@ambitresearch/paperclip-agent-identities 0.2.3

package/dist/ui/index.js

@@ -0,0 +1,3360 @@
+// src/ui/index.tsx
+import { usePluginData as usePluginData2 } from "@paperclipai/plugin-sdk/ui";
+
+// src/ui/theme.ts
+import { useEffect, useState } from "react";
+var uiSurface = "var(--agent-identities-surface)";
+var uiCanvas = "var(--agent-identities-canvas)";
+var uiPanel = "var(--agent-identities-panel)";
+var uiInput = "var(--agent-identities-input)";
+var uiBorder = "var(--agent-identities-border)";
+var uiBorderStrong = "var(--agent-identities-border-strong)";
+var uiText = "var(--agent-identities-text)";
+var uiMutedText = "var(--agent-identities-muted-text)";
+var uiPrimary = "var(--agent-identities-primary)";
+var uiPrimaryText = "var(--agent-identities-primary-text)";
+var uiLink = "var(--agent-identities-link)";
+var uiSuccess = "var(--agent-identities-success)";
+var uiWarning = "var(--agent-identities-warning)";
+var uiDanger = "var(--agent-identities-danger)";
+var uiOverlay = "var(--agent-identities-overlay)";
+var uiShadow = "var(--agent-identities-shadow)";
+function createPaperclipThemeStyle(mode) {
+  return mode === "dark" ? darkThemeVars : lightThemeVars;
+}
+function usePaperclipThemeMode() {
+  const [mode, setMode] = useState(() => detectPaperclipThemeMode());
+  useEffect(() => {
+    const updateMode = () => setMode(detectPaperclipThemeMode());
+    const observedDocuments = [document, getSameOriginParentDocument()].filter((doc) => Boolean(doc));
+    const observers = observedDocuments.flatMap((doc) => {
+      const targets = [doc.documentElement, doc.body].filter((target) => Boolean(target));
+      return targets.map((target) => {
+        const observer = new MutationObserver(updateMode);
+        observer.observe(target, { attributes: true, attributeFilter: ["class", "data-theme", "style"] });
+        return observer;
+      });
+    });
+    const mediaQuery = window.matchMedia?.("(prefers-color-scheme: dark)");
+    mediaQuery?.addEventListener?.("change", updateMode);
+    updateMode();
+    return () => {
+      observers.forEach((observer) => observer.disconnect());
+      mediaQuery?.removeEventListener?.("change", updateMode);
+    };
+  }, []);
+  return mode;
+}
+function detectPaperclipThemeMode() {
+  if (typeof document === "undefined") return "light";
+  const documents = [document, getSameOriginParentDocument()].filter((doc) => Boolean(doc));
+  for (const doc of documents) {
+    const explicitMode = getExplicitThemeMode(doc.documentElement) ?? getExplicitThemeMode(doc.body);
+    if (explicitMode) return explicitMode;
+  }
+  if (window.matchMedia?.("(prefers-color-scheme: dark)").matches) return "dark";
+  return "light";
+}
+function getExplicitThemeMode(element) {
+  if (!element) return null;
+  const theme = element.dataset.theme?.toLowerCase();
+  if (theme === "dark") return "dark";
+  if (theme === "light") return "light";
+  if (element.classList.contains("dark") || element.classList.contains("dark-theme")) return "dark";
+  if (element.classList.contains("light") || element.classList.contains("light-theme")) return "light";
+  if (element.style.colorScheme === "dark") return "dark";
+  if (element.style.colorScheme === "light") return "light";
+  return null;
+}
+function getSameOriginParentDocument() {
+  if (typeof window === "undefined" || window.parent === window) return null;
+  try {
+    return window.parent.document;
+  } catch {
+    return null;
+  }
+}
+var lightThemeVars = {
+  colorScheme: "light",
+  "--agent-identities-surface": "oklch(100% 0 0)",
+  "--agent-identities-canvas": "oklch(100% 0 0)",
+  "--agent-identities-panel": "oklch(97% 0 0)",
+  "--agent-identities-muted-panel": "oklch(92.2% 0 0)",
+  "--agent-identities-input": "oklch(100% 0 0)",
+  "--agent-identities-border": "oklch(92.2% 0 0)",
+  "--agent-identities-border-strong": "oklch(70.8% 0 0)",
+  "--agent-identities-text": "oklch(14.5% 0 0)",
+  "--agent-identities-muted-text": "oklch(55.6% 0 0)",
+  "--agent-identities-primary": "oklch(20.5% 0 0)",
+  "--agent-identities-primary-text": "oklch(98.5% 0 0)",
+  "--agent-identities-link": "oklch(42% 0.16 264)",
+  "--agent-identities-success": "oklch(52.7% 0.154 150.069)",
+  "--agent-identities-warning": "oklch(55.5% 0.163 48.998)",
+  "--agent-identities-danger": "oklch(57.7% 0.245 27.325)",
+  "--agent-identities-overlay": "oklch(0% 0 0 / 42%)",
+  "--agent-identities-shadow": "oklch(0% 0 0 / 18%)"
+};
+var darkThemeVars = {
+  colorScheme: "dark",
+  "--agent-identities-surface": "oklch(20.5% 0 0)",
+  "--agent-identities-canvas": "oklch(20.5% 0 0)",
+  "--agent-identities-panel": "oklch(26.9% 0 0)",
+  "--agent-identities-muted-panel": "oklch(35% 0 0)",
+  "--agent-identities-input": "oklch(26.9% 0 0)",
+  "--agent-identities-border": "oklch(35% 0 0)",
+  "--agent-identities-border-strong": "oklch(43.9% 0 0)",
+  "--agent-identities-text": "oklch(98.5% 0 0)",
+  "--agent-identities-muted-text": "oklch(70.8% 0 0)",
+  "--agent-identities-primary": "oklch(98.5% 0 0)",
+  "--agent-identities-primary-text": "oklch(20.5% 0 0)",
+  "--agent-identities-link": "oklch(78% 0.12 264)",
+  "--agent-identities-success": "oklch(72.3% 0.219 149.579)",
+  "--agent-identities-warning": "oklch(85.2% 0.199 91.936)",
+  "--agent-identities-danger": "oklch(70.4% 0.191 22.216)",
+  "--agent-identities-overlay": "oklch(0% 0 0 / 58%)",
+  "--agent-identities-shadow": "oklch(0% 0 0 / 45%)"
+};
+
+// src/ui/SettingsPage.tsx
+import { useEffect as useEffect4, useState as useState4 } from "react";
+import { usePluginData, usePluginAction } from "@paperclipai/plugin-sdk/ui";
+
+// src/shared/types.ts
+var GITHUB_IDENTITY_PROVIDER_ID = "github";
+var SLACK_IDENTITY_PROVIDER_ID = "slack";
+var REBIND_LEGACY_SLACK_CREDENTIALS_ACTION = "rebind-legacy-slack-credentials";
+var SUPPORTED_IDENTITY_PROVIDERS = [
+  {
+    id: "github",
+    name: "GitHub",
+    description: "GitHub App identity for repositories, pull requests, branch pushes, and commit attribution.",
+    status: "enabled"
+  },
+  {
+    id: "slack",
+    name: "Slack",
+    description: "Workspace identity for Slack messages and app-mediated actions.",
+    status: "coming-soon"
+  },
+  {
+    id: "mattermost",
+    name: "Mattermost",
+    description: "Team identity for Mattermost posts and channel operations.",
+    status: "coming-soon"
+  },
+  {
+    id: "entra",
+    name: "Microsoft Entra",
+    description: "Cloud directory identity for Microsoft Graph and Azure-backed workflows.",
+    status: "coming-soon"
+  },
+  {
+    id: "gcp",
+    name: "Google Cloud",
+    description: "Service account identity for Google Cloud APIs.",
+    status: "coming-soon"
+  },
+  {
+    id: "aws",
+    name: "AWS",
+    description: "IAM-backed identity for AWS APIs.",
+    status: "coming-soon"
+  }
+];
+function isIdentityProviderId(value) {
+  return SUPPORTED_IDENTITY_PROVIDERS.some((provider) => provider.id === value);
+}
+var DEFAULT_BOT_IDENTITY_CONFIG = {
+  provider: GITHUB_IDENTITY_PROVIDER_ID,
+  id: "",
+  agentId: "",
+  label: "",
+  github: { username: "" }
+};
+
+// src/shared/slack-bot-whoami-tool.ts
+var slackBotWhoamiToolName = "slack_bot_whoami";
+var slackBotWhoamiToolMetadata = {
+  displayName: "Slack Identity Who Am I",
+  description: "Returns the calling agent's configured Slack identity metadata.",
+  parametersSchema: {
+    type: "object",
+    properties: {},
+    additionalProperties: false
+  }
+};
+var slackBotWhoamiManifestTool = {
+  name: slackBotWhoamiToolName,
+  ...slackBotWhoamiToolMetadata
+};
+
+// src/core/provider-settings-contract.ts
+function buildProviderSettingsRegistry(adapters, defaultProviderId) {
+  const ordered = [...adapters];
+  const byId = new Map(ordered.map((adapter) => [adapter.providerId, adapter]));
+  const fallback = byId.get(defaultProviderId) ?? ordered[0];
+  if (!fallback) {
+    throw new Error("buildProviderSettingsRegistry: at least one adapter is required");
+  }
+  return {
+    get(providerId) {
+      return byId.get(providerId) ?? fallback;
+    },
+    all() {
+      return ordered;
+    }
+  };
+}
+
+// src/providers/github/settings-adapter.ts
+var GITHUB_SETTINGS_PROVIDER_ID = "github";
+var githubSettingsAdapter = {
+  providerId: GITHUB_SETTINGS_PROVIDER_ID,
+  formSteps: [
+    { id: "identity", label: "Identity" },
+    { id: "github", label: "GitHub App" },
+    { id: "commit", label: "Commit" }
+  ],
+  credentialStepId: "github",
+  savesViaSeparateAction: false,
+  hasProviderAccountFieldsInIdentityStep: true,
+  getValidation(config, hasDuplicate) {
+    const hasIdentity = Boolean(config.agentId.trim() && config.provider.trim() && config.label.trim() && config.githubUsername.trim()) && !hasDuplicate;
+    const hasGitHubAppCredential = Boolean(
+      config.githubAppId.trim() && config.githubInstallationId.trim() && (config.privateKeySecretId.trim() || config.privateKeyFile.trim())
+    );
+    const hasFallbackCredential2 = Boolean(config.fallbackTokenSecretId.trim() || config.tokenFile.trim());
+    const identityComplete = hasIdentity;
+    const credentialComplete = hasGitHubAppCredential || hasFallbackCredential2;
+    const identityMessage = hasDuplicate ? "This agent already has an identity for the selected provider. Edit the existing identity instead." : !hasIdentity ? "Choose an agent, provider, label, and provider username before continuing." : "Identity details are complete.";
+    const credentialMessage = credentialComplete ? "Credential source is complete." : "Add a complete GitHub App credential, or choose a fallback token source, before this identity can be saved.";
+    const saveMessage = !identityComplete ? identityMessage : !credentialComplete ? credentialMessage : "Required setup is complete. Review optional commit metadata, then save.";
+    return {
+      identityComplete,
+      credentialComplete,
+      isComplete: identityComplete && credentialComplete,
+      identityMessage,
+      credentialMessage,
+      saveMessage
+    };
+  }
+};
+
+// src/providers/slack/settings-adapter.ts
+var SLACK_SETTINGS_PROVIDER_ID = "slack";
+var slackSettingsAdapter = {
+  providerId: SLACK_SETTINGS_PROVIDER_ID,
+  formSteps: [
+    { id: "identity", label: "Identity" },
+    { id: "slack", label: "Slack App" }
+  ],
+  credentialStepId: "slack",
+  savesViaSeparateAction: true,
+  hasProviderAccountFieldsInIdentityStep: false,
+  getValidation(config, hasDuplicate, extra) {
+    const slackSaveResult = extra.slackSaveResult ?? null;
