entry.envVarName,\n required: entry.required,\n description: entry.description,\n scope: this.getProviderSecretScope(providerRef, slug),\n ...(entry.holdsDeploymentHost === true ? { holdsDeploymentHost: true as const } : {}),\n ...(entry.holdsBrowserPublicValue === true ? { holdsBrowserPublicValue: true as const } : {}),\n configured: Boolean(\n this.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, entry.envVarName)\n ?? this.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, slug),\n ),\n }));\n }\n\n public getProviderSecretScope(\n providerRef: string,\n secretRef: string,\n ): ExternalProvider_SecretScope {\n const entry = this.findSecretsContractEntry(providerRef, secretRef);\n if (entry?.scope !== undefined) {\n return entry.scope;\n }\n\n // Compare on the ENV-VAR NAME, not on the ref as supplied. A ref may arrive as either the\n // authoring slug (`accessToken`) or the env-var name (`SLACK_API_KEY`), while a runtime\n // contract only ever references the latter — so deriving from the raw ref answered CREDENTIAL\n // for `clientSecret` and REGISTRATION for `SLACK_CLIENT_SECRET`, two names for one secret.\n const comparableRef = entry?.envVarName ?? secretRef;\n const contract = this.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n const oauth2 = contract?.kind === ProviderProtocolRuntimeKind.REST ? contract.oauth2 : undefined;\n const namesRegistration = oauth2 !== undefined\n && (oauth2.clientIdSecretRef === comparableRef \|\| oauth2.clientSecretSecretRef === comparableRef);\n\n return namesRegistration\n ? ExternalProvider_SecretScope.REGISTRATION\n : ExternalProvider_SecretScope.CREDENTIAL;\n }\n\n /\n The contract entry for a ref, found by ENV-VAR NAME or by SLUG.\n \n Both are real addresses for the same thing and callers use both: the map key is the authoring\n * slug (`accessToken`), while runtime contracts reference the env-var name (`SLACK_API_KEY`).\n * Matching only one would leave half the callers unable to find an entry that is plainly there.\n /\n private findSecretsContractEntry(providerRef: string, secretRef: string): SecretsContractEntry \| undefined {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract;\n if (contract === undefined) {\n return undefined;\n }\n const slug = this.findSecretsContractSlug(providerRef, secretRef);\n return slug === undefined ? undefined : contract[slug];\n }\n\n /\n The secrets-contract KEY for either of a slot's two names, or `undefined` when the provider\n * declares no such slot.\n \n Kept as the ONE lookup rule: {@link findSecretsContractEntry} and\n * {@link canonicalCredentialSlug} both go through it, so \"which slot did the caller mean\" cannot\n * be answered two ways. Before this, the entry lookup and the connect leg's canonicalisation each\n * re-derived it, which is how they came to disagree about which of the two names to keep.\n /\n private findSecretsContractSlug(providerRef: string, secretRef: string): string \| undefined {\n // Tolerant of an unbound or partially-bound provider registry, because this is now reached\n // from the credential RESOLUTION path: a wiring gap there must degrade to \"I cannot map this\n // name\" and let the caller's own refusal speak, never turn a missing credential into a crash\n // whose message names neither the provider nor the owner.\n const contract = this.backendProviderRegistry?.getProvider?.(providerRef)?.secretsContract;\n if (contract === undefined) {\n return undefined;\n }\n // OWN keys only: `contract['constructor']` is a function inherited from `Object.prototype`, and a\n // bare `!== undefined` read it as a declared slot — so a stored slug named `constructor` would\n // have classified as CURRENT and a lookup would have \"canonicalised\" to a slot that does not exist.\n if (Object.prototype.hasOwnProperty.call(contract, secretRef)) {\n return secretRef;\n }\n return Object.entries(contract).find(([, entry]) => entry.envVarName === secretRef)?.[0];\n }\n\n /\n The name a STORED credential is keyed on: the provider's secrets-contract KEY, never its\n * environment-variable spelling.\n \n ## Why the contract key and not the env-var name (#624)\n \n A slot has two names and they have different LIFETIMES:\n \n \| \| example \| may it change? \|\n * \|---\|---\|---\|\n * \| the contract KEY \| `accessToken` \| no — it is the slot's identity, and there are five across all providers \|\n * \| `envVarName` \| `ASANA_ACCESS_TOKEN` \| yes — it is a deployment-configuration spelling \|\n \n A durable credential row must be keyed on the stable one. It was keyed on the other, and on\n * 2026-09-10 commit `2e8f7488` renamed the env-var spelling for 130 OAuth2 vendors — a\n * correct rename, `ASANA_API_KEY` was the wrong name for an OAuth2 account slot — thirty-one\n * minutes after two real grants were minted. Every stored credential on the machine (7 of 7,\n * across asana and slack) became a row whose provider no longer declares its key, and the\n * refusal an operator read was \"no credential for 'ASANA_ACCESS_TOKEN'\": indistinguishable from\n * never having connected.\n \n There is no silent substitution — the ORGANIZATION and USER branches of\n * {@link resolveProviderSecretForTarget} refuse rather than fall through to the deployment's own\n * credential — so this was never a wrong-account defect. It was a live secret reported as absent.\n \n Those rows are NOT migrated and never will be: the seal binds the slot name, so they cannot be\n * renamed, and re-sealing them was decided against (2026-09-12). Instead a refusal that misses now\n * names the retired slot and says to reconnect, and the boot report counts every such row — see\n * {@link classifyStoredCredentialSlot} and `retired-credential-slot.backend.utils.ts`.\n \n ## Accepting both names is deliberate, and permanent\n \n A caller may still NAME either one — the runtime contract's `apiKey.secretRef` carries the\n * env-var spelling, and every generated provider emits it that way — so this maps rather than\n * refuses. What it guarantees is that whatever a caller names, the value that reaches a store is\n * the one a rename cannot move.\n \n ## The environment lookup does NOT use this\n \n {@link getProviderSecret} resolves `process.env[envVarName]`, and must keep doing so: there the\n * spelling IS the identity, because it is what an operator writes in a deployment environment.\n * The two names exist for two jobs, and this method is the boundary between them.\n /\n public canonicalCredentialSlug(providerRef: string, secretRef: string): string {\n return this.findSecretsContractSlug(providerRef, secretRef) ?? secretRef;\n }\n\n /\n The CONNECTION a credential spent or written through `providerRef` belongs to (#1670).\n \n ## Why a connection and not the ref\n \n A stored credential is keyed and sealed on `(owner, connectionRef, secretSlug)`. A connection is the\n * unit a vendor grant belongs to, and a vendor may be served by several refs — an engine part and the\n * add-on packages beside it — that must spend ONE grant rather than ask the person to authorize once\n * per ref (#1669).\n \n ## A declared member maps to its BASE; everything else is its own connection\n \n `providers.sharedConnections` (#1725) names a base ref and the members that spend its grant, and this\n * answers the base for every one of them. An undeclared ref is its own connection — which is also why every\n * row stored before the key moved was backfilled to `connectionRef = providerRef` and still opens under the\n * same seal. The membership rule itself is `resolveProviderConnectionRef` in `@wildo-ai/saas-models`, the one\n * function `wildo config sync` records the lock entry with, so config and runtime cannot disagree.\n \n A row a member stored under its OWN ref before it joined a connection is keyed on that ref, not the base,\n * and is never read through the connection: it was sealed to the other identity, and there is deliberately no\n * re-seal door (2026-09-12). The miss names it instead — see {@link resolveProviderSecretForTarget}.\n \n ONE function, deliberately: every write door derives the row's `connectionRef` through it and every\n * read path addresses the store through {@link resolveCredentialAddress}, which calls it — so when the\n * mapping stops being the identity, reading and writing change together rather than one of them\n * keeping the ref (the invariant-applied-at-one-site shape this subsystem has met before).\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — which delegated grant a call through a ref\n * may spend is decided here, in one place, never by the caller.\n /\n public resolveCredentialConnectionRef(providerRef: string): string {\n return resolveProviderConnectionRef(this.declaredSharedConnections(), providerRef);\n }\n\n /\n The npm package that owns `providerRef` — its module's `metadata.packageName` — or `undefined` when no module\n * of that ref is loaded here. Named on the audit rows of a shared connection (#1725), where the connection alone\n * no longer says whose code spent the grant.\n /\n public getProviderPackageName(providerRef: string): string \| undefined {\n return this.backendProviderRegistry?.getProvider?.(providerRef)?.metadata?.packageName;\n }\n\n /\n The declared shared connection `providerRef` belongs to (as base or member), or `undefined` when it is its\n * own connection (#1725). What the connect, refresh and revoke paths ask before choosing whose OAuth client\n * to use.\n /\n public getProviderSharedConnection(providerRef: string): ResolvedProviderSharedConnection \| undefined {\n return resolveDeclaredSharedConnection(this.declaredSharedConnections(), providerRef);\n }\n\n /\n The application's `providers.sharedConnections`, or `undefined` on a host whose configuration carries none\n * — a platform service, a harness with no configuration. Read on every call, never cached, so the answer is\n * always the configuration the host is running.\n /\n private declaredSharedConnections(): ProviderSharedConnections \| undefined {\n try {\n return this.configService.isInitialized() ? this.configService.config.providers?.sharedConnections : undefined;\n } catch {\n return undefined;\n }\n }\n\n /\n The OAuth client a connect, refresh or revocation through `providerRef` must use (#1725): the BASE ref's\n * REST OAuth2 block and client slots for a declared connection — a member's own block is inert — and the\n * ref's own for an undeclared one. `undefined` when the owner declares no REST OAuth2 block.\n \n With `sharedWithSignIn`, the endpoints, scopes and audiences stay the base's connected-account block, and\n * only the CLIENT changes to the base's sign-in registration: that is the one thing the option decides.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — one connection has exactly one OAuth client,\n * the declared base's, whichever ref the person connects through.\n /\n public getConnectionOAuth2Client(providerRef: string): ProviderConnectionOAuth2Client \| undefined {\n const declared = this.getProviderSharedConnection(providerRef);\n const connectionRef = declared?.connectionRef ?? providerRef;\n const contract = this.getProviderRuntimeContract(connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n if (contract?.kind !== ProviderProtocolRuntimeKind.REST \|\| contract.oauth2 === undefined) return undefined;\n return {\n connectionRef,\n providerRef,\n oauth2: contract.oauth2,\n restContract: contract,\n sharedWithSignIn: declared?.sharedWithSignIn === true,\n };\n }\n\n /\n The scopes the connection `providerRef` spends may ask a person to consent to (#1671) — see\n * `computeProviderConnectionScopeCeiling`. `undefined` when the connection's owner declares no REST OAuth2 block,\n * which means there is no consent flow to grow.\n /\n public getConnectionScopeCeiling(providerRef: string): ProviderConnectionScopeCeiling \| undefined {\n const client = this.getConnectionOAuth2Client(providerRef);\n if (client === undefined) return undefined;\n const memberRefs = this.getProviderSharedConnection(providerRef)?.memberRefs ?? [];\n const sources: ProviderConnectionScopeSource[] = [];\n for (const memberRef of memberRefs) {\n const contract = this.getProviderRuntimeContract(memberRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n const scopes = contract?.kind === ProviderProtocolRuntimeKind.REST ? contract.oauth2?.scopes ?? [] : [];\n if (scopes.length > 0) sources.push({ providerRef: memberRef, scopes: scopes.flatMap((scope) => scope.split(/\\s+/)).filter((scope) => scope.length > 0) });\n }\n for (const ref of [client.connectionRef, ...memberRefs]) {\n for (const applied of this.backendProviderRegistry?.getProvider?.(ref)?.appliedAugmentations ?? []) {\n if (applied.requiredScopes.length > 0) sources.push({ providerRef: ref, augmentationPackageName: applied.packageName, scopes: applied.requiredScopes });\n }\n }\n return computeProviderConnectionScopeCeiling({ connectionRef: client.connectionRef, ownerOAuth2: client.oauth2, sources });\n }\n\n /\n The npm package whose code an operation of `providerRef` is — the opted-in augmentation that declares\n * `operationId`, else the ref's own package (#1671). Read from static declarations, so it loads no catalogue; named\n * on the grant row of a re-authorization so the trail says whose operation widened the consent.\n /\n public describeOperationContributorPackage(providerRef: string, operationId: string): string \| undefined {\n const applied = this.backendProviderRegistry?.getProvider?.(providerRef)?.appliedAugmentations ?? [];\n return applied.find((augmentation) => augmentation.operationIds.includes(operationId))?.packageName\n ?? this.getProviderPackageName(providerRef);\n }\n\n /\n The offer a call refused for `missingScopes` carries (#1671): which of them a person may grant by re-authorizing\n * the connection, which need an administrator, and which nobody can ask for on this connection. `undefined` when the\n * connection has no consent flow at all (a pasted credential, the deployment's own) — then only an operator can act.\n /\n public planProviderScopeReauthorization(providerRef: string, operationId: string, missingScopes: readonly string[]): ProviderScopeReauthorizationOffer \| undefined {\n const ceiling = this.getConnectionScopeCeiling(providerRef);\n if (ceiling === undefined) return undefined;\n const classified = classifyProviderConnectionScopes(ceiling, missingScopes);\n return {\n connectionRef: ceiling.connectionRef,\n providerRef,\n operationId,\n requestableScopes: classified.requestable,\n administratorConsentScopes: classified.administratorConsent,\n unrequestableScopes: classified.unrequestable,\n };\n }\n\n /\n The application's registration with the vendor for a connection — the two values an operator pastes —\n * resolved from the deployment for the connection's OWNER, never per connection and never from a row.\n \n Default: the base's connected-account slots (`oauth2.clientIdSecretRef` / `clientSecretSecretRef`). With\n * `sharedWithSignIn`: the base's sign-in registration, read exactly as the sign-in lane reads it — the client\n * id from `providerConfigurations.<base>.sso_oauth2`, the secret from the sign-in contract's secret ref — so\n * the two lanes cannot come to use two different registrations while both claim to share one.\n \n The REFS are returned beside the values so a refusal can name what to configure.\n /\n public resolveConnectionOAuth2ClientCredentials(client: ProviderConnectionOAuth2Client): {\n clientId?: string;\n clientSecret?: string;\n clientIdRef?: string;\n clientSecretRef?: string;\n } {\n if (!client.sharedWithSignIn) {\n const { clientIdSecretRef, clientSecretSecretRef } = client.oauth2;\n return {\n clientIdRef: clientIdSecretRef,\n clientSecretRef: clientSecretSecretRef,\n clientId: clientIdSecretRef === undefined ? undefined\n : this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, clientIdSecretRef),\n clientSecret: clientSecretSecretRef === undefined ? undefined\n : this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, clientSecretSecretRef),\n };\n }\n const signIn = this.getProviderRuntimeContract(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2);\n if (signIn?.kind !== ProviderProtocolRuntimeKind.OAUTH2_SSO) return {};\n const protocolConfiguration = (this.configService.config.providerConfigurations?.[client.connectionRef] as Record<string, unknown> \| undefined)\n ?.[ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2] as { clientId?: string; authConfig?: { clientId?: string; secretRef?: string } } & Record<string, unknown> \| undefined;\n const clientId = protocolConfiguration?.authConfig?.clientId\n ?? protocolConfiguration?.clientId\n ?? (signIn.clientIdPublicConfigKey === undefined ? undefined : protocolConfiguration?.[signIn.clientIdPublicConfigKey] as string \| undefined);\n const clientSecretRef = protocolConfiguration?.authConfig?.secretRef ?? signIn.clientSecretRef;\n return {\n clientIdRef: `providerConfigurations.${client.connectionRef}.${ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2}.clientId`,\n clientSecretRef,\n ...(typeof clientId === 'string' && clientId.length > 0 ? { clientId } : {}),\n clientSecret: this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2, clientSecretRef),\n };\n }\n\n /\n Refuse, at boot, a loaded provider whose OAuth2 block declares resource AUDIENCES it cannot honour (#1725) — or an\n * incremental-consent declaration restating a scope it does not declare (#1671) —\n * `describeProviderOAuth2AudienceDefects`: no primary, a primary the authorization is not for, two audiences\n * admitting one host. The token-host binding selects a token by host, so an ambiguous declaration would let the\n * order of a record decide which token a request carries.\n /\n private assertDeclaredAudiencesCoherent(): void {\n const defects: string[] = [];\n for (const module of this.backendProviderRegistry.getRegistry?.()?.modules?.values() ?? []) {\n const contract = this.getProviderRuntimeContract(module.metadata.ref, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n if (contract?.kind !== ProviderProtocolRuntimeKind.REST) continue;\n // The vendor's rate limits (#1729): a number no window can hold, or a contract-level list beside audiences\n // that would apply to no call, is refused here rather than silently counting nothing.\n defects.push(...describeProviderRateBudgetDefects({ contractRateBudgets: contract.rateBudgets, audiences: contract.oauth2?.audiences })\n .map((defect) => `\"${module.metadata.ref}\": ${defect}`));\n if (contract.oauth2 === undefined) continue;\n defects.push(...describeProviderOAuth2AudienceDefects(contract.oauth2).map((defect) => `\"${module.metadata.ref}\": ${defect}`));\n // A scope every re-authorization repeats (#1671) must be one the provider declares: the connect leg admits\n // only declared scopes, so an undeclared one would refuse every incremental request of this provider.\n const declared = new Set((contract.oauth2.scopes ?? []).flatMap((scope) => scope.split(/\\s+/)));\n for (const restated of contract.oauth2.incrementalConsent?.restatedScopes ?? []) {\n if (!declared.has(restated)) defects.push(`\"${module.metadata.ref}\": incrementalConsent restates the scope '${restated}', which its oauth2.scopes do not declare`);\n // Restated scopes go into every request a PERSON is sent to; an administrator-only one would make every\n // re-authorization of this provider unanswerable by the person it is for.\n if ((contract.oauth2.administratorConsentScopes ?? []).includes(restated)) {\n defects.push(`\"${module.metadata.ref}\": incrementalConsent restates the administrator-only scope '${restated}'`);\n }\n }\n }\n if (defects.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: { message: `A provider declares OAuth2 audiences that cannot be honoured:\\n- ${defects.join('\\n- ')}`, defects },\n });\n }\n\n /\n Refuse, at boot, declared shared connections this host's loaded modules cannot honour (#1725) — see\n * `findSharedConnectionBootDefects`. A CONFIGURATION refusal, because the remedy is editing the SaaS config\n * and needs nothing running.\n /\n private assertSharedConnectionsCoherent(): void {\n const connections = this.declaredSharedConnections();\n if (connections === undefined \|\| Object.keys(connections).length === 0) return;\n const restOAuth2Of = (ref: string) => {\n const contract = this.getProviderRuntimeContract(ref, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n return contract?.kind === ProviderProtocolRuntimeKind.REST ? contract : undefined;\n };\n const defects = findSharedConnectionBootDefects({\n connections,\n systemOfRecordInstanceNames: Object.keys(this.configService.config.systemsOfRecord ?? {}),\n isLoaded: (ref) => this.backendProviderRegistry.getProvider(ref) !== undefined,\n viewOf: (ref) => {\n const contract = restOAuth2Of(ref);\n return {\n ...(contract?.oauth2 === undefined ? {} : { oauth2: contract.oauth2 }),\n ...(contract?.apiKey?.secretRef === undefined ? {} : { spentCredentialSlotKey: this.canonicalCredentialSlug(ref, contract.apiKey.secretRef) }),\n };\n },\n baseAdmitsCredentialSlot: (baseRef, slotKey) => this.resolveStorableCredentialSlot(baseRef, slotKey).admitted,\n baseHasSignInClient: (baseRef) =>\n this.getProviderRuntimeContract(baseRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2)?.kind === ProviderProtocolRuntimeKind.OAUTH2_SSO,\n });\n if (defects.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `providers.sharedConnections cannot run on this host:\\n- ${defects.join('\\n- ')}`,\n defects,\n },\n });\n }\n\n /\n Where a READ through `providerRef` finds its stored credential: the connection and the contract KEY\n * of the slot the caller named by either of its two names (#1670, #624).\n \n The read-side counterpart of the write doors' derivation — see {@link resolveCredentialConnectionRef}\n * for the connection and {@link canonicalCredentialSlug} for the slot. Every caller that addresses a\n * credential store asks this, never assembles the address itself.\n /\n public resolveCredentialAddress(providerRef: string, secretRef: string): ProviderCredentialAddress {\n return {\n connectionRef: this.resolveCredentialConnectionRef(providerRef),\n secretSlug: this.canonicalCredentialSlug(providerRef, secretRef),\n };\n }\n\n /\n Where a slug a credential row was STORED under stands against the provider's CURRENT contract.\n \n ## The definition, and why it is this one\n \n A stored slug is {@link StoredCredentialSlotStanding.CURRENT} exactly when canonicalising it is a\n * FIXED POINT — when {@link canonicalCredentialSlug}'s own rule answers the slug back unchanged.\n * Defined through {@link findSecretsContractSlug} rather than by re-reading the contract, so \"which\n * slot is current\" and \"which name a lookup asks for\" are one rule and cannot disagree.\n \n That makes an env-var SPELLING that the provider still declares RETIRED as a stored key, which\n * is correct rather than harsh: every lookup now asks for the contract key, so a row keyed on\n * `ASANA_ACCESS_TOKEN` is as unreachable as one keyed on the renamed `ASANA_API_KEY` (#624).\n \n Tolerant of an unbound provider registry for the reason {@link findSecretsContractSlug} states;\n * an absent provider is reported as such, never as a retired slot, because its remedy differs.\n /\n public classifyStoredCredentialSlot(providerRef: string, storedSecretSlug: string): StoredCredentialSlotStanding {\n if (this.backendProviderRegistry?.getProvider?.(providerRef) === undefined) {\n return StoredCredentialSlotStanding.PROVIDER_UNREGISTERED;\n }\n return this.findSecretsContractSlug(providerRef, storedSecretSlug) === storedSecretSlug\n ? StoredCredentialSlotStanding.CURRENT\n : StoredCredentialSlotStanding.RETIRED;\n }\n\n /\n The slot a credential VALUE may be written under, or why it may not (#624).\n \n The write-side twin of {@link canonicalCredentialSlug}, and the one rule every write door asks\n * — the connect leg, and the resource's own CREATE and UPDATE hooks — so \"may a value be stored\n * here\" cannot be answered differently by different doors.\n \n ## Admitted only for a DECLARED CREDENTIAL slot, and always as its KEY\n \n - A name that maps to no slot of the provider's current contract (under either of a slot's two\n * names) is refused {@link ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_DECLARED}. The\n * read-side canonicaliser passes such a name through, which is right for a READ — the caller's\n * own refusal speaks — and wrong for a WRITE: stored under a name nobody asks for, the value\n * reports success and resolves as absent forever. That is how a retired slot keeps producing\n * orphans after the keying was fixed forward.\n * - A slot holding the application's own OAuth2 registration is refused\n * {@link ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_A_CREDENTIAL}, as the connect leg\n * always did: the exchange reads that from the deployment environment, never from a row.\n * - An admitted name comes back as the contract KEY whichever name the caller used.\n \n Every generated provider's default slot passes: measured 2026-09-12 over 695 provider modules\n * with a literal `apiKey.secretRef`, all 695 name a declared slot.\n /\n public resolveStorableCredentialSlot(providerRef: string, secretName: string): StorableCredentialSlot {\n const secretSlug = this.findSecretsContractSlug(providerRef, secretName);\n if (secretSlug === undefined) {\n return { admitted: false, refusal: ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_DECLARED };\n }\n if (this.getProviderSecretScope(providerRef, secretSlug) !== ExternalProvider_SecretScope.CREDENTIAL) {\n return { admitted: false, refusal: ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_A_CREDENTIAL };\n }\n return { admitted: true, secretSlug };\n }\n\n public getProviderRuntimeContract(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): ProviderProtocolRuntimeContract \| undefined {\n return this.getProviderConfiguration(providerRef, protocolKind)?.runtimeContract;\n }\n\n public getLLMSemanticOperationKeys(providerRef: string): LLMProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.LLM) {\n return [];\n }\n\n return this.toSemanticOperationKeys(runtimeContract.operations);\n }\n\n /\n The semantic embeddings operations a provider's `EMBEDDINGS_PROVIDER` contract declares.\n * Consumer: `EmbeddingsBackendService`, which refuses to invoke a provider whose contract\n * does not declare {@link EmbeddingsProvider_OperationKey.EMBED_TEXTS} (fail-closed, named —\n * never an undefined-method throw inside an SDK call).\n /\n public getEmbeddingsSemanticOperationKeys(providerRef: string): EmbeddingsProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.EMBEDDINGS) {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is EmbeddingsProvider_OperationKey => operation !== undefined);\n }\n\n\n /\n The semantic extraction operations a provider's `DOCUMENT_EXTRACTION_PROVIDER` contract\n * declares. Consumer: `DocumentExtractionBackendService`, which refuses to invoke a provider\n * whose contract does not declare\n * {@link DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT} — fail-closed and\n * named, rather than a 404 from a route the provider never claimed to serve.\n /\n public getDocumentExtractionSemanticOperationKeys(providerRef: string): DocumentExtractionProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION) {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is DocumentExtractionProvider_OperationKey => operation !== undefined);\n }\n\n\n public getAgentClientProtocolConfiguration(providerRef: string): AgentClientProtocol_Configuration \| undefined {\n const config = this.getProviderConfiguration(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n return config as AgentClientProtocol_Configuration \| undefined;\n }\n\n public getAgentClientProtocolProfile(providerRef: string): RuntimeAgentClientProtocolProfile \| undefined {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL) {\n return undefined;\n }\n\n const supportedModels = [\n ...(runtimeContract.models ?? []),\n ...(runtimeContract.defaultModel ? [runtimeContract.defaultModel] : []),\n ];\n return {\n agentCommand: runtimeContract.agentCommand,\n agentArgs: [...(runtimeContract.agentArgs ?? [])],\n supportedOperationKeys: runtimeContract.operations\n .map((operation) => RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is CodingAgent_OperationKey => operation !== undefined),\n supportedModels: [...new Set(supportedModels)],\n supportedProtocolVersions: [...(runtimeContract.supportedProtocolVersions ?? [1])],\n ...(runtimeContract.sessionMetaExtensions ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions } : {}),\n ...(runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance\n ? { sessionMetaExtensionsByHostConfigurationInheritance: runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance }\n : {}),\n ...(runtimeContract.modelDelivery ? { modelDelivery: runtimeContract.modelDelivery } : {}),\n ...(runtimeContract.modelTransportIds\n ? { modelTransportIds: { ...runtimeContract.modelTransportIds } }\n : {}),\n ...(runtimeContract.inheritedEnvironmentVariables\n ? { inheritedEnvironmentVariables: [...runtimeContract.inheritedEnvironmentVariables] }\n : {}),\n ...(runtimeContract.hostLogin ? { hostLogin: runtimeContract.hostLogin } : {}),\n // Normalised to the AUTHORED vocabulary: the contract spells these\n // with hyphens and the profile enum with underscores, and comparing\n // the two spellings directly is a guard that never fires.\n supportedAuthModes: runtimeContract.authModes.map((mode) => mode.replace(/-/g, '_')),\n ...(runtimeContract.sessionModeIdsByPermissionCeiling\n ? {\n sessionModeIdsByPermissionCeiling: Object.fromEntries(\n Object.entries(runtimeContract.sessionModeIdsByPermissionCeiling).map(\n ([ceiling, modeIds]) => [ceiling, [...(modeIds ?? [])]],\n ),\n ),\n }\n : {}),\n };\n }\n\n /\n Resolve one named ACP execution profile, PARSED rather than trusted.\n \n Application-authored `providerConfigurations` are typed `unknown` all the\n * way to here, so an authored profile would otherwise reach the runner\n * unvalidated — and for this transport the unvalidated fields include the\n * environment gate and the permission ceiling. Parsing here makes the\n * profile fail closed BEFORE any agent is spawned, and applies the schema\n * defaults the authoring contract promises.\n /\n public getAgentClientProtocolExecutionProfile(\n providerRef: string,\n executionProfileRef: string,\n ): AgentClientProtocol_ExecutionProfile \| undefined {\n this.ensureInitialized();\n\n const configuration = this.getAgentClientProtocolConfiguration(providerRef);\n const executionProfile = configuration?.executionProfiles?.[executionProfileRef];\n\n if (!executionProfile) {\n this.logDebug(`ACP execution profile ${executionProfileRef} not found for ${providerRef}`);\n return undefined;\n }\n\n try {\n return AgentClientProtocol_ExecutionProfileSchema.parse(executionProfile);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n providerRef,\n executionProfileRef,\n message: '[external-providers-registry] ACP execution profile is not a valid authored profile',\n validationError: describeCaughtError(error),\n },\n },\n );\n }\n }\n\n public getAgentClientProtocolExecutionProfileSecret(\n providerRef: string,\n executionProfileRef: string,\n ): string \| undefined {\n this.ensureInitialized();\n\n const executionProfile = this.getAgentClientProtocolExecutionProfile(providerRef, executionProfileRef);\n if (\n !executionProfile\n \|\| executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n return undefined;\n }\n\n const runtimeSecret = executionProfile.secretEnvVarName\n ? process.env[executionProfile.secretEnvVarName]\n : undefined;\n if (runtimeSecret && runtimeSecret.length > 0) {\n this.logDebug('Resolved ACP secret from process env', { providerRef, executionProfileRef });\n return runtimeSecret;\n }\n\n return undefined;\n }\n\n private toSemanticOperationKeys(operations: readonly string[]): LLMProvider_OperationKey[] {\n return operations\n .map((operation) => RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION[operation] ?? operation)\n .filter((operation): operation is LLMProvider_OperationKey => (\n Object.values(LLMProvider_OperationKey).includes(operation as LLMProvider_OperationKey)\n ));\n }\n\n private getDefaultProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n try {\n const runtimeContract = this.backendProviderRegistry.getRuntimeContract(providerRef, protocolKind);\n\n if (!runtimeContract) {\n this.logDebug(`Runtime contract not found: ${providerRef}:${protocolKind}`);\n return undefined;\n }\n\n\n if (runtimeContract.kind === ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL) {\n const defaultExecutionProfileRef = 'default';\n const hasExplicitSecretBinding = Boolean(\n runtimeContract.secretRef\n && runtimeContract.secretEnvVarName\n && runtimeContract.authModes.includes('secret-ref-env-injection'),\n );\n return {\n enabled: true,\n defaultExecutionProfileRef,\n executionProfiles: {\n [defaultExecutionProfileRef]: {\n runnerHost: AgentClientProtocol_RunnerHost.BACKEND_SUBPROCESS,\n command: runtimeContract.agentCommand,\n args: [...(runtimeContract.agentArgs ?? [])],\n inheritedEnvironmentVariables: [...(runtimeContract.inheritedEnvironmentVariables ?? [])],\n authMode: hasExplicitSecretBinding\n ? AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n : runtimeContract.authModes.includes('host-managed')\n ? AgentClientProtocol_AuthMode.HOST_MANAGED\n : AgentClientProtocol_AuthMode.NONE,\n ...(hasExplicitSecretBinding\n ? { secretRef: runtimeContract.secretRef, secretEnvVarName: runtimeContract.secretEnvVarName }\n : {}),\n // DEVELOPMENT only, and deliberately NARROWER than any other\n // synthesized default. Nobody authored this profile and\n // nobody reviewed it, and what it authorises is an agent\n // that edits a workspace. An application that wants a coding\n // agent anywhere else must say so in its own profile, where\n // the decision is visible.\n allowedApplicationEnvironments: [APPLICATION_ENVIRONMENT.DEVELOPMENT],\n workingDirectoryPolicy: AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_ROOT,\n // Both safety postures stated rather than left to a schema\n // default, so reading this profile tells you what it permits\n // without resolving anything.\n permissionCeiling: AgentClientProtocol_PermissionCeiling.PROMPT_ALWAYS,\n hostConfigurationInheritance: AgentClientProtocol_HostConfigurationInheritance.APPLICATION_SCOPED,\n ...(runtimeContract.sessionMetaExtensions\n ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions }\n : {}),\n },\n },\n runtimeContract,\n };\n }\n\n const secretRef = this.secretRefForRuntimeContract(runtimeContract);\n return {\n enabled: true,\n ...(secretRef\n ? {\n authConfig: {\n authKind: this.authKindForRuntimeContract(runtimeContract),\n secretRef,\n },\n }\n : {}),\n ...(runtimeContract.kind === ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR\n ? { endpoints: this.buildWebhookEndpoints(runtimeContract) }\n : {}),\n runtimeContract,\n };\n } catch (error) {\n // Same pattern as `getProviderConfiguration` — contract\n // violations (`authKindForRuntimeContract` misuse) throw a\n // `WildoError_Backend` instance that MUST surface.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting default provider configuration', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n private secretRefForRuntimeContract(runtimeContract: ProviderProtocolRuntimeContract): string \| undefined {\n switch (runtimeContract.kind) {\n case ProviderProtocolRuntimeKind.EMAIL:\n // A `delivery: 'log'` email contract (the dev `preview`\n // provider) has NO endpoint and NO apiKey — it renders +\n // logs instead of sending. No secretRef to resolve; the\n // caller emits no `authConfig` and the email service skips\n // the API-key requirement. Contract-driven, not ref-keyed.\n return runtimeContract.delivery === 'log' ? undefined : runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.LLM:\n return runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.IMAGE:\n return runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.EMBEDDINGS:\n return runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION:\n return runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.OAUTH2_SSO:\n return runtimeContract.clientSecretRef;\n case ProviderProtocolRuntimeKind.BILLING:\n case ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR:\n return runtimeContract.secretRef;\n case ProviderProtocolRuntimeKind.SMS:\n case ProviderProtocolRuntimeKind.EMAIL_INBOUND:\n return runtimeContract.auth.secretRef;\n case ProviderProtocolRuntimeKind.REST:\n return runtimeContract.apiKey.secretRef;\n case ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL:\n // An ACP agent that needs a credential carries it on the\n // contract; a host-managed one (the default for a coding agent\n // running under an operator's own login) carries none.\n return runtimeContract.secretRef;\n default: {\n const exhaustiveCheck: never = runtimeContract;\n return exhaustiveCheck;\n }\n }\n }\n\n /\n Map a runtime contract's `kind` to the canonical\n * `ExternalProvider_Auth_Kind` for the `authConfig` projection.\n * Used by `getDefaultProviderConfiguration` so the emitted\n * `authConfig: { authKind, secretRef }` satisfies the schema's\n * required-`authKind` invariant (was previously `{ secretRef }`\n * with no `authKind`, masked by `as unknown as` casts).\n \n Mapping rationale:\n \n - `llm` / `email` / `sms` / `billing` — providers authenticate\n * with an opaque API key supplied via env var.\n * - `webhook-originator` — provider signs payloads with HMAC; the\n * `secretRef` is the HMAC signing key.\n * - `oauth2-sso` — kind `OAUTH2`; the `secretRef` is the OAuth2\n * client secret.\n * - `agent-client-protocol` — auth is encoded on the executionProfile,\n * not `authConfig`; this method is not called for that kind\n * because that arm returns from the dedicated branch in\n * `getDefaultProviderConfiguration` BEFORE reaching this\n * mapping. A misuse throws via `errorBuilder` so the\n * `WildoError_Backend` instance bypasses the\n * `getProviderConfiguration` fallback catch.\n /\n private authKindForRuntimeContract(\n runtimeContract: ProviderProtocolRuntimeContract,\n ): ExternalProvider_Auth_Kind {\n switch (runtimeContract.kind) {\n case ProviderProtocolRuntimeKind.LLM:\n case ProviderProtocolRuntimeKind.IMAGE:\n case ProviderProtocolRuntimeKind.EMBEDDINGS:\n // Document extraction authenticates with an opaque API key in a request header, like\n // its siblings above; the header SHAPE (name/prefix) stays on the contract because\n // this family builds its own HTTPS request rather than handing a key to an SDK.\n case ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION:\n case ProviderProtocolRuntimeKind.EMAIL:\n case ProviderProtocolRuntimeKind.SMS:\n // A receiving provider authenticates the engine's fetches with an opaque API key in a header.\n case ProviderProtocolRuntimeKind.EMAIL_INBOUND:\n case ProviderProtocolRuntimeKind.BILLING:\n // `rest` authenticates with an opaque API key supplied via env var, like its siblings\n // above; the header SHAPE (name/prefix) stays on the contract for its consumer.\n case ProviderProtocolRuntimeKind.REST:\n return ExternalProvider_Auth_Kind.API_KEY;\n case ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR:\n return ExternalProvider_Auth_Kind.HMAC_SIGNATURE;\n case ProviderProtocolRuntimeKind.OAUTH2_SSO:\n return ExternalProvider_Auth_Kind.OAUTH2;\n case ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL:\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message: '[external-providers-registry] authKindForRuntimeContract called with kind=agent-client-protocol; '\n + 'ACP auth lives on executionProfiles[].authMode, not on authConfig.',\n },\n },\n );\n default: {\n const exhaustiveCheck: never = runtimeContract;\n return exhaustiveCheck;\n }\n }\n }\n\n /\n Project the provider-authored `runtimeContract.endpoints` into\n * the canonical `Hook_Endpoint` shape consumed by the framework\n * webhook controller. Provider-agnostic: each endpoint descriptor\n * is owned by the provider module (see Stripe's `endpoints` array\n * on `stripe.backend.module.ts`); the only field this projection\n * adds is `signatureConfig.headerName`, sourced from the contract's\n * top-level `signatureHeaderName` so providers don't repeat it on\n * every endpoint.\n \n Previously branched on a Stripe-only provider literal\n * with the entire endpoint shape (event types, polymorphic\n * variants, `lookupField`) hardcoded inside this consumer site —\n * the same anti-pattern Step 7 was supposed to eliminate. Moved\n * to the provider module 2026-05-06 to close the gap; the CI\n * guard regex (`no-provider-ref-branches.guard.test.ts`) now\n * also catches the `runtimeContract.provider` literal pattern.\n \n Per-endpoint secret overrides (if a future provider needs them)\n * still flow through `HookInitiatorProvider_Configuration.endpointSecrets`,\n * not through this projection.\n /\n private buildWebhookEndpoints(\n runtimeContract: Extract<ProviderProtocolRuntimeContract, { kind: typeof ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR }>,\n ): ReadonlyArray<Hook_Endpoint> {\n return runtimeContract.endpoints.map((endpoint) => ({\n ...endpoint,\n signatureConfig: {\n ...endpoint.signatureConfig,\n headerName: runtimeContract.signatureHeaderName,\n },\n eventTypes: [...endpoint.eventTypes],\n }));\n }\n\n /\n Get provider secrets for a specific protocol and secret reference.\n * Provider secrets are runtime-delivered via env/K8s materialization.\n * The secret binding contract is still declared by the provider protocol\n * configuration, but the secret value source is `process.env`.\n \n The `envVarName ?? secretRef` fallback covers the case where the\n * resolver doesn't find an explicit env-var-name mapping for the\n * requested secretRef. Today every engine provider authors\n * `secretsContract.<slug>.envVarName === <secretRef value>` (verified\n * across 17 modules), so this fallback is exactly equivalent to a\n * direct `process.env[secretRef]` lookup. If a future provider's\n * `secretsContract.envVarName` diverges from its `secretRef`, the\n * load-bearing path becomes `protocolConfig.authConfig.secretRef`\n * (returned by `getProviderSecretEnvVarName`), and the fallback\n * stays a defensive last-chance match.\n /\n public getProviderSecret(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const envVarName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef);\n const resolvedEnvVarName = envVarName ?? secretRef;\n\n const secretValue = process.env[resolvedEnvVarName];\n return secretValue && secretValue.length > 0 ? secretValue : undefined;\n } catch {\n return undefined;\n }\n }\n\n private getProviderSecretEnvVarName(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n ): string \| undefined {\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n && executionProfile.secretRef === secretRef\n ) {\n return executionProfile.secretEnvVarName;\n }\n }\n }\n\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n if (protocolConfig?.authConfig?.secretRef === secretRef) {\n return protocolConfig.authConfig.secretRef;\n }\n\n return undefined;\n }\n\n /\n The sentence for a provider API key that has no value — naming the environment variable and how\n * to provide it (#1637). Secrets are asked when a feature needs one rather than all up front, so\n * this refusal IS the moment a person learns which key a feature waits on; a message that said\n * \"configure the provider secrets\" left them to find out which, and where.\n /\n public describeMissingProviderApiKey(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): string {\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n const envVarName = secretRef ? (this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef) : undefined;\n return envVarName\n ? `No value for ${envVarName} (${providerRef}, ${protocolKind}). ${describeProviderSecretRemedy(envVarName)}`\n : `${providerRef} declares no API key for ${protocolKind}, so this call cannot authenticate.`;\n }\n\n public getConfiguredProviderSecretRef(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n return config?.authConfig?.secretRef;\n }\n\n\n\n public getProviderApiKey(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n if (!secretRef) {\n this.logDebug(`No authConfig.secretRef found for ${providerRef}.${protocolKind}`);\n return undefined;\n }\n\n const apiKey = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (!apiKey) {\n this.logDebug(`Secret ${secretRef} not found for ${providerRef}.${protocolKind}`);\n }\n return apiKey;\n } catch (error) {\n this.logDebug('Error getting provider API key', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n /\n WHICH connections this provider admits — the recorded decision, or the FLOOR.\n \n The floor is an APPLICATION-owned, undelegated connection and nothing else, and it is what a\n * provider that has recorded no decision gets. It is not a permissive default: it is the one\n * answer always available (an operator can author an environment variable) and the one that\n * cannot produce a cross-tenant mistake (it has exactly one instance).\n \n Never derived here from a provider's auth shape. Whether a vendor can be connected per tenant\n * is a fact about that vendor's product and about what somebody verified — see the catalogue\n * record for a generated provider, or the module itself for a hand-authored one.\n /\n public getProviderAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[] {\n const declared = this.backendProviderRegistry.getProvider(providerRef)?.admissibleConnections;\n const catalogue = declared === undefined \|\| declared.length === 0\n ? UNJUDGED_PROVIDER_ADMISSIBLE_CONNECTIONS\n : declared;\n\n return this.narrowToApplicationConnectionPolicy(providerRef, catalogue);\n }\n\n /\n What the VENDOR admits, before this application's policy narrows it.\n \n Exists so a refusal can name the right cause. Once a policy can subtract, \"this provider does\n * not admit that connection\" has two meanings — nobody recorded the vendor's capability, or this\n * application switched it off — and they are repaired in different files by different people.\n * A diagnostic that always blamed the catalogue would send an operator to edit a decision record\n * that is already correct.\n /\n public getProviderCatalogueAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[] {\n const declared = this.backendProviderRegistry.getProvider(providerRef)?.admissibleConnections;\n return declared === undefined \|\| declared.length === 0\n ? UNJUDGED_PROVIDER_ADMISSIBLE_CONNECTIONS\n : declared;\n }\n\n /\n Intersect what the VENDOR admits with what THIS application permits.\n \n Two layers answering different questions, and the intersection is what makes them composable:\n * the catalogue record says an organization-owned Slack connection is possible because Slack is\n * installed per workspace, while `providers.connections.slack` says whether this product offers\n * one. A vendor opening a capability and a product deciding to use it are different events, and\n * a single list would make them look identical.\n \n NARROWING ONLY, and that direction is the guarantee rather than a convention. An application\n * cannot declare a connection the vendor does not support into existence — the connect leg would\n * build an authorize URL the vendor rejects, or store a grant nothing can spend — so a policy\n * entry naming an unadmitted shape contributes nothing instead of granting it.\n \n An ABSENT policy means \"everything the catalogue admits\", never \"nothing\". Most applications\n * will never author one, and reading their silence as a refusal would switch off the whole\n * connect surface for every product that has not yet thought about it.\n \n An intersection that empties is a legitimate outcome, not a misconfiguration: it is how an\n * application switches a provider's connect surface off without removing the provider, which it\n * may still need for its own application-scope credential.\n /\n private narrowToApplicationConnectionPolicy(\n providerRef: string,\n catalogue: readonly ExternalProvider_ConnectionShape[],\n ): readonly ExternalProvider_ConnectionShape[] {\n const permitted = this.configService.config.providers?.connections?.[providerRef]?.admissible;\n if (permitted === undefined) {\n return catalogue;\n }\n return catalogue.filter((shape) => permitted.some(\n (allowed) => allowed.ownerScope === shape.ownerScope && allowed.delegation === shape.delegation,\n ));\n }\n\n /\n @wildo_source:part:start saas.backend.providers.connection-target-credential-resolution facet:layer:backend facet:audience:app-developer\n \n One provider secret for ONE connection target — strictly, with no substitution.\n \n Reached as `ExternalProvidersRegistryBackendService` from `@wildo-ai/saas-backend-lib`, through\n * the container token `SAAS_SERVICE_TYPES.ExternalProvidersRegistryService`.\n \n ## What a TARGET is, and why the call names one\n \n A target is `ownerScope` × `delegation`: WHOSE credential is spent, and whether the call acts\n * for a person. The four combinations are different principals, not four ways of saying the same\n * thing — an ORGANIZATION target spends the tenant's own connected account, an APPLICATION target\n * spends the deployment's shared one, a USER target spends one person's.\n \n Naming the target is what makes the identity on the wire a decision the calling code states\n * rather than one the engine infers.\n \n ## There is NO fallback, deliberately, and that is the whole design\n \n A miss in any branch REFUSES, naming what it will not substitute. It never quietly reaches for\n * a different principal's credential.\n \n This replaced a resolver that did fall back — an organization with no credential of its own\n * silently spent the deployment's — and the difference is not a tightening of one idea, it is the\n * opposite policy. A fallback means the vendor sees the application's identity while the\n * application believes it acted as the tenant, so every artifact the call leaves behind — a\n * message, a record, a line in the vendor's own audit log — is attributed to the wrong party, and\n * nothing downstream can detect it.\n \n *An application that wants \"the tenant's key when they have connected one, otherwise ours\"\n still has it*, and composes it itself: try an ORGANIZATION target, and on the refusal call\n again with an APPLICATION one. That is three lines in the application's own code, where the\n * substitution is visible to whoever reads it. What no longer exists is the engine performing\n * that swap underneath a call that asked for a tenant.\n \n ## A refusal is never `undefined`\n \n Every miss throws. Returning nothing was the original defect: several callers passed the empty\n * value onward, the vendor received a blank credential and answered 401, and that is\n * indistinguishable from a revoked key — which is how \"nobody ever configured this\" stayed\n * invisible. Each refusal below therefore names the PLACE an operator must go.\n \n Two misses are deliberately not fall-throughs, and both are cases where the tenant or the\n * person DID connect:\n \n - a credential stored under a RETIRED slot name (a provider regeneration renamed it). Nothing\n * can read or rename that row — its seal binds the slot name — so the owner reconnects the\n * account. The deployment's credential is NOT used instead, because the fallback that would\n * have applied is for an owner that has none (#624);\n * - a credential that cannot be OPENED. The envelope failure is not caught: a principal that HAS\n * an unreadable credential and one that has none are indistinguishable to a caller, and only\n * one of them is safe to continue from.\n /\n public async resolveProviderSecretForTarget(\n target: ExternalProvider_ConnectionTarget,\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n /\n A resource AUDIENCE other than the grant's primary (#1725): the token is minted from the stored grant's\n * refresh token for these scopes (or read from the audience cache), never the stored primary token. Absent:\n * the stored credential, as always. Meaningless for an APPLICATION target, which holds no grant to mint from,\n * and refused there.\n /\n options?: { readonly audience?: ProviderOAuth2RefreshAudience },\n ): Promise<{\n value: string;\n source: ProviderCredentialResolutionSource;\n credentialId?: string;\n credentialSetByUserId?: string;\n /* The connection row's account facts, for a tenant-owned credential (#333, #1047). Absent for the deployment's own. /\n connectionFacts?: ProviderConnectionFacts;\n /* What the vendor granted, when it stated it (#979). Absent means not recorded, never nothing granted. /\n grantedScopes?: readonly string[];\n }> {\n this.ensureInitialized();\n\n // Only the APPLICATION's identity impersonating a person is unbuilt. It needs a vendor-side\n // impersonation grant (domain-wide delegation) that no store holds, so it refuses by name.\n //\n // An ORGANIZATION × USER target resolves below like any tenant credential: it IS one — a member\n // linked their own account for the organization, and every member spends it (decision on #18).\n // This used to refuse every USER delegation with \"no outbound per-principal token store exists\n // yet\", after both stores existed, while the connect leg admitted and stored the very shape\n // this refused: a grant could be connected that nothing could ever spend.\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n && target.delegation === ExternalProvider_Connection_DelegationMode.USER) {\n throw this.buildConnectionRefusal(\n providerRef,\n `the application cannot act as user '${target.actingForUserId}': impersonating a person with the application's own `\n + 'identity needs a vendor impersonation grant, which nothing stores. Declare a USER-owned connection, so the person '\n + 'connects their own account.',\n );\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n // An envelope failure is NOT caught here, deliberately, for the organization branch's\n // reason: a person who HAS a credential which cannot be opened must refuse loudly rather\n // than be treated as a person who has none. The two are indistinguishable to a caller\n // and only one of them is a safe thing to continue from.\n const userResolver = this.resolveUserCredentialResolver();\n if (!userResolver) {\n throw this.buildConnectionRefusal(\n providerRef,\n 'no user credential store is bound, so a person-owned connection cannot be read at all. '\n + 'This is a wiring fault rather than a missing credential.',\n );\n }\n // The row's ADDRESS: the connection the ref belongs to (#1670) and the contract KEY of the slot,\n // never the env-var spelling a rename can move (#624). One answer for every read path.\n const { connectionRef: userConnectionRef, secretSlug: userSecretSlug } = this.resolveCredentialAddress(providerRef, secretRef);\n // A name the provider no longer declares is never sent to the store: its row would still open,\n // because the seal binds the name it was stored under, and spend a credential this subsystem\n // reports as unusable (#624). The miss path below then names that row as retired.\n const userSlotRetired = this.classifyStoredCredentialSlot(providerRef, userSecretSlug) === StoredCredentialSlotStanding.RETIRED;\n const ownedByUser = userSlotRetired ? undefined : await userResolver.resolveUserCredential({\n userId: target.ownerId!,\n providerRef,\n connectionRef: userConnectionRef,\n secretSlug: userSecretSlug,\n ...(options?.audience === undefined ? {} : { audience: options.audience }),\n });\n if (!ownedByUser) {\n const retiredSlots = await this.findRetiredSlotsBehindMiss(providerRef, userSlotRetired ? undefined : userSecretSlug, ExternalProvider_Connection_OwnerScope.USER, () =>\n userResolver.listStoredSecretSlugs({ userId: target.ownerId!, providerRef, connectionRef: userConnectionRef }));\n const storedBeforeJoining = await this.describeRowStoredBeforeJoining(providerRef, userConnectionRef, () =>\n userResolver.listStoredSecretSlugs({ userId: target.ownerId!, providerRef, connectionRef: providerRef }));\n throw this.buildConnectionRefusal(\n providerRef,\n storedBeforeJoining\n + (retiredSlots.length === 0\n ? `user '${target.ownerId}' has not connected '${secretRef}'. `\n : `user '${target.ownerId}' has no credential for '${secretRef}' under the provider's current secrets contract. `\n + `${describeCredentialsStoredUnderRetiredSlots(retiredSlots)} `)\n + \"It is not substituted with the deployment's or their organization's: the call asked to act as this person, and \"\n + 'acting as anyone else would put the wrong name on the record the provider keeps.',\n );\n }\n return {\n value: ownedByUser.value,\n source: ProviderCredentialResolutionSource.USER_CREDENTIAL,\n credentialId: ownedByUser.credentialId,\n ...(ownedByUser.connectionFacts === undefined ? {} : { connectionFacts: ownedByUser.connectionFacts }),\n ...(ownedByUser.grantedScopes === undefined ? {} : { grantedScopes: ownedByUser.grantedScopes }),\n };\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION) {\n if (options?.audience !== undefined) {\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own credential cannot serve the '${options.audience.id}' audience: a token for another resource `\n + 'is minted from a connected account\\'s refresh token, and the deployment\\'s credential is a pasted token with none.',\n );\n }\n const fromEnvironment = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (fromEnvironment) {\n return { value: fromEnvironment, source: ProviderCredentialResolutionSource.DEPLOYMENT_ENVIRONMENT };\n }\n const environmentVariableName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef;\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own credential for '${secretRef}' is not set. Author '${environmentVariableName}' in the deployment environment.`,\n );\n }\n\n // ORGANIZATION. An envelope failure is NOT caught, deliberately: a tenant that HAS a\n // credential which cannot be opened must refuse loudly rather than be treated as a tenant\n // that has none — the two are indistinguishable to a caller and only one is safe.\n const resolver = this.resolveOrganizationCredentialResolver();\n if (!resolver) {\n throw this.buildConnectionRefusal(\n providerRef,\n 'no organization credential store is bound, so a tenant-owned connection cannot be read at all. '\n + 'This is a wiring fault rather than a missing credential.',\n );\n }\n // The row's ADDRESS — connection and contract KEY — see the USER branch above (#1670, #624).\n const { connectionRef: organizationConnectionRef, secretSlug: organizationSecretSlug } = this.resolveCredentialAddress(providerRef, secretRef);\n // Never sends a RETIRED name to the store — see the USER branch above (#624).\n const organizationSlotRetired = this.classifyStoredCredentialSlot(providerRef, organizationSecretSlug) === StoredCredentialSlotStanding.RETIRED;\n const owned = organizationSlotRetired ? undefined : await resolver.resolveOrganizationCredential({\n organizationId: target.ownerId!,\n providerRef,\n connectionRef: organizationConnectionRef,\n secretSlug: organizationSecretSlug,\n ...