+    const slackSaveBusy = Boolean(extra.slackSaveBusy);
+    const hasIdentity = Boolean(config.agentId.trim() && config.provider.trim() && config.label.trim()) && !hasDuplicate;
+    const hasSlackInstallFields = Boolean(
+      config.slackTeamId.trim() && config.slackAppId.trim() && config.slackBotUserId.trim() && config.slackBotTokenSecretId.trim() && config.slackSigningSecretId.trim()
+    );
+    const slackSaveMatchesCurrentFields = Boolean(
+      slackSaveResult && slackSaveResult.teamId === config.slackTeamId.trim() && slackSaveResult.appId === config.slackAppId.trim() && slackSaveResult.botUserId === config.slackBotUserId.trim() && slackSaveResult.eventsRequestUrl === config.slackEventsRequestUrl.trim() && slackSaveResult.botTokenSecretId === config.slackBotTokenSecretId.trim() && slackSaveResult.signingSecretId === config.slackSigningSecretId.trim() && (slackSaveResult.defaultChannel ?? "") === config.slackDefaultChannel.trim()
+    );
+    const hasSlackInstall = hasSlackInstallFields && slackSaveMatchesCurrentFields && !slackSaveBusy;
+    const identityComplete = hasIdentity;
+    const credentialComplete = hasSlackInstall;
+    const identityMessage = hasDuplicate ? "This agent already has an identity for the selected provider. Edit the existing identity instead." : !hasIdentity ? "Choose an agent, provider, and label before continuing." : "Identity details are complete.";
+    const credentialMessage = credentialComplete ? "Slack install metadata is complete." : slackSaveBusy ? "Saving Slack install metadata..." : "Create the Slack App manifest, install it, and paste back the team/app/bot IDs plus bot token and signing secret references, then save install metadata before this identity can be saved.";
+    const saveMessage = !identityComplete ? identityMessage : !credentialComplete ? credentialMessage : "Required setup is complete.";
+    return {
+      identityComplete,
+      credentialComplete,
+      isComplete: identityComplete && credentialComplete,
+      identityMessage,
+      credentialMessage,
+      saveMessage
+    };
+  }
+};
+
+// src/providers/settings-index.ts
+var ALL_SETTINGS_ADAPTERS = [githubSettingsAdapter, slackSettingsAdapter];
+
+// src/core/provider-settings-ui-contract.ts
+function buildProviderSettingsUIRegistry(adapters) {
+  const byId = new Map(adapters.map((adapter) => [adapter.providerId, adapter]));
+  return {
+    get(providerId) {
+      return byId.get(providerId);
+    }
+  };
+}
+
+// src/providers/slack/settings-adapter-ui.tsx
+import { useEffect as useEffect2, useRef, useState as useState2 } from "react";
+import { jsx, jsxs } from "react/jsx-runtime";
+var SLACK_MANIFEST_STATE_STORAGE_PREFIX = "paperclip-agent-identities:slack-app-manifest-state:";
+function normalizeSlackAppIdInput(value) {
+  const trimmed = value.trim();
+  if (/^A[A-Z0-9]+$/i.test(trimmed)) {
+    return trimmed.toUpperCase();
+  }
+  try {
+    const url = new URL(trimmed);
+    const path = url.pathname.split("/").filter(Boolean);
+    const appId = path[0] === "apps" ? path[1] : void 0;
+    if (url.hostname === "api.slack.com" && appId && /^A[A-Z0-9]+$/i.test(appId)) {
+      return appId.toUpperCase();
+    }
+  } catch {
+  }
+  return value;
+}
+function actionErrorMessage(error, fallback) {
+  if (error instanceof Error && error.message.trim()) return error.message;
+  if (typeof error === "object" && error !== null) {
+    const message = error.message;
+    if (typeof message === "string" && message.trim()) return message;
+  }
+  return fallback;
+}
+function getSlackManifestStateStorageKey(companyId, agentId) {
+  return `${SLACK_MANIFEST_STATE_STORAGE_PREFIX}${companyId}:${agentId}`;
+}
+function writeSlackManifestFlowState(companyId, agentId, state) {
+  try {
+    window.sessionStorage.setItem(getSlackManifestStateStorageKey(companyId, agentId), state);
+  } catch {
+  }
+}
+function readSlackManifestFlowState(companyId, agentId) {
+  try {
+    return window.sessionStorage.getItem(getSlackManifestStateStorageKey(companyId, agentId));
+  } catch {
+    return null;
+  }
+}
+function deleteSlackManifestFlowState(companyId, agentId) {
+  try {
+    window.sessionStorage.removeItem(getSlackManifestStateStorageKey(companyId, agentId));
+  } catch {
+  }
+}
+async function copyTextToClipboard(value) {
+  try {
+    if (navigator.clipboard?.writeText) {
+      await navigator.clipboard.writeText(value);
+      return;
+    }
+  } catch {
+  }
+  const textarea = document.createElement("textarea");
+  textarea.value = value;
+  textarea.setAttribute("readonly", "");
+  textarea.style.position = "fixed";
+  textarea.style.opacity = "0";
+  document.body.appendChild(textarea);
+  textarea.select();
+  try {
+    const copied = document.execCommand("copy");
+    if (!copied) {
+      throw new Error("execCommand('copy') was rejected");
+    }
+  } finally {
+    textarea.remove();
+  }
+}
+function useSlackCredentialStep(input) {
+  const { config, hasPersistedIdentity, updateField, refresh, deleteConfig, patchFormState, createSlackAppManifest, getSlackAppManifestFlow, discoverSlackInstallMetadata, saveSlackInstallMetadata, rebindLegacySlackCredentials, slackBotWhoami, companyId } = input;
+  const [slackManifestFlow, setSlackManifestFlow] = useState2(null);
+  const [slackManifestBusy, setSlackManifestBusy] = useState2(false);
+  const [slackSaveBusy, setSlackSaveBusy] = useState2(false);
+  const [slackManifestError, setSlackManifestError] = useState2(null);
+  const [slackSaveResult, setSlackSaveResult] = useState2(null);
+  const [slackManifestCopied, setSlackManifestCopied] = useState2(false);
+  const [slackDiscoveryBusy, setSlackDiscoveryBusy] = useState2(false);
+  const [slackDiscoveryError, setSlackDiscoveryError] = useState2(null);
+  const [slackResumeStateInput, setSlackResumeStateInput] = useState2("");
+  const [slackResumeBusy, setSlackResumeBusy] = useState2(false);
+  const [slackResumeError, setSlackResumeError] = useState2(null);
+  const [slackStatus, setSlackStatus] = useState2(null);
+  const [slackStatusLoading, setSlackStatusLoading] = useState2(false);
+  const [slackStatusError, setSlackStatusError] = useState2(null);
+  const [legacySlackRebindBusy, setLegacySlackRebindBusy] = useState2(false);
+  const [legacySlackRebindError, setLegacySlackRebindError] = useState2(null);
+  const [legacySlackRebindResult, setLegacySlackRebindResult] = useState2(null);
+  const slackStatusGenerationRef = useRef(0);
+  const slackDiscoveryGenerationRef = useRef(0);
+  const [slackCleanupPendingAgentId, setSlackCleanupPendingAgentId] = useState2(null);
+  const [slackCleanupBusy, setSlackCleanupBusy] = useState2(false);
+  const [slackCleanupError, setSlackCleanupError] = useState2(null);
+  const slackCleanupPendingResultRef = useRef(null);
+  const slackSaveGenerationRef = useRef(0);
+  const slackManifestFlowGenerationRef = useRef(0);
+  function reset() {
+    setSlackManifestFlow(null);
+    setSlackManifestError(null);
+    setSlackSaveResult(null);
+    setSlackManifestCopied(false);
+    setSlackDiscoveryBusy(false);
+    setSlackDiscoveryError(null);
+    slackDiscoveryGenerationRef.current += 1;
+    setSlackResumeStateInput("");
+    setSlackResumeError(null);
+    slackManifestFlowGenerationRef.current += 1;
+    setSlackManifestBusy(false);
+    setSlackResumeBusy(false);
+    slackSaveGenerationRef.current += 1;
+    setSlackSaveBusy(false);
+    setSlackCleanupPendingAgentId(null);
+    setSlackCleanupError(null);
+    setSlackCleanupBusy(false);
+    slackCleanupPendingResultRef.current = null;
+    setSlackStatus(null);
+    setSlackStatusError(null);
+    setSlackStatusLoading(false);
+    slackStatusGenerationRef.current += 1;
+    setLegacySlackRebindBusy(false);
+    setLegacySlackRebindError(null);
+    setLegacySlackRebindResult(null);
+  }
+  const slackFieldsSignature = config ? `${config.slackTeamId}|${config.slackAppId}|${config.slackBotUserId}|${config.slackDefaultChannel}|${config.slackBotTokenSecretId}|${config.slackSigningSecretId}` : "";
+  const prevSlackFieldsSignatureRef = useRef(slackFieldsSignature);
+  useEffect2(() => {
+    if (prevSlackFieldsSignatureRef.current !== slackFieldsSignature) {
+      prevSlackFieldsSignatureRef.current = slackFieldsSignature;
+      setSlackSaveResult(null);
+      slackSaveGenerationRef.current += 1;
+      setSlackSaveBusy(false);
+    }
+  }, [slackFieldsSignature]);
+  const slackDiscoverySecretSignature = config?.slackBotTokenSecretId ?? "";
+  const prevSlackDiscoverySecretSignatureRef = useRef(slackDiscoverySecretSignature);
+  useEffect2(() => {
+    if (prevSlackDiscoverySecretSignatureRef.current === slackDiscoverySecretSignature) return;
+    prevSlackDiscoverySecretSignatureRef.current = slackDiscoverySecretSignature;
+    slackDiscoveryGenerationRef.current += 1;
+    setSlackDiscoveryBusy(false);
+    setSlackDiscoveryError(null);
+  }, [slackDiscoverySecretSignature]);
+  useEffect2(() => {
+    if (!config || config.provider !== SLACK_IDENTITY_PROVIDER_ID) return;
+    if (!hasPersistedIdentity || !config.agentId.trim()) {
+      slackStatusGenerationRef.current += 1;
+      setSlackStatus(null);
+      setSlackStatusError(null);
+      setSlackStatusLoading(false);
+      return;
+    }
+    void handleCheckSlackStatus();
+  }, [config?.agentId, config?.label, config?.provider, hasPersistedIdentity]);
+  useEffect2(() => {
+    if (!config || config.provider !== SLACK_IDENTITY_PROVIDER_ID) return;
+    if (slackManifestFlow) return;
+    const agentId = config.agentId.trim();
+    if (!agentId) return;
+    const storedState = readSlackManifestFlowState(companyId, agentId);
+    if (!storedState) return;
+    let cancelled = false;
+    const generation = slackManifestFlowGenerationRef.current;
+    void getSlackAppManifestFlow({ state: storedState }).then((result) => {
+      if (cancelled || slackManifestFlowGenerationRef.current !== generation) return;
+      const flow = result;
+      if (flow.agentId !== agentId) {
+        deleteSlackManifestFlowState(companyId, agentId);
+        return;
+      }
+      if (config.label.trim() && flow.label && flow.label !== config.label.trim()) {
+        deleteSlackManifestFlowState(companyId, agentId);
+        return;
+      }
+      if (config.slackEventsRequestUrl.trim() && flow.eventsRequestUrl !== config.slackEventsRequestUrl.trim()) {
+        deleteSlackManifestFlowState(companyId, agentId);
+        return;
+      }
+      if (!config.slackEventsRequestUrl.trim()) {