(options?.audience === undefined ? {} : { audience: options.audience }),\n });\n if (!owned) {\n const retiredSlots = await this.findRetiredSlotsBehindMiss(providerRef, organizationSlotRetired ? undefined : organizationSecretSlug, ExternalProvider_Connection_OwnerScope.ORGANIZATION, () =>\n resolver.listStoredSecretSlugs({ organizationId: target.ownerId!, providerRef, connectionRef: organizationConnectionRef }));\n const storedBeforeJoining = await this.describeRowStoredBeforeJoining(providerRef, organizationConnectionRef, () =>\n resolver.listStoredSecretSlugs({ organizationId: target.ownerId!, providerRef, connectionRef: providerRef }));\n throw this.buildConnectionRefusal(\n providerRef,\n storedBeforeJoining\n + (retiredSlots.length === 0\n ? `organization '${target.ownerId}' has no credential for '${secretRef}'. `\n : `organization '${target.ownerId}' has no credential for '${secretRef}' under the provider's current secrets contract. `\n + `${describeCredentialsStoredUnderRetiredSlots(retiredSlots)} `)\n + \"It is not substituted with the deployment's: the call asked to act as this tenant, and acting as someone else \"\n + 'instead would be attributed to the wrong party.',\n );\n }\n return {\n value: owned.value,\n source: ProviderCredentialResolutionSource.ORGANIZATION_CREDENTIAL,\n credentialId: owned.credentialId,\n ...(owned.setByUserId === undefined ? {} : { credentialSetByUserId: owned.setByUserId }),\n ...(owned.connectionFacts === undefined ? {} : { connectionFacts: owned.connectionFacts }),\n ...(owned.grantedScopes === undefined ? {} : { grantedScopes: owned.grantedScopes }),\n };\n }\n /* @wildo_source:part:end saas.backend.providers.connection-target-credential-resolution /\n\n /\n Record that the credential {@link resolveProviderSecretForTarget} just handed out was SPENT,\n * and what the provider thought of it.\n \n ## Why the recording lives HERE, beside the resolution\n \n Because the two must never disagree about which store they are talking about. This method\n * dispatches on `target.ownerScope` in exactly the same order and by exactly the same rule as\n * the resolution above, so the store that was read is the store that is stamped is a property\n * of one function rather than an agreement between two.\n \n The alternative — the caller routing for itself — was tried and is the defect this replaces.\n * The provider-operation executor held a thunk to A store, typed with an `organizationId` field,\n * and `target.ownerId` is a USER id whenever `ownerScope` is `USER` (#333's two-axis connection\n * shape). Wired as it stood, a person-owned call would have stamped a tenant row that does not\n * exist and emitted an organization audit event naming a user id as the organization. The\n * caller cannot route this correctly, because the ORDER is this class's knowledge — the same\n * argument `OrganizationProviderCredentialResolverPort`'s own docstring makes for why the order\n * does not live on the port.\n \n ## Fire-and-forget is the CALLER's decision, not this method's\n \n This returns a promise and lets a store failure reject. The outbound call has already happened\n * by the time anybody calls this, so the caller must not fail its own request on a bookkeeping\n * write — but swallowing here would also hide the rejection from the caller's loss counter, and\n * an observation nobody counts is the shape this whole change exists to remove. The executor\n * routes it through `emitAuditObservation`, which counts a rejection and never rethrows.\n \n @param provenance Exactly what {@link resolveProviderSecretForTarget} returned for this call,\n * carried through the access resolver. Passing anything else describes a row that was not the\n * one spent.\n /\n public async recordProviderSecretUseForTarget(\n target: ExternalProvider_ConnectionTarget,\n providerRef: string,\n provenance: { source: ProviderCredentialResolutionSource; credentialId?: string; secretSlug: string; credentialSetByUserId?: string },\n outcome?: { accepted: boolean; providerMessage?: string },\n ): Promise<void> {\n // The USE event names the STORED slot — the contract KEY — so it joins the credential's own SET,\n // ROTATED and DELETED events, which all carry the row's `secretSlug`. A caller's provenance may still\n // carry the env-var spelling a runtime contract names (#624); canonicalising here, at the one\n // recording chokepoint, makes that unrepresentable in the trail rather than a rule every caller keeps.\n const storedSecretSlug = this.canonicalCredentialSlug(providerRef, provenance.secretSlug);\n // The CONNECTION the spent row is keyed on, by the one function the resolution addressed it with (#1670),\n // so the use event names the grant beside the ref the call went through.\n const connectionRef = this.resolveCredentialConnectionRef(providerRef);\n // And WHOSE package the ref belongs to (#1725): on a shared connection several packages spend one grant.\n const providerPackageName = this.getProviderPackageName(providerRef);\n if (target.ownerId === undefined) {\n // An APPLICATION-owned resolution names no owner and has no row. Inventing one would\n // create a credential the tenant never set, which would then appear on their settings\n // screen as something they are responsible for rotating.\n return;\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n const userResolver = this.resolveUserCredentialResolver();\n // A person's credential ALWAYS has a row — there is nothing for a person to fall through\n // to — so an absent id here means the caller did not pass this method the provenance the\n // resolution produced, and stamping some other row would be worse than stamping none.\n if (!userResolver \|\| !provenance.credentialId) return;\n await userResolver.recordCredentialUse({\n userId: target.ownerId,\n providerRef,\n connectionRef,\n ...(providerPackageName === undefined ? {} : { providerPackageName }),\n secretSlug: storedSecretSlug,\n credentialId: provenance.credentialId,\n ...(outcome === undefined ? {} : { outcome }),\n });\n return;\n }\n\n if (target.ownerScope !== ExternalProvider_Connection_OwnerScope.ORGANIZATION) return;\n\n const resolver = this.resolveOrganizationCredentialResolver();\n if (!resolver) return;\n // `source` is passed through rather than filtered here: the store emits the use audit for\n // BOTH sources and stamps a row only for the tenant's own, and that split is its decision to\n // make. Filtering here would silently drop the audit row for the case a reviewer most wants\n // — a tenant acting as the shared deployment principal.\n await resolver.recordCredentialUse({\n organizationId: target.ownerId,\n providerRef,\n connectionRef,\n ...(providerPackageName === undefined ? {} : { providerPackageName }),\n secretSlug: storedSecretSlug,\n source: provenance.source,\n ...(provenance.credentialId === undefined ? {} : { credentialId: provenance.credentialId }),\n ...(provenance.credentialSetByUserId === undefined ? {} : { credentialSetByUserId: provenance.credentialSetByUserId }),\n ...(outcome === undefined ? {} : { outcome }),\n });\n }\n\n /\n After a store lookup under the current key MISSED: the retired slot names a credential is stored\n * under for the same owner and provider, so the refusal can say the row exists (#624).\n \n Chooses WORDS, never an outcome — the caller throws its refusal whatever this answers, and a\n * failure here (a store that cannot list, a partial binding) answers `[]` so that refusal is thrown\n * exactly as it was. Use it ONLY where the refusal is already decided; where the answer permits a\n * fall-through to another principal, use `requireCredentialsStoredUnderRetiredSlots`, which throws.\n * See `retired-credential-slot.backend.utils.ts`.\n /\n private findRetiredSlotsBehindMiss(\n providerRef: string,\n /* `undefined` when no lookup was made because the requested name was itself retired. /\n lookedUpSecretSlug: string \| undefined,\n ownerScope: ExternalProvider_Connection_OwnerScope,\n listStoredSecretSlugs: () => Promise<readonly string[]>,\n ): Promise<readonly string[]> {\n return findCredentialsStoredUnderRetiredSlots({\n registry: this,\n providerRef,\n lookedUpSecretSlug,\n listStoredSecretSlugs,\n onDetectionFailure: (error) => this.logDebug('Retired credential slot detection could not run; refusing with the plain message', {\n providerRef,\n ownerScope,\n error: describeCaughtError(error),\n }),\n });\n }\n\n /\n After a miss under a SHARED connection: whether the owner holds a row the ref stored under its OWN identity\n * before it joined that connection (#1725), as the sentence that opens the refusal — empty otherwise.\n \n Such a row is sealed to `(owner, providerRef, slot)`, the connection it was written for, and is never spent\n * through the shared one: re-sealing was decided against (2026-09-12), and a grant quietly read across two\n * identities is exactly what the connection key exists to prevent. So the person reconnects once, and the\n * refusal tells them why rather than claiming they never connected. Words only — a listing that fails answers\n * empty, and the refusal is thrown either way.\n /\n private async describeRowStoredBeforeJoining(\n providerRef: string,\n connectionRef: string,\n listStoredUnderOwnRef: () => Promise<readonly string[]>,\n ): Promise<string> {\n if (connectionRef === providerRef) return '';\n try {\n const stored = await listStoredUnderOwnRef();\n return stored.length === 0 ? '' : `a credential is stored under '${providerRef}' from before it joined the shared connection `\n + `'${connectionRef}'; it is not spent through the connection. Reconnect through any ref of '${connectionRef}'. `;\n } catch {\n return '';\n }\n }\n\n /\n One shape for every connection refusal, so an operator reads the same sentence everywhere — and one\n * CLASS, so a consumer can tell a refusal (a gap somebody fixes by connecting) from a fault (an unopenable\n * envelope, a failing store), which stays a plain error and stays loud.\n /\n private buildConnectionRefusal(providerRef: string, detail: string): ExternalProviderConnectionRefusedError {\n return new ExternalProviderConnectionRefusedError(`Provider '${providerRef}': ${detail}`);\n }\n\n // ══════════════════════════════════════════════════════════════════════════════════════════\n // PER-ORGANIZATION SECRET RESOLUTION (#357)\n //\n // ## Why these are separate methods and not a change to `getProviderSecret`\n //\n // `getProviderSecret` is synchronous, and six consumers across four other workstreams' files\n // call it that way. A per-organization credential lives in the database, so resolving one is\n // necessarily asynchronous — making the existing method async would reshape every one of those\n // call sites at once, in files this slice may not touch. So the environment path stays exactly\n // as it was, and the tenant-aware path is added beside it.\n //\n // This is a seam, not a duplication: the async path CALLS `getProviderSecret` for its second\n // step, so there remains exactly one implementation of \"what does the environment say\".\n //\n // ## The ORDER, and why the third step is a throw\n //\n // 1. the organization's OWN credential\n // 2. the deployment's env-projected `SecretsContract`\n // 3. refuse, BY NAME\n //\n // Step 3 is the one that matters. Before this existed, an unresolvable secret returned\n // `undefined`, and every caller then decided for itself what that meant — several of them by\n // passing it onward, so a vendor received an empty Authorization header and answered 401. A 401\n // from a vendor is indistinguishable from a revoked credential, so the real fault (nobody ever\n // configured one) was invisible. Naming both places that were checked turns that into a\n // sentence an operator can act on.\n //\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — resolving which principal this\n // application acts as toward a third party, per tenant.\n // ══════════════════════════════════════════════════════════════════════════════════════════\n\n /\n Lazy getter for the per-organization credential store — see the `container` constructor\n * param's JSDoc for why this cannot be a constructor injection.\n \n `isBound` is what preserves the old `@optional()` semantics: a host that binds no store\n * (a minion, a unit harness) resolves nothing here and falls through to the deployment\n * environment, exactly as it did before the store existed.\n /\n protected resolveOrganizationCredentialResolver(): OrganizationProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver)) return undefined;\n return this.container.get<OrganizationProviderCredentialResolverPort>(\n SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver,\n );\n }\n\n /\n Lazy getter for the per-user credential store — same mechanics as the organization one above,\n * and the OPPOSITE meaning when it resolves nothing.\n \n An unbound organization store falls through to the deployment environment, because a tenant\n * legitimately may not have its own credential. An unbound USER store REFUSES, because there is\n * nothing a person's credential could fall through to: spending the deployment's shared\n * principal on someone's behalf would attribute the act to the wrong party at the vendor. So a\n * host that forgot to bind this gets a refusal naming the wiring fault, never a silent\n * substitution.\n /\n protected resolveUserCredentialResolver(): UserProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.UserProviderCredentialResolver)) return undefined;\n return this.container.get<UserProviderCredentialResolverPort>(\n SAAS_SERVICE_TYPES.UserProviderCredentialResolver,\n );\n }\n\n\n public isProviderEnabled(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): boolean {\n this.ensureInitialized();\n try {\n if (!this.hasProvider(providerRef)) {\n return false;\n }\n\n const provider = this.getProvider(providerRef);\n if (!provider \|\| !provider.protocols.includes(protocolKind)) {\n return false;\n }\n\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n if (!config) {\n return true;\n }\n\n return config.enabled !== false;\n } catch (error) {\n this.logDebug('Error checking if provider is enabled', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return false;\n }\n }\n\n public getProviderProtocolSecrets(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): Record<string, string> \| undefined {\n this.ensureInitialized();\n try {\n const resolvedSecrets: Record<string, string> = {};\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n const protocolSecretRef = protocolConfig?.authConfig?.secretRef;\n if (protocolSecretRef) {\n const secretValue = this.getProviderSecret(providerRef, protocolKind, protocolSecretRef);\n if (secretValue) {\n resolvedSecrets[protocolSecretRef] = secretValue;\n }\n }\n\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n continue;\n }\n\n const secretValue = this.getProviderSecret(providerRef, protocolKind, executionProfile.secretRef);\n if (secretValue) {\n resolvedSecrets[executionProfile.secretRef] = secretValue;\n }\n }\n }\n\n return Object.keys(resolvedSecrets).length > 0 ? resolvedSecrets : undefined;\n } catch {\n return undefined;\n }\n }\n\n /\n Refresh the runtime registry facade from first-class backend provider modules.\n \n This mirrors `initialize()` and intentionally no longer depends on the\n * deleted capability-bindings service.\n */\n public async refreshFromConfig(): Promise<void> {\n try {\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.registry = registry;\n this.isInitialized = true;\n\n this.logDebug('External providers registry refreshed from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n } catch (error) {\n this.logDebug('Failed to refresh registry from config', {\n error: describeCaughtError(error)\n });\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n error: describeCaughtError(error),\n },\n }\n );\n }\n }\n\n // ================================\n // Initialization Utils\n // ================================\n\n protected ensureInitialized(): void {\n if (!this.isInitialized \|\| !this.registry) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED\n }\n );\n }\n }\n}\n"]}
1	+ {"version":3,"file":"external-providers-registry.backend.service.js","sourceRoot":"","sources":["../../../../../src/external-providers/services/external-providers-registry.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;;;AAEH,OAAO,EAAE,sCAAsC,EAAE,MAAM,gDAAgD,CAAC;AAExG,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EACH,+BAA+B,EAC/B,+BAA+B,GAElC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACH,gCAAgC,EAChC,qCAAqC,GAGxC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAGH,gBAAgB,EAChB,8BAA8B,EAC9B,qDAAqD,EACrD,iCAAiC,EACjC,wCAAwC,GAC3C,MAAM,uBAAuB,CAAC;AAc/B,OAAO,EACL,sCAAsC,EAEtC,wBAAwB,EACxB,uCAAuC,EACvC,+BAA+B,EAC/B,uBAAuB,EACvB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAMpF,OAAO,EACH,4BAA4B,EAC5B,0CAA0C,EAC1C,sCAAsC,GAEzC,MAAM,4FAA4F,CAAC;AAEpG,OAAO,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAMpG,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAE1G,OAAO,EAAE,qCAAqC,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAChI,OAAO,EACH,4BAA4B,EAC5B,0CAA0C,EAC1C,gDAAgD,EAChD,qCAAqC,EACrC,8BAA8B,EAC9B,0CAA0C,EAC1C,wBAAwB,GAG3B,MAAM,sCAAsC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,8CAA8C,GAA6C;IAC7F,aAAa,EAAE,wBAAwB,CAAC,eAAe;CAC1D,CAAC;AAgEF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACH,sCAAsC,EACtC,uCAAuC,GAE1C,MAAM,yGAAyG,CAAC;AAwCjH,MAAM,6BAA6B,GAAG;IAClC,uBAAuB,CAAC,WAAW;IACnC,uBAAuB,CAAC,OAAO;IAC/B,uBAAuB,CAAC,UAAU;CACrC,CAAC;AAEF,SAAS,6BAA6B,CAAC,WAAmB;IACtD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,OAAO,UAAU,KAAK,WAAW;WAC1B,UAAU,KAAK,qBAAqB;WACpC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,2CAA2C,GAA6C;IAC1F,YAAY,EAAE,wBAAwB,CAAC,aAAa;IACpD,UAAU,EAAE,wBAAwB,CAAC,WAAW;IAChD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,cAAc,EAAE,wBAAwB,CAAC,eAAe;IACxD,kBAAkB,EAAE,wBAAwB,CAAC,mBAAmB;IAChE,gBAAgB,EAAE,wBAAwB,CAAC,iBAAiB;IAC5D,8EAA8E;IAC9E,sEAAsE;CACzE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kDAAkD,GAAoD;IACxG,UAAU,EAAE,+BAA+B,CAAC,WAAW;CAC1D,CAAC;AAEF;;;;GAIG;AACH,MAAM,2DAA2D,GAA4D;IACzH,mBAAmB,EAAE,uCAAuC,CAAC,qBAAqB;CACrF,CAAC;AAeF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,wCAAwC,GAAgD;IAC1F,EAAE,UAAU,EAAE,sCAAsC,CAAC,WAAW,EAAE,UAAU,EAAE,0CAA0C,CAAC,OAAO,EAAE;CACrI,CAAC;AAwCF;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC3D,OAAO,uCAAuC,UAAU,0EAA0E;UAC5H,mEAAmE,CAAC;AAC9E,CAAC;AAGM,IAAM,uCAAuC,GAA7C,MAAM,uCAAuC;IAOU;IACU;IACG;IACW;IAgC1B;IAzC9C,QAAQ,CAA+D;IACvE,QAAQ,GAAuC,IAAI,CAAC;IAEpD,aAAa,GAAG,KAAK,CAAC;IAEhC,YAC0D,MAAqB,EACX,aAAsC,EACnC,YAAwC,EAC7B,uBAA8D,EAgCxF,SAAqB;QAnCnB,WAAM,GAAN,MAAM,CAAe;QACX,kBAAa,GAAb,aAAa,CAAyB;QACnC,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QAgCxF,cAAS,GAAT,SAAS,CAAY;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAElF,IAAI,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,mCAAmC;IACnC,wBAAwB;IACxB,mCAAmC;IAEnC;;;OAGG;IACI,KAAK,CAAC,UAAU;QACnB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YACvD,OAAO;QACX,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;QAEhE,IAAI,CAAC,iCAAiC,EAAE,CAAC;QAEzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC;YACD,IAAI,CAAC,+BAA+B,EAAE,CAAC;YACvC,IAAI,CAAC,+BAA+B,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,qGAAqG;YACrG,iDAAiD;YACjD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,uEAAuE,EAAE;YACnF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;SAC/C,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACK,iCAAiC;QACrC,MAAM,SAAS,GAAG;YACd,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5G,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,SAAS,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,EAAE;SAC3F,CAAC,MAAM,CAAC,CAAC,QAAQ,EAA2B,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnE,MAAM,YAAY,GAAG,CAAC,WAAmB,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC/E,IAAI,CAAC;gBACD,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC9B,OAAO,IAAI,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,SAAS;YACb,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;gBACrF,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG;gBAClC,eAAe,EAAE,OAAO;gBACxB,MAAM,EAAE,sGAAsG;sBACxG,uGAAuG;aAChH,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,2EAA2E;IAEnE,uCAAuC;QAC3C,MAAM,QAAQ,GAAgC,EAAE,CAAC;QACjD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,oBAAoB;iBACnD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,wCAAwC,CAAC,UAAU,CAAC,CAAC;iBACzE,MAAM,CAAC,CAAC,UAAU,EAAkC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAEjF,QAAQ,CAAC,WAAW,CAAC,GAAG;gBACpB,WAAW;gBACX,SAAS;gBACT,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACpD,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,sCAAsC,CAAC,UAAU,CAAC,IAAI,SAAS;aACrG,CAAC;QACN,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,mCAAmC;IACnC,iBAAiB;IACjB,mCAAmC;IAE5B,4BAA4B;QAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC;IAC1B,CAAC;IAEM,gBAAgB;QACnB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,QAAS,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAEM,WAAW,CAAC,WAAmB;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACI,OAAO;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAEM,+BAA+B,CAAC,UAA4B;QAC/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,CAAC;YAC9E,IAAI,UAAU,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC/B,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YACtD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,iBAAiB,GAAG,YAAY,EAAE,SAAS;YAC7C,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE;YAC1D,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAS,CAAC;aACnD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;aACtE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;aACvC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;YACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,SAAS,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;YACzD,OAAO,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;mBAClC,CAAC,SAAS,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEP,sEAAsE;QACtE,6EAA6E;QAC7E,wEAAwE;QACxE,yEAAyE;QACzE,wDAAwD;QACxD,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,yEAAyE;QACzE,+EAA+E;QAC/E,uEAAuE;QACvE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,sBAAsB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC;eACrE,YAAY,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,iCAAiC,CAAC,UAAU,CAAC,KAAK,8BAA8B,CAAC,OAAO;YACrG,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,sBAAsB,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;iBACxE,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACvE,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3G,OAAO,CAAC,GAAG,iBAAiB,EAAE,GAAG,aAAa,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3C,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,cAAc,GAAG,eAAe,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,qCAAqC,CAAC,UAA4B;QACrE,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,oCAAoC,CAAC,UAA4B;QACpE,IAAI,iCAAiC,CAAC,UAAU,CAAC,KAAK,8BAA8B,CAAC,OAAO,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IAEM,2BAA2B,CAAC,UAA4B;QAC3D,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;OAWG;IACI,yBAAyB,CAAC,UAA4B;QACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACxF,CAAC;IAED;;;;;;;;;;OAUG;IACI,sCAAsC,CACzC,UAA0C,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAEtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,mFAAmF;YACnF,mFAAmF;YACnF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,OAAO,EAAE,mFAAmF;0BACtF,qDAAqD;iBAC9D;aACJ,CAAC,CAAC;QACP,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACvE,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,2BAA2B;QAC3B,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,qBAAqB,GAAG,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAC;YAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,kBAAkB;mBAC5C,UAAU,EAAE,OAAO,KAAK,IAAI;mBAC5B,qDAAqD,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7E,IACI,CAAC,qBAAqB,IAAI,gBAAgB,CAAC;mBACxC,IAAI,CAAC,oCAAoC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EACvE,CAAC;gBACC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7B,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAAC,OAAwC;QACzE,MAAM,2BAA2B,GAAG,IAAI,CAAC,sCAAsC,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,2BAA2B,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EACH,6DAA6D,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;sBACtG,oGAAoG;sBACpG,2FAA2F;sBAC3F,qFAAqF;gBAC3F,2BAA2B;aAC9B;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,+BAA+B,CAAsF;IACrH,yCAAyC,GAAG,KAAK,CAAC;IACzC,mCAAmC,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE3E,4BAA4B,CAChC,UAA4B;QAE5B,IAAI,IAAI,CAAC,+BAA+B,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;oBAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjE,IAAI,CAAC,+BAA+B,GAAG,MAA4F,CAAC;oBACxI,CAAC;yBAAM,CAAC;wBACJ,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;wBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;oBAC1D,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE;wBAC3F,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBACpC,CAAC,CAAC;oBACH,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC;oBAC1C,IAAI,CAAC,yCAAyC,GAAG,IAAI,CAAC;gBAC1D,CAAC;YACL,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC;QAClE,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IACI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;eACjC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;eAC7B,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS,IAAI,CAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;mBACrC,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAC9G,CAAC,EACJ,CAAC;YACC,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACI,sCAAsC,CAAC,UAA4B;QACtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QACvF,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,iBAAiB,GAAG,IAAI,CAAC,yCAAyC,IAAI,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrI,OAAO,MAAM,CAAC,MAAM,CAAC;YACjB,aAAa,EAAE,oBAAoB;gBAC/B,CAAC,CAAC,sCAAsC,CAAC,oBAAoB;gBAC7D,CAAC,CAAC,gBAAgB;oBACd,CAAC,CAAC,sCAAsC,CAAC,4BAA4B;oBACrE,CAAC,CAAC,sCAAsC,CAAC,kBAAkB;YACnE,cAAc,EAAE,iBAAiB;gBAC7B,CAAC,CAAC,uCAAuC,CAAC,SAAS;gBACnD,CAAC,CAAC,oBAAoB;oBAClB,CAAC,CAAC,uCAAuC,CAAC,OAAO;oBACjD,CAAC,CAAC,uCAAuC,CAAC,MAAM;YACxD,6BAA6B,EAAE,gBAAgB,EAAE,OAAO,IAAI,IAAI;YAChE,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YAChG,6BAA6B,EAAE,oBAAoB,EAAE,OAAO,IAAI,IAAI;YACpE,iCAAiC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YACpG,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,0CAA0C,EAAE;SAC3F,CAAC,CAAC;IACP,CAAC;IAEO,6BAA6B;QACjC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAG,OAAQ,IAAI,CAAC,aAA0C,CAAC,WAAW,KAAK,QAAQ;YAChG,CAAC,CAAE,IAAI,CAAC,aAA0C,CAAC,WAAY;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,SAAS,IAAI,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,SAAiC,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,CAAC,OAA2C,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACI,wBAAwB,CAC3B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5C,MAAM,eAAe,GAAG,SAAS,CAAC,sBAAsB,IAAI,EAAE,CAAC;YAE/D,MAAM,aAAa,GAAG,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACtF,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAClE,IAAI,YAAY,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,yCAAyC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBACtF,OAAO,IAAI,CAAC,0BAA0B,CAClC,aAAa,EACb,YAA6C,CAChD,CAAC;YACN,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,mCAAmC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,aAAa,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,4DAA4D;YAC5D,qEAAqE;YACrE,6DAA6D;YAC7D,6DAA6D;YAC7D,2DAA2D;YAC3D,4DAA4D;YAC5D,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE;gBAC3E,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;IAEO,0BAA0B,CAC9B,aAAwD,EACxD,YAA2C;QAE3C,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC;QACxB,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,uDAAuD;QACvD,+DAA+D;QAC/D,wDAAwD;QACxD,2DAA2D;QAC3D,6DAA6D;QAC7D,EAAE;QACF,6DAA6D;QAC7D,4DAA4D;QAC5D,2DAA2D;QAC3D,6DAA6D;QAC7D,6DAA6D;QAC7D,yDAAyD;QACzD,6DAA6D;QAC7D,6DAA6D;QAC7D,SAAS;QACT,MAAM,WAAW,GAAG,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC;QACxD,MAAM,UAAU,GAAG,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC;QACtD,IAAI,WAAW,IAAI,UAAU,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,OAAO,EAAE,kGAAkG;oBAC3G,WAAW;oBACX,UAAU;iBACb;aACJ,CACJ,CAAC;QACN,CAAC;QAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,eAAe,CAC9C,aAAa,CAAC,eAAsD,EACpE,YAAY,CAAC,eAAsD,CACtE,CAAC;QAEF,OAAO;YACH,GAAG,aAAa;YAChB,GAAG,YAAY;YACf,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,kEAAkE;YAClE,oEAAoE;YACpE,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,YAAY,CAAC,iBAAiB;gBACjE,CAAC,CAAC;oBACE,iBAAiB,EAAE;wBACf,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,EAAE,CAAC;wBAC1C,GAAG,CAAC,YAAY,CAAC,iBAAiB,IAAI,EAAE,CAAC;qBAC5C;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;YACT,UAAU,EAAE,IAAI,CAAC,eAAe,CAC5B,aAAa,CAAC,UAAU,EACxB,YAAY,CAAC,UAAU,CACqB;YAChD,kFAAkF;YAClF,8EAA8E;YAC9E,6EAA6E;YAC7E,oCAAoC;YACpC,eAAe,EAAE,qBAAoE;SACxF,CAAC;IACN,CAAC;IAEO,eAAe,CACnB,YAAqB,EACrB,WAAoB;QAEpB,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACpD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACnF,OAAO,WAAkD,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,OAAO,YAAuC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAA4B;YACpC,GAAI,YAAwC;SAC/C,CAAC;QACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpD,SAAS;YACb,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ;mBACf,OAAO,QAAQ,KAAK,QAAQ;mBAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;mBACxB,KAAK;mBACL,OAAO,KAAK,KAAK,QAAQ;mBACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;gBACvC,CAAC,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAGD;;;;;;;;;;;;;;;;;OAiBG;IACH;;;;;;;;;;;;;;OAcG;IACI,sBAAsB,CAAC,WAAmB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QACxF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI;YACJ,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,IAAI,CAAC;YACrD,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,UAAU,EAAE,OAAO,CACf,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;mBACnG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAChG;SACJ,CAAC,CAAC,CAAC;IACR,CAAC;IAEM,sBAAsB,CACzB,WAAmB,EACnB,SAAiB;QAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC;QACvB,CAAC;QAED,0FAA0F;QAC1F,wFAAwF;QACxF,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,aAAa,GAAG,KAAK,EAAE,UAAU,IAAI,SAAS,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,iBAAiB,GAAG,MAAM,KAAK,SAAS;eACvC,CAAC,MAAM,CAAC,iBAAiB,KAAK,aAAa,IAAI,MAAM,CAAC,qBAAqB,KAAK,aAAa,CAAC,CAAC;QAEtG,OAAO,iBAAiB;YACpB,CAAC,CAAC,4BAA4B,CAAC,YAAY;YAC3C,CAAC,CAAC,4BAA4B,CAAC,UAAU,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QACxF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;;OAQG;IACK,uBAAuB,CAAC,WAAmB,EAAE,SAAiB;QAClE,2FAA2F;QAC3F,6FAA6F;QAC7F,6FAA6F;QAC7F,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;QAC3F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,kGAAkG;QAClG,+FAA+F;QAC/F,oGAAoG;QACpG,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5D,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACI,uBAAuB,CAAC,WAAmB,EAAE,SAAiB;QACjE,OAAO,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACI,8BAA8B,CAAC,WAAmB;QACrD,OAAO,4BAA4B,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACI,sBAAsB,CAAC,WAAmB;QAC7C,OAAO,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACI,2BAA2B,CAAC,WAAmB;QAClD,OAAO,+BAA+B,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACK,yBAAyB;QAC7B,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QACnH,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,WAAmB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,QAAQ,EAAE,aAAa,IAAI,WAAW,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;QACjH,IAAI,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3G,OAAO;YACH,aAAa;YACb,WAAW;YACX,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY,EAAE,QAAQ;YACtB,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,KAAK,IAAI;SACxD,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,yBAAyB,CAAC,WAAmB;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QACnF,MAAM,OAAO,GAAoC,EAAE,CAAC;QACpD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YAC7G,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/J,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;YACtD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;gBACjG,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,uBAAuB,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YAC5J,CAAC;QACL,CAAC;QACD,OAAO,qCAAqC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED;;;;OAIG;IACI,mCAAmC,CAAC,WAAmB,EAAE,WAAmB;QAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,oBAAoB,IAAI,EAAE,CAAC;QACrG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,WAAW;eAC5F,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACI,gCAAgC,CAAC,WAAmB,EAAE,WAAmB,EAAE,aAAgC;QAC9G,MAAM,OAAO,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,UAAU,GAAG,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC5E,OAAO;YACH,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW;YACX,WAAW;YACX,iBAAiB,EAAE,UAAU,CAAC,WAAW;YACzC,0BAA0B,EAAE,UAAU,CAAC,oBAAoB;YAC3D,mBAAmB,EAAE,UAAU,CAAC,aAAa;SAChD,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACI,wCAAwC,CAAC,MAAsC;QAMlF,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;YACnE,OAAO;gBACH,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,qBAAqB;gBACtC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;oBACjD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACtH,YAAY,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS;oBACzD,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE,qBAAqB,CAAC;aAC7H,CAAC;QACN,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,UAAU,CAAC,CAAC;QACxH,IAAI,MAAM,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QACvE,MAAM,qBAAqB,GAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,aAAa,CAClG,EAAE,CAAC,sCAAsC,CAAC,UAAU,CAAwH,CAAC;QACjL,MAAM,QAAQ,GAAG,qBAAqB,EAAE,UAAU,EAAE,QAAQ;eACrD,qBAAqB,EAAE,QAAQ;eAC/B,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAuB,CAAC,CAAC;QAClJ,MAAM,eAAe,GAAG,qBAAqB,EAAE,UAAU,EAAE,SAAS,IAAI,MAAM,CAAC,eAAe,CAAC;QAC/F,OAAO;YACH,WAAW,EAAE,0BAA0B,MAAM,CAAC,aAAa,IAAI,sCAAsC,CAAC,UAAU,WAAW;YAC3H,eAAe;YACf,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,sCAAsC,CAAC,UAAU,EAAE,eAAe,CAAC;SACjI,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,+BAA+B;QACnC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACzF,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YACvH,IAAI,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI;gBAAE,SAAS;YAClE,2GAA2G;YAC3G,sFAAsF;YACtF,OAAO,CAAC,IAAI,CAAC,GAAG,iCAAiC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;iBAClI,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC;YAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,qCAAqC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/H,2GAA2G;YAC3G,sGAAsG;YACtG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChG,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,cAAc,IAAI,EAAE,EAAE,CAAC;gBAC9E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,6CAA6C,QAAQ,2CAA2C,CAAC,CAAC;gBACnK,wGAAwG;gBACxG,0EAA0E;gBAC1E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxE,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,gEAAgE,QAAQ,GAAG,CAAC,CAAC;gBACrH,CAAC;YACL,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE,EAAE,OAAO,EAAE,oEAAoE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE;SAC5H,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACK,+BAA+B;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACrD,IAAI,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/E,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,sCAAsC,CAAC,QAAQ,CAAC,CAAC;YACvG,OAAO,QAAQ,EAAE,IAAI,KAAK,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,+BAA+B,CAAC;YAC5C,WAAW;YACX,2BAA2B,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;YACzF,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,SAAS;YAC9E,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;gBACZ,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACnC,OAAO;oBACH,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACtE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;iBACjJ,CAAC;YACN,CAAC;YACD,wBAAwB,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ;YAC7G,mBAAmB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC7B,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,sCAAsC,CAAC,UAAU,CAAC,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU;SACnJ,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACL,OAAO,EAAE,2DAA2D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC1F,OAAO;aACV;SACJ,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;OAOG;IACI,wBAAwB,CAAC,WAAmB,EAAE,SAAiB;QAClE,OAAO;YACH,aAAa,EAAE,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC;YAC/D,UAAU,EAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC;SACnE,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,4BAA4B,CAAC,WAAmB,EAAE,gBAAwB;QAC7E,IAAI,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACzE,OAAO,4BAA4B,CAAC,qBAAqB,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,gBAAgB,CAAC,KAAK,gBAAgB;YACnF,CAAC,CAAC,4BAA4B,CAAC,OAAO;YACtC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,6BAA6B,CAAC,WAAmB,EAAE,UAAkB;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,CAAC,wBAAwB,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,UAAU,CAAC,KAAK,4BAA4B,CAAC,UAAU,EAAE,CAAC;YACnG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,CAAC,4BAA4B,EAAE,CAAC;QACzG,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC;IACrF,CAAC;IAEM,2BAA2B,CAAC,WAAmB;QAClD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,YAAY,CACtD,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,GAAG,EAAE,CAAC;YAC5D,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACI,kCAAkC,CAAC,WAAmB;QACzD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,mBAAmB,CAC7D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU,EAAE,CAAC;YACnE,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kDAAkD,CAAC,SAAS,CAAC,CAAC;aACjF,MAAM,CAAC,CAAC,SAAS,EAAgD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACtG,CAAC;IAGD;;;;;;OAMG;IACI,0CAA0C,CAAC,WAAmB;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,4BAA4B,CACtE,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,mBAAmB,EAAE,CAAC;YAC5E,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,eAAe,CAAC,UAAU;aAC5B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2DAA2D,CAAC,SAAS,CAAC,CAAC;aAC1F,MAAM,CAAC,CAAC,SAAS,EAAwD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC9G,CAAC;IAGM,mCAAmC,CAAC,WAAmB;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CACxC,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QACF,OAAO,MAAuD,CAAC;IACnE,CAAC;IAEM,6BAA6B,CAAC,WAAmB;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,0BAA0B,CACnD,WAAW,EACX,sCAAsC,CAAC,qBAAqB,CAC/D,CAAC;QAEF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;YAC9E,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,eAAe,GAAG;YACpB,GAAG,CAAC,eAAe,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;QACF,OAAO;YACH,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,SAAS,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACjD,sBAAsB,EAAE,eAAe,CAAC,UAAU;iBAC7C,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8CAA8C,CAAC,SAAS,CAAC,CAAC;iBAC7E,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;YAC1F,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;YAC9C,yBAAyB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,yBAAyB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,GAAG,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,GAAG,CAAC,eAAe,CAAC,mDAAmD;gBACnE,CAAC,CAAC,EAAE,mDAAmD,EAAE,eAAe,CAAC,mDAAmD,EAAE;gBAC9H,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,eAAe,CAAC,iBAAiB;gBACjC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,GAAG,eAAe,CAAC,iBAAiB,EAAE,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,6BAA6B;gBAC7C,CAAC,CAAC,EAAE,6BAA6B,EAAE,CAAC,GAAG,eAAe,CAAC,6BAA6B,CAAC,EAAE;gBACvF,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,mEAAmE;YACnE,oEAAoE;YACpE,0DAA0D;YAC1D,kBAAkB,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpF,GAAG,CAAC,eAAe,CAAC,iCAAiC;gBACjD,CAAC,CAAC;oBACE,iCAAiC,EAAE,MAAM,CAAC,WAAW,CACjD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,iCAAiC,CAAC,CAAC,GAAG,CACjE,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAC1D,CACJ;iBACJ;gBACD,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACI,sCAAsC,CACzC,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,aAAa,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,aAAa,EAAE,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAEjF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,yBAAyB,mBAAmB,kBAAkB,WAAW,EAAE,CAAC,CAAC;YAC3F,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC;YACD,OAAO,0CAA0C,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,aAAa,EACvB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,WAAW;oBACX,mBAAmB;oBACnB,OAAO,EAAE,qFAAqF;oBAC9F,eAAe,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBAC9C;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAEM,4CAA4C,CAC/C,WAAmB,EACnB,mBAA2B;QAE3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,sCAAsC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACvG,IACI,CAAC,gBAAgB;eACd,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;eACnF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;YACC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,gBAAgB;YACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5F,OAAO,aAAa,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAEO,uBAAuB,CAAC,UAA6B;QACzD,OAAO,UAAU;aACZ,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2CAA2C,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;aACvF,MAAM,CAAC,CAAC,SAAS,EAAyC,EAAE,CAAC,CAC1D,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,SAAqC,CAAC,CAC1F,CAAC,CAAC;IACX,CAAC;IAEO,+BAA+B,CACnC,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAEnG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,+BAA+B,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAC5E,OAAO,SAAS,CAAC;YACrB,CAAC;YAGD,IAAI,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,qBAAqB,EAAE,CAAC;gBAC7E,MAAM,0BAA0B,GAAG,SAAS,CAAC;gBAC7C,MAAM,wBAAwB,GAAG,OAAO,CACpC,eAAe,CAAC,SAAS;uBACtB,eAAe,CAAC,gBAAgB;uBAChC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CACpE,CAAC;gBACF,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,0BAA0B;oBAC1B,iBAAiB,EAAE;wBACf,CAAC,0BAA0B,CAAC,EAAE;4BAC1B,UAAU,EAAE,8BAA8B,CAAC,kBAAkB;4BAC7D,OAAO,EAAE,eAAe,CAAC,YAAY;4BACrC,IAAI,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;4BAC5C,6BAA6B,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;4BACzF,QAAQ,EAAE,wBAAwB;gCAC9B,CAAC,CAAC,4BAA4B,CAAC,wBAAwB;gCACvD,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;oCAChD,CAAC,CAAC,4BAA4B,CAAC,YAAY;oCAC3C,CAAC,CAAC,4BAA4B,CAAC,IAAI;4BAC3C,GAAG,CAAC,wBAAwB;gCACxB,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,EAAE;gCAC9F,CAAC,CAAC,EAAE,CAAC;4BACT,6DAA6D;4BAC7D,wDAAwD;4BACxD,yDAAyD;4BACzD,6DAA6D;4BAC7D,4DAA4D;4BAC5D,2BAA2B;4BAC3B,8BAA8B,EAAE,CAAC,uBAAuB,CAAC,WAAW,CAAC;4BACrE,sBAAsB,EAAE,0CAA0C,CAAC,cAAc;4BACjF,2DAA2D;4BAC3D,6DAA6D;4BAC7D,8BAA8B;4BAC9B,iBAAiB,EAAE,qCAAqC,CAAC,aAAa;4BACtE,4BAA4B,EAAE,gDAAgD,CAAC,kBAAkB;4BACjG,GAAG,CAAC,eAAe,CAAC,qBAAqB;gCACrC,CAAC,CAAC,EAAE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,EAAE;gCAClE,CAAC,CAAC,EAAE,CAAC;yBACZ;qBACJ;oBACD,eAAe;iBAClB,CAAC;YACN,CAAC;YAED,oGAAoG;YACpG,8DAA8D;YAC9D,MAAM,SAAS,GAAG,iCAAiC,CAAC,eAAe,CAAC,CAAC;YACrE,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS;oBACT,CAAC,CAAC;wBACE,UAAU,EAAE;4BACR,QAAQ,EAAE,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC;4BAC1D,SAAS;yBACZ;qBACJ;oBACD,CAAC,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,eAAe,CAAC,IAAI,KAAK,2BAA2B,CAAC,kBAAkB;oBACvE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE;oBAC5D,CAAC,CAAC,EAAE,CAAC;gBACT,eAAe;aAClB,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,wDAAwD;YACxD,2DAA2D;YAC3D,mDAAmD;YACnD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,8CAA8C,EAAE;gBAC1D,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACK,0BAA0B,CAC9B,eAAgD;QAEhD,QAAQ,eAAe,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,KAAK,2BAA2B,CAAC,KAAK,CAAC;YACvC,KAAK,2BAA2B,CAAC,UAAU,CAAC;YAC5C,qFAAqF;YACrF,mFAAmF;YACnF,gFAAgF;YAChF,KAAK,2BAA2B,CAAC,mBAAmB,CAAC;YACrD,KAAK,2BAA2B,CAAC,KAAK,CAAC;YACvC,KAAK,2BAA2B,CAAC,GAAG,CAAC;YACrC,8FAA8F;YAC9F,KAAK,2BAA2B,CAAC,aAAa,CAAC;YAC/C,KAAK,2BAA2B,CAAC,OAAO,CAAC;YACzC,sFAAsF;YACtF,gFAAgF;YAChF,KAAK,2BAA2B,CAAC,IAAI;gBACjC,OAAO,0BAA0B,CAAC,OAAO,CAAC;YAC9C,KAAK,2BAA2B,CAAC,kBAAkB;gBAC/C,OAAO,0BAA0B,CAAC,cAAc,CAAC;YACrD,KAAK,2BAA2B,CAAC,UAAU;gBACvC,OAAO,0BAA0B,CAAC,MAAM,CAAC;YAC7C,KAAK,2BAA2B,CAAC,qBAAqB;gBAClD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;oBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;oBACpG,OAAO,EAAE;wBACL,OAAO,EAAE,mGAAmG;8BACtG,oEAAoE;qBAC7E;iBACJ,CACJ,CAAC;YACN,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,eAAe,GAAU,eAAe,CAAC;gBAC/C,OAAO,eAAe,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,qBAAqB,CACzB,eAA0H;QAE1H,OAAO,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,GAAG,QAAQ;YACX,eAAe,EAAE;gBACb,GAAG,QAAQ,CAAC,eAAe;gBAC3B,UAAU,EAAE,eAAe,CAAC,mBAAmB;aAClD;YACD,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC;SACvC,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,iBAAiB,CACpB,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC1F,MAAM,kBAAkB,GAAG,UAAU,IAAI,SAAS,CAAC;YAEnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACpD,OAAO,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,2BAA2B,CAC/B,WAAmB,EACnB,YAAoD,EACpD,SAAiB;QAEjB,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;YAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;YAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;uBAChF,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAC7C,CAAC;oBACC,OAAO,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,CAAC;YACL,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAChF,IAAI,cAAc,EAAE,UAAU,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QAC/C,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACI,6BAA6B,CAChC,WAAmB,EACnB,YAAoD;QAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjI,OAAO,UAAU;YACb,CAAC,CAAC,gBAAgB,UAAU,KAAK,WAAW,KAAK,YAAY,MAAM,4BAA4B,CAAC,UAAU,CAAC,EAAE;YAC7G,CAAC,CAAC,GAAG,WAAW,4BAA4B,YAAY,qCAAqC,CAAC;IACtG,CAAC;IAEM,8BAA8B,CACjC,WAAmB,EACnB,YAAoD;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;IACzC,CAAC;IAIM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,qCAAqC,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;gBAClF,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,UAAU,SAAS,kBAAkB,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE;gBAC5C,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACI,gCAAgC,CAAC,WAAmB;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;QAC9F,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC7D,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,QAAQ,CAAC;QAEf,OAAO,IAAI,CAAC,mCAAmC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;OAQG;IACI,yCAAyC,CAAC,WAAmB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;QAC9F,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAClD,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,QAAQ,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,mCAAmC,CACvC,WAAmB,EACnB,SAAsD;QAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC;QAC9F,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAC7C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAClG,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACI,KAAK,CAAC,8BAA8B,CACvC,MAAyC,EACzC,WAAmB,EACnB,YAAoD,EACpD,SAAiB;IACjB;;;;;OAKG;IACH,OAA+D;QAW/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,4FAA4F;QAC5F,2FAA2F;QAC3F,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,4FAA4F;QAC5F,0EAA0E;QAC1E,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW;eACrE,MAAM,CAAC,UAAU,KAAK,0CAA0C,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,uCAAuC,MAAM,CAAC,eAAe,uDAAuD;kBAClH,oHAAoH;kBACpH,6BAA6B,CAClC,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACpE,sFAAsF;YACtF,yFAAyF;YACzF,sFAAsF;YACtF,yDAAyD;YACzD,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,yFAAyF;sBACvF,0DAA0D,CAC/D,CAAC;YACN,CAAC;YACD,iGAAiG;YACjG,uFAAuF;YACvF,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC/H,+FAA+F;YAC/F,6FAA6F;YAC7F,kFAAkF;YAClF,MAAM,eAAe,GAAG,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,cAAc,CAAC,KAAK,4BAA4B,CAAC,OAAO,CAAC;YAChI,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,qBAAqB,CAAC;gBACvF,MAAM,EAAE,MAAM,CAAC,OAAQ;gBACvB,WAAW;gBACX,aAAa,EAAE,iBAAiB;gBAChC,UAAU,EAAE,cAAc;gBAC1B,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aAC7E,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,sCAAsC,CAAC,IAAI,EAAE,GAAG,EAAE,CACpK,YAAY,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;gBACpH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,iBAAiB,EAAE,GAAG,EAAE,CACvG,YAAY,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC9G,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,mBAAmB;sBACjB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;wBACxB,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,wBAAwB,SAAS,KAAK;wBAC/D,CAAC,CAAC,SAAS,MAAM,CAAC,OAAO,4BAA4B,SAAS,mDAAmD;8BAC3G,GAAG,0CAA0C,CAAC,YAAY,CAAC,GAAG,CAAC;sBACvE,iHAAiH;sBACjH,kFAAkF,CACvF,CAAC;YACN,CAAC;YACD,OAAO;gBACH,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,MAAM,EAAE,kCAAkC,CAAC,eAAe;gBAC1D,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,GAAG,CAAC,WAAW,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC;gBACtG,GAAG,CAAC,WAAW,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC;aACnG,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,EAAE,CAAC;YAC3E,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,sDAAsD,OAAO,CAAC,QAAQ,CAAC,EAAE,2CAA2C;sBAClH,oHAAoH,CACzH,CAAC;YACN,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACrF,IAAI,eAAe,EAAE,CAAC;gBAClB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,kCAAkC,CAAC,sBAAsB,EAAE,CAAC;YACzG,CAAC;YACD,MAAM,uBAAuB,GAAG,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;YACpH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,yCAAyC,SAAS,yBAAyB,uBAAuB,kCAAkC,CACvI,CAAC;QACN,CAAC;QAED,qFAAqF;QACrF,0FAA0F;QAC1F,kFAAkF;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,iGAAiG;kBAC/F,0DAA0D,CAC/D,CAAC;QACN,CAAC;QACD,6FAA6F;QAC7F,MAAM,EAAE,aAAa,EAAE,yBAAyB,EAAE,UAAU,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC/I,8EAA8E;QAC9E,MAAM,uBAAuB,GAAG,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,sBAAsB,CAAC,KAAK,4BAA4B,CAAC,OAAO,CAAC;QAChJ,MAAM,KAAK,GAAG,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,6BAA6B,CAAC;YAC7F,cAAc,EAAE,MAAM,CAAC,OAAQ;YAC/B,WAAW;YACX,aAAa,EAAE,yBAAyB;YACxC,UAAU,EAAE,sBAAsB;YAClC,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,YAAY,EAAE,GAAG,EAAE,CAC5L,QAAQ,CAAC,qBAAqB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;YAChI,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAC/G,QAAQ,CAAC,qBAAqB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAClH,MAAM,IAAI,CAAC,sBAAsB,CAC7B,WAAW,EACX,mBAAmB;kBACjB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;oBACxB,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,4BAA4B,SAAS,KAAK;oBAC3E,CAAC,CAAC,iBAAiB,MAAM,CAAC,OAAO,4BAA4B,SAAS,mDAAmD;0BACnH,GAAG,0CAA0C,CAAC,YAAY,CAAC,GAAG,CAAC;kBACvE,gHAAgH;kBAChH,iDAAiD,CACtD,CAAC;QACN,CAAC;QACD,OAAO;YACH,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,kCAAkC,CAAC,uBAAuB;YAClE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YACxF,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1F,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;SACvF,CAAC;IACN,CAAC;IACD,4FAA4F;IAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,KAAK,CAAC,gCAAgC,CACzC,MAAyC,EACzC,WAAmB,EACnB,UAAqI,EACrI,OAAyD;QAEzD,iGAAiG;QACjG,sGAAsG;QACtG,8FAA8F;QAC9F,uGAAuG;QACvG,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1F,0GAA0G;QAC1G,yEAAyE;QACzE,MAAM,aAAa,GAAG,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;QACvE,yGAAyG;QACzG,MAAM,mBAAmB,GAAG,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,qFAAqF;YACrF,sFAAsF;YACtF,yDAAyD;YACzD,OAAO;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;YACpE,MAAM,YAAY,GAAG,IAAI,CAAC,6BAA6B,EAAE,CAAC;YAC1D,yFAAyF;YACzF,yFAAyF;YACzF,sFAAsF;YACtF,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY;gBAAE,OAAO;YACtD,MAAM,YAAY,CAAC,mBAAmB,CAAC;gBACnC,MAAM,EAAE,MAAM,CAAC,OAAO;gBACtB,WAAW;gBACX,aAAa;gBACb,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;gBACrE,UAAU,EAAE,gBAAgB;gBAC5B,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,sCAAsC,CAAC,YAAY;YAAE,OAAO;QAEtF,MAAM,QAAQ,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,0FAA0F;QAC1F,6FAA6F;QAC7F,4FAA4F;QAC5F,wDAAwD;QACxD,MAAM,QAAQ,CAAC,mBAAmB,CAAC;YAC/B,cAAc,EAAE,MAAM,CAAC,OAAO;YAC9B,WAAW;YACX,aAAa;YACb,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;YACrE,UAAU,EAAE,gBAAgB;YAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;YAC3F,GAAG,CAAC,UAAU,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,CAAC;YACtH,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAChD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACK,0BAA0B,CAC9B,WAAmB;IACnB,yFAAyF;IACzF,kBAAsC,EACtC,UAAkD,EAClD,qBAAuD;QAEvD,OAAO,sCAAsC,CAAC;YAC1C,QAAQ,EAAE,IAAI;YACd,WAAW;YACX,kBAAkB;YAClB,qBAAqB;YACrB,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kFAAkF,EAAE;gBAC7H,WAAW;gBACX,UAAU;gBACV,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC;SACL,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,8BAA8B,CACxC,WAAmB,EACnB,aAAqB,EACrB,qBAAuD;QAEvD,IAAI,aAAa,KAAK,WAAW;YAAE,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iCAAiC,WAAW,gDAAgD;kBACxH,IAAI,aAAa,4EAA4E,aAAa,KAAK,CAAC;QAC1H,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAAC,WAAmB,EAAE,MAAc;QAC9D,OAAO,IAAI,sCAAsC,CAAC,aAAa,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,6FAA6F;IAC7F,4CAA4C;IAC5C,EAAE;IACF,4EAA4E;IAC5E,EAAE;IACF,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,+FAA+F;IAC/F,2DAA2D;IAC3D,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,EAAE;IACF,kDAAkD;IAClD,EAAE;IACF,yCAAyC;IACzC,wDAAwD;IACxD,uBAAuB;IACvB,EAAE;IACF,uFAAuF;IACvF,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,wFAAwF;IACxF,mCAAmC;IACnC,EAAE;IACF,6FAA6F;IAC7F,wDAAwD;IACxD,6FAA6F;IAE7F;;;;;;;OAOG;IACO,qCAAqC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1G,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACrB,kBAAkB,CAAC,sCAAsC,CAC5D,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACO,6BAA6B;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC;YAAE,OAAO,SAAS,CAAC;QAClG,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACrB,kBAAkB,CAAC,8BAA8B,CACpD,CAAC;IACN,CAAC;IAGM,iBAAiB,CACpB,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,OAAO,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;gBACnD,WAAW;gBACX,YAAY;gBACZ,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEM,0BAA0B,CAC7B,WAAmB,EACnB,YAAoD;QAEpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACD,MAAM,eAAe,GAA2B,EAAE,CAAC;YACnD,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAChF,MAAM,iBAAiB,GAAG,cAAc,EAAE,UAAU,EAAE,SAAS,CAAC;YAChE,IAAI,iBAAiB,EAAE,CAAC;gBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBACzF,IAAI,WAAW,EAAE,CAAC;oBACd,eAAe,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC;gBACrD,CAAC;YACL,CAAC;YAED,IAAI,YAAY,KAAK,sCAAsC,CAAC,qBAAqB,EAAE,CAAC;gBAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAAC,CAAC;gBAC/E,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;oBACtF,IACI,gBAAgB,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;2BAChF,CAAC,gBAAgB,CAAC,SAAS,EAChC,CAAC;wBACC,SAAS;oBACb,CAAC;oBAED,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;oBAClG,IAAI,WAAW,EAAE,CAAC;wBACd,eAAe,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC;oBAC9D,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,iBAAiB;QAC1B,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,uCAAuC,EAAE,CAAC;YAEhE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAE1B,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;gBACjF,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;aAC/C,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACpD,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;gBACpG,OAAO,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;iBACpC;aACJ,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,uBAAuB;IACvB,mCAAmC;IAEzB,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAC9B,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT;gBACI,sBAAsB,EAAE,2BAA2B,CAAC,gDAAgD;aACvG,CACJ,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AAtwEY,uCAAuC;IADnD,UAAU,EAAE;IAQJ,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IAgCzD,WAAA,MAAM,CAAC,WAAW,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;yDAjCiD,0BAA0B;GATtG,uCAAuC,CAswEnD","sourcesContent":["/*\n External Providers Registry Backend Service\n \n Provides runtime access to the backend provider registry and\n * their protocol configurations, secrets, and operations.\n /\n\nimport { ExternalProviderConnectionRefusedError } from './external-provider-connection-refusal.backend';\nimport type { ProviderConnectionFacts, ProviderCredentialAddress, ProviderSharedConnections } from '@wildo-ai/saas-models';\nimport { resolveProviderConnectionRef } from '@wildo-ai/saas-models';\nimport {\n findSharedConnectionBootDefects,\n resolveDeclaredSharedConnection,\n type ResolvedProviderSharedConnection,\n} from './provider-shared-connection.backend';\nimport {\n classifyProviderConnectionScopes,\n computeProviderConnectionScopeCeiling,\n type ProviderConnectionScopeCeiling,\n type ProviderConnectionScopeSource,\n} from './provider-connection-scope-ceiling.backend';\nimport type { ProviderScopeReauthorizationOffer } from '@wildo-ai/saas-models';\nimport { createRequire } from 'node:module';\nimport { join } from 'node:path';\nimport { injectable, inject, optional } from 'inversify';\nimport type { Container } from 'inversify';\nimport {\n External_Providers_Registry,\n External_Providers_RegistryItem,\n EngineCapability,\n EngineCapabilityResolutionMode,\n ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED,\n getEngineCapabilityResolutionMode,\n PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY,\n} from '@wildo-ai/saas-models';\n\n/\n How the required-capability floor is evaluated on the calling host.\n \n `includeEngineFloor` — whether ENABLED members of\n * `ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED` count as required. True on a host\n * expected to SERVE those slots (the application backend, the platform services); false on a\n * scope-filtered host such as a minion, whose registry legitimately resolves none of them.\n * The application's own `required` flags are honoured on every host regardless.\n /\nexport interface RequiredCapabilityFloorOptions {\n includeEngineFloor: boolean;\n}\nimport {\n ExternalProvider_ExchangeProtocol_Kind,\n ExternalProvider_ExchangeProtocol_Configuration_Base,\n LLMProvider_OperationKey,\n DocumentExtractionProvider_OperationKey,\n EmbeddingsProvider_OperationKey,\n APPLICATION_ENVIRONMENT,\n ProviderProtocolRuntimeKind,\n ExternalProvider_SecretScope,\n} from '@wildo-ai/external-connectors-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { OrganizationProviderCredentialResolverPort } from '~wildo-backend-lib/security/connected-accounts/organization-provider-credential-resolver.port';\nimport type {\n UserProviderCredentialResolverPort,\n} from '~wildo-backend-lib/security/connected-accounts/user-provider-credential-resolver.port';\nimport type { ProviderOAuth2RefreshAudience } from '~wildo-backend-lib/security/connected-accounts/provider-oauth2-refresher.port';\nimport {\n StoredCredentialSlotStanding,\n describeCredentialsStoredUnderRetiredSlots,\n findCredentialsStoredUnderRetiredSlots,\n requireCredentialsStoredUnderRetiredSlots,\n} from '~wildo-backend-lib/security/connected-accounts/utils/retired-credential-slot.backend.utils';\nimport type { StorableCredentialSlot } from '~wildo-backend-lib/security/connected-accounts/utils/retired-credential-slot.backend.utils';\nimport { ProviderCredentialResolutionSource, ProviderCredentialSlotWriteRefusal } from '@wildo-ai/saas-models';\nimport {\n ExternalProvider_Connection_DelegationMode,\n ExternalProvider_Connection_OwnerScope,\n} from '@wildo-ai/external-connectors-models';\nimport type {\n ExternalProvider_ConnectionShape,\n ExternalProvider_ConnectionTarget,\n} from '@wildo-ai/external-connectors-models';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { ErrorType, ErrorCustomMessageReference, isWildoBackendError } from '@wildo-ai/saas-models';\nimport type { BackendProviderRegistryBackendService } from './backend-provider-registry.backend.service';\nimport type { ProviderProtocolRuntimeContract,\n SecretsContractEntry,\n CodingAgentHostLoginContract,\n} from '@wildo-ai/external-connectors-private/backend';\nimport { describeProviderProtocolSecretRef } from '@wildo-ai/external-connectors-private/backend-runtime';\nimport type { Hook_Endpoint, ProviderRestOAuth2 } from '@wildo-ai/external-connectors-models';\nimport { describeProviderOAuth2AudienceDefects, describeProviderRateBudgetDefects } from '@wildo-ai/external-connectors-models';\nimport {\n AgentClientProtocol_AuthMode,\n AgentClientProtocol_ExecutionProfileSchema,\n AgentClientProtocol_HostConfigurationInheritance,\n AgentClientProtocol_PermissionCeiling,\n AgentClientProtocol_RunnerHost,\n AgentClientProtocol_WorkingDirectoryPolicy,\n CodingAgent_OperationKey,\n type AgentClientProtocol_Configuration,\n type AgentClientProtocol_ExecutionProfile,\n} from '@wildo-ai/external-connectors-models';\n\n/\n Provider-contract operation literal → the semantic coding operation key. The\n * contract package uses short literals so it need not depend on the operation\n * family that consumes it; this map is the single translation.