+        updateField("slackEventsRequestUrl", flow.eventsRequestUrl);
+      }
+      setSlackManifestFlow(flow);
+      setSlackManifestCopied(false);
+    }).catch((err) => {
+      if (cancelled) return;
+      const message = err instanceof Error ? err.message : String(err);
+      const isDefinitivelyGone = /unknown or expired|already been used|has expired/i.test(message);
+      if (isDefinitivelyGone) {
+        deleteSlackManifestFlowState(companyId, agentId);
+      } else {
+        setSlackManifestError(
+          `Could not restore the in-progress Slack App manifest flow (${message}). It has not been discarded - reload or try again.`
+        );
+      }
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [config, getSlackAppManifestFlow, slackManifestFlow, companyId]);
+  async function handleResumeSlackAppManifestFlow() {
+    if (!config) return;
+    const state = slackResumeStateInput.trim();
+    if (!state) return;
+    const generation = slackManifestFlowGenerationRef.current;
+    setSlackResumeBusy(true);
+    setSlackResumeError(null);
+    try {
+      const flow = await getSlackAppManifestFlow({ state });
+      if (slackManifestFlowGenerationRef.current !== generation) return;
+      if (flow.agentId !== config.agentId.trim()) {
+        throw new Error("This state token belongs to a different agent than the one currently selected.");
+      }
+      if (config.label.trim() && flow.label && flow.label !== config.label.trim()) {
+        throw new Error("This state token belongs to a different label than the one currently entered.");
+      }
+      if (config.slackEventsRequestUrl.trim() && flow.eventsRequestUrl !== config.slackEventsRequestUrl.trim()) {
+        throw new Error("This state token belongs to a different Events Request URL than the one currently entered.");
+      }
+      if (!config.slackEventsRequestUrl.trim()) {
+        updateField("slackEventsRequestUrl", flow.eventsRequestUrl);
+      }
+      setSlackManifestFlow(flow);
+      setSlackManifestCopied(false);
+      setSlackManifestError(null);
+      writeSlackManifestFlowState(companyId, config.agentId.trim(), flow.state);
+    } catch (err) {
+      if (slackManifestFlowGenerationRef.current !== generation) return;
+      setSlackResumeError(err instanceof Error ? err.message : "Could not restore the Slack App manifest flow for that state token.");
+    } finally {
+      if (slackManifestFlowGenerationRef.current === generation) {
+        setSlackResumeBusy(false);
+      }
+    }
+  }
+  async function handleCreateSlackAppManifest() {
+    if (!config) return;
+    if (config.provider !== SLACK_IDENTITY_PROVIDER_ID) {
+      setSlackManifestError("Slack App setup is only available for the Slack provider.");
+      return;
+    }
+    const generation = slackManifestFlowGenerationRef.current;
+    setSlackManifestBusy(true);
+    setSlackManifestError(null);
+    setSlackSaveResult(null);
+    try {
+      const result = await createSlackAppManifest({
+        agentId: config.agentId.trim(),
+        provider: config.provider,
+        label: config.label.trim(),
+        eventsRequestUrl: config.slackEventsRequestUrl.trim()
+      });
+      if (slackManifestFlowGenerationRef.current !== generation) return;
+      setSlackManifestFlow(result);
+      setSlackManifestCopied(false);
+      writeSlackManifestFlowState(companyId, config.agentId.trim(), result.state);
+    } catch (err) {
+      if (slackManifestFlowGenerationRef.current !== generation) return;
+      setSlackManifestError(err instanceof Error ? err.message : "Failed to create Slack App manifest");
+    } finally {
+      if (slackManifestFlowGenerationRef.current === generation) {
+        setSlackManifestBusy(false);
+      }
+    }
+  }
+  async function handleSaveSlackInstallMetadata() {
+    if (!config || !slackManifestFlow) return;
+    const generation = ++slackSaveGenerationRef.current;
+    setSlackSaveBusy(true);
+    setSlackManifestError(null);
+    try {
+      const targetAgentId = config.agentId.trim();
+      const previousAgentId = config.previousAgentId.trim();
+      const botTokenSecretId = config.slackBotTokenSecretId.trim();
+      const signingSecretId = config.slackSigningSecretId.trim();
+      const result = await saveSlackInstallMetadata({
+        state: slackManifestFlow.state,
+        agentId: targetAgentId,
+        teamId: config.slackTeamId.trim(),
+        appId: config.slackAppId.trim(),
+        botUserId: config.slackBotUserId.trim(),
+        botTokenSecretId,
+        signingSecretId,
+        ...config.slackDefaultChannel.trim() ? { defaultChannel: config.slackDefaultChannel.trim() } : {}
+      });
+      if (slackSaveGenerationRef.current !== generation) {
+        return;
+      }
+      if (previousAgentId && previousAgentId !== targetAgentId) {
+        try {
+          await deleteConfig({ agentId: previousAgentId, provider: SLACK_IDENTITY_PROVIDER_ID });
+        } catch (err) {
+          setSlackManifestError(
+            `Slack install metadata saved, but could not remove the previous identity for ${previousAgentId}: ${err instanceof Error ? err.message : "unknown error"}. Use "Retry cleanup" below.`
+          );
+          setSlackCleanupPendingAgentId(previousAgentId);
+          setSlackCleanupError(null);
+          slackCleanupPendingResultRef.current = result;
+          setSlackManifestFlow(null);
+          deleteSlackManifestFlowState(companyId, targetAgentId);
+          await refresh();
+          await handleCheckSlackStatus();
+          return;
+        }
+      }
+      setSlackSaveResult(result);
+      setSlackManifestFlow(null);
+      deleteSlackManifestFlowState(companyId, targetAgentId);
+      patchFormState((prev) => ({ ...prev, previousAgentId: result.agentId }));
+      await refresh();
+      if (hasPersistedIdentity) {
+        await handleCheckSlackStatus();
+      }
+    } catch (err) {
+      if (slackSaveGenerationRef.current !== generation) return;
+      setSlackManifestError(err instanceof Error ? err.message : "Failed to save Slack install metadata");
+    } finally {
+      if (slackSaveGenerationRef.current === generation) {
+        setSlackSaveBusy(false);
+      }
+    }
+  }
+  async function handleDiscoverSlackInstallMetadata() {
+    if (!config) return;
+    const botTokenSecretId = config.slackBotTokenSecretId.trim();
+    if (!botTokenSecretId) return;
+    const generation = ++slackDiscoveryGenerationRef.current;
+    setSlackDiscoveryBusy(true);
+    setSlackDiscoveryError(null);
+    try {
+      const result = await discoverSlackInstallMetadata({ botTokenSecretId });
+      if (slackDiscoveryGenerationRef.current !== generation) return;
+      const teamId = result.teamId?.trim();
+      const botUserId = result.botUserId?.trim();
+      const appId = result.appId?.trim();
+      if (!teamId || !botUserId || !appId) {
+        throw new Error("Slack did not return the workspace ID, App ID, and bot user ID for this token.");
+      }
+      updateField("slackTeamId", teamId);
+      updateField("slackAppId", appId);
+      updateField("slackBotUserId", botUserId);
+    } catch (err) {
+      if (slackDiscoveryGenerationRef.current !== generation) return;
+      setSlackDiscoveryError(actionErrorMessage(err, "Could not detect Slack installation metadata"));
+    } finally {
+      if (slackDiscoveryGenerationRef.current === generation) {
+        setSlackDiscoveryBusy(false);
+      }
+    }
+  }
+  async function handleRetrySlackCleanup() {
+    const pendingAgentId = slackCleanupPendingAgentId;
+    const pendingResult = slackCleanupPendingResultRef.current;
+    if (!pendingAgentId || !pendingResult) return;
+    const generation = slackSaveGenerationRef.current;
+    setSlackCleanupBusy(true);
+    setSlackCleanupError(null);
+    try {
+      await deleteConfig({ agentId: pendingAgentId, provider: SLACK_IDENTITY_PROVIDER_ID });
+      if (slackSaveGenerationRef.current !== generation) return;
+      setSlackCleanupPendingAgentId(null);
+      slackCleanupPendingResultRef.current = null;
+      setSlackManifestError(null);
+      setSlackSaveResult(pendingResult);
+      patchFormState((prev) => ({ ...prev, previousAgentId: pendingResult.agentId }));
+      await refresh();
+    } catch (err) {
+      if (slackSaveGenerationRef.current !== generation) return;
+      setSlackCleanupError(
+        err instanceof Error ? err.message : `Failed to remove the previous identity for ${pendingAgentId}`
+      );
+    } finally {
+      if (slackSaveGenerationRef.current === generation) {
+        setSlackCleanupBusy(false);
+      }
+    }
+  }
+  async function handleCheckSlackStatus() {
+    const agentId = config?.agentId?.trim();
+    if (!agentId) return;
+    const generation = ++slackStatusGenerationRef.current;
+    setSlackStatusLoading(true);
+    setSlackStatusError(null);
+    try {
+      const result = await slackBotWhoami({ agentId, companyId });
+      if (slackStatusGenerationRef.current !== generation) return;
+      const resultError = result?.error;
+      if (resultError) {
+        setSlackStatus(null);
+        setSlackStatusError(typeof resultError === "string" ? resultError : "Identity metadata unavailable");
+        return;
+      }
+      const data = result?.data ?? result;
+      setSlackStatus(data ?? null);
+    } catch (err) {
+      if (slackStatusGenerationRef.current !== generation) return;
+      setSlackStatus(null);
+      setSlackStatusError(err instanceof Error ? err.message : "Identity metadata unavailable");
+    } finally {
+      if (slackStatusGenerationRef.current === generation) {
+        setSlackStatusLoading(false);
+      }
+    }
+  }
+  async function handleReinstallSlackApp() {
+    if (!config) return;
+    const confirmed = window.confirm(
+      "Reinstall the Slack App for this identity? This creates a new Slack App manifest flow; you'll need to re-create/reinstall the app on Slack and paste back the resulting IDs and bot token secret."
+    );
+    if (!confirmed) return;
+    await handleCreateSlackAppManifest();
+  }
+  async function handleLegacySlackRebind() {
+    if (!config?.agentId.trim()) return;
+    const signingSecretId = config.slackSigningSecretId.trim();
+    if (config.slackLegacySigningSecretRequired === "true" && !signingSecretId) {
+      setLegacySlackRebindError(
+        "Select or enter the Paperclip company secret UUID containing the Slack signing secret before rebinding."