\n /\nconst RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION: Record<string, CodingAgent_OperationKey> = {\n runCodingTask: CodingAgent_OperationKey.RUN_CODING_TASK,\n};\n\n/\n The runtime projection of an ACP provider's transport capability.\n \n Far smaller than a request/response protocol's, because ACP agents advertise\n * their own capabilities, modes and commands during `initialize` /\n * `session/new`. Re-declaring any of that in authored configuration would\n * create a second source of truth that drifts the first time the agent is\n * upgraded — so what remains is only what the HOST must know before it opens a\n * connection.\n /\nexport type RuntimeAgentClientProtocolProfile = {\n /* How the provider says to START its agent — the authority an application inherits. /\n agentCommand: string;\n agentArgs: string[];\n supportedOperationKeys: CodingAgent_OperationKey[];\n supportedModels: string[];\n supportedProtocolVersions: number[];\n sessionMetaExtensions?: Record<string, unknown>;\n /* How this agent expresses each isolation posture; an absent posture is refused, never substituted. /\n sessionMetaExtensionsByHostConfigurationInheritance?: Partial<Record<string, Record<string, unknown>>>;\n /\n How the selected model reaches this agent. Absent means the provider\n * declared none, and a run that selected a model is refused rather than\n * started with the choice silently dropped.\n /\n modelDelivery?:\n \| { channel: 'environment-variable'; environmentVariableName: string }\n \| { channel: 'session-config-option'; configId: string };\n /\n Semantic model id → this agent's own spelling, where the two differ.\n \n Absent, or absent for a given model, means the semantic id is sent\n * unchanged — correct for every agent whose vocabulary already is Wildo's.\n /\n modelTransportIds?: Record<string, string>;\n /* Agent-vocabulary session-mode ids to prefer per ceiling; an optimisation, never the guarantee. /\n sessionModeIdsByPermissionCeiling?: Partial<Record<string, string[]>>;\n /\n The auth modes the PROVIDER declares its agent can actually use.\n \n Carried so an application-authored profile can be validated against it.\n * The contract's list previously reached only the synthesized `default`\n * profile, so an authored profile could declare any mode and nothing checked\n * whether the agent supports it.\n /\n supportedAuthModes?: string[];\n /\n Host environment variables the AGENT ITSELF needs, declared by its provider.\n \n Distinct from the execution profile's list, which is application policy.\n * This one is provider knowledge — which variable an agent reads to find its\n * own credentials is not something an application can be expected to know —\n * and it is UNIONED with the profile's rather than replaced by it.\n /\n inheritedEnvironmentVariables?: string[];\n /\n How to ask the host whether this agent's operator is signed in, without a model call — the\n * provider's declaration, carried so a runtime can refuse a dispatch to a signed-out agent before\n * spawning it rather than discover the login on the first prompt (#1637).\n /\n hostLogin?: CodingAgentHostLoginContract;\n};\nimport { ExternalProvider_Auth_Kind } from '@wildo-ai/external-connectors-models';\nimport {\n ExternalProviderSelectionAuthorityKind,\n ExternalProviderSelectionOverrideStatus,\n type ExternalProviderSelectionResolutionEvidence,\n} from '~wildo-backend-lib/external-providers/models/provider-selection-resolution-evidence.backend.definitions';\n\n/\n F-6 (2026-05-06) — runtime-side projection of a resolved provider\n * configuration. The base schema (`ExternalProvider_ExchangeProtocol_Configuration_Base`)\n * lives in `external-connectors-models` (which can't import the\n * backend-only discriminated union); we extend it here at the consumer\n * boundary so callers narrow on `runtimeContract.kind` instead of\n * casting through `as any`.\n \n Optional fields beyond the base also appear on this projection:\n \n - `defaultExecutionProfileRef` / `executionProfiles` — set by\n * `getDefaultProviderConfiguration` for `kind: ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL`\n * contracts, consumed by `getAgentClientProtocolProfile` and the ACP runner.\n * - `endpoints` — set for `kind: ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR`.\n \n They stay typed as `unknown` here because their canonical schemas\n * live in `external-connectors-models`'s `AgentClientProtocol_Configuration` /\n * webhook surfaces and are narrowed at consumer sites already.\n /\nexport type ResolvedProviderConfiguration =\n & ExternalProvider_ExchangeProtocol_Configuration_Base\n & {\n runtimeContract?: ProviderProtocolRuntimeContract;\n defaultExecutionProfileRef?: string;\n executionProfiles?: Record<string, unknown>;\n /\n Webhook-originator endpoint descriptors emitted by\n * `buildWebhookEndpoints` 2026-05-06: now matches the canonical\n * `Hook_Endpoint` shape (with the optional `displayName` field).\n * The dead extras (`providerRef`, `path`, `secretBinding`) that\n * previously polluted the emit have been removed; their values\n * were redundant with information already carried by other\n * fields (controller loop key, route convention, `authConfig.secretRef`).\n /\n endpoints?: ReadonlyArray<Hook_Endpoint>;\n };\n\n\nconst DEFAULT_IDENTITY_ENVIRONMENTS = [\n APPLICATION_ENVIRONMENT.DEVELOPMENT,\n APPLICATION_ENVIRONMENT.STAGING,\n APPLICATION_ENVIRONMENT.PRODUCTION,\n];\n\nfunction isCompanionRuntimeServiceName(serviceName: string): boolean {\n const normalized = serviceName.trim().toLowerCase();\n return normalized === 'companion'\n \|\| normalized === 'wildo-dev-companion'\n \|\| normalized.endsWith('-companion');\n}\n\nconst RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION: Record<string, LLMProvider_OperationKey> = {\n generateText: LLMProvider_OperationKey.GENERATE_TEXT,\n streamText: LLMProvider_OperationKey.STREAM_TEXT,\n chatCompletion: LLMProvider_OperationKey.CHAT_COMPLETION,\n chatMultimodal: LLMProvider_OperationKey.CHAT_MULTIMODAL,\n generateStructured: LLMProvider_OperationKey.GENERATE_STRUCTURED,\n streamStructured: LLMProvider_OperationKey.STREAM_STRUCTURED,\n // The `Thinking` runtime operation names were RETIRED 2026-07-17 — reasoning\n // depth is the `reasoningEffort` PARAMETER, not a separate operation.\n};\n\n/*\n The embeddings protocol's OWN runtime-op → semantic-key map (RAG plan DL2/H4 surface 1):\n * embeddings operations never enter {@link RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION}, whose\n * `toSemanticOperationKeys` filter would silently DROP any key outside `LLMProvider_OperationKey`\n * — the exact fall-through a sixth LLM operation key would have died in. Disjoint kind, disjoint map.\n /\nconst RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION: Record<string, EmbeddingsProvider_OperationKey> = {\n embedTexts: EmbeddingsProvider_OperationKey.EMBED_TEXTS,\n};\n\n/\n The document-extraction protocol's OWN runtime-op → semantic-key map, for the same reason its\n * embeddings sibling above has one: each protocol kind owns a disjoint operation vocabulary, so a\n * key never falls through a foreign filter and silently disappears.\n /\nconst RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION: Record<string, DocumentExtractionProvider_OperationKey> = {\n extractDocumentText: DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT,\n};\n\ninterface RuntimeProviderScopeSelection {\n engineCapabilities?: EngineCapability[];\n}\n\ninterface RuntimeProviderScope {\n providers?: Record<string, RuntimeProviderScopeSelection \| undefined>;\n selection?: Partial<Record<EngineCapability, {\n primary: string;\n whenUnavailable?: string[];\n }>>;\n}\n\n\n/\n What a provider admits when NOBODY HAS JUDGED IT — the SAFETY NET, not the answer.\n \n Named and stated once because it was previously an anonymous literal inlined at two call sites,\n * and a value that applies to most of the catalogue should be readable as the decision it is.\n \n ONE row, and it is the conservative end deliberately. APPLICATION x SERVICE is the deployment's\n * own credential, authored in the environment by the operator — the only claim that needs no\n * knowledge of the vendor whatsoever.\n \n It was briefly widened to include ORGANIZATION x SERVICE, with a careful argument that a tenant\n * bringing its own key is a fact about Wildo's tenancy model rather than about any vendor. The\n * argument holds and the change was still wrong: it made a blanket rule decide for 688 vendors at\n * once, which is precisely the per-vendor judgement this framework refuses to shortcut. A default\n * that carries the whole catalogue is not a fallback — it is mass management with a justification\n * attached, and the justification is what makes it hard to notice.\n \n So a provider earns every row beyond this one by somebody ANALYSING it and recording why, as a registry\n * provider's own `admissibleConnections` does (`providers-registry/asana/`), and as the archived catalogue's\n * `_code_archive/providers/catalogue-record/decisions/slack.json` did. The population that needs that judgement\n * is far smaller than the catalogue: 99 of the 689 transposed vendors declare an OAuth2 contract,\n * and only those have a connection flow to admit anybody to.\n /\nconst UNJUDGED_PROVIDER_ADMISSIBLE_CONNECTIONS: readonly ExternalProvider_ConnectionShape[] = [\n { ownerScope: ExternalProvider_Connection_OwnerScope.APPLICATION, delegation: ExternalProvider_Connection_DelegationMode.SERVICE },\n];\n\n/\n One declared secret slot of a provider, as a SCREEN needs it.\n \n Carries the slug so a form can name the field without anybody typing it, the environment variable\n * so an operator knows exactly what to set, and `configured` so a missing one can be reported rather\n * than discovered by pressing a button. It carries no VALUE, and there is no field for one.\n /\n/\n The OAuth client a connect, refresh or revocation must use — see\n * `ExternalProvidersRegistryBackendService.getConnectionOAuth2Client` (#1725).\n /\nexport interface ProviderConnectionOAuth2Client {\n /* The connection's identity: the declared base, or the ref itself when undeclared. /\n readonly connectionRef: string;\n /* The ref the flow came through. Recorded and audited; never the client's owner for a member. /\n readonly providerRef: string;\n /* The OWNER's REST OAuth2 block — endpoints, scopes, allowances, audiences. /\n readonly oauth2: ProviderRestOAuth2;\n /* The owner's REST contract, for the deployment base URL and the deployment-configured hosts. /\n readonly restContract: Extract<ProviderProtocolRuntimeContract, { kind: typeof ProviderProtocolRuntimeKind.REST }>;\n /* The client is the owner's sign-in registration (`sharedWithSignIn`) rather than its connected-account one. /\n readonly sharedWithSignIn: boolean;\n}\n\nexport interface ProviderSecretSlot {\n readonly slug: string;\n readonly envVarName: string;\n readonly required: boolean;\n readonly description: string;\n readonly scope: ExternalProvider_SecretScope;\n /* Whether the deployment environment supplies it. Never the value itself. /\n readonly configured: boolean;\n /* Present when the contract marks the slot as holding a deployment host (see `SecretsContractEntry.holdsDeploymentHost`). /\n readonly holdsDeploymentHost?: true;\n /* Present when the contract marks the slot as holding a vendor value made for browsers (see `SecretsContractEntry.holdsBrowserPublicValue`). /\n readonly holdsBrowserPublicValue?: true;\n}\n\n/\n How an operator provides an application-owned provider secret (#1637) — one wording for every refusal\n * that reaches a person because a key is missing, so each names the same door: `wildo secrets set`, or\n * the workbench's Secrets section, which runs it.\n /\nexport function describeProviderSecretRemedy(envVarName: string): string {\n return `Provide it with \\`wildo secrets set ${envVarName}\\` (add \\`--env <environment>\\` for a remote one) or in the workbench's `\n + 'Secrets section; the runtimes that read it restart to pick it up.';\n}\n\n@injectable()\nexport class ExternalProvidersRegistryBackendService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n protected registry: External_Providers_Registry \| null = null;\n\n protected isInitialized = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) protected readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) protected readonly configService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) protected readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) protected readonly backendProviderRegistry: BackendProviderRegistryBackendService,\n /\n The container, used ONLY to resolve the per-organization credential store on demand\n * ({@link resolveOrganizationCredentialResolver}). OPTIONAL, and appended LAST so no\n * existing parameter position moves.\n \n *Deliberately NOT a constructor injection of\n {@link OrganizationProviderCredentialResolverPort}.** `@optional()` tolerates an ABSENT\n * BINDING; it does not defer construction. So injecting the port directly made this\n * configuration-tier registry construct the entire resource stack that stands behind the\n * store — and that stack closes a cycle straight back here:\n \n ```\n * SaaS.AuditLogSink → CompositeAuditLogSink → ExternalProvidersRegistryService\n * → OrganizationProviderCredentialResolver (the store)\n * → SystemAccessService / AuditLogsService → SaaS.AuditLogSink\n * ```\n \n which InversifyJS reports as `Circular dependency found: (No dependency trace)` +\n * `RangeError: Maximum call stack size exceeded` at BOOT — every platform service and every\n * application backend, since `AuditLogsBackendService` injects the sink. The same edge\n * poisons `LlmObservabilityAgentCallTraceSink`, which depends on this registry too.\n \n Resolving on demand is also what the port's own contract already assumed: this service is\n * constructed at configuration tier, BEFORE repositories exist, while a tenant credential is\n * only ever needed once a request is being served. Lazy-container is the pattern\n * `AuthorizationsBackendService` and `WebSocketService` use to break their own cycles.\n \n When the container is absent (a unit harness) or the store is unbound (a minion resolving\n * an LLM key), no tenant has its own credential here and resolution falls through to the\n * deployment environment — the behaviour every caller had before the store existed.\n /\n @inject('Container') @optional() protected readonly container?: Container,\n ) {\n this.logDebug = this.logger.debugByType('ExternalProvidersRegistryBackendService');\n this.logger.setDebugTypeLogging('ExternalProvidersRegistryBackendService', false);\n\n this.logDebug('External providers registry service created (not yet initialized)');\n }\n\n // ================================\n // Initialization Method\n // ================================\n\n /\n Initialize by projecting first-class backend provider modules into the\n * runtime registry facade used by existing callers.\n /\n public async initialize(): Promise<void> {\n if (this.isInitialized) {\n this.logDebug('Service already initialized, skipping');\n return;\n }\n\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.reportMissingProviderRuntimePeers();\n\n this.registry = registry;\n\n this.isInitialized = true;\n try {\n this.assertSharedConnectionsCoherent();\n this.assertDeclaredAudiencesCoherent();\n } catch (error) {\n // A host that refused its shared connections is not initialized: nothing may resolve a grant through\n // a declaration this boot has just proven wrong.\n this.isInitialized = false;\n this.registry = null;\n throw error;\n }\n this.logDebug('External providers registry initialized from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n }\n\n /\n @wildo_source:part:start saas.backend.providers.optional-runtime-peers facet:layer:backend facet:audience:app-developer\n \n Report a registered provider whose optional runtime peer is not installed (#438).\n \n What this means for an application: a provider may lazy-load a vendor SDK that is not a\n * dependency of the engine or of your application. Declaring the provider in a scope does not\n * install it. YOU install it, in the runtime that enables the provider — which is your own\n * `backend-api`, not the engine package — and if you do not, the capability that provider serves\n * quietly does not work.\n \n The startup warning names the provider and the missing packages, so read it as an\n * installation instruction rather than as noise.\n \n `requiredPackages` declares the npm packages a provider LAZY-LOADS — a vendor SDK that is\n * never an engine or application dependency, installed only in a runtime that enables the\n * provider. Two providers declare it (immudb -> `immudb-node`, posthog -> `posthog-node`), and\n * until 2026-09-08 the field had NO READER anywhere: no start-up check, no installation step,\n * no diagnostic. A provider could be registered with its SDK absent and the first sign was the\n * feature quietly not working.\n \n A REPORT, never a refusal, and the asymmetry is deliberate: a declared provider may\n * legitimately never be reached (a fan-out audit sink in an environment that emits nothing),\n * so an absent optional peer is information rather than a misconfiguration. The capability\n * DISAGREEMENT check in `define-saas-config` refuses, because a wrong declaration is wrong\n * whatever happens next.\n \n Resolution is attempted from the RUNNING APPLICATION first and from this module second. The\n * peer is installed in the application's own `backend-api`, not in the engine package, so\n * resolving only from here would report a false absence — and a diagnostic that cries wolf is\n * worse than the silence it replaces.\n /\n private reportMissingProviderRuntimePeers(): void {\n const resolvers = [\n (() => { try { return createRequire(join(process.cwd(), 'package.json')); } catch { return undefined; } })(),\n (() => { try { return createRequire(import.meta.url); } catch { return undefined; } })(),\n ].filter((resolver): resolver is NodeRequire => Boolean(resolver));\n\n const isResolvable = (packageName: string): boolean => resolvers.some((resolver) => {\n try {\n resolver.resolve(packageName);\n return true;\n } catch {\n return false;\n }\n });\n\n for (const provider of this.backendProviderRegistry.getRegistry().modules.values()) {\n const declaredPackages = provider.requiredPackages ?? [];\n const missing = declaredPackages.filter((packageName) => !isResolvable(packageName));\n if (missing.length === 0) {\n continue;\n }\n this.logger.warn('Provider is registered without its declared optional runtime peer(s)', {\n providerRef: provider.metadata.ref,\n missingPackages: missing,\n detail: 'The provider lazy-loads these and degrades without them, so the capability it serves will not work. '\n + 'Install them in the runtime that enables this provider, or stop declaring the provider in that scope.',\n });\n }\n }\n /* @wildo_source:part:end saas.backend.providers.optional-runtime-peers /\n\n private buildRuntimeRegistryFromProviderModules(): External_Providers_Registry {\n const registry: External_Providers_Registry = {};\n for (const provider of this.backendProviderRegistry.getRegistry().modules.values()) {\n const providerRef = provider.metadata.ref;\n const protocols = this.backendProviderRegistry.getProtocolKinds(providerRef);\n const engineCapabilities = provider.providerCapabilities\n .map((capability) => PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability])\n .filter((capability): capability is EngineCapability => Boolean(capability));\n\n registry[providerRef] = {\n providerRef,\n protocols,\n engineCapabilities: [...new Set(engineCapabilities)],\n supportsOAuth2: protocols.includes(ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2) \|\| undefined,\n };\n }\n return registry;\n }\n\n // ================================\n // Access Methods\n // ================================\n\n public getExternalProvidersRegistry(): External_Providers_Registry {\n this.ensureInitialized();\n return this.registry!;\n }\n\n public getProviderTypes(): string[] {\n this.ensureInitialized();\n return Object.keys(this.registry!);\n }\n\n public getProvider(providerRef: string): External_Providers_RegistryItem \| undefined {\n this.ensureInitialized();\n return this.registry![providerRef];\n }\n\n public hasProvider(providerRef: string): boolean {\n this.ensureInitialized();\n return providerRef in (this.registry \|\| {});\n }\n\n /\n Public, NON-throwing readiness probe — whether `initialize()` has run.\n * Lets lazy consumers (e.g. `CompositeAuditLogSink`) distinguish the expected\n * pre-startup window (skip silently, retry later) from a genuine post-init\n * resolution fault (which must be surfaced, not swallowed) — without tripping\n * the `ensureInitialized()` throw just to probe.\n /\n public isReady(): boolean {\n return this.isInitialized;\n }\n\n public getProvidersForEngineCapability(capability: EngineCapability): string[] {\n this.ensureInitialized();\n if (this.configService.isInitialized()) {\n const activation = this.configService.config.engineCapabilities?.[capability];\n if (activation?.enabled !== true) {\n return [];\n }\n }\n\n const runtimeScope = this.getActiveRuntimeProviderScope();\n if (this.configService.isInitialized() && !runtimeScope) {\n return [];\n }\n\n const scopeProviderRefs = runtimeScope?.providers\n ? new Set(Object.keys(runtimeScope.providers))\n : undefined;\n const configuredProviders = this.configService.isInitialized()\n ? (this.configService.config.providerConfigurations ?? {})\n : {};\n\n const availableProviders = Object.values(this.registry!)\n .filter((provider) => provider.engineCapabilities.includes(capability))\n .map((provider) => provider.providerRef)\n .filter((providerRef) => {\n if (!scopeProviderRefs) {\n return true;\n }\n\n const selection = runtimeScope?.providers?.[providerRef];\n return scopeProviderRefs.has(providerRef)\n && (selection?.engineCapabilities ?? []).includes(capability);\n });\n\n // A FAN_OUT capability ignores any `selection` policy: every declared\n // provider is active, so primary/substitute ordering is meaningless (and the\n // config validator rejects authoring one). Guarding here is defense-in-\n // depth — a stray selection on a fan-out cap from a legacy/hand-authored\n // artifact never reorders or truncates the fan-out set.\n // Per-environment selection override (WILDO_PROVIDER_SELECTION_OVERRIDES,\n // authored in `wildo.infra.<env>.config.ts > providerSelection`) wins over\n // the app-wide `wildo.saas.config.ts` selection for a SELECT_ONE capability.\n // It only REORDERS — the availability/enabled filtering above is unchanged,\n // so undeclared or capability-disabled refs are skipped, never admitted.\n // Remaining eligible refs are appended after the eligible primary/substitutes;\n // an invalid primary therefore does not empty a nonempty eligible set.\n // This ordering does not test credentials or retry a failed vendor call.\n // FAN_OUT ignores it (same rule as the SaaS-side selection).\n const selectionForCapability = this.getProviderSelectionOverride(capability)\n ?? runtimeScope?.selection?.[capability];\n const policy = getEngineCapabilityResolutionMode(capability) === EngineCapabilityResolutionMode.FAN_OUT\n ? undefined\n : selectionForCapability;\n if (policy) {\n const orderedPolicyRefs = [policy.primary, ...(policy.whenUnavailable ?? [])]\n .filter((providerRef) => availableProviders.includes(providerRef));\n const remainingRefs = availableProviders.filter((providerRef) => !orderedPolicyRefs.includes(providerRef));\n return [...orderedPolicyRefs, ...remainingRefs];\n }\n\n return availableProviders.sort((left, right) => {\n const leftConfigured = configuredProviders[left] ? 0 : 1;\n const rightConfigured = configuredProviders[right] ? 0 : 1;\n return leftConfigured - rightConfigured \|\| left.localeCompare(right);\n });\n }\n\n public getPrimaryProviderForEngineCapability(capability: EngineCapability): string \| undefined {\n return this.getProvidersForEngineCapability(capability)[0];\n }\n\n /\n Resolve the provider ref(s) that should be ACTIVE for a capability,\n * honouring its declared `EngineCapabilityResolutionMode`:\n * - `SELECT_ONE` (the default — billing, email, observability, …): the\n * single primary, as a 0- or 1-element list. A declared `whenUnavailable` entry\n * only orders the candidate list ahead of this call — it substitutes for a\n * primary that is not AVAILABLE, and nothing tries a second provider when a\n * call to the first one FAILS.\n * - `FAN_OUT` (e.g. `COMPLIANCE_AUDIT_TRAIL`): EVERY declared + available\n * provider — all active simultaneously (no primary, no failover).\n \n The single entry point a fan-out consumer (the `CompositeAuditLogSink`)\n * uses, so the resolution mode is honoured centrally rather than each\n * consumer choosing `getPrimary…` vs `getProviders…` by convention.\n /\n public getResolvedProviderRefsForCapability(capability: EngineCapability): string[] {\n if (getEngineCapabilityResolutionMode(capability) === EngineCapabilityResolutionMode.FAN_OUT) {\n return this.getProvidersForEngineCapability(capability);\n }\n const primary = this.getPrimaryProviderForEngineCapability(capability);\n return primary ? [primary] : [];\n }\n\n public isEngineCapabilityAvailable(capability: EngineCapability): boolean {\n return this.getProvidersForEngineCapability(capability).length > 0;\n }\n\n /\n G4 (audit Phase 5) — fail-open reconcile support. Whether a capability is\n * switched ON in `engineCapabilities` config (`activation.enabled === true`),\n * INDEPENDENT of whether any provider resolves to serve it. Distinct from:\n * - `isEngineCapabilityAvailable` — a provider is DECLARED (says nothing about\n * the operator's config intent), and\n * - `getRequiredCapabilitiesWithoutProvider` — a HARD requirement is unmet\n * (throws at boot; F5).\n * The G4 warn pairs this (\"the operator turned audit on\") with a zero-resolved-\n * provider check (\"but nothing is delivering it\") to flag a SILENT Layer-2\n * fan-out — a warn, never a throw.\n /\n public isEngineCapabilityEnabled(capability: EngineCapability): boolean {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n return false;\n }\n return this.configService.config.engineCapabilities?.[capability]?.enabled === true;\n }\n\n /\n F5 (audit Phase 5) — boot-guard support. Returns every capability the app\n * marked `activation.required === true` that resolves to ZERO active providers\n * (respecting the capability's resolution mode — SELECT_ONE needs a primary,\n * FAN_OUT needs ≥1 declared; a `required` capability left `enabled: false`\n * resolves to none and is therefore also caught). A non-empty result means a\n * misconfigured deployment — a HARD requirement with nothing to serve it — and\n * `StartApplicationBackendService.initialize()` throws CONFIGURATION on any.\n * Audit (`COMPLIANCE_AUDIT_TRAIL`, when marked required) is the FIRST user, not\n * a special case: this generalizes the coherence to EVERY capability.\n /\n public getRequiredCapabilitiesWithoutProvider(\n options: RequiredCapabilityFloorOptions = { includeEngineFloor: true },\n ): EngineCapability[] {\n this.ensureInitialized();\n if (!this.configService.isInitialized()) {\n // Used to answer `[]` here, which read as \"nothing missing\" on a host whose config\n // had never loaded — a floor that cannot see its inputs must refuse, not reassure.\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'The required-capability floor was evaluated before the application configuration '\n + 'was initialized; it cannot decide what is required.',\n },\n });\n }\n const activations = this.configService.config.engineCapabilities ?? {};\n const missing: EngineCapability[] = [];\n // Swept over the ENUM, not over the authored keys (#328), so the population and its order\n // are the engine's. Requiredness itself always needs an activation entry — an absent key is\n // neither `enabled` nor `required` — so this is about which list is authoritative, not about\n // catching an omitted key.\n for (const capability of Object.values(EngineCapability)) {\n const activation = activations[capability];\n const requiredByApplication = activation?.required === true;\n const requiredByEngine = options.includeEngineFloor\n && activation?.enabled === true\n && ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED.has(capability);\n if (\n (requiredByApplication \|\| requiredByEngine)\n && this.getResolvedProviderRefsForCapability(capability).length === 0\n ) {\n missing.push(capability);\n }\n }\n return missing;\n }\n\n /\n The floor as a single fail-closed door (#328): every host that serves the application\n * calls this after its registry is ready — the application backend, and the platform\n * services after `refreshFromConfig()` — so \"required with nothing serving it\" cannot pass\n * one host's boot because the check happened to live on another's branch.\n /\n public assertRequiredCapabilityFloor(options?: RequiredCapabilityFloorOptions): void {\n const missingRequiredCapabilities = this.getRequiredCapabilitiesWithoutProvider(options);\n if (missingRequiredCapabilities.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Required engine capabilities resolve no active provider: [${missingRequiredCapabilities.join(', ')}]. `\n + 'Each is either marked `required` in engineCapabilities or is an engine flow that needs a provider '\n + 'the moment it is enabled (EMAIL_TRANSACTIONAL, BILLING, SMS) — declare a provider for it '\n + '(SELECT_ONE needs a primary; FAN_OUT needs ≥1 declared), or disable the capability.',\n missingRequiredCapabilities,\n },\n });\n }\n\n /\n Per-environment external-provider selection override, read once from\n * `process.env.WILDO_PROVIDER_SELECTION_OVERRIDES` (a JSON map of\n * `EngineCapability -> { primary, whenUnavailable? }`). Projected by the Wildo\n * CLI's `env-vars-builder` from `wildo.infra.<env>.config.ts > providerSelection`.\n * Read as a string literal (not via a `platform-config-lib` import) to\n * preserve the engine → platform dependency direction — mirrors how\n * `LoggerService` reads `LOG_LEVEL` and `otel-preload` reads `OTEL_ENABLED`.\n \n Memoized on first read: env vars are fixed for a process lifetime, and\n * `getProvidersForEngineCapability` is a hot path. A malformed value is\n * tolerated (logged + ignored) so a bad override degrades to the SaaS-config\n * selection rather than breaking provider resolution.\n /\n private providerSelectionOverridesCache?: Partial<Record<EngineCapability, { primary: string; whenUnavailable?: string[] }>>;\n private providerSelectionOverridePayloadMalformed = false;\n private readonly malformedProviderSelectionOverrides = new Set<EngineCapability>();\n\n private getProviderSelectionOverride(\n capability: EngineCapability,\n ): { primary: string; whenUnavailable?: string[] } \| undefined {\n if (this.providerSelectionOverridesCache === undefined) {\n const raw = process.env.WILDO_PROVIDER_SELECTION_OVERRIDES;\n if (!raw) {\n this.providerSelectionOverridesCache = {};\n } else {\n try {\n const parsed = JSON.parse(raw) as unknown;\n if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n this.providerSelectionOverridesCache = parsed as Partial<Record<EngineCapability, { primary: string; whenUnavailable?: string[] }>>;\n } else {\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n } catch (error) {\n this.logDebug('Failed to parse WILDO_PROVIDER_SELECTION_OVERRIDES; ignoring per-env override', {\n error: describeCaughtError(error),\n });\n this.providerSelectionOverridesCache = {};\n this.providerSelectionOverridePayloadMalformed = true;\n }\n }\n }\n const override = this.providerSelectionOverridesCache[capability];\n // Guard the shape defensively — a hand-crafted env var could carry a\n // non-conforming entry that upstream Zod validation never saw.\n if (override === undefined) return undefined;\n if (\n typeof override.primary !== 'string'\n \|\| override.primary.length === 0\n \|\| (override.whenUnavailable !== undefined && (\n !Array.isArray(override.whenUnavailable)\n \|\| !override.whenUnavailable.every((substitute) => typeof substitute === 'string' && substitute.length > 0)\n ))\n ) {\n this.malformedProviderSelectionOverrides.add(capability);\n return undefined;\n }\n return override;\n }\n\n /\n Sanitized provenance for the effective provider selection. This exposes\n * neither environment bytes nor provider configuration; it only preserves\n * which authority won and the generated artifact identities behind it.\n /\n public getProviderSelectionResolutionEvidence(capability: EngineCapability): ExternalProviderSelectionResolutionEvidence {\n this.ensureInitialized();\n const runtimeSelection = this.getActiveRuntimeProviderScope()?.selection?.[capability];\n const environmentSelection = this.getProviderSelectionOverride(capability);\n const overrideMalformed = this.providerSelectionOverridePayloadMalformed \|\| this.malformedProviderSelectionOverrides.has(capability);\n return Object.freeze({\n authorityKind: environmentSelection\n ? ExternalProviderSelectionAuthorityKind.ENVIRONMENT_OVERRIDE\n : runtimeSelection\n ? ExternalProviderSelectionAuthorityKind.APPLICATION_RUNTIME_ARTIFACT\n : ExternalProviderSelectionAuthorityKind.DEFAULT_RESOLUTION,\n overrideStatus: overrideMalformed\n ? ExternalProviderSelectionOverrideStatus.MALFORMED\n : environmentSelection\n ? ExternalProviderSelectionOverrideStatus.APPLIED\n : ExternalProviderSelectionOverrideStatus.ABSENT,\n applicationPrimaryProviderRef: runtimeSelection?.primary ?? null,\n applicationSubstituteProviderRefs: Object.freeze([...(runtimeSelection?.whenUnavailable ?? [])]),\n environmentPrimaryProviderRef: environmentSelection?.primary ?? null,\n environmentSubstituteProviderRefs: Object.freeze([...(environmentSelection?.whenUnavailable ?? [])]),\n providerRuntimeArtifact: this.configService.getProviderRuntimeArtifactEvidenceMetadata(),\n });\n }\n\n private getActiveRuntimeProviderScope(): RuntimeProviderScope \| undefined {\n if (!this.configService.isInitialized()) {\n return undefined;\n }\n\n const scopes = this.configService.config.providers?.scopes;\n if (!scopes) {\n return undefined;\n }\n\n const serviceName = typeof (this.configService as { serviceName?: string }).serviceName === 'string'\n ? (this.configService as { serviceName?: string }).serviceName!\n : '';\n if (scopes.companion && isCompanionRuntimeServiceName(serviceName)) {\n return scopes.companion as RuntimeProviderScope;\n }\n\n return scopes.backend as RuntimeProviderScope \| undefined;\n }\n\n /\n Get provider configuration for a specific protocol.\n * Falls back to default configuration from cached provider definitions if not overridden.\n /\n public getProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n this.ensureInitialized();\n try {\n if (!this.configService.isInitialized()) {\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n const appConfig = this.configService.config;\n const providerConfigs = appConfig.providerConfigurations \|\| {};\n\n const defaultConfig = this.getDefaultProviderConfiguration(providerRef, protocolKind);\n const customConfig = providerConfigs[providerRef]?.[protocolKind];\n if (customConfig) {\n this.logDebug(`Using merged custom configuration for ${providerRef}.${protocolKind}`);\n return this.mergeProviderConfiguration(\n defaultConfig,\n customConfig as ResolvedProviderConfiguration,\n );\n }\n\n if (defaultConfig) {\n this.logDebug(`Using default configuration for ${providerRef}.${protocolKind}`);\n }\n return defaultConfig;\n } catch (error) {\n // Programmer-error / contract-violation paths (cross-`kind`\n // merge guard, authKind misuse on `agent-client-protocol`) throw via\n // `errorBuilder.buildError`, producing `WildoError_Backend`.\n // Those MUST surface — they signal projection drift that the\n // silent fallback would mask. Only network/runtime hiccups\n // (the original intent of this catch) fall back to default.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting provider configuration, falling back to default', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return this.getDefaultProviderConfiguration(providerRef, protocolKind);\n }\n }\n\n private mergeProviderConfiguration(\n defaultConfig: ResolvedProviderConfiguration \| undefined,\n customConfig: ResolvedProviderConfiguration\n ): ResolvedProviderConfiguration {\n if (!defaultConfig) {\n return customConfig;\n }\n\n // Fail-closed cross-`kind` guard. Both inputs are looked up by\n // the same `(providerRef, protocolKind)` pair upstream, so the\n // discriminated-union `kind` MUST match if both contracts are\n // present. A mismatch here would silently corrupt the merged\n // result into a type-broken union member; we throw via\n // `errorBuilder.buildError` so the WildoError_Backend instance\n // is detected by `getProviderConfiguration`'s catch and\n // re-thrown past the default-fallback path (the catch only\n // swallows generic runtime errors, not contract violations).\n //\n // Note on scope: this guard fires against cross-`kind` drift\n // between `getDefaultProviderConfiguration`'s emit (carries\n // `runtimeContract`) and any caller-provided override that\n // ALSO carries `runtimeContract`. App-developer authoring of\n // `providerConfigurations.<providerRef>.<protocolKind>` does\n // not include `runtimeContract` (the backend module owns\n // that), so today the guard primarily defends against future\n // refactors of the merge call site rather than user-authored\n // input.\n const defaultKind = defaultConfig.runtimeContract?.kind;\n const customKind = customConfig.runtimeContract?.kind;\n if (defaultKind && customKind && defaultKind !== customKind) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message: `[external-providers-registry] mergeProviderConfiguration received contracts with mismatched kind`,\n defaultKind,\n customKind,\n },\n },\n );\n }\n\n const mergedRuntimeContract = this.deepMergeRecord(\n defaultConfig.runtimeContract as Record<string, unknown> \| undefined,\n customConfig.runtimeContract as Record<string, unknown> \| undefined,\n );\n\n return {\n ...defaultConfig,\n ...customConfig,\n // `executionProfiles` is a MAP OF NAMED PROFILES, so the top-level\n // spread above would drop every profile the provider synthesized\n // (including `default`, which existing consumers still resolve) as\n // soon as an application authors one profile of its own. Merge by\n // ref instead — and replace a same-named profile WHOLE rather than\n // deep-merging it: a deep merge would let an override inherit\n // `secretRef`/`secretEnvVarName` from the synthesized default and\n // silently turn a host-managed profile into a secret-injecting one.\n ...(defaultConfig.executionProfiles \|\| customConfig.executionProfiles\n ? {\n executionProfiles: {\n ...(defaultConfig.executionProfiles ?? {}),\n ...(customConfig.executionProfiles ?? {}),\n },\n }\n : {}),\n authConfig: this.deepMergeRecord(\n defaultConfig.authConfig,\n customConfig.authConfig,\n ) as ResolvedProviderConfiguration['authConfig'],\n // The deep-merge result is loosely typed (`Record<string, unknown> \| undefined`).\n // Cast back through `ProviderProtocolRuntimeContract`: the cross-`kind` guard\n // above ensures both inputs share the same `kind`, so the merged result is a\n // valid discriminated-union member.\n runtimeContract: mergedRuntimeContract as ProviderProtocolRuntimeContract \| undefined,\n };\n }\n\n private deepMergeRecord(\n defaultValue: unknown,\n customValue: unknown\n ): Record<string, unknown> \| undefined {\n if (!defaultValue && !customValue) return undefined;\n if (!defaultValue \|\| typeof defaultValue !== 'object' \|\| Array.isArray(defaultValue)) {\n return customValue as Record<string, unknown> \| undefined;\n }\n if (!customValue \|\| typeof customValue !== 'object' \|\| Array.isArray(customValue)) {\n return defaultValue as Record<string, unknown>;\n }\n\n const merged: Record<string, unknown> = {\n ...(defaultValue as Record<string, unknown>),\n };\n for (const [key, value] of Object.entries(customValue as Record<string, unknown>)) {\n const previous = merged[key];\n if (Array.isArray(previous) && Array.isArray(value)) {\n merged[key] = [...new Set([...previous, ...value])];\n continue;\n }\n merged[key] = previous\n && typeof previous === 'object'\n && !Array.isArray(previous)\n && value\n && typeof value === 'object'\n && !Array.isArray(value)\n ? this.deepMergeRecord(previous, value)\n : value;\n }\n return merged;\n }\n\n\n /\n WHAT a declared secret identifies — the integration, or an account.\n \n DECLARED wins; otherwise DERIVED, and the derivation is deliberately narrow. A ref the REST\n * runtime contract names as the OAuth2 client id or client secret is a REGISTRATION. Everything\n * else answers CREDENTIAL.\n \n The fallback exists because the field arrived after 689 provider packages had been emitted,\n * from catalogues that live outside this repository — a mark that only worked once every package\n * had been re-emitted would enforce nothing until then, which for a guard is the same as not\n * existing.\n \n It is a FLOOR, not a complete answer, and the direction of its error matters. Deriving\n * CREDENTIAL for a registration secret the contract does not name in those two slots is the\n * permissive mistake: such a secret would still be storable as a tenant's own. That is exactly\n * the case a provider must declare explicitly, and it is why `scope` is authorable at all rather\n * than purely computed.\n /\n /\n A provider's declared secret slots, each classified and each answered as configured or not.\n \n The contract already says everything a screen needs — the slug, the environment variable, the\n * operator-facing description, whether it is required — and nothing was reading it. So a person\n * connecting an account typed a `secretSlug` into a free-text field, and an operator learned that\n * `ASANA_CLIENT_ID` was missing only when somebody pressed Connect and got a 502.\n \n NEVER the value, only whether one is present. The whole point is to make a missing secret\n * REPORTABLE on a screen, and a report that carried the secret would be the one thing that must\n * not leave the backend.\n \n Scope comes from {@link getProviderSecretScope}, so this and the connect leg's refusal cannot\n * disagree about which slot is a registration and which is an account.\n /\n public getProviderSecretSlots(providerRef: string): readonly ProviderSecretSlot[] {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract;\n if (contract === undefined) return [];\n return Object.entries(contract).map(([slug, entry]) => ({\n slug,\n envVarName: entry.envVarName,\n required: entry.required,\n description: entry.description,\n scope: this.getProviderSecretScope(providerRef, slug),\n ...(entry.holdsDeploymentHost === true ? { holdsDeploymentHost: true as const } : {}),\n ...(entry.holdsBrowserPublicValue === true ? { holdsBrowserPublicValue: true as const } : {}),\n configured: Boolean(\n this.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, entry.envVarName)\n ?? this.getProviderSecret(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, slug),\n ),\n }));\n }\n\n public getProviderSecretScope(\n providerRef: string,\n secretRef: string,\n ): ExternalProvider_SecretScope {\n const entry = this.findSecretsContractEntry(providerRef, secretRef);\n if (entry?.scope !== undefined) {\n return entry.scope;\n }\n\n // Compare on the ENV-VAR NAME, not on the ref as supplied. A ref may arrive as either the\n // authoring slug (`accessToken`) or the env-var name (`SLACK_API_KEY`), while a runtime\n // contract only ever references the latter — so deriving from the raw ref answered CREDENTIAL\n // for `clientSecret` and REGISTRATION for `SLACK_CLIENT_SECRET`, two names for one secret.\n const comparableRef = entry?.envVarName ?? secretRef;\n const contract = this.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n const oauth2 = contract?.kind === ProviderProtocolRuntimeKind.REST ? contract.oauth2 : undefined;\n const namesRegistration = oauth2 !== undefined\n && (oauth2.clientIdSecretRef === comparableRef \|\| oauth2.clientSecretSecretRef === comparableRef);\n\n return namesRegistration\n ? ExternalProvider_SecretScope.REGISTRATION\n : ExternalProvider_SecretScope.CREDENTIAL;\n }\n\n /\n The contract entry for a ref, found by ENV-VAR NAME or by SLUG.\n \n Both are real addresses for the same thing and callers use both: the map key is the authoring\n * slug (`accessToken`), while runtime contracts reference the env-var name (`SLACK_API_KEY`).\n * Matching only one would leave half the callers unable to find an entry that is plainly there.\n /\n private findSecretsContractEntry(providerRef: string, secretRef: string): SecretsContractEntry \| undefined {\n const contract = this.backendProviderRegistry.getProvider(providerRef)?.secretsContract;\n if (contract === undefined) {\n return undefined;\n }\n const slug = this.findSecretsContractSlug(providerRef, secretRef);\n return slug === undefined ? undefined : contract[slug];\n }\n\n /\n The secrets-contract KEY for either of a slot's two names, or `undefined` when the provider\n * declares no such slot.\n \n Kept as the ONE lookup rule: {@link findSecretsContractEntry} and\n * {@link canonicalCredentialSlug} both go through it, so \"which slot did the caller mean\" cannot\n * be answered two ways. Before this, the entry lookup and the connect leg's canonicalisation each\n * re-derived it, which is how they came to disagree about which of the two names to keep.\n /\n private findSecretsContractSlug(providerRef: string, secretRef: string): string \| undefined {\n // Tolerant of an unbound or partially-bound provider registry, because this is now reached\n // from the credential RESOLUTION path: a wiring gap there must degrade to \"I cannot map this\n // name\" and let the caller's own refusal speak, never turn a missing credential into a crash\n // whose message names neither the provider nor the owner.\n const contract = this.backendProviderRegistry?.getProvider?.(providerRef)?.secretsContract;\n if (contract === undefined) {\n return undefined;\n }\n // OWN keys only: `contract['constructor']` is a function inherited from `Object.prototype`, and a\n // bare `!== undefined` read it as a declared slot — so a stored slug named `constructor` would\n // have classified as CURRENT and a lookup would have \"canonicalised\" to a slot that does not exist.\n if (Object.prototype.hasOwnProperty.call(contract, secretRef)) {\n return secretRef;\n }\n return Object.entries(contract).find(([, entry]) => entry.envVarName === secretRef)?.[0];\n }\n\n /\n The name a STORED credential is keyed on: the provider's secrets-contract KEY, never its\n * environment-variable spelling.\n \n ## Why the contract key and not the env-var name (#624)\n \n A slot has two names and they have different LIFETIMES:\n \n \| \| example \| may it change? \|\n * \|---\|---\|---\|\n * \| the contract KEY \| `accessToken` \| no — it is the slot's identity, and there are five across all providers \|\n * \| `envVarName` \| `ASANA_ACCESS_TOKEN` \| yes — it is a deployment-configuration spelling \|\n \n A durable credential row must be keyed on the stable one. It was keyed on the other, and on\n * 2026-09-10 commit `2e8f7488` renamed the env-var spelling for 130 OAuth2 vendors — a\n * correct rename, `ASANA_API_KEY` was the wrong name for an OAuth2 account slot — thirty-one\n * minutes after two real grants were minted. Every stored credential on the machine (7 of 7,\n * across asana and slack) became a row whose provider no longer declares its key, and the\n * refusal an operator read was \"no credential for 'ASANA_ACCESS_TOKEN'\": indistinguishable from\n * never having connected.\n \n There is no silent substitution — the ORGANIZATION and USER branches of\n * {@link resolveProviderSecretForTarget} refuse rather than fall through to the deployment's own\n * credential — so this was never a wrong-account defect. It was a live secret reported as absent.\n \n Those rows are NOT migrated and never will be: the seal binds the slot name, so they cannot be\n * renamed, and re-sealing them was decided against (2026-09-12). Instead a refusal that misses now\n * names the retired slot and says to reconnect, and the boot report counts every such row — see\n * {@link classifyStoredCredentialSlot} and `retired-credential-slot.backend.utils.ts`.\n \n ## Accepting both names is deliberate, and permanent\n \n A caller may still NAME either one — the runtime contract's `apiKey.secretRef` carries the\n * env-var spelling, and every generated provider emits it that way — so this maps rather than\n * refuses. What it guarantees is that whatever a caller names, the value that reaches a store is\n * the one a rename cannot move.\n \n ## The environment lookup does NOT use this\n \n {@link getProviderSecret} resolves `process.env[envVarName]`, and must keep doing so: there the\n * spelling IS the identity, because it is what an operator writes in a deployment environment.\n * The two names exist for two jobs, and this method is the boundary between them.\n /\n public canonicalCredentialSlug(providerRef: string, secretRef: string): string {\n return this.findSecretsContractSlug(providerRef, secretRef) ?? secretRef;\n }\n\n /\n The CONNECTION a credential spent or written through `providerRef` belongs to (#1670).\n \n ## Why a connection and not the ref\n \n A stored credential is keyed and sealed on `(owner, connectionRef, secretSlug)`. A connection is the\n * unit a vendor grant belongs to, and a vendor may be served by several refs — an engine part and the\n * add-on packages beside it — that must spend ONE grant rather than ask the person to authorize once\n * per ref (#1669).\n \n ## A declared member maps to its BASE; everything else is its own connection\n \n `providers.sharedConnections` (#1725) names a base ref and the members that spend its grant, and this\n * answers the base for every one of them. An undeclared ref is its own connection — which is also why every\n * row stored before the key moved was backfilled to `connectionRef = providerRef` and still opens under the\n * same seal. The membership rule itself is `resolveProviderConnectionRef` in `@wildo-ai/saas-models`, the one\n * function `wildo config sync` records the lock entry with, so config and runtime cannot disagree.\n \n A row a member stored under its OWN ref before it joined a connection is keyed on that ref, not the base,\n * and is never read through the connection: it was sealed to the other identity, and there is deliberately no\n * re-seal door (2026-09-12). The miss names it instead — see {@link resolveProviderSecretForTarget}.\n \n ONE function, deliberately: every write door derives the row's `connectionRef` through it and every\n * read path addresses the store through {@link resolveCredentialAddress}, which calls it — so when the\n * mapping stops being the identity, reading and writing change together rather than one of them\n * keeping the ref (the invariant-applied-at-one-site shape this subsystem has met before).\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — which delegated grant a call through a ref\n * may spend is decided here, in one place, never by the caller.\n /\n public resolveCredentialConnectionRef(providerRef: string): string {\n return resolveProviderConnectionRef(this.declaredSharedConnections(), providerRef);\n }\n\n /\n The npm package that owns `providerRef` — its module's `metadata.packageName` — or `undefined` when no module\n * of that ref is loaded here. Named on the audit rows of a shared connection (#1725), where the connection alone\n * no longer says whose code spent the grant.\n /\n public getProviderPackageName(providerRef: string): string \| undefined {\n return this.backendProviderRegistry?.getProvider?.(providerRef)?.metadata?.packageName;\n }\n\n /\n The declared shared connection `providerRef` belongs to (as base or member), or `undefined` when it is its\n * own connection (#1725). What the connect, refresh and revoke paths ask before choosing whose OAuth client\n * to use.\n /\n public getProviderSharedConnection(providerRef: string): ResolvedProviderSharedConnection \| undefined {\n return resolveDeclaredSharedConnection(this.declaredSharedConnections(), providerRef);\n }\n\n /\n The application's `providers.sharedConnections`, or `undefined` on a host whose configuration carries none\n * — a platform service, a harness with no configuration. Read on every call, never cached, so the answer is\n * always the configuration the host is running.\n /\n private declaredSharedConnections(): ProviderSharedConnections \| undefined {\n try {\n return this.configService.isInitialized() ? this.configService.config.providers?.sharedConnections : undefined;\n } catch {\n return undefined;\n }\n }\n\n /\n The OAuth client a connect, refresh or revocation through `providerRef` must use (#1725): the BASE ref's\n * REST OAuth2 block and client slots for a declared connection — a member's own block is inert — and the\n * ref's own for an undeclared one. `undefined` when the owner declares no REST OAuth2 block.\n \n With `sharedWithSignIn`, the endpoints, scopes and audiences stay the base's connected-account block, and\n * only the CLIENT changes to the base's sign-in registration: that is the one thing the option decides.\n \n assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — one connection has exactly one OAuth client,\n * the declared base's, whichever ref the person connects through.\n /\n public getConnectionOAuth2Client(providerRef: string): ProviderConnectionOAuth2Client \| undefined {\n const declared = this.getProviderSharedConnection(providerRef);\n const connectionRef = declared?.connectionRef ?? providerRef;\n const contract = this.getProviderRuntimeContract(connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n if (contract?.kind !== ProviderProtocolRuntimeKind.REST \|\| contract.oauth2 === undefined) return undefined;\n return {\n connectionRef,\n providerRef,\n oauth2: contract.oauth2,\n restContract: contract,\n sharedWithSignIn: declared?.sharedWithSignIn === true,\n };\n }\n\n /\n The scopes the connection `providerRef` spends may ask a person to consent to (#1671) — see\n * `computeProviderConnectionScopeCeiling`. `undefined` when the connection's owner declares no REST OAuth2 block,\n * which means there is no consent flow to grow.\n /\n public getConnectionScopeCeiling(providerRef: string): ProviderConnectionScopeCeiling \| undefined {\n const client = this.getConnectionOAuth2Client(providerRef);\n if (client === undefined) return undefined;\n const memberRefs = this.getProviderSharedConnection(providerRef)?.memberRefs ?? [];\n const sources: ProviderConnectionScopeSource[] = [];\n for (const memberRef of memberRefs) {\n const contract = this.getProviderRuntimeContract(memberRef, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n const scopes = contract?.kind === ProviderProtocolRuntimeKind.REST ? contract.oauth2?.scopes ?? [] : [];\n if (scopes.length > 0) sources.push({ providerRef: memberRef, scopes: scopes.flatMap((scope) => scope.split(/\\s+/)).filter((scope) => scope.length > 0) });\n }\n for (const ref of [client.connectionRef, ...memberRefs]) {\n for (const applied of this.backendProviderRegistry?.getProvider?.(ref)?.appliedAugmentations ?? []) {\n if (applied.requiredScopes.length > 0) sources.push({ providerRef: ref, augmentationPackageName: applied.packageName, scopes: applied.requiredScopes });\n }\n }\n return computeProviderConnectionScopeCeiling({ connectionRef: client.connectionRef, ownerOAuth2: client.oauth2, sources });\n }\n\n /\n The npm package whose code an operation of `providerRef` is — the opted-in augmentation that declares\n * `operationId`, else the ref's own package (#1671). Read from static declarations, so it loads no catalogue; named\n * on the grant row of a re-authorization so the trail says whose operation widened the consent.\n /\n public describeOperationContributorPackage(providerRef: string, operationId: string): string \| undefined {\n const applied = this.backendProviderRegistry?.getProvider?.(providerRef)?.appliedAugmentations ?? [];\n return applied.find((augmentation) => augmentation.operationIds.includes(operationId))?.packageName\n ?? this.getProviderPackageName(providerRef);\n }\n\n /\n The offer a call refused for `missingScopes` carries (#1671): which of them a person may grant by re-authorizing\n * the connection, which need an administrator, and which nobody can ask for on this connection. `undefined` when the\n * connection has no consent flow at all (a pasted credential, the deployment's own) — then only an operator can act.\n /\n public planProviderScopeReauthorization(providerRef: string, operationId: string, missingScopes: readonly string[]): ProviderScopeReauthorizationOffer \| undefined {\n const ceiling = this.getConnectionScopeCeiling(providerRef);\n if (ceiling === undefined) return undefined;\n const classified = classifyProviderConnectionScopes(ceiling, missingScopes);\n return {\n connectionRef: ceiling.connectionRef,\n providerRef,\n operationId,\n requestableScopes: classified.requestable,\n administratorConsentScopes: classified.administratorConsent,\n unrequestableScopes: classified.unrequestable,\n };\n }\n\n /\n The application's registration with the vendor for a connection — the two values an operator pastes —\n * resolved from the deployment for the connection's OWNER, never per connection and never from a row.\n \n Default: the base's connected-account slots (`oauth2.clientIdSecretRef` / `clientSecretSecretRef`). With\n * `sharedWithSignIn`: the base's sign-in registration, read exactly as the sign-in lane reads it — the client\n * id from `providerConfigurations.<base>.sso_oauth2`, the secret from the sign-in contract's secret ref — so\n * the two lanes cannot come to use two different registrations while both claim to share one.\n \n The REFS are returned beside the values so a refusal can name what to configure.\n /\n public resolveConnectionOAuth2ClientCredentials(client: ProviderConnectionOAuth2Client): {\n clientId?: string;\n clientSecret?: string;\n clientIdRef?: string;\n clientSecretRef?: string;\n } {\n if (!client.sharedWithSignIn) {\n const { clientIdSecretRef, clientSecretSecretRef } = client.oauth2;\n return {\n clientIdRef: clientIdSecretRef,\n clientSecretRef: clientSecretSecretRef,\n clientId: clientIdSecretRef === undefined ? undefined\n : this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, clientIdSecretRef),\n clientSecret: clientSecretSecretRef === undefined ? undefined\n : this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.REST_API, clientSecretSecretRef),\n };\n }\n const signIn = this.getProviderRuntimeContract(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2);\n if (signIn?.kind !