+      );
+      return;
+    }
+    setLegacySlackRebindBusy(true);
+    setLegacySlackRebindError(null);
+    try {
+      const result = await rebindLegacySlackCredentials({
+        agentId: config.agentId.trim(),
+        ...signingSecretId ? { signingSecretId } : {}
+      });
+      setLegacySlackRebindResult(result);
+      await refresh();
+    } catch (error) {
+      setLegacySlackRebindResult(null);
+      setLegacySlackRebindError(actionErrorMessage(error, "Could not rebind released Slack credentials"));
+    } finally {
+      setLegacySlackRebindBusy(false);
+    }
+  }
+  return {
+    validationExtra: { slackSaveResult, slackSaveBusy },
+    reset,
+    slackManifestFlow,
+    slackManifestBusy,
+    slackSaveBusy,
+    slackManifestError,
+    slackSaveResult,
+    slackManifestCopied,
+    slackDiscoveryBusy,
+    slackDiscoveryError,
+    setSlackManifestCopied,
+    setSlackManifestError,
+    slackResumeStateInput,
+    setSlackResumeStateInput,
+    slackResumeBusy,
+    slackResumeError,
+    handleResumeSlackAppManifestFlow,
+    handleCreateSlackAppManifest,
+    handleDiscoverSlackInstallMetadata,
+    handleSaveSlackInstallMetadata,
+    slackCleanupPendingAgentId,
+    slackCleanupBusy,
+    slackCleanupError,
+    handleRetrySlackCleanup,
+    slackStatus,
+    slackStatusLoading,
+    slackStatusError,
+    handleCheckSlackStatus,
+    hasPersistedIdentity,
+    handleReinstallSlackApp,
+    legacySlackRebindBusy,
+    legacySlackRebindError,
+    legacySlackRebindResult,
+    handleLegacySlackRebind,
+    updateField,
+    secretOptions: input.secretOptions,
+    secretsLoading: input.secretsLoading,
+    secretsError: input.secretsError,
+    companyId: input.companyId
+  };
+}
+function getSecretFieldHint(input) {
+  if (!input.companyId) {
+    return "No company context is available, so paste the Paperclip secret UUID manually.";
+  }
+  if (input.secretsLoading) {
+    return "Loading Paperclip secrets...";
+  }
+  if (input.secretsError) {
+    return `Could not load Paperclip secrets (${input.secretsError}); paste the secret UUID manually.`;
+  }
+  if (!input.hasSecretOptions) {
+    return "No Paperclip secrets were found; paste the bot token secret UUID manually.";
+  }
+  return "Saved as a Paperclip secret reference for the Slack bot token. There is no private-key or file fallback for Slack.";
+}
+function getSigningSecretFieldHint(input) {
+  if (!input.companyId) {
+    return "No company context is available, so paste the Paperclip secret UUID manually.";
+  }
+  if (input.secretsLoading) {
+    return "Loading Paperclip secrets...";
+  }
+  if (input.secretsError) {
+    return `Could not load Paperclip secrets (${input.secretsError}); paste the secret UUID manually.`;
+  }
+  if (!input.hasSecretOptions) {
+    return "No Paperclip secrets were found; paste the signing secret UUID manually.";
+  }
+  return "Saved as a Paperclip secret reference for Slack request signature verification.";
+}
+function formatSecretOption(secret) {
+  const label = secret.name || secret.key || secret.id;
+  const details = [secret.key && secret.key !== label ? secret.key : null, secret.status, secret.provider].filter(Boolean).join(" - ");
+  return details ? `${label} (${details})` : label;
+}
+function SlackCredentialStep(props) {
+  const { state, config } = props;
+  const {
+    slackManifestFlow,
+    slackManifestBusy,
+    slackSaveBusy,
+    slackManifestError,
+    slackSaveResult,
+    slackManifestCopied,
+    slackDiscoveryBusy,
+    slackDiscoveryError,
+    setSlackManifestCopied,
+    setSlackManifestError,
+    slackResumeStateInput,
+    setSlackResumeStateInput,
+    slackResumeBusy,
+    slackResumeError,
+    handleResumeSlackAppManifestFlow,
+    handleCreateSlackAppManifest,
+    handleDiscoverSlackInstallMetadata,
+    handleSaveSlackInstallMetadata,
+    slackCleanupPendingAgentId,
+    slackCleanupBusy,
+    slackCleanupError,
+    handleRetrySlackCleanup,
+    slackStatus,
+    slackStatusLoading,
+    slackStatusError,
+    handleReinstallSlackApp,
+    legacySlackRebindBusy,
+    legacySlackRebindError,
+    legacySlackRebindResult,
+    handleLegacySlackRebind,
+    hasPersistedIdentity,
+    validationExtra,
+    updateField,
+    secretOptions,
+    secretsLoading,
+    secretsError,
+    companyId
+  } = state;
+  const hasSecretOptions = secretOptions.length > 0;
+  const credentialComplete = Boolean(
+    slackSaveResult && slackSaveResult.teamId === config.slackTeamId.trim() && slackSaveResult.appId === config.slackAppId.trim() && slackSaveResult.botUserId === config.slackBotUserId.trim() && slackSaveResult.eventsRequestUrl === config.slackEventsRequestUrl.trim() && slackSaveResult.botTokenSecretId === config.slackBotTokenSecretId.trim() && slackSaveResult.signingSecretId === config.slackSigningSecretId.trim() && (slackSaveResult.defaultChannel ?? "") === config.slackDefaultChannel.trim() && !validationExtra.slackSaveBusy
+  );
+  const hasLegacyCredentialRecovery = Boolean(config.slackLegacyCredentialStatus);
+  return /* @__PURE__ */ jsxs("fieldset", { style: fieldsetStyle, children: [
+    /* @__PURE__ */ jsx("legend", { style: legendStyle, children: "Slack App setup" }),
+    hasPersistedIdentity && /* @__PURE__ */ jsx(
+      SlackStatusPanel,
+      {
+        agentId: config.agentId,
+        label: config.label,
+        loading: slackStatusLoading,
+        status: slackStatus,
+        error: slackStatusError
+      }
+    ),
+    hasPersistedIdentity && config.slackLegacyCredentialStatus && /* @__PURE__ */ jsx(
+      LegacySlackCredentialRebindPanel,
+      {
+        status: config.slackLegacyCredentialStatus,
+        signingSecretRequired: config.slackLegacySigningSecretRequired === "true",
+        signingSecretReady: Boolean(config.slackSigningSecretId.trim()),
+        busy: legacySlackRebindBusy,
+        error: legacySlackRebindError,
+        result: legacySlackRebindResult,
+        onRebind: handleLegacySlackRebind
+      }
+    ),
+    !credentialComplete && !hasLegacyCredentialRecovery && /* @__PURE__ */ jsx("div", { style: validationNoticeStyle, children: "Create the Slack App manifest, install it, and paste back the team/app/bot IDs plus bot token and signing secret references, then save install metadata before this identity can be saved. Do not verify the Request URL in Slack yet. Paperclip cannot answer Slack's verification challenge until the signing secret reference has been saved." }),
+    !hasLegacyCredentialRecovery && /* @__PURE__ */ jsxs("div", { style: inlineNoticeStyle, children: [
+      /* @__PURE__ */ jsx("strong", { children: "Create a Slack App from a manifest." }),
+      ' Slack does not support a prefilled deep link for manifests, so Paperclip generates the manifest JSON below for you to copy, then opens the plain Slack "create app" page where you paste it in via "From an app manifest".'
+    ] }),
+    !hasLegacyCredentialRecovery && /* @__PURE__ */ jsxs("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsxs("span", { children: [
+        "Events Request URL ",
+        /* @__PURE__ */ jsx("span", { style: requiredStyle, children: "*" })
+      ] }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "url",
+          value: config.slackEventsRequestUrl,
+          onChange: (e) => updateField("slackEventsRequestUrl", e.target.value),
+          placeholder: "https://your-public-tunnel.example/events",
+          style: inputStyle,
+          disabled: slackManifestBusy || slackSaveBusy || Boolean(slackManifestFlow)
+        }
+      ),
+      /* @__PURE__ */ jsx("span", { style: hintStyle, children: "Public HTTPS URL for the local Slack Events adapter. It must use the exact /events path." })
+    ] }),
+    !hasPersistedIdentity && /* @__PURE__ */ jsx("div", { style: formActionsStyle, children: /* @__PURE__ */ jsx(
+      "button",
+      {
+        type: "button",
+        onClick: () => void handleCreateSlackAppManifest(),
+        disabled: slackManifestBusy || slackSaveBusy || slackResumeBusy || !config.agentId || !config.label || !config.slackEventsRequestUrl.trim(),
+        style: secondaryButtonStyle,
+        children: slackManifestBusy ? "Working..." : "Create Slack App manifest"
+      }
+    ) }),
+    !hasLegacyCredentialRecovery && !slackManifestFlow && /* @__PURE__ */ jsxs("div", { style: formActionsStyle, children: [
+      /* @__PURE__ */ jsxs("label", { style: fieldStyle, children: [
+        /* @__PURE__ */ jsx("span", { children: "Resume an existing manifest flow" }),
+        /* @__PURE__ */ jsx(
+          "input",
+          {
+            type: "text",
+            value: slackResumeStateInput,
+            onChange: (e) => setSlackResumeStateInput(e.target.value),
+            placeholder: "Paste the pc_... state token from a previous session",
+            style: inputStyle
+          }
+        ),
+        /* @__PURE__ */ jsx("span", { style: hintStyle, children: "Reloading settings or closing this editor loses the in-progress manifest flow from local state. If you saved the state token from when the manifest was created, paste it here to resume within its 30-minute server-side window instead of creating a new Slack App." })
+      ] }),
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => void handleResumeSlackAppManifestFlow(),
+          disabled: slackResumeBusy || slackManifestBusy || slackSaveBusy || !slackResumeStateInput.trim(),
+          style: secondaryButtonStyle,
+          children: slackResumeBusy ? "Restoring..." : "Restore flow"
+        }
+      )
+    ] }),
+    slackResumeError && /* @__PURE__ */ jsx("span", { style: errorStyle, children: slackResumeError }),
+    slackManifestFlow && /* @__PURE__ */ jsxs("div", { style: manifestPanelStyle, children: [
+      /* @__PURE__ */ jsxs("label", { style: fieldStyle, children: [
+        /* @__PURE__ */ jsx("span", { children: "Manifest JSON" }),
+        /* @__PURE__ */ jsx(
+          "textarea",
+          {
+            readOnly: true,
+            value: slackManifestFlow.manifest,
+            style: { ...textareaStyle, minHeight: 320, fontFamily: "ui-monospace, SFMono-Regular, Menlo, monospace" }
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxs("div", { style: formActionsStyle, children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void copyTextToClipboard(slackManifestFlow.manifest).then(() => {
+              setSlackManifestCopied(true);
+              setSlackManifestError(null);
+            }).catch(() => {
+              setSlackManifestCopied(false);
+              setSlackManifestError("Could not copy the manifest JSON to the clipboard. Select the text above and copy it manually.");
+            }),
+            style: secondaryButtonStyle,
+            children: slackManifestCopied ? "Copied!" : "Copy manifest JSON"
+          }
+        ),
+        /* @__PURE__ */ jsx("a", { href: slackManifestFlow.createAppUrl, target: "_blank", rel: "noreferrer", style: linkStyle, children: 'Open Slack "Create an app" page' })
+      ] }),
+      /* @__PURE__ */ jsx("span", { style: hintStyle, children: 'On the Slack page, choose "From an app manifest," select the workspace, then paste the copied JSON. After Slack creates and you install the app, come back and paste the resulting IDs below. Slack may show the Request URL as unverified. Leave it unverified until you save the signing secret reference in Paperclip.' }),
+      /* @__PURE__ */ jsxs("label", { style: fieldStyle, children: [
+        /* @__PURE__ */ jsx("span", { children: "Flow state token" }),
+        /* @__PURE__ */ jsx("input", { type: "text", readOnly: true, value: slackManifestFlow.state, style: inputStyle }),
+        /* @__PURE__ */ jsx("span", { style: hintStyle, children: 'Save this token if you might reload settings or close this editor before finishing setup. Paste it into "Resume an existing manifest flow" above to restore this in-progress flow within its 30-minute window.' })
+      ] })
+    ] }),
+    slackManifestError && /* @__PURE__ */ jsx("span", { style: errorStyle, children: slackManifestError }),
+    /* @__PURE__ */ jsxs("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsxs("span", { children: [
+        "Team ID ",
+        /* @__PURE__ */ jsx("span", { style: requiredStyle, children: "*" })
+      ] }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "text",
+          value: config.slackTeamId,
+          onChange: (e) => updateField("slackTeamId", e.target.value),
+          placeholder: "e.g. T0123456789",
+          style: inputStyle,
+          disabled: slackSaveBusy
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsxs("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsxs("span", { children: [
+        "App ID ",
+        /* @__PURE__ */ jsx("span", { style: requiredStyle, children: "*" })
+      ] }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "text",
+          value: config.slackAppId,
+          onChange: (e) => updateField("slackAppId", normalizeSlackAppIdInput(e.target.value)),
+          placeholder: "A0123456789 or https://api.slack.com/apps/A0123456789/general",
+          style: inputStyle,
+          disabled: slackSaveBusy
+        }
+      ),
+      /* @__PURE__ */ jsx("span", { style: hintStyle, children: "Paste the App ID or the Slack app settings URL. Paperclip extracts the App ID from the URL." })
+    ] }),
+    /* @__PURE__ */ jsxs("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsxs("span", { children: [
+        "Bot User ID ",
+        /* @__PURE__ */ jsx("span", { style: requiredStyle, children: "*" })
+      ] }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "text",
+          value: config.slackBotUserId,
+          onChange: (e) => updateField("slackBotUserId", e.target.value),
+          placeholder: "e.g. U0123456789",
+          style: inputStyle,
+          disabled: slackSaveBusy
+        }
+      )
+    ] }),
+    !hasLegacyCredentialRecovery && /* @__PURE__ */ jsxs("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsxs("span", { children: [
+        "Bot token Paperclip secret UUID ",
+        /* @__PURE__ */ jsx("span", { style: requiredStyle, children: "*" })
+      ] }),
+      hasSecretOptions ? /* @__PURE__ */ jsxs(
+        "select",
+        {
+          value: config.slackBotTokenSecretId,
+          onChange: (e) => updateField("slackBotTokenSecretId", e.target.value),
+          style: inputStyle,
+          disabled: slackSaveBusy || slackDiscoveryBusy,
+          children: [
+            /* @__PURE__ */ jsx("option", { value: "", children: "No bot token secret reference" }),
+            config.slackBotTokenSecretId && !secretOptions.some((secret) => secret.id === config.slackBotTokenSecretId) && /* @__PURE__ */ jsxs("option", { value: config.slackBotTokenSecretId, children: [
+              config.slackBotTokenSecretId,
+              " (saved)"
+            ] }),
+            secretOptions.map((secret) => /* @__PURE__ */ jsx("option", { value: secret.id, children: formatSecretOption(secret) }, secret.id))
+          ]
+        }
+      ) : /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "text",
+          value: config.slackBotTokenSecretId,
+          onChange: (e) => updateField("slackBotTokenSecretId", e.target.value),
+          placeholder: "Company secret UUID containing the Slack bot token",
+          style: inputStyle,
+          disabled: slackSaveBusy || slackDiscoveryBusy
+        }
+      ),
+      /* @__PURE__ */ jsxs("span", { style: hintStyle, children: [
+        getSecretFieldHint({ companyId, secretsLoading, secretsError, hasSecretOptions }),
+        " The bot token itself is never stored in this config; only the secret reference is."