== ProviderProtocolRuntimeKind.OAUTH2_SSO) return {};\n const protocolConfiguration = (this.configService.config.providerConfigurations?.[client.connectionRef] as Record<string, unknown> \| undefined)\n ?.[ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2] as { clientId?: string; authConfig?: { clientId?: string; secretRef?: string } } & Record<string, unknown> \| undefined;\n const clientId = protocolConfiguration?.authConfig?.clientId\n ?? protocolConfiguration?.clientId\n ?? (signIn.clientIdPublicConfigKey === undefined ? undefined : protocolConfiguration?.[signIn.clientIdPublicConfigKey] as string \| undefined);\n const clientSecretRef = protocolConfiguration?.authConfig?.secretRef ?? signIn.clientSecretRef;\n return {\n clientIdRef: `providerConfigurations.${client.connectionRef}.${ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2}.clientId`,\n clientSecretRef,\n ...(typeof clientId === 'string' && clientId.length > 0 ? { clientId } : {}),\n clientSecret: this.getProviderSecret(client.connectionRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2, clientSecretRef),\n };\n }\n\n /\n Refuse, at boot, a loaded provider whose OAuth2 block declares resource AUDIENCES it cannot honour (#1725) — or an\n * incremental-consent declaration restating a scope it does not declare (#1671) —\n * `describeProviderOAuth2AudienceDefects`: no primary, a primary the authorization is not for, two audiences\n * admitting one host. The token-host binding selects a token by host, so an ambiguous declaration would let the\n * order of a record decide which token a request carries.\n /\n private assertDeclaredAudiencesCoherent(): void {\n const defects: string[] = [];\n for (const module of this.backendProviderRegistry.getRegistry?.()?.modules?.values() ?? []) {\n const contract = this.getProviderRuntimeContract(module.metadata.ref, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n if (contract?.kind !== ProviderProtocolRuntimeKind.REST) continue;\n // The vendor's rate limits (#1729): a number no window can hold, or a contract-level list beside audiences\n // that would apply to no call, is refused here rather than silently counting nothing.\n defects.push(...describeProviderRateBudgetDefects({ contractRateBudgets: contract.rateBudgets, audiences: contract.oauth2?.audiences })\n .map((defect) => `\"${module.metadata.ref}\": ${defect}`));\n if (contract.oauth2 === undefined) continue;\n defects.push(...describeProviderOAuth2AudienceDefects(contract.oauth2).map((defect) => `\"${module.metadata.ref}\": ${defect}`));\n // A scope every re-authorization repeats (#1671) must be one the provider declares: the connect leg admits\n // only declared scopes, so an undeclared one would refuse every incremental request of this provider.\n const declared = new Set((contract.oauth2.scopes ?? []).flatMap((scope) => scope.split(/\\s+/)));\n for (const restated of contract.oauth2.incrementalConsent?.restatedScopes ?? []) {\n if (!declared.has(restated)) defects.push(`\"${module.metadata.ref}\": incrementalConsent restates the scope '${restated}', which its oauth2.scopes do not declare`);\n // Restated scopes go into every request a PERSON is sent to; an administrator-only one would make every\n // re-authorization of this provider unanswerable by the person it is for.\n if ((contract.oauth2.administratorConsentScopes ?? []).includes(restated)) {\n defects.push(`\"${module.metadata.ref}\": incrementalConsent restates the administrator-only scope '${restated}'`);\n }\n }\n }\n if (defects.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: { message: `A provider declares OAuth2 audiences that cannot be honoured:\\n- ${defects.join('\\n- ')}`, defects },\n });\n }\n\n /\n Refuse, at boot, declared shared connections this host's loaded modules cannot honour (#1725) — see\n * `findSharedConnectionBootDefects`. A CONFIGURATION refusal, because the remedy is editing the SaaS config\n * and needs nothing running.\n /\n private assertSharedConnectionsCoherent(): void {\n const connections = this.declaredSharedConnections();\n if (connections === undefined \|\| Object.keys(connections).length === 0) return;\n const restOAuth2Of = (ref: string) => {\n const contract = this.getProviderRuntimeContract(ref, ExternalProvider_ExchangeProtocol_Kind.REST_API);\n return contract?.kind === ProviderProtocolRuntimeKind.REST ? contract : undefined;\n };\n const defects = findSharedConnectionBootDefects({\n connections,\n systemOfRecordInstanceNames: Object.keys(this.configService.config.systemsOfRecord ?? {}),\n isLoaded: (ref) => this.backendProviderRegistry.getProvider(ref) !== undefined,\n viewOf: (ref) => {\n const contract = restOAuth2Of(ref);\n return {\n ...(contract?.oauth2 === undefined ? {} : { oauth2: contract.oauth2 }),\n ...(contract?.apiKey?.secretRef === undefined ? {} : { spentCredentialSlotKey: this.canonicalCredentialSlug(ref, contract.apiKey.secretRef) }),\n };\n },\n baseAdmitsCredentialSlot: (baseRef, slotKey) => this.resolveStorableCredentialSlot(baseRef, slotKey).admitted,\n baseHasSignInClient: (baseRef) =>\n this.getProviderRuntimeContract(baseRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2)?.kind === ProviderProtocolRuntimeKind.OAUTH2_SSO,\n });\n if (defects.length === 0) return;\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: `providers.sharedConnections cannot run on this host:\\n- ${defects.join('\\n- ')}`,\n defects,\n },\n });\n }\n\n /\n Where a READ through `providerRef` finds its stored credential: the connection and the contract KEY\n * of the slot the caller named by either of its two names (#1670, #624).\n \n The read-side counterpart of the write doors' derivation — see {@link resolveCredentialConnectionRef}\n * for the connection and {@link canonicalCredentialSlug} for the slot. Every caller that addresses a\n * credential store asks this, never assembles the address itself.\n /\n public resolveCredentialAddress(providerRef: string, secretRef: string): ProviderCredentialAddress {\n return {\n connectionRef: this.resolveCredentialConnectionRef(providerRef),\n secretSlug: this.canonicalCredentialSlug(providerRef, secretRef),\n };\n }\n\n /\n Where a slug a credential row was STORED under stands against the provider's CURRENT contract.\n \n ## The definition, and why it is this one\n \n A stored slug is {@link StoredCredentialSlotStanding.CURRENT} exactly when canonicalising it is a\n * FIXED POINT — when {@link canonicalCredentialSlug}'s own rule answers the slug back unchanged.\n * Defined through {@link findSecretsContractSlug} rather than by re-reading the contract, so \"which\n * slot is current\" and \"which name a lookup asks for\" are one rule and cannot disagree.\n \n That makes an env-var SPELLING that the provider still declares RETIRED as a stored key, which\n * is correct rather than harsh: every lookup now asks for the contract key, so a row keyed on\n * `ASANA_ACCESS_TOKEN` is as unreachable as one keyed on the renamed `ASANA_API_KEY` (#624).\n \n Tolerant of an unbound provider registry for the reason {@link findSecretsContractSlug} states;\n * an absent provider is reported as such, never as a retired slot, because its remedy differs.\n /\n public classifyStoredCredentialSlot(providerRef: string, storedSecretSlug: string): StoredCredentialSlotStanding {\n if (this.backendProviderRegistry?.getProvider?.(providerRef) === undefined) {\n return StoredCredentialSlotStanding.PROVIDER_UNREGISTERED;\n }\n return this.findSecretsContractSlug(providerRef, storedSecretSlug) === storedSecretSlug\n ? StoredCredentialSlotStanding.CURRENT\n : StoredCredentialSlotStanding.RETIRED;\n }\n\n /\n The slot a credential VALUE may be written under, or why it may not (#624).\n \n The write-side twin of {@link canonicalCredentialSlug}, and the one rule every write door asks\n * — the connect leg, and the resource's own CREATE and UPDATE hooks — so \"may a value be stored\n * here\" cannot be answered differently by different doors.\n \n ## Admitted only for a DECLARED CREDENTIAL slot, and always as its KEY\n \n - A name that maps to no slot of the provider's current contract (under either of a slot's two\n * names) is refused {@link ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_DECLARED}. The\n * read-side canonicaliser passes such a name through, which is right for a READ — the caller's\n * own refusal speaks — and wrong for a WRITE: stored under a name nobody asks for, the value\n * reports success and resolves as absent forever. That is how a retired slot keeps producing\n * orphans after the keying was fixed forward.\n * - A slot holding the application's own OAuth2 registration is refused\n * {@link ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_A_CREDENTIAL}, as the connect leg\n * always did: the exchange reads that from the deployment environment, never from a row.\n * - An admitted name comes back as the contract KEY whichever name the caller used.\n \n Every generated provider's default slot passes: measured 2026-09-12 over 695 provider modules\n * with a literal `apiKey.secretRef`, all 695 name a declared slot.\n /\n public resolveStorableCredentialSlot(providerRef: string, secretName: string): StorableCredentialSlot {\n const secretSlug = this.findSecretsContractSlug(providerRef, secretName);\n if (secretSlug === undefined) {\n return { admitted: false, refusal: ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_DECLARED };\n }\n if (this.getProviderSecretScope(providerRef, secretSlug) !== ExternalProvider_SecretScope.CREDENTIAL) {\n return { admitted: false, refusal: ProviderCredentialSlotWriteRefusal.SECRET_SLUG_NOT_A_CREDENTIAL };\n }\n return { admitted: true, secretSlug };\n }\n\n public getProviderRuntimeContract(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): ProviderProtocolRuntimeContract \| undefined {\n return this.getProviderConfiguration(providerRef, protocolKind)?.runtimeContract;\n }\n\n public getLLMSemanticOperationKeys(providerRef: string): LLMProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.LLM_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.LLM) {\n return [];\n }\n\n return this.toSemanticOperationKeys(runtimeContract.operations);\n }\n\n /\n The semantic embeddings operations a provider's `EMBEDDINGS_PROVIDER` contract declares.\n * Consumer: `EmbeddingsBackendService`, which refuses to invoke a provider whose contract\n * does not declare {@link EmbeddingsProvider_OperationKey.EMBED_TEXTS} (fail-closed, named —\n * never an undefined-method throw inside an SDK call).\n /\n public getEmbeddingsSemanticOperationKeys(providerRef: string): EmbeddingsProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.EMBEDDINGS_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.EMBEDDINGS) {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_EMBEDDINGS_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is EmbeddingsProvider_OperationKey => operation !== undefined);\n }\n\n\n /\n The semantic extraction operations a provider's `DOCUMENT_EXTRACTION_PROVIDER` contract\n * declares. Consumer: `DocumentExtractionBackendService`, which refuses to invoke a provider\n * whose contract does not declare\n * {@link DocumentExtractionProvider_OperationKey.EXTRACT_DOCUMENT_TEXT} — fail-closed and\n * named, rather than a 404 from a route the provider never claimed to serve.\n /\n public getDocumentExtractionSemanticOperationKeys(providerRef: string): DocumentExtractionProvider_OperationKey[] {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.DOCUMENT_EXTRACTION_PROVIDER,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION) {\n return [];\n }\n\n return runtimeContract.operations\n .map((operation) => RUNTIME_DOCUMENT_EXTRACTION_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is DocumentExtractionProvider_OperationKey => operation !== undefined);\n }\n\n\n public getAgentClientProtocolConfiguration(providerRef: string): AgentClientProtocol_Configuration \| undefined {\n const config = this.getProviderConfiguration(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n return config as AgentClientProtocol_Configuration \| undefined;\n }\n\n public getAgentClientProtocolProfile(providerRef: string): RuntimeAgentClientProtocolProfile \| undefined {\n const runtimeContract = this.getProviderRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL,\n );\n\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL) {\n return undefined;\n }\n\n const supportedModels = [\n ...(runtimeContract.models ?? []),\n ...(runtimeContract.defaultModel ? [runtimeContract.defaultModel] : []),\n ];\n return {\n agentCommand: runtimeContract.agentCommand,\n agentArgs: [...(runtimeContract.agentArgs ?? [])],\n supportedOperationKeys: runtimeContract.operations\n .map((operation) => RUNTIME_CODING_OPERATION_TO_SEMANTIC_OPERATION[operation])\n .filter((operation): operation is CodingAgent_OperationKey => operation !== undefined),\n supportedModels: [...new Set(supportedModels)],\n supportedProtocolVersions: [...(runtimeContract.supportedProtocolVersions ?? [1])],\n ...(runtimeContract.sessionMetaExtensions ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions } : {}),\n ...(runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance\n ? { sessionMetaExtensionsByHostConfigurationInheritance: runtimeContract.sessionMetaExtensionsByHostConfigurationInheritance }\n : {}),\n ...(runtimeContract.modelDelivery ? { modelDelivery: runtimeContract.modelDelivery } : {}),\n ...(runtimeContract.modelTransportIds\n ? { modelTransportIds: { ...runtimeContract.modelTransportIds } }\n : {}),\n ...(runtimeContract.inheritedEnvironmentVariables\n ? { inheritedEnvironmentVariables: [...runtimeContract.inheritedEnvironmentVariables] }\n : {}),\n ...(runtimeContract.hostLogin ? { hostLogin: runtimeContract.hostLogin } : {}),\n // Normalised to the AUTHORED vocabulary: the contract spells these\n // with hyphens and the profile enum with underscores, and comparing\n // the two spellings directly is a guard that never fires.\n supportedAuthModes: runtimeContract.authModes.map((mode) => mode.replace(/-/g, '_')),\n ...(runtimeContract.sessionModeIdsByPermissionCeiling\n ? {\n sessionModeIdsByPermissionCeiling: Object.fromEntries(\n Object.entries(runtimeContract.sessionModeIdsByPermissionCeiling).map(\n ([ceiling, modeIds]) => [ceiling, [...(modeIds ?? [])]],\n ),\n ),\n }\n : {}),\n };\n }\n\n /\n Resolve one named ACP execution profile, PARSED rather than trusted.\n \n Application-authored `providerConfigurations` are typed `unknown` all the\n * way to here, so an authored profile would otherwise reach the runner\n * unvalidated — and for this transport the unvalidated fields include the\n * environment gate and the permission ceiling. Parsing here makes the\n * profile fail closed BEFORE any agent is spawned, and applies the schema\n * defaults the authoring contract promises.\n /\n public getAgentClientProtocolExecutionProfile(\n providerRef: string,\n executionProfileRef: string,\n ): AgentClientProtocol_ExecutionProfile \| undefined {\n this.ensureInitialized();\n\n const configuration = this.getAgentClientProtocolConfiguration(providerRef);\n const executionProfile = configuration?.executionProfiles?.[executionProfileRef];\n\n if (!executionProfile) {\n this.logDebug(`ACP execution profile ${executionProfileRef} not found for ${providerRef}`);\n return undefined;\n }\n\n try {\n return AgentClientProtocol_ExecutionProfileSchema.parse(executionProfile);\n } catch (error) {\n throw this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n providerRef,\n executionProfileRef,\n message: '[external-providers-registry] ACP execution profile is not a valid authored profile',\n validationError: describeCaughtError(error),\n },\n },\n );\n }\n }\n\n public getAgentClientProtocolExecutionProfileSecret(\n providerRef: string,\n executionProfileRef: string,\n ): string \| undefined {\n this.ensureInitialized();\n\n const executionProfile = this.getAgentClientProtocolExecutionProfile(providerRef, executionProfileRef);\n if (\n !executionProfile\n \|\| executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n return undefined;\n }\n\n const runtimeSecret = executionProfile.secretEnvVarName\n ? process.env[executionProfile.secretEnvVarName]\n : undefined;\n if (runtimeSecret && runtimeSecret.length > 0) {\n this.logDebug('Resolved ACP secret from process env', { providerRef, executionProfileRef });\n return runtimeSecret;\n }\n\n return undefined;\n }\n\n private toSemanticOperationKeys(operations: readonly string[]): LLMProvider_OperationKey[] {\n return operations\n .map((operation) => RUNTIME_LLM_OPERATION_TO_SEMANTIC_OPERATION[operation] ?? operation)\n .filter((operation): operation is LLMProvider_OperationKey => (\n Object.values(LLMProvider_OperationKey).includes(operation as LLMProvider_OperationKey)\n ));\n }\n\n private getDefaultProviderConfiguration(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): ResolvedProviderConfiguration \| undefined {\n try {\n const runtimeContract = this.backendProviderRegistry.getRuntimeContract(providerRef, protocolKind);\n\n if (!runtimeContract) {\n this.logDebug(`Runtime contract not found: ${providerRef}:${protocolKind}`);\n return undefined;\n }\n\n\n if (runtimeContract.kind === ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL) {\n const defaultExecutionProfileRef = 'default';\n const hasExplicitSecretBinding = Boolean(\n runtimeContract.secretRef\n && runtimeContract.secretEnvVarName\n && runtimeContract.authModes.includes('secret-ref-env-injection'),\n );\n return {\n enabled: true,\n defaultExecutionProfileRef,\n executionProfiles: {\n [defaultExecutionProfileRef]: {\n runnerHost: AgentClientProtocol_RunnerHost.BACKEND_SUBPROCESS,\n command: runtimeContract.agentCommand,\n args: [...(runtimeContract.agentArgs ?? [])],\n inheritedEnvironmentVariables: [...(runtimeContract.inheritedEnvironmentVariables ?? [])],\n authMode: hasExplicitSecretBinding\n ? AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n : runtimeContract.authModes.includes('host-managed')\n ? AgentClientProtocol_AuthMode.HOST_MANAGED\n : AgentClientProtocol_AuthMode.NONE,\n ...(hasExplicitSecretBinding\n ? { secretRef: runtimeContract.secretRef, secretEnvVarName: runtimeContract.secretEnvVarName }\n : {}),\n // DEVELOPMENT only, and deliberately NARROWER than any other\n // synthesized default. Nobody authored this profile and\n // nobody reviewed it, and what it authorises is an agent\n // that edits a workspace. An application that wants a coding\n // agent anywhere else must say so in its own profile, where\n // the decision is visible.\n allowedApplicationEnvironments: [APPLICATION_ENVIRONMENT.DEVELOPMENT],\n workingDirectoryPolicy: AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_ROOT,\n // Both safety postures stated rather than left to a schema\n // default, so reading this profile tells you what it permits\n // without resolving anything.\n permissionCeiling: AgentClientProtocol_PermissionCeiling.PROMPT_ALWAYS,\n hostConfigurationInheritance: AgentClientProtocol_HostConfigurationInheritance.APPLICATION_SCOPED,\n ...(runtimeContract.sessionMetaExtensions\n ? { sessionMetaExtensions: runtimeContract.sessionMetaExtensions }\n : {}),\n },\n },\n runtimeContract,\n };\n }\n\n // One derivation for this default and for the companion contribution's `protocolSecretRefs`, so the\n // key tooling predicts (#2229) is the key this refusal reads.\n const secretRef = describeProviderProtocolSecretRef(runtimeContract);\n return {\n enabled: true,\n ...(secretRef\n ? {\n authConfig: {\n authKind: this.authKindForRuntimeContract(runtimeContract),\n secretRef,\n },\n }\n : {}),\n ...(runtimeContract.kind === ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR\n ? { endpoints: this.buildWebhookEndpoints(runtimeContract) }\n : {}),\n runtimeContract,\n };\n } catch (error) {\n // Same pattern as `getProviderConfiguration` — contract\n // violations (`authKindForRuntimeContract` misuse) throw a\n // `WildoError_Backend` instance that MUST surface.\n if (isWildoBackendError(error)) {\n throw error;\n }\n this.logDebug('Error getting default provider configuration', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n /\n Map a runtime contract's `kind` to the canonical\n * `ExternalProvider_Auth_Kind` for the `authConfig` projection.\n * Used by `getDefaultProviderConfiguration` so the emitted\n * `authConfig: { authKind, secretRef }` satisfies the schema's\n * required-`authKind` invariant (was previously `{ secretRef }`\n * with no `authKind`, masked by `as unknown as` casts).\n \n Mapping rationale:\n \n - `llm` / `email` / `sms` / `billing` — providers authenticate\n * with an opaque API key supplied via env var.\n * - `webhook-originator` — provider signs payloads with HMAC; the\n * `secretRef` is the HMAC signing key.\n * - `oauth2-sso` — kind `OAUTH2`; the `secretRef` is the OAuth2\n * client secret.\n * - `agent-client-protocol` — auth is encoded on the executionProfile,\n * not `authConfig`; this method is not called for that kind\n * because that arm returns from the dedicated branch in\n * `getDefaultProviderConfiguration` BEFORE reaching this\n * mapping. A misuse throws via `errorBuilder` so the\n * `WildoError_Backend` instance bypasses the\n * `getProviderConfiguration` fallback catch.\n /\n private authKindForRuntimeContract(\n runtimeContract: ProviderProtocolRuntimeContract,\n ): ExternalProvider_Auth_Kind {\n switch (runtimeContract.kind) {\n case ProviderProtocolRuntimeKind.LLM:\n case ProviderProtocolRuntimeKind.IMAGE:\n case ProviderProtocolRuntimeKind.EMBEDDINGS:\n // Document extraction authenticates with an opaque API key in a request header, like\n // its siblings above; the header SHAPE (name/prefix) stays on the contract because\n // this family builds its own HTTPS request rather than handing a key to an SDK.\n case ProviderProtocolRuntimeKind.DOCUMENT_EXTRACTION:\n case ProviderProtocolRuntimeKind.EMAIL:\n case ProviderProtocolRuntimeKind.SMS:\n // A receiving provider authenticates the engine's fetches with an opaque API key in a header.\n case ProviderProtocolRuntimeKind.EMAIL_INBOUND:\n case ProviderProtocolRuntimeKind.BILLING:\n // `rest` authenticates with an opaque API key supplied via env var, like its siblings\n // above; the header SHAPE (name/prefix) stays on the contract for its consumer.\n case ProviderProtocolRuntimeKind.REST:\n return ExternalProvider_Auth_Kind.API_KEY;\n case ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR:\n return ExternalProvider_Auth_Kind.HMAC_SIGNATURE;\n case ProviderProtocolRuntimeKind.OAUTH2_SSO:\n return ExternalProvider_Auth_Kind.OAUTH2;\n case ProviderProtocolRuntimeKind.AGENT_CLIENT_PROTOCOL:\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n message: '[external-providers-registry] authKindForRuntimeContract called with kind=agent-client-protocol; '\n + 'ACP auth lives on executionProfiles[].authMode, not on authConfig.',\n },\n },\n );\n default: {\n const exhaustiveCheck: never = runtimeContract;\n return exhaustiveCheck;\n }\n }\n }\n\n /\n Project the provider-authored `runtimeContract.endpoints` into\n * the canonical `Hook_Endpoint` shape consumed by the framework\n * webhook controller. Provider-agnostic: each endpoint descriptor\n * is owned by the provider module (see Stripe's `endpoints` array\n * on `stripe.backend.module.ts`); the only field this projection\n * adds is `signatureConfig.headerName`, sourced from the contract's\n * top-level `signatureHeaderName` so providers don't repeat it on\n * every endpoint.\n \n Previously branched on a Stripe-only provider literal\n * with the entire endpoint shape (event types, polymorphic\n * variants, `lookupField`) hardcoded inside this consumer site —\n * the same anti-pattern Step 7 was supposed to eliminate. Moved\n * to the provider module 2026-05-06 to close the gap; the CI\n * guard regex (`no-provider-ref-branches.guard.test.ts`) now\n * also catches the `runtimeContract.provider` literal pattern.\n \n Per-endpoint secret overrides (if a future provider needs them)\n * still flow through `HookInitiatorProvider_Configuration.endpointSecrets`,\n * not through this projection.\n /\n private buildWebhookEndpoints(\n runtimeContract: Extract<ProviderProtocolRuntimeContract, { kind: typeof ProviderProtocolRuntimeKind.WEBHOOK_ORIGINATOR }>,\n ): ReadonlyArray<Hook_Endpoint> {\n return runtimeContract.endpoints.map((endpoint) => ({\n ...endpoint,\n signatureConfig: {\n ...endpoint.signatureConfig,\n headerName: runtimeContract.signatureHeaderName,\n },\n eventTypes: [...endpoint.eventTypes],\n }));\n }\n\n /\n Get provider secrets for a specific protocol and secret reference.\n * Provider secrets are runtime-delivered via env/K8s materialization.\n * The secret binding contract is still declared by the provider protocol\n * configuration, but the secret value source is `process.env`.\n \n The `envVarName ?? secretRef` fallback covers the case where the\n * resolver doesn't find an explicit env-var-name mapping for the\n * requested secretRef. Today every engine provider authors\n * `secretsContract.<slug>.envVarName === <secretRef value>` (verified\n * across 17 modules), so this fallback is exactly equivalent to a\n * direct `process.env[secretRef]` lookup. If a future provider's\n * `secretsContract.envVarName` diverges from its `secretRef`, the\n * load-bearing path becomes `protocolConfig.authConfig.secretRef`\n * (returned by `getProviderSecretEnvVarName`), and the fallback\n * stays a defensive last-chance match.\n /\n public getProviderSecret(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const envVarName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef);\n const resolvedEnvVarName = envVarName ?? secretRef;\n\n const secretValue = process.env[resolvedEnvVarName];\n return secretValue && secretValue.length > 0 ? secretValue : undefined;\n } catch {\n return undefined;\n }\n }\n\n private getProviderSecretEnvVarName(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n ): string \| undefined {\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n && executionProfile.secretRef === secretRef\n ) {\n return executionProfile.secretEnvVarName;\n }\n }\n }\n\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n if (protocolConfig?.authConfig?.secretRef === secretRef) {\n return protocolConfig.authConfig.secretRef;\n }\n\n return undefined;\n }\n\n /\n The sentence for a provider API key that has no value — naming the environment variable and how\n * to provide it (#1637). Secrets are asked when a feature needs one rather than all up front, so\n * this refusal IS the moment a person learns which key a feature waits on; a message that said\n * \"configure the provider secrets\" left them to find out which, and where.\n /\n public describeMissingProviderApiKey(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n ): string {\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n const envVarName = secretRef ? (this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef) : undefined;\n return envVarName\n ? `No value for ${envVarName} (${providerRef}, ${protocolKind}). ${describeProviderSecretRemedy(envVarName)}`\n : `${providerRef} declares no API key for ${protocolKind}, so this call cannot authenticate.`;\n }\n\n public getConfiguredProviderSecretRef(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n return config?.authConfig?.secretRef;\n }\n\n\n\n public getProviderApiKey(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): string \| undefined {\n this.ensureInitialized();\n try {\n const secretRef = this.getConfiguredProviderSecretRef(providerRef, protocolKind);\n if (!secretRef) {\n this.logDebug(`No authConfig.secretRef found for ${providerRef}.${protocolKind}`);\n return undefined;\n }\n\n const apiKey = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (!apiKey) {\n this.logDebug(`Secret ${secretRef} not found for ${providerRef}.${protocolKind}`);\n }\n return apiKey;\n } catch (error) {\n this.logDebug('Error getting provider API key', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return undefined;\n }\n }\n\n /\n WHICH connections this provider admits — the recorded decision, or the FLOOR.\n \n The floor is an APPLICATION-owned, undelegated connection and nothing else, and it is what a\n * provider that has recorded no decision gets. It is not a permissive default: it is the one\n * answer always available (an operator can author an environment variable) and the one that\n * cannot produce a cross-tenant mistake (it has exactly one instance).\n \n Never derived here from a provider's auth shape. Whether a vendor can be connected per tenant\n * is a fact about that vendor's product and about what somebody verified — see the catalogue\n * record for a generated provider, or the module itself for a hand-authored one.\n /\n public getProviderAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[] {\n const declared = this.backendProviderRegistry.getProvider(providerRef)?.admissibleConnections;\n const catalogue = declared === undefined \|\| declared.length === 0\n ? UNJUDGED_PROVIDER_ADMISSIBLE_CONNECTIONS\n : declared;\n\n return this.narrowToApplicationConnectionPolicy(providerRef, catalogue);\n }\n\n /\n What the VENDOR admits, before this application's policy narrows it.\n \n Exists so a refusal can name the right cause. Once a policy can subtract, \"this provider does\n * not admit that connection\" has two meanings — nobody recorded the vendor's capability, or this\n * application switched it off — and they are repaired in different files by different people.\n * A diagnostic that always blamed the catalogue would send an operator to edit a decision record\n * that is already correct.