+      ] })
+    ] }),
+    !hasLegacyCredentialRecovery && /* @__PURE__ */ jsxs("div", { style: formActionsStyle, children: [
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => void handleDiscoverSlackInstallMetadata(),
+          disabled: slackSaveBusy || slackDiscoveryBusy || !config.slackBotTokenSecretId.trim(),
+          style: secondaryButtonStyle,
+          children: slackDiscoveryBusy ? "Detecting..." : "Detect Slack installation IDs"
+        }
+      ),
+      /* @__PURE__ */ jsx("span", { style: hintStyle, children: "Uses the selected bot token secret to fill Team ID, App ID, and Bot User ID." })
+    ] }),
+    !hasLegacyCredentialRecovery && slackDiscoveryError && /* @__PURE__ */ jsx("span", { style: errorStyle, children: slackDiscoveryError }),
+    (!hasLegacyCredentialRecovery || config.slackLegacySigningSecretRequired === "true") && /* @__PURE__ */ jsxs("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsxs("span", { children: [
+        "Signing secret Paperclip secret UUID ",
+        /* @__PURE__ */ jsx("span", { style: requiredStyle, children: "*" })
+      ] }),
+      hasSecretOptions ? /* @__PURE__ */ jsxs(
+        "select",
+        {
+          value: config.slackSigningSecretId,
+          onChange: (e) => updateField("slackSigningSecretId", e.target.value),
+          style: inputStyle,
+          disabled: slackSaveBusy,
+          children: [
+            /* @__PURE__ */ jsx("option", { value: "", children: "No signing secret reference" }),
+            config.slackSigningSecretId && !secretOptions.some((secret) => secret.id === config.slackSigningSecretId) && /* @__PURE__ */ jsxs("option", { value: config.slackSigningSecretId, children: [
+              config.slackSigningSecretId,
+              " (saved)"
+            ] }),
+            secretOptions.map((secret) => /* @__PURE__ */ jsx("option", { value: secret.id, children: formatSecretOption(secret) }, secret.id))
+          ]
+        }
+      ) : /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "text",
+          value: config.slackSigningSecretId,
+          onChange: (e) => updateField("slackSigningSecretId", e.target.value),
+          placeholder: "Company secret UUID containing the Slack signing secret",
+          style: inputStyle,
+          disabled: slackSaveBusy
+        }
+      ),
+      /* @__PURE__ */ jsxs("span", { style: hintStyle, children: [
+        getSigningSecretFieldHint({ companyId, secretsLoading, secretsError, hasSecretOptions }),
+        " The signing secret itself is never stored in this config; only the secret reference is."
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsx("span", { children: "Default channel" }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          type: "text",
+          value: config.slackDefaultChannel,
+          onChange: (e) => updateField("slackDefaultChannel", e.target.value),
+          placeholder: "e.g. C0123456789",
+          style: inputStyle,
+          disabled: slackSaveBusy
+        }
+      ),
+      /* @__PURE__ */ jsx("span", { style: hintStyle, children: "Optional. Must be a Slack conversation ID starting with C, D, or G." })
+    ] }),
+    !hasLegacyCredentialRecovery && /* @__PURE__ */ jsx("div", { style: formActionsStyle, children: /* @__PURE__ */ jsx(
+      "button",
+      {
+        type: "button",
+        onClick: () => void handleSaveSlackInstallMetadata(),
+        disabled: slackManifestBusy || slackSaveBusy || Boolean(slackCleanupPendingAgentId) || !slackManifestFlow || !config.slackTeamId.trim() || !config.slackAppId.trim() || !config.slackBotUserId.trim() || !config.slackBotTokenSecretId.trim() || !config.slackSigningSecretId.trim(),
+        style: secondaryButtonStyle,
+        children: slackSaveBusy ? "Saving..." : "Save Slack install metadata"
+      }
+    ) }),
+    !hasLegacyCredentialRecovery && !slackManifestFlow && !slackCleanupPendingAgentId && !slackSaveResult && /* @__PURE__ */ jsx("span", { style: hintStyle, children: "Create the manifest above first; saving install metadata requires an active manifest flow state." }),
+    slackCleanupPendingAgentId && /* @__PURE__ */ jsxs("div", { style: validationNoticeStyle, children: [
+      /* @__PURE__ */ jsxs("div", { children: [
+        "Slack install metadata was saved, but Paperclip could not remove the previous identity for",
+        " ",
+        /* @__PURE__ */ jsx("strong", { children: slackCleanupPendingAgentId }),
+        ". The new identity is safe; retry cleanup below rather than saving again (the manifest flow used for this save has already been consumed)."
+      ] }),
+      /* @__PURE__ */ jsx("div", { style: formActionsStyle, children: /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => void handleRetrySlackCleanup(),
+          disabled: slackCleanupBusy,
+          style: secondaryButtonStyle,
+          children: slackCleanupBusy ? "Retrying..." : "Retry cleanup"
+        }
+      ) }),
+      slackCleanupError && /* @__PURE__ */ jsx("span", { style: errorStyle, children: slackCleanupError })
+    ] }),
+    slackSaveResult && /* @__PURE__ */ jsxs("div", { style: successStyle, children: [
+      "Slack install metadata saved for team ",
+      slackSaveResult.teamId,
+      ". Return to Slack's App Manifest page now, verify the Request URL, and save the manifest changes. If verification failed before this save, retry it now."
+    ] }),
+    hasPersistedIdentity && !hasLegacyCredentialRecovery && /* @__PURE__ */ jsxs("details", { children: [
+      /* @__PURE__ */ jsx("summary", { children: "Reinstall the Slack App for this identity" }),
+      /* @__PURE__ */ jsxs("div", { style: { display: "grid", gap: "0.75rem", marginTop: "0.75rem" }, children: [
+        /* @__PURE__ */ jsxs("div", { style: inlineNoticeStyle, children: [
+          /* @__PURE__ */ jsx("strong", { children: "Reinstall from a manifest." }),
+          " This re-runs Slack App setup for this identity - creating a new manifest flow, requiring you to reinstall the app on Slack and paste back the resulting IDs and bot token secret. It does not remove the currently saved install metadata unless you save over it."
+        ] }),
+        /* @__PURE__ */ jsx("div", { style: formActionsStyle, children: /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void handleReinstallSlackApp(),
+            disabled: slackManifestBusy || slackSaveBusy || slackResumeBusy || !config.slackEventsRequestUrl.trim(),
+            style: secondaryButtonStyle,
+            children: slackManifestBusy ? "Working..." : "Reinstall"
+          }
+        ) })
+      ] })
+    ] })
+  ] });
+}
+function LegacySlackCredentialRebindPanel(props) {
+  if (props.status === "conflict") {
+    return /* @__PURE__ */ jsxs("div", { style: validationNoticeStyle, children: [
+      /* @__PURE__ */ jsx("strong", { children: "Released Slack credentials need operator review." }),
+      " The existing company Slack binding conflicts with the public identity or released sidecar references. Paperclip will not overwrite it. Remove or correct the conflicting host binding, then reopen this identity and rebind; reinstall is not required."
+    ] });
+  }
+  const cleanupPending = props.status === "cleanup-pending" || props.result?.status === "cleanup-pending";
+  return /* @__PURE__ */ jsxs("div", { style: cleanupPending ? inlineNoticeStyle : validationNoticeStyle, children: [
+    /* @__PURE__ */ jsxs("div", { children: [
+      /* @__PURE__ */ jsx("strong", { children: cleanupPending ? "Legacy Slack sidecar cleanup pending." : "Upgrade action required." }),
+      " ",
+      cleanupPending ? "The company host binding is working. Retry to remove only the released Slack sidecar entry." : "Slack v0.1.7/v0.1.8 saved credential UUID references in the local sidecar. Rebind copies those references into this company's authorized Slack config without reading either secret value.",
+      !cleanupPending && props.signingSecretRequired ? " This released entry has no signing-secret reference; select or enter its Paperclip company secret UUID below first." : ""
+    ] }),
+    /* @__PURE__ */ jsx("div", { style: formActionsStyle, children: /* @__PURE__ */ jsx(
+      "button",
+      {
+        type: "button",
+        onClick: () => void props.onRebind(),
+        disabled: props.busy || props.signingSecretRequired && !props.signingSecretReady,
+        style: secondaryButtonStyle,
+        children: props.busy ? "Working..." : cleanupPending ? "Retry legacy cleanup" : "Rebind released credentials"
+      }
+    ) }),
+    props.result?.status === "rebound" && /* @__PURE__ */ jsx("span", { style: successStyle, children: "Released Slack credentials rebound successfully. Close this editor; reinstall is not required." }),
+    props.error && /* @__PURE__ */ jsx("span", { style: errorStyle, children: props.error })
+  ] });
+}
+function SlackStatusPanel(props) {
+  const { agentId, label, loading, status, error } = props;
+  if (loading) {
+    return /* @__PURE__ */ jsxs("div", { style: inlineNoticeStyle, children: [
+      "Loading configured Slack identity metadata for ",
+      label || agentId,
+      "..."
+    ] });
+  }
+  if (error) {
+    return /* @__PURE__ */ jsxs("div", { style: validationNoticeStyle, children: [
+      "Slack identity metadata unavailable for agent ",
+      /* @__PURE__ */ jsx("strong", { children: label || agentId }),
+      " (",
+      error,
+      ")."
+    ] });
+  }
+  if (!status) {
+    return null;
+  }
+  return /* @__PURE__ */ jsxs("div", { style: inlineNoticeStyle, children: [
+    /* @__PURE__ */ jsx("strong", { children: "Configured Slack identity." }),
+    " ",
+    "Saved metadata for agent ",
+    /* @__PURE__ */ jsx("strong", { children: label || agentId }),
+    ": workspace ",
+    status.teamId ?? "unknown",
+    ", app ",
+    status.appId ?? "unknown",
+    ", bot user ",
+    status.botUserId ?? "unknown",
+    status.hasDefaultChannel ? ", default channel configured" : ", no default channel configured",
+    ".",
+    " ",
+    "This reflects saved install metadata only - it does not verify the bot token is still valid; a revoked or stale token is not detected here."
+  ] });
+}
+var slackSettingsUIAdapter = {
+  providerId: SLACK_IDENTITY_PROVIDER_ID,
+  useCredentialStep: useSlackCredentialStep,
+  CredentialStep: SlackCredentialStep,
+  getRemovalConfirmation(entry) {
+    return `Delete agent identity mapping for ${entry.label}? This clears saved Slack install metadata; your Slack app and bot token are not deleted, only unlinked from this agent. To reconnect later, create a new Slack mapping with "Add identity".`;
+  }
+};
+
+// src/providers/github/settings-adapter-ui.tsx
+import { useEffect as useEffect3, useState as useState3 } from "react";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+var MANIFEST_DRAFT_STORAGE_PREFIX = "paperclip-agent-identities:github-app-manifest-draft:";
+function getManifestDraftStorageKey(state) {
+  return MANIFEST_DRAFT_STORAGE_PREFIX + state;
+}
+function writeManifestDraftForm(state, formState) {
+  try {
+    window.sessionStorage.setItem(getManifestDraftStorageKey(state), JSON.stringify(formState));
+  } catch {
+  }
+}
+function readManifestDraftForm(state) {
+  try {
+    const raw = window.sessionStorage.getItem(getManifestDraftStorageKey(state));
+    if (!raw) return null;
+    return normalizeManifestDraftForm(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+function deleteManifestDraftForm(state) {
+  try {
+    window.sessionStorage.removeItem(getManifestDraftStorageKey(state));
+  } catch {
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function readString(value) {
+  return typeof value === "string" ? value : "";
+}
+function normalizeManifestDraftForm(raw) {
+  if (!isRecord(raw)) return null;
+  return {
+    agentId: readString(raw.agentId),
+    provider: readString(raw.provider) || GITHUB_IDENTITY_PROVIDER_ID,
+    label: readString(raw.label),
+    githubUsername: readString(raw.githubUsername),
+    commitName: readString(raw.commitName),
+    commitEmail: readString(raw.commitEmail),
+    githubAppId: readString(raw.githubAppId),
+    githubInstallationId: readString(raw.githubInstallationId),
+    privateKeySecretId: readString(raw.privateKeySecretId),
+    privateKeyFile: readString(raw.privateKeyFile),
+    fallbackTokenSecretId: readString(raw.fallbackTokenSecretId),
+    tokenFile: readString(raw.tokenFile),
+    previousAgentId: readString(raw.previousAgentId),
+    previousGithubAppId: readString(raw.previousGithubAppId),
+    previousGithubInstallationId: readString(raw.previousGithubInstallationId),
+    previousPrivateKeySecretId: readString(raw.previousPrivateKeySecretId),
+    previousPrivateKeyFile: readString(raw.previousPrivateKeyFile)
+  };
+}
+function submitGitHubAppManifest(flow) {
+  const form = document.createElement("form");
+  form.method = "post";
+  form.action = flow.postUrl;
+  form.target = "_blank";
+  form.setAttribute("rel", "noopener noreferrer");
+  const manifest = document.createElement("input");
+  manifest.type = "hidden";
+  manifest.name = "manifest";
+  manifest.value = flow.manifest;
+  form.appendChild(manifest);
+  document.body.appendChild(form);
+  form.submit();
+  form.remove();
+}
+function getManifestReturnUrl() {
+  const url = new URL(window.location.href);
+  url.searchParams.delete("code");
+  url.searchParams.delete("installation_id");
+  url.searchParams.delete("setup_action");
+  url.searchParams.delete("state");
+  url.searchParams.set("githubAppManifest", "1");
+  return url.toString();
+}
+function getAgentDashboardUrl(agentId) {
+  const url = new URL(window.location.href);
+  const companySegment = url.pathname.split("/").filter(Boolean)[0];
+  const agentSegment = encodeURIComponent(agentId);
+  url.pathname = companySegment ? `/${encodeURIComponent(companySegment)}/agents/${agentSegment}/dashboard` : `/agents/${agentSegment}/dashboard`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function getManifestCallbackParams() {
+  const url = new URL(window.location.href);
+  const code = url.searchParams.get("code")?.trim();
+  const installationId = url.searchParams.get("installation_id")?.trim();
+  const state = url.searchParams.get("state")?.trim();
+  if (!state?.startsWith("pc_") || !code && !installationId) return null;
+  return { ...code ? { code } : {}, ...installationId ? { installationId } : {}, state };
+}
+function cleanManifestCallbackParams() {
+  const url = new URL(window.location.href);
+  url.searchParams.delete("code");
+  url.searchParams.delete("installation_id");
+  url.searchParams.delete("setup_action");
+  url.searchParams.delete("state");
+  url.searchParams.delete("githubAppManifest");
+  window.history.replaceState(window.history.state, document.title, url.toString());
+}
+function extractManifestCode(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return "";
+  try {
+    const parsed = new URL(trimmed);
+    return parsed.searchParams.get("code")?.trim() || trimmed;
+  } catch {
+    return trimmed.replace(/^code=/i, "").trim();
+  }
+}
+function useGitHubCredentialStep(input) {
+  const {
+    config,
+    updateField,
+    createGitHubAppManifest,
+    getGitHubAppManifestFlow,
+    convertGitHubAppManifest,
+    identities,
+    agentOptions,
+    companyDisplayName,
+    credentialSidecarPath,
+    getAgentIdentityDefaults: getAgentIdentityDefaults2,
+    toFormState: toFormState2,
+    patchFormState
+  } = input;
+  const [manifestFlow, setManifestFlow] = useState3(null);
+  const [manifestBusy, setManifestBusy] = useState3(false);
+  const [manifestCode, setManifestCode] = useState3("");
+  const [manifestError, setManifestError] = useState3(null);
+  const [manifestResult, setManifestResult] = useState3(null);
+  function reset() {
+    setManifestFlow(null);
+    setManifestCode("");
+    setManifestError(null);
+    setManifestResult(null);
+  }
+  useEffect3(() => {
+    const callback = getManifestCallbackParams();
+    if (!callback) return;
+    let cancelled = false;
+    setManifestBusy(true);
+    setManifestError(null);
+    setManifestResult(null);
+    void getGitHubAppManifestFlow({ state: callback.state }).then((result) => {
+      if (cancelled) return;
+      const flow = result;
+      const savedIdentity = identities.find((entry) => entry.agentId === flow.agentId && entry.provider === flow.provider);
+      const selectedAgent = agentOptions.find((agent) => agent.id === flow.agentId);
+      const defaults = selectedAgent ? getAgentIdentityDefaults2(selectedAgent, companyDisplayName, credentialSidecarPath) : null;
+      const restoredForm = toFormState2(savedIdentity);
+      const draftForm = readManifestDraftForm(callback.state);
+      const conversion = flow.conversion;
+      patchFormState(() => ({
+        ...restoredForm,
+        ...draftForm,
+        agentId: flow.agentId,
+        provider: flow.provider,
+        label: draftForm?.label || restoredForm.label || flow.label,
+        githubUsername: conversion?.githubUsername || draftForm?.githubUsername || restoredForm.githubUsername || defaults?.githubUsername || DEFAULT_BOT_IDENTITY_CONFIG.github.username,
+        commitName: draftForm?.commitName || restoredForm.commitName || defaults?.commitName || "",
+        commitEmail: draftForm?.commitEmail || restoredForm.commitEmail || defaults?.commitEmail || "",
+        githubAppId: conversion?.appId || draftForm?.githubAppId || restoredForm.githubAppId,
+        githubInstallationId: callback.installationId || restoredForm.githubInstallationId,
+        privateKeyFile: conversion?.privateKeyFile || draftForm?.privateKeyFile || restoredForm.privateKeyFile || defaults?.privateKeyFile || ""
+      }));
+      setManifestFlow(flow);
+      setManifestCode(callback.code ?? "");
+      if (callback.installationId) {
+        setManifestResult(conversion ?? null);
+        deleteManifestDraftForm(callback.state);
+        void getGitHubAppManifestFlow({ state: callback.state, consume: true }).catch(() => void 0);
+      }
+      cleanManifestCallbackParams();
+    }).catch((err) => {
+      if (!cancelled) {
+        setManifestError(err instanceof Error ? err.message : "Could not restore GitHub App manifest flow");
+      }
+    }).finally(() => {
+      if (!cancelled) {
+        setManifestBusy(false);
+      }
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [agentOptions, companyDisplayName, credentialSidecarPath, getGitHubAppManifestFlow, identities]);
+  async function handleCreateGitHubAppManifest() {
+    if (!config) return;
+    if (config.provider !== GITHUB_IDENTITY_PROVIDER_ID) {
+      setManifestError("GitHub App setup is only available for the GitHub provider.");
+      return;
+    }
+    setManifestBusy(true);
+    setManifestError(null);
+    setManifestResult(null);
+    try {
+      const result = await createGitHubAppManifest({
+        agentId: config.agentId.trim(),
+        provider: config.provider,
+        label: config.label.trim(),
+        homepageUrl: getAgentDashboardUrl(config.agentId.trim()),
+        callbackUrl: getManifestReturnUrl()
+      });
+      setManifestFlow(result);
+      writeManifestDraftForm(result.state, config);
+      submitGitHubAppManifest(result);
+    } catch (err) {
+      setManifestError(err instanceof Error ? err.message : "Failed to create GitHub App manifest");
+    } finally {
+      setManifestBusy(false);
+    }
+  }
+  async function handleConvertGitHubAppManifest() {
+    if (!manifestFlow || !config) return;
+    setManifestBusy(true);
+    setManifestError(null);
+    try {
+      const result = await convertGitHubAppManifest({
+        state: manifestFlow.state,
+        code: manifestCode.trim()
+      });
+      const nextFormState = {
+        ...config,
+        githubAppId: result.appId,
+        privateKeyFile: result.privateKeyFile,
+        githubUsername: result.githubUsername
+      };
+      writeManifestDraftForm(manifestFlow.state, nextFormState);
+      setManifestResult(result);
+      updateField("githubAppId", result.appId);
+      updateField("privateKeyFile", result.privateKeyFile);
+      updateField("githubUsername", result.githubUsername);
+      window.location.assign(result.installUrl);
+    } catch (err) {
+      setManifestError(err instanceof Error ? err.message : "Failed to convert GitHub App manifest");
+    } finally {
+      setManifestBusy(false);
+    }
+  }
+  return {
+    validationExtra: {},
+    reset,
+    manifestFlow,
+    manifestBusy,
+    manifestCode,
+    setManifestCode,
+    manifestError,
+    manifestResult,
+    handleCreateGitHubAppManifest,
+    handleConvertGitHubAppManifest,
+    updateField,
+    secretOptions: input.secretOptions,
+    secretsLoading: input.secretsLoading,
+    secretsError: input.secretsError,
+    companyId: input.companyId
+  };
+}
+function GitHubAppManifestCreateIntro() {
+  return /* @__PURE__ */ jsxs2("div", { style: inlineNoticeStyle, children: [
+    /* @__PURE__ */ jsx2("strong", { children: "Create a GitHub App with a manifest." }),
+    " This opens GitHub with the required app permissions prefilled. After GitHub creates the app, Paperclip saves the generated private key file, preloads the App ID, opens the install flow, and restores the form with the Installation ID when GitHub redirects back."
+  ] });
+}
+function GitHubAppManifestActions(props) {
+  return /* @__PURE__ */ jsxs2("div", { style: formActionsStyle, children: [
+    /* @__PURE__ */ jsx2(
+      "button",
+      {
+        type: "button",
+        onClick: props.onCreate,
+        disabled: props.manifestBusy || props.disabled,
+        style: secondaryButtonStyle,
+        children: props.manifestBusy ? "Working..." : props.buttonLabel
+      }
+    ),
+    props.manifestFlow && /* @__PURE__ */ jsxs2("span", { style: hintStyle, children: [
+      "Manifest ready for ",
+      props.manifestFlow.appName,
+      ". GitHub should be open in a new tab."