\n /\n public getProviderCatalogueAdmissibleConnections(providerRef: string): readonly ExternalProvider_ConnectionShape[] {\n const declared = this.backendProviderRegistry.getProvider(providerRef)?.admissibleConnections;\n return declared === undefined \|\| declared.length === 0\n ? UNJUDGED_PROVIDER_ADMISSIBLE_CONNECTIONS\n : declared;\n }\n\n /\n Intersect what the VENDOR admits with what THIS application permits.\n \n Two layers answering different questions, and the intersection is what makes them composable:\n * the catalogue record says an organization-owned Slack connection is possible because Slack is\n * installed per workspace, while `providers.connections.slack` says whether this product offers\n * one. A vendor opening a capability and a product deciding to use it are different events, and\n * a single list would make them look identical.\n \n NARROWING ONLY, and that direction is the guarantee rather than a convention. An application\n * cannot declare a connection the vendor does not support into existence — the connect leg would\n * build an authorize URL the vendor rejects, or store a grant nothing can spend — so a policy\n * entry naming an unadmitted shape contributes nothing instead of granting it.\n \n An ABSENT policy means \"everything the catalogue admits\", never \"nothing\". Most applications\n * will never author one, and reading their silence as a refusal would switch off the whole\n * connect surface for every product that has not yet thought about it.\n \n An intersection that empties is a legitimate outcome, not a misconfiguration: it is how an\n * application switches a provider's connect surface off without removing the provider, which it\n * may still need for its own application-scope credential.\n /\n private narrowToApplicationConnectionPolicy(\n providerRef: string,\n catalogue: readonly ExternalProvider_ConnectionShape[],\n ): readonly ExternalProvider_ConnectionShape[] {\n const permitted = this.configService.config.providers?.connections?.[providerRef]?.admissible;\n if (permitted === undefined) {\n return catalogue;\n }\n return catalogue.filter((shape) => permitted.some(\n (allowed) => allowed.ownerScope === shape.ownerScope && allowed.delegation === shape.delegation,\n ));\n }\n\n /\n @wildo_source:part:start saas.backend.providers.connection-target-credential-resolution facet:layer:backend facet:audience:app-developer\n \n One provider secret for ONE connection target — strictly, with no substitution.\n \n Reached as `ExternalProvidersRegistryBackendService` from `@wildo-ai/saas-backend-lib`, through\n * the container token `SAAS_SERVICE_TYPES.ExternalProvidersRegistryService`.\n \n ## What a TARGET is, and why the call names one\n \n A target is `ownerScope` × `delegation`: WHOSE credential is spent, and whether the call acts\n * for a person. The four combinations are different principals, not four ways of saying the same\n * thing — an ORGANIZATION target spends the tenant's own connected account, an APPLICATION target\n * spends the deployment's shared one, a USER target spends one person's.\n \n Naming the target is what makes the identity on the wire a decision the calling code states\n * rather than one the engine infers.\n \n ## There is NO fallback, deliberately, and that is the whole design\n \n A miss in any branch REFUSES, naming what it will not substitute. It never quietly reaches for\n * a different principal's credential.\n \n This replaced a resolver that did fall back — an organization with no credential of its own\n * silently spent the deployment's — and the difference is not a tightening of one idea, it is the\n * opposite policy. A fallback means the vendor sees the application's identity while the\n * application believes it acted as the tenant, so every artifact the call leaves behind — a\n * message, a record, a line in the vendor's own audit log — is attributed to the wrong party, and\n * nothing downstream can detect it.\n \n *An application that wants \"the tenant's key when they have connected one, otherwise ours\"\n still has it*, and composes it itself: try an ORGANIZATION target, and on the refusal call\n again with an APPLICATION one. That is three lines in the application's own code, where the\n * substitution is visible to whoever reads it. What no longer exists is the engine performing\n * that swap underneath a call that asked for a tenant.\n \n ## A refusal is never `undefined`\n \n Every miss throws. Returning nothing was the original defect: several callers passed the empty\n * value onward, the vendor received a blank credential and answered 401, and that is\n * indistinguishable from a revoked key — which is how \"nobody ever configured this\" stayed\n * invisible. Each refusal below therefore names the PLACE an operator must go.\n \n Two misses are deliberately not fall-throughs, and both are cases where the tenant or the\n * person DID connect:\n \n - a credential stored under a RETIRED slot name (a provider regeneration renamed it). Nothing\n * can read or rename that row — its seal binds the slot name — so the owner reconnects the\n * account. The deployment's credential is NOT used instead, because the fallback that would\n * have applied is for an owner that has none (#624);\n * - a credential that cannot be OPENED. The envelope failure is not caught: a principal that HAS\n * an unreadable credential and one that has none are indistinguishable to a caller, and only\n * one of them is safe to continue from.\n /\n public async resolveProviderSecretForTarget(\n target: ExternalProvider_ConnectionTarget,\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind,\n secretRef: string,\n /\n A resource AUDIENCE other than the grant's primary (#1725): the token is minted from the stored grant's\n * refresh token for these scopes (or read from the audience cache), never the stored primary token. Absent:\n * the stored credential, as always. Meaningless for an APPLICATION target, which holds no grant to mint from,\n * and refused there.\n /\n options?: { readonly audience?: ProviderOAuth2RefreshAudience },\n ): Promise<{\n value: string;\n source: ProviderCredentialResolutionSource;\n credentialId?: string;\n credentialSetByUserId?: string;\n /* The connection row's account facts, for a tenant-owned credential (#333, #1047). Absent for the deployment's own. /\n connectionFacts?: ProviderConnectionFacts;\n /* What the vendor granted, when it stated it (#979). Absent means not recorded, never nothing granted. /\n grantedScopes?: readonly string[];\n }> {\n this.ensureInitialized();\n\n // Only the APPLICATION's identity impersonating a person is unbuilt. It needs a vendor-side\n // impersonation grant (domain-wide delegation) that no store holds, so it refuses by name.\n //\n // An ORGANIZATION × USER target resolves below like any tenant credential: it IS one — a member\n // linked their own account for the organization, and every member spends it (decision on #18).\n // This used to refuse every USER delegation with \"no outbound per-principal token store exists\n // yet\", after both stores existed, while the connect leg admitted and stored the very shape\n // this refused: a grant could be connected that nothing could ever spend.\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION\n && target.delegation === ExternalProvider_Connection_DelegationMode.USER) {\n throw this.buildConnectionRefusal(\n providerRef,\n `the application cannot act as user '${target.actingForUserId}': impersonating a person with the application's own `\n + 'identity needs a vendor impersonation grant, which nothing stores. Declare a USER-owned connection, so the person '\n + 'connects their own account.',\n );\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n // An envelope failure is NOT caught here, deliberately, for the organization branch's\n // reason: a person who HAS a credential which cannot be opened must refuse loudly rather\n // than be treated as a person who has none. The two are indistinguishable to a caller\n // and only one of them is a safe thing to continue from.\n const userResolver = this.resolveUserCredentialResolver();\n if (!userResolver) {\n throw this.buildConnectionRefusal(\n providerRef,\n 'no user credential store is bound, so a person-owned connection cannot be read at all. '\n + 'This is a wiring fault rather than a missing credential.',\n );\n }\n // The row's ADDRESS: the connection the ref belongs to (#1670) and the contract KEY of the slot,\n // never the env-var spelling a rename can move (#624). One answer for every read path.\n const { connectionRef: userConnectionRef, secretSlug: userSecretSlug } = this.resolveCredentialAddress(providerRef, secretRef);\n // A name the provider no longer declares is never sent to the store: its row would still open,\n // because the seal binds the name it was stored under, and spend a credential this subsystem\n // reports as unusable (#624). The miss path below then names that row as retired.\n const userSlotRetired = this.classifyStoredCredentialSlot(providerRef, userSecretSlug) === StoredCredentialSlotStanding.RETIRED;\n const ownedByUser = userSlotRetired ? undefined : await userResolver.resolveUserCredential({\n userId: target.ownerId!,\n providerRef,\n connectionRef: userConnectionRef,\n secretSlug: userSecretSlug,\n ...(options?.audience === undefined ? {} : { audience: options.audience }),\n });\n if (!ownedByUser) {\n const retiredSlots = await this.findRetiredSlotsBehindMiss(providerRef, userSlotRetired ? undefined : userSecretSlug, ExternalProvider_Connection_OwnerScope.USER, () =>\n userResolver.listStoredSecretSlugs({ userId: target.ownerId!, providerRef, connectionRef: userConnectionRef }));\n const storedBeforeJoining = await this.describeRowStoredBeforeJoining(providerRef, userConnectionRef, () =>\n userResolver.listStoredSecretSlugs({ userId: target.ownerId!, providerRef, connectionRef: providerRef }));\n throw this.buildConnectionRefusal(\n providerRef,\n storedBeforeJoining\n + (retiredSlots.length === 0\n ? `user '${target.ownerId}' has not connected '${secretRef}'. `\n : `user '${target.ownerId}' has no credential for '${secretRef}' under the provider's current secrets contract. `\n + `${describeCredentialsStoredUnderRetiredSlots(retiredSlots)} `)\n + \"It is not substituted with the deployment's or their organization's: the call asked to act as this person, and \"\n + 'acting as anyone else would put the wrong name on the record the provider keeps.',\n );\n }\n return {\n value: ownedByUser.value,\n source: ProviderCredentialResolutionSource.USER_CREDENTIAL,\n credentialId: ownedByUser.credentialId,\n ...(ownedByUser.connectionFacts === undefined ? {} : { connectionFacts: ownedByUser.connectionFacts }),\n ...(ownedByUser.grantedScopes === undefined ? {} : { grantedScopes: ownedByUser.grantedScopes }),\n };\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION) {\n if (options?.audience !== undefined) {\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own credential cannot serve the '${options.audience.id}' audience: a token for another resource `\n + 'is minted from a connected account\\'s refresh token, and the deployment\\'s credential is a pasted token with none.',\n );\n }\n const fromEnvironment = this.getProviderSecret(providerRef, protocolKind, secretRef);\n if (fromEnvironment) {\n return { value: fromEnvironment, source: ProviderCredentialResolutionSource.DEPLOYMENT_ENVIRONMENT };\n }\n const environmentVariableName = this.getProviderSecretEnvVarName(providerRef, protocolKind, secretRef) ?? secretRef;\n throw this.buildConnectionRefusal(\n providerRef,\n `the application's own credential for '${secretRef}' is not set. Author '${environmentVariableName}' in the deployment environment.`,\n );\n }\n\n // ORGANIZATION. An envelope failure is NOT caught, deliberately: a tenant that HAS a\n // credential which cannot be opened must refuse loudly rather than be treated as a tenant\n // that has none — the two are indistinguishable to a caller and only one is safe.\n const resolver = this.resolveOrganizationCredentialResolver();\n if (!resolver) {\n throw this.buildConnectionRefusal(\n providerRef,\n 'no organization credential store is bound, so a tenant-owned connection cannot be read at all. '\n + 'This is a wiring fault rather than a missing credential.',\n );\n }\n // The row's ADDRESS — connection and contract KEY — see the USER branch above (#1670, #624).\n const { connectionRef: organizationConnectionRef, secretSlug: organizationSecretSlug } = this.resolveCredentialAddress(providerRef, secretRef);\n // Never sends a RETIRED name to the store — see the USER branch above (#624).\n const organizationSlotRetired = this.classifyStoredCredentialSlot(providerRef, organizationSecretSlug) === StoredCredentialSlotStanding.RETIRED;\n const owned = organizationSlotRetired ? undefined : await resolver.resolveOrganizationCredential({\n organizationId: target.ownerId!,\n providerRef,\n connectionRef: organizationConnectionRef,\n secretSlug: organizationSecretSlug,\n ...(options?.audience === undefined ? {} : { audience: options.audience }),\n });\n if (!owned) {\n const retiredSlots = await this.findRetiredSlotsBehindMiss(providerRef, organizationSlotRetired ? undefined : organizationSecretSlug, ExternalProvider_Connection_OwnerScope.ORGANIZATION, () =>\n resolver.listStoredSecretSlugs({ organizationId: target.ownerId!, providerRef, connectionRef: organizationConnectionRef }));\n const storedBeforeJoining = await this.describeRowStoredBeforeJoining(providerRef, organizationConnectionRef, () =>\n resolver.listStoredSecretSlugs({ organizationId: target.ownerId!, providerRef, connectionRef: providerRef }));\n throw this.buildConnectionRefusal(\n providerRef,\n storedBeforeJoining\n + (retiredSlots.length === 0\n ? `organization '${target.ownerId}' has no credential for '${secretRef}'. `\n : `organization '${target.ownerId}' has no credential for '${secretRef}' under the provider's current secrets contract. `\n + `${describeCredentialsStoredUnderRetiredSlots(retiredSlots)} `)\n + \"It is not substituted with the deployment's: the call asked to act as this tenant, and acting as someone else \"\n + 'instead would be attributed to the wrong party.',\n );\n }\n return {\n value: owned.value,\n source: ProviderCredentialResolutionSource.ORGANIZATION_CREDENTIAL,\n credentialId: owned.credentialId,\n ...(owned.setByUserId === undefined ? {} : { credentialSetByUserId: owned.setByUserId }),\n ...(owned.connectionFacts === undefined ? {} : { connectionFacts: owned.connectionFacts }),\n ...(owned.grantedScopes === undefined ? {} : { grantedScopes: owned.grantedScopes }),\n };\n }\n /* @wildo_source:part:end saas.backend.providers.connection-target-credential-resolution /\n\n /\n Record that the credential {@link resolveProviderSecretForTarget} just handed out was SPENT,\n * and what the provider thought of it.\n \n ## Why the recording lives HERE, beside the resolution\n \n Because the two must never disagree about which store they are talking about. This method\n * dispatches on `target.ownerScope` in exactly the same order and by exactly the same rule as\n * the resolution above, so the store that was read is the store that is stamped is a property\n * of one function rather than an agreement between two.\n \n The alternative — the caller routing for itself — was tried and is the defect this replaces.\n * The provider-operation executor held a thunk to A store, typed with an `organizationId` field,\n * and `target.ownerId` is a USER id whenever `ownerScope` is `USER` (#333's two-axis connection\n * shape). Wired as it stood, a person-owned call would have stamped a tenant row that does not\n * exist and emitted an organization audit event naming a user id as the organization. The\n * caller cannot route this correctly, because the ORDER is this class's knowledge — the same\n * argument `OrganizationProviderCredentialResolverPort`'s own docstring makes for why the order\n * does not live on the port.\n \n ## Fire-and-forget is the CALLER's decision, not this method's\n \n This returns a promise and lets a store failure reject. The outbound call has already happened\n * by the time anybody calls this, so the caller must not fail its own request on a bookkeeping\n * write — but swallowing here would also hide the rejection from the caller's loss counter, and\n * an observation nobody counts is the shape this whole change exists to remove. The executor\n * routes it through `emitAuditObservation`, which counts a rejection and never rethrows.\n \n @param provenance Exactly what {@link resolveProviderSecretForTarget} returned for this call,\n * carried through the access resolver. Passing anything else describes a row that was not the\n * one spent.\n /\n public async recordProviderSecretUseForTarget(\n target: ExternalProvider_ConnectionTarget,\n providerRef: string,\n provenance: { source: ProviderCredentialResolutionSource; credentialId?: string; secretSlug: string; credentialSetByUserId?: string },\n outcome?: { accepted: boolean; providerMessage?: string },\n ): Promise<void> {\n // The USE event names the STORED slot — the contract KEY — so it joins the credential's own SET,\n // ROTATED and DELETED events, which all carry the row's `secretSlug`. A caller's provenance may still\n // carry the env-var spelling a runtime contract names (#624); canonicalising here, at the one\n // recording chokepoint, makes that unrepresentable in the trail rather than a rule every caller keeps.\n const storedSecretSlug = this.canonicalCredentialSlug(providerRef, provenance.secretSlug);\n // The CONNECTION the spent row is keyed on, by the one function the resolution addressed it with (#1670),\n // so the use event names the grant beside the ref the call went through.\n const connectionRef = this.resolveCredentialConnectionRef(providerRef);\n // And WHOSE package the ref belongs to (#1725): on a shared connection several packages spend one grant.\n const providerPackageName = this.getProviderPackageName(providerRef);\n if (target.ownerId === undefined) {\n // An APPLICATION-owned resolution names no owner and has no row. Inventing one would\n // create a credential the tenant never set, which would then appear on their settings\n // screen as something they are responsible for rotating.\n return;\n }\n\n if (target.ownerScope === ExternalProvider_Connection_OwnerScope.USER) {\n const userResolver = this.resolveUserCredentialResolver();\n // A person's credential ALWAYS has a row — there is nothing for a person to fall through\n // to — so an absent id here means the caller did not pass this method the provenance the\n // resolution produced, and stamping some other row would be worse than stamping none.\n if (!userResolver \|\| !provenance.credentialId) return;\n await userResolver.recordCredentialUse({\n userId: target.ownerId,\n providerRef,\n connectionRef,\n ...(providerPackageName === undefined ? {} : { providerPackageName }),\n secretSlug: storedSecretSlug,\n credentialId: provenance.credentialId,\n ...(outcome === undefined ? {} : { outcome }),\n });\n return;\n }\n\n if (target.ownerScope !== ExternalProvider_Connection_OwnerScope.ORGANIZATION) return;\n\n const resolver = this.resolveOrganizationCredentialResolver();\n if (!resolver) return;\n // `source` is passed through rather than filtered here: the store emits the use audit for\n // BOTH sources and stamps a row only for the tenant's own, and that split is its decision to\n // make. Filtering here would silently drop the audit row for the case a reviewer most wants\n // — a tenant acting as the shared deployment principal.\n await resolver.recordCredentialUse({\n organizationId: target.ownerId,\n providerRef,\n connectionRef,\n ...(providerPackageName === undefined ? {} : { providerPackageName }),\n secretSlug: storedSecretSlug,\n source: provenance.source,\n ...(provenance.credentialId === undefined ? {} : { credentialId: provenance.credentialId }),\n ...(provenance.credentialSetByUserId === undefined ? {} : { credentialSetByUserId: provenance.credentialSetByUserId }),\n ...(outcome === undefined ? {} : { outcome }),\n });\n }\n\n /\n After a store lookup under the current key MISSED: the retired slot names a credential is stored\n * under for the same owner and provider, so the refusal can say the row exists (#624).\n \n Chooses WORDS, never an outcome — the caller throws its refusal whatever this answers, and a\n * failure here (a store that cannot list, a partial binding) answers `[]` so that refusal is thrown\n * exactly as it was. Use it ONLY where the refusal is already decided; where the answer permits a\n * fall-through to another principal, use `requireCredentialsStoredUnderRetiredSlots`, which throws.\n * See `retired-credential-slot.backend.utils.ts`.\n /\n private findRetiredSlotsBehindMiss(\n providerRef: string,\n /* `undefined` when no lookup was made because the requested name was itself retired. /\n lookedUpSecretSlug: string \| undefined,\n ownerScope: ExternalProvider_Connection_OwnerScope,\n listStoredSecretSlugs: () => Promise<readonly string[]>,\n ): Promise<readonly string[]> {\n return findCredentialsStoredUnderRetiredSlots({\n registry: this,\n providerRef,\n lookedUpSecretSlug,\n listStoredSecretSlugs,\n onDetectionFailure: (error) => this.logDebug('Retired credential slot detection could not run; refusing with the plain message', {\n providerRef,\n ownerScope,\n error: describeCaughtError(error),\n }),\n });\n }\n\n /\n After a miss under a SHARED connection: whether the owner holds a row the ref stored under its OWN identity\n * before it joined that connection (#1725), as the sentence that opens the refusal — empty otherwise.\n \n Such a row is sealed to `(owner, providerRef, slot)`, the connection it was written for, and is never spent\n * through the shared one: re-sealing was decided against (2026-09-12), and a grant quietly read across two\n * identities is exactly what the connection key exists to prevent. So the person reconnects once, and the\n * refusal tells them why rather than claiming they never connected. Words only — a listing that fails answers\n * empty, and the refusal is thrown either way.\n /\n private async describeRowStoredBeforeJoining(\n providerRef: string,\n connectionRef: string,\n listStoredUnderOwnRef: () => Promise<readonly string[]>,\n ): Promise<string> {\n if (connectionRef === providerRef) return '';\n try {\n const stored = await listStoredUnderOwnRef();\n return stored.length === 0 ? '' : `a credential is stored under '${providerRef}' from before it joined the shared connection `\n + `'${connectionRef}'; it is not spent through the connection. Reconnect through any ref of '${connectionRef}'. `;\n } catch {\n return '';\n }\n }\n\n /\n One shape for every connection refusal, so an operator reads the same sentence everywhere — and one\n * CLASS, so a consumer can tell a refusal (a gap somebody fixes by connecting) from a fault (an unopenable\n * envelope, a failing store), which stays a plain error and stays loud.\n /\n private buildConnectionRefusal(providerRef: string, detail: string): ExternalProviderConnectionRefusedError {\n return new ExternalProviderConnectionRefusedError(`Provider '${providerRef}': ${detail}`);\n }\n\n // ══════════════════════════════════════════════════════════════════════════════════════════\n // PER-ORGANIZATION SECRET RESOLUTION (#357)\n //\n // ## Why these are separate methods and not a change to `getProviderSecret`\n //\n // `getProviderSecret` is synchronous, and six consumers across four other workstreams' files\n // call it that way. A per-organization credential lives in the database, so resolving one is\n // necessarily asynchronous — making the existing method async would reshape every one of those\n // call sites at once, in files this slice may not touch. So the environment path stays exactly\n // as it was, and the tenant-aware path is added beside it.\n //\n // This is a seam, not a duplication: the async path CALLS `getProviderSecret` for its second\n // step, so there remains exactly one implementation of \"what does the environment say\".\n //\n // ## The ORDER, and why the third step is a throw\n //\n // 1. the organization's OWN credential\n // 2. the deployment's env-projected `SecretsContract`\n // 3. refuse, BY NAME\n //\n // Step 3 is the one that matters. Before this existed, an unresolvable secret returned\n // `undefined`, and every caller then decided for itself what that meant — several of them by\n // passing it onward, so a vendor received an empty Authorization header and answered 401. A 401\n // from a vendor is indistinguishable from a revoked credential, so the real fault (nobody ever\n // configured one) was invisible. Naming both places that were checked turns that into a\n // sentence an operator can act on.\n //\n // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — resolving which principal this\n // application acts as toward a third party, per tenant.\n // ══════════════════════════════════════════════════════════════════════════════════════════\n\n /\n Lazy getter for the per-organization credential store — see the `container` constructor\n * param's JSDoc for why this cannot be a constructor injection.\n \n `isBound` is what preserves the old `@optional()` semantics: a host that binds no store\n * (a minion, a unit harness) resolves nothing here and falls through to the deployment\n * environment, exactly as it did before the store existed.\n /\n protected resolveOrganizationCredentialResolver(): OrganizationProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver)) return undefined;\n return this.container.get<OrganizationProviderCredentialResolverPort>(\n SAAS_SERVICE_TYPES.OrganizationProviderCredentialResolver,\n );\n }\n\n /\n Lazy getter for the per-user credential store — same mechanics as the organization one above,\n * and the OPPOSITE meaning when it resolves nothing.\n \n An unbound organization store falls through to the deployment environment, because a tenant\n * legitimately may not have its own credential. An unbound USER store REFUSES, because there is\n * nothing a person's credential could fall through to: spending the deployment's shared\n * principal on someone's behalf would attribute the act to the wrong party at the vendor. So a\n * host that forgot to bind this gets a refusal naming the wiring fault, never a silent\n * substitution.\n /\n protected resolveUserCredentialResolver(): UserProviderCredentialResolverPort \| undefined {\n if (!this.container?.isBound(SAAS_SERVICE_TYPES.UserProviderCredentialResolver)) return undefined;\n return this.container.get<UserProviderCredentialResolverPort>(\n SAAS_SERVICE_TYPES.UserProviderCredentialResolver,\n );\n }\n\n\n public isProviderEnabled(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): boolean {\n this.ensureInitialized();\n try {\n if (!this.hasProvider(providerRef)) {\n return false;\n }\n\n const provider = this.getProvider(providerRef);\n if (!provider \|\| !provider.protocols.includes(protocolKind)) {\n return false;\n }\n\n const config = this.getProviderConfiguration(providerRef, protocolKind);\n if (!config) {\n return true;\n }\n\n return config.enabled !== false;\n } catch (error) {\n this.logDebug('Error checking if provider is enabled', {\n providerRef,\n protocolKind,\n error: describeCaughtError(error)\n });\n return false;\n }\n }\n\n public getProviderProtocolSecrets(\n providerRef: string,\n protocolKind: ExternalProvider_ExchangeProtocol_Kind\n ): Record<string, string> \| undefined {\n this.ensureInitialized();\n try {\n const resolvedSecrets: Record<string, string> = {};\n const protocolConfig = this.getProviderConfiguration(providerRef, protocolKind);\n const protocolSecretRef = protocolConfig?.authConfig?.secretRef;\n if (protocolSecretRef) {\n const secretValue = this.getProviderSecret(providerRef, protocolKind, protocolSecretRef);\n if (secretValue) {\n resolvedSecrets[protocolSecretRef] = secretValue;\n }\n }\n\n if (protocolKind === ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL) {\n const acpConfiguration = this.getAgentClientProtocolConfiguration(providerRef);\n for (const executionProfile of Object.values(acpConfiguration?.executionProfiles ?? {})) {\n if (\n executionProfile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION\n \|\| !executionProfile.secretRef\n ) {\n continue;\n }\n\n const secretValue = this.getProviderSecret(providerRef, protocolKind, executionProfile.secretRef);\n if (secretValue) {\n resolvedSecrets[executionProfile.secretRef] = secretValue;\n }\n }\n }\n\n return Object.keys(resolvedSecrets).length > 0 ? resolvedSecrets : undefined;\n } catch {\n return undefined;\n }\n }\n\n /\n Refresh the runtime registry facade from first-class backend provider modules.\n \n This mirrors `initialize()` and intentionally no longer depends on the\n * deleted capability-bindings service.\n */\n public async refreshFromConfig(): Promise<void> {\n try {\n if (!this.configService.isInitialized()) {\n await this.configService.initialize();\n }\n\n const registry = this.buildRuntimeRegistryFromProviderModules();\n\n this.registry = registry;\n this.isInitialized = true;\n\n this.logDebug('External providers registry refreshed from backend provider modules', {\n totalProviders: Object.keys(registry).length,\n });\n } catch (error) {\n this.logDebug('Failed to refresh registry from config', {\n error: describeCaughtError(error)\n });\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED,\n context: {\n error: describeCaughtError(error),\n },\n }\n );\n }\n }\n\n // ================================\n // Initialization Utils\n // ================================\n\n protected ensureInitialized(): void {\n if (!this.isInitialized \|\| !this.registry) {\n throw this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {\n customMessageReference: ErrorCustomMessageReference.EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED\n }\n );\n }\n }\n}\n"]}