+    ] })
+  ] });
+}
+function GitHubCredentialStep(props) {
+  const { state, config } = props;
+  const { manifestFlow, manifestBusy, manifestCode, setManifestCode, manifestError, manifestResult, handleCreateGitHubAppManifest, handleConvertGitHubAppManifest } = state;
+  const hasExistingGitHubAppCredential = Boolean(
+    config.previousGithubAppId || config.previousGithubInstallationId || config.previousPrivateKeySecretId || config.previousPrivateKeyFile
+  );
+  const hasSecretOptions = state.secretOptions.length > 0;
+  const hasSavedSecretOutsideOptions = Boolean(
+    config.privateKeySecretId && !state.secretOptions.some((secret) => secret.id === config.privateKeySecretId)
+  );
+  const hasSavedFallbackSecretOutsideOptions = Boolean(
+    config.fallbackTokenSecretId && !state.secretOptions.some((secret) => secret.id === config.fallbackTokenSecretId)
+  );
+  return /* @__PURE__ */ jsxs2("fieldset", { style: fieldsetStyle, children: [
+    /* @__PURE__ */ jsx2("legend", { style: legendStyle, children: "GitHub App credential source" }),
+    hasExistingGitHubAppCredential ? /* @__PURE__ */ jsxs2("div", { style: inlineNoticeStyle, children: [
+      /* @__PURE__ */ jsx2("strong", { children: "GitHub App already configured." }),
+      " Edit the fields below to update the saved App ID, Installation ID, or private key source. Creating another manifest is a replacement/rotation flow; it creates a new GitHub App and does not update the existing app in GitHub."
+    ] }) : /* @__PURE__ */ jsx2(GitHubAppManifestCreateIntro, {}),
+    hasExistingGitHubAppCredential ? /* @__PURE__ */ jsxs2("details", { children: [
+      /* @__PURE__ */ jsx2("summary", { children: "Replace this GitHub App with a new manifest-created app" }),
+      /* @__PURE__ */ jsxs2("div", { style: { display: "grid", gap: "0.75rem", marginTop: "0.75rem" }, children: [
+        /* @__PURE__ */ jsx2(GitHubAppManifestCreateIntro, {}),
+        /* @__PURE__ */ jsx2(
+          GitHubAppManifestActions,
+          {
+            manifestBusy,
+            disabled: !config.agentId || !config.label,
+            manifestFlow,
+            onCreate: () => void handleCreateGitHubAppManifest(),
+            buttonLabel: "Create replacement GitHub App on GitHub"
+          }
+        )
+      ] })
+    ] }) : /* @__PURE__ */ jsx2(
+      GitHubAppManifestActions,
+      {
+        manifestBusy,
+        disabled: !config.agentId || !config.label,
+        manifestFlow,
+        onCreate: () => void handleCreateGitHubAppManifest(),
+        buttonLabel: "Create GitHub App on GitHub"
+      }
+    ),
+    manifestFlow && /* @__PURE__ */ jsxs2("div", { style: manifestPanelStyle, children: [
+      /* @__PURE__ */ jsxs2("div", { style: fieldStyle, children: [
+        /* @__PURE__ */ jsx2("span", { style: hintStyle, children: "If a popup was blocked, use this manual form:" }),
+        /* @__PURE__ */ jsxs2("form", { action: manifestFlow.postUrl, method: "post", target: "_blank", children: [
+          /* @__PURE__ */ jsx2("input", { type: "hidden", name: "manifest", value: manifestFlow.manifest }),
+          /* @__PURE__ */ jsx2("button", { type: "submit", style: secondaryButtonStyle, children: "Open GitHub manifest form" })
+        ] })
+      ] }),
+      /* @__PURE__ */ jsxs2("label", { style: fieldStyle, children: [
+        /* @__PURE__ */ jsx2("span", { children: "Callback code" }),
+        /* @__PURE__ */ jsx2(
+          "input",
+          {
+            type: "text",
+            value: manifestCode,
+            onChange: (e) => setManifestCode(extractManifestCode(e.target.value)),
+            placeholder: "Paste GitHub's callback URL or just the code=... value",
+            style: inputStyle
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxs2("div", { style: formActionsStyle, children: [
+        /* @__PURE__ */ jsx2(
+          "button",
+          {
+            type: "button",
+            onClick: () => void handleConvertGitHubAppManifest(),
+            disabled: manifestBusy || !manifestCode.trim(),
+            style: secondaryButtonStyle,
+            children: "Save generated private key and prefill fields"
+          }
+        ),
+        manifestResult && /* @__PURE__ */ jsx2("a", { href: manifestResult.installUrl, target: "_blank", rel: "noreferrer", style: linkStyle, children: "Install GitHub App" })
+      ] })
+    ] }),
+    manifestError && /* @__PURE__ */ jsx2("span", { style: errorStyle, children: manifestError }),
+    manifestResult && config.githubInstallationId ? /* @__PURE__ */ jsxs2("span", { style: successStyle, children: [
+      "GitHub App ",
+      manifestResult.appName,
+      " installed. Review the prefilled Installation ID, then save this identity."
+    ] }) : manifestResult ? /* @__PURE__ */ jsxs2("span", { style: successStyle, children: [
+      "GitHub App ",
+      manifestResult.appName,
+      " created. Install it on GitHub; Paperclip will prefill the Installation ID when GitHub redirects back."
+    ] }) : null,
+    hasExistingGitHubAppCredential && /* @__PURE__ */ jsxs2("div", { style: formActionsStyle, children: [
+      /* @__PURE__ */ jsx2("a", { href: "https://github.com/settings/apps", target: "_blank", rel: "noreferrer", style: linkStyle, children: "Manage GitHub Apps" }),
+      /* @__PURE__ */ jsx2("a", { href: "https://github.com/settings/installations", target: "_blank", rel: "noreferrer", style: linkStyle, children: "Manage GitHub App installations" })
+    ] }),
+    /* @__PURE__ */ jsxs2("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsx2("span", { children: "GitHub App ID" }),
+      /* @__PURE__ */ jsx2(
+        "input",
+        {
+          type: "text",
+          value: config.githubAppId,
+          onChange: (e) => state.updateField("githubAppId", e.target.value),
+          placeholder: "GitHub App ID",
+          style: inputStyle
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsxs2("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsx2("span", { children: "Installation ID" }),
+      /* @__PURE__ */ jsx2(
+        "input",
+        {
+          type: "text",
+          value: config.githubInstallationId,
+          onChange: (e) => state.updateField("githubInstallationId", e.target.value),
+          placeholder: "GitHub App installation ID",
+          style: inputStyle
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsxs2("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsx2("span", { children: "Private key Paperclip secret UUID" }),
+      hasSecretOptions ? /* @__PURE__ */ jsxs2(
+        "select",
+        {
+          value: config.privateKeySecretId,
+          onChange: (e) => state.updateField("privateKeySecretId", e.target.value),
+          style: inputStyle,
+          children: [
+            /* @__PURE__ */ jsx2("option", { value: "", children: "No private key secret reference" }),
+            hasSavedSecretOutsideOptions && /* @__PURE__ */ jsxs2("option", { value: config.privateKeySecretId, children: [
+              config.privateKeySecretId,
+              " (saved)"
+            ] }),
+            state.secretOptions.map((secret) => /* @__PURE__ */ jsx2("option", { value: secret.id, children: formatSecretOption2(secret) }, secret.id))
+          ]
+        }
+      ) : /* @__PURE__ */ jsx2(
+        "input",
+        {
+          type: "text",
+          value: config.privateKeySecretId,
+          onChange: (e) => state.updateField("privateKeySecretId", e.target.value),
+          placeholder: "Company secret UUID containing the GitHub App private key",
+          style: inputStyle
+        }
+      ),
+      /* @__PURE__ */ jsx2("span", { style: hintStyle, children: getSecretFieldHint2({ companyId: state.companyId, secretsLoading: state.secretsLoading, secretsError: state.secretsError, hasSecretOptions }) })
+    ] }),
+    /* @__PURE__ */ jsxs2("label", { style: fieldStyle, children: [
+      /* @__PURE__ */ jsx2("span", { children: "Private key file fallback" }),
+      /* @__PURE__ */ jsx2(
+        "input",
+        {
+          type: "text",
+          value: config.privateKeyFile,
+          onChange: (e) => state.updateField("privateKeyFile", e.target.value),
+          placeholder: "<runtime-home>/.paperclip/agent-identities/github-apps/<agent>/private-key.pem",
+          style: inputStyle
+        }
+      ),
+      /* @__PURE__ */ jsx2("span", { style: hintStyle, children: "Used by plugin tools while a secret UUID is not configured or cannot be resolved. The plugin mints short-lived installation tokens from this private key; it does not store generated tokens." })
+    ] }),
+    /* @__PURE__ */ jsxs2("details", { children: [
+      /* @__PURE__ */ jsx2("summary", { children: "Fallback token source" }),
+      /* @__PURE__ */ jsxs2("div", { style: { display: "grid", gap: "0.75rem", marginTop: "0.75rem" }, children: [
+        /* @__PURE__ */ jsxs2("label", { style: fieldStyle, children: [
+          /* @__PURE__ */ jsx2("span", { children: "Fallback token secret UUID" }),
+          hasSecretOptions ? /* @__PURE__ */ jsxs2(
+            "select",
+            {
+              value: config.fallbackTokenSecretId,
+              onChange: (e) => state.updateField("fallbackTokenSecretId", e.target.value),
+              style: inputStyle,
+              children: [
+                /* @__PURE__ */ jsx2("option", { value: "", children: "No fallback token secret reference" }),
+                hasSavedFallbackSecretOutsideOptions && /* @__PURE__ */ jsxs2("option", { value: config.fallbackTokenSecretId, children: [
+                  config.fallbackTokenSecretId,
+                  " (saved)"
+                ] }),
+                state.secretOptions.map((secret) => /* @__PURE__ */ jsx2("option", { value: secret.id, children: formatSecretOption2(secret) }, secret.id))
+              ]
+            }
+          ) : /* @__PURE__ */ jsx2(
+            "input",
+            {
+              type: "text",
+              value: config.fallbackTokenSecretId,
+              onChange: (e) => state.updateField("fallbackTokenSecretId", e.target.value),
+              placeholder: "Company secret UUID containing a GitHub token",
+              style: inputStyle
+            }
+          ),
+          /* @__PURE__ */ jsx2("span", { style: hintStyle, children: getFallbackTokenSecretFieldHint({ companyId: state.companyId, secretsLoading: state.secretsLoading, secretsError: state.secretsError, hasSecretOptions }) })
+        ] }),
+        /* @__PURE__ */ jsxs2("label", { style: fieldStyle, children: [
+          /* @__PURE__ */ jsx2("span", { children: "Fallback token file" }),
+          /* @__PURE__ */ jsx2(
+            "input",
+            {
+              type: "text",
+              value: config.tokenFile,
+              onChange: (e) => state.updateField("tokenFile", e.target.value),
+              placeholder: "<runtime-home>/.paperclip/agent-identities/tokens/<agent-id>.token",
+              style: inputStyle
+            }
+          ),
+          /* @__PURE__ */ jsx2("span", { style: hintStyle, children: "Fallback token files are available for dev and recovery flows. Prefer GitHub App credentials above." })
+        ] })
+      ] })
+    ] })
+  ] });
+}
+var githubSettingsUIAdapter = {
+  providerId: GITHUB_IDENTITY_PROVIDER_ID,
+  useCredentialStep: useGitHubCredentialStep,
+  CredentialStep: GitHubCredentialStep,
+  getRemovalConfirmation(entry) {
+    return `Delete agent identity mapping for ${entry.label}? This clears the saved GitHub App binding for this agent; the GitHub App itself and its installation are not deleted, only unlinked from this agent. To reconnect later, create a new GitHub mapping with "Add identity".`;
+  }
+};
+
+// src/providers/settings-ui-index.ts
+var ALL_SETTINGS_UI_ADAPTERS = [githubSettingsUIAdapter, slackSettingsUIAdapter];
+var providerSettingsUIRegistry = buildProviderSettingsUIRegistry([...ALL_SETTINGS_UI_ADAPTERS]);
+
+// src/ui/SettingsPage.tsx
+import { Fragment, jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+function SettingsPage(props) {
+  const companyId = props.context.companyId ?? "";
+  const themeMode = usePaperclipThemeMode();
+  const { data, loading, error, refresh } = usePluginData("bot-identity-config", { companyId });
+  const companyDisplayName = getCompanyDisplayName(data?.companyName, props.context.companyPrefix, companyId);
+  const { data: agentsData, loading: agentsLoading, error: agentsError } = usePluginData("paperclip-agents", { companyId });
+  const saveConfig = usePluginAction("save-bot-identity-config");
+  const deleteConfig = usePluginAction("delete-bot-identity-config");
+  const createGitHubAppManifest = usePluginAction("create-github-app-manifest");
+  const getGitHubAppManifestFlow = usePluginAction("get-github-app-manifest-flow");
+  const convertGitHubAppManifest = usePluginAction("convert-github-app-manifest");
+  const createSlackAppManifest = usePluginAction("create-slack-app-manifest");
+  const getSlackAppManifestFlow = usePluginAction("get-slack-app-manifest-flow");
+  const discoverSlackInstallMetadata = usePluginAction("discover-slack-install-metadata");
+  const saveSlackInstallMetadata = usePluginAction("save-slack-install-metadata");
+  const rebindLegacySlackCredentials = usePluginAction(REBIND_LEGACY_SLACK_CREDENTIALS_ACTION);
+  const slackBotWhoami = usePluginAction(slackBotWhoamiToolName);
+  const [formState, setFormState] = useState4(null);
+  const [saving, setSaving] = useState4(false);
+  const [deletingAgentId, setDeletingAgentId] = useState4(null);
+  const [saveError, setSaveError] = useState4(null);
+  const [saveSuccess, setSaveSuccess] = useState4(false);
+  const [secretOptions, setSecretOptions] = useState4([]);
+  const [secretsLoading, setSecretsLoading] = useState4(false);
+  const [secretsError, setSecretsError] = useState4(null);
+  const [activeFormSection, setActiveFormSection] = useState4("identity");
+  const identities = data?.identities ?? [];
+  const agentOptions = agentsData?.agents ?? [];
+  const summary = summarizeIdentitySettings(identities);
+  useEffect4(() => {
+    if (!companyId) {
+      setSecretOptions([]);
+      setSecretsError(null);
+      setSecretsLoading(false);
+      return;
+    }
+    let cancelled = false;
+    setSecretsLoading(true);
+    setSecretsError(null);
+    void loadSecretOptions(companyId).then((secrets) => {
+      if (!cancelled) {
+        setSecretOptions(secrets);
+      }
+    }).catch((err) => {
+      if (!cancelled) {
+        setSecretOptions([]);
+        setSecretsError(err instanceof Error ? err.message : "Could not load Paperclip secrets");
+      }
+    }).finally(() => {
+      if (!cancelled) {
+        setSecretsLoading(false);
+      }
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [companyId]);
+  const hasAgentOptions = agentOptions.length > 0;
+  const config = formState;
+  const persistedAgentId = config?.previousAgentId || config?.agentId;
+  const isEditingExistingIdentity = Boolean(
+    config && identities.some(
+      (entry) => entry.agentId === persistedAgentId && entry.provider === config.provider
+    )
+  );
+  const slackUIState = providerSettingsUIRegistry.get(SLACK_IDENTITY_PROVIDER_ID).useCredentialStep({
+    config,
+    hasPersistedIdentity: isEditingExistingIdentity,
+    updateField: (field, value) => updateField(field, value),
+    refresh,
+    deleteConfig,
+    patchFormState: (patch) => setFormState((prev) => prev ? patch(prev) : prev),
+    secretOptions,
+    secretsLoading,
+    secretsError,
+    companyId,
+    createSlackAppManifest,
+    getSlackAppManifestFlow,
+    discoverSlackInstallMetadata,
+    saveSlackInstallMetadata,
+    rebindLegacySlackCredentials,
+    slackBotWhoami
+  });
+  const githubUIState = providerSettingsUIRegistry.get(GITHUB_IDENTITY_PROVIDER_ID).useCredentialStep({
+    config,
+    hasPersistedIdentity: isEditingExistingIdentity,
+    updateField: (field, value) => updateField(field, value),
+    refresh,
+    deleteConfig,
+    // Unlike Slack's patchFormState (which only ever patches an already-open
+    // dialog), the GitHub OAuth callback effect can fire with the dialog
+    // closed (formState === null) -- the operator left the page entirely to
+    // authorize the GitHub App and is now landing back on a fresh page load.
+    // Falling back to a no-op there (as a plain `prev ? patch(prev) : prev`
+    // would) silently drops the restored manifest flow and the wizard never
+    // reopens. Construct a fresh base via `toFormState()` -- the same
+    // construction `startCreate` uses to open the dialog -- so the patch
+    // always has a form to apply to and the wizard reopens with the restored
+    // state.
+    patchFormState: (patch) => setFormState((prev) => patch(prev ?? toFormState())),
+    secretOptions,
+    secretsLoading,
+    secretsError,
+    companyId,
+    createGitHubAppManifest,
+    getGitHubAppManifestFlow,
+    convertGitHubAppManifest,
+    identities,
+    agentOptions,
+    companyDisplayName,
+    credentialSidecarPath: data?.credentialSidecarPath ?? "",
+    getAgentIdentityDefaults,
+    toFormState
+  });
+  const activeProviderId = config?.provider ?? GITHUB_IDENTITY_PROVIDER_ID;
+  const activeProviderUIState = activeProviderId === SLACK_IDENTITY_PROVIDER_ID ? slackUIState : githubUIState;
+  const activeProviderUIAdapter = providerSettingsUIRegistry.get(activeProviderId);
+  const ActiveCredentialStep = activeProviderUIAdapter?.CredentialStep;
+  const activeProviderCredentialStepId = providerSettingsRegistry.get(activeProviderId).credentialStepId;
+  const hasSavedAgentOutsideOptions = Boolean(
+    config?.agentId && !agentOptions.some((agent) => agent.id === config.agentId)
+  );
+  const duplicateIdentity = config ? identities.find((entry) => entry.agentId === config.agentId && entry.provider === config.provider && !(config.previousAgentId === entry.agentId && config.provider === entry.provider)) : void 0;
+  const formValidation = config ? getIdentityFormValidation(config, Boolean(duplicateIdentity), slackUIState.slackSaveResult, slackUIState.slackSaveBusy) : null;
+  const activeFormSteps = getFormSteps(config?.provider ?? GITHUB_IDENTITY_PROVIDER_ID);
+  const activeFormStepIndex = getFormStepIndex(activeFormSection, config?.provider ?? GITHUB_IDENTITY_PROVIDER_ID);
+  const isLastFormStep = activeFormStepIndex === activeFormSteps.length - 1;
+  const canGoNext = formValidation ? canAdvanceFromStep(activeFormSection, formValidation) : false;
+  const canSave = Boolean(formValidation?.isComplete && isLastFormStep && !saving);
+  const slackSaveInFlight = activeProviderId === SLACK_IDENTITY_PROVIDER_ID && (slackUIState.slackSaveBusy || slackUIState.slackCleanupBusy || slackUIState.legacySlackRebindBusy);
+  if (loading) return /* @__PURE__ */ jsx3("div", { children: "Loading settings..." });
+  if (error) return /* @__PURE__ */ jsxs3("div", { children: [
+    "Error loading settings: ",
+    error.message
+  ] });
+  function startCreate() {
+    setActiveFormSection("identity");
+    setFormState(toFormState());
+    setSaveError(null);
+    setSaveSuccess(false);
+    githubUIState.reset();
+    slackUIState.reset();
+  }
+  function startEdit(entry) {
+    setActiveFormSection("identity");
+    setFormState(toFormState(entry));
+    setSaveError(null);
+    setSaveSuccess(false);
+    githubUIState.reset();
+    slackUIState.reset();
+  }
+  function updateField(field, value) {
+    if (field === "agentId") {
+      updateAgentSelection(value);
+    } else {
+      setFormState((prev) => ({
+        ...prev ?? toFormState(),
+        [field]: value
+      }));
+    }
+    setSaveSuccess(false);
+    setSaveError(null);
+    if ((field === "agentId" || field === "label") && config?.[field] !== value) {
+      githubUIState.reset();
+      slackUIState.reset();
+    }
+  }
+  function updateAgentSelection(agentId) {
+    setFormState((prev) => {
+      const base = prev ?? toFormState();
+      const selectedAgent = agentOptions.find((agent) => agent.id === agentId);
+      if (!selectedAgent || base.previousAgentId || base.agentId === agentId) {
+        return { ...base, agentId };
+      }
+      const defaults = getAgentIdentityDefaults(
+        selectedAgent,
+        companyDisplayName,
+        data?.credentialSidecarPath ?? ""
+      );
+      return {
+        ...base,
+        agentId,
+        label: shouldPrefillIdentityField(base.label, DEFAULT_BOT_IDENTITY_CONFIG.label) ? defaults.label : base.label,
+        githubUsername: shouldPrefillIdentityField(base.githubUsername, DEFAULT_BOT_IDENTITY_CONFIG.github.username) ? defaults.githubUsername : base.githubUsername,
+        commitName: shouldPrefillIdentityField(base.commitName, "") ? defaults.commitName : base.commitName,
+        commitEmail: shouldPrefillIdentityField(base.commitEmail, "") ? defaults.commitEmail : base.commitEmail,
+        privateKeyFile: shouldPrefillIdentityField(base.privateKeyFile, "") ? defaults.privateKeyFile : base.privateKeyFile
+      };
+    });
+  }
+  async function handleSave() {
+    if (!config) return;
+    const validation = getIdentityFormValidation(config, Boolean(duplicateIdentity), slackUIState.slackSaveResult, slackUIState.slackSaveBusy);
+    if (!validation.isComplete) {
+      setSaveSuccess(false);
+      setSaveError(validation.saveMessage);
+      const adapter = providerSettingsRegistry.get(config.provider);
+      setActiveFormSection(validation.identityComplete ? adapter.credentialStepId : "identity");
+      return;
+    }
+    if (providerSettingsRegistry.get(config.provider).savesViaSeparateAction) {
+      setSaveSuccess(true);
+      setFormState(null);
+      return;
+    }
+    setSaving(true);
+    setSaveError(null);
+    setSaveSuccess(false);
+    try {
+      if (!isIdentityProviderId(config.provider)) {
+        throw new Error("Choose a supported identity provider before saving.");
+      }
+      const targetAgentId = config.agentId.trim();
+      const previousAgentIds = config.previousAgentId && config.previousAgentId !== targetAgentId ? [config.previousAgentId] : [];
+      const payload = {
+        agentId: config.agentId.trim(),
+        previousAgentId: config.previousAgentId.trim() || void 0,
+        provider: "github",
+        label: config.label.trim(),
+        github: {
+          username: config.githubUsername.trim(),
+          ...config.commitName.trim() ? { commitName: config.commitName.trim() } : {},
+          ...config.commitEmail.trim() ? { commitEmail: config.commitEmail.trim() } : {}
+        },
+        credential: {
+          secretId: config.fallbackTokenSecretId.trim() || void 0,
+          tokenFile: config.tokenFile.trim() || void 0,
+          githubApp: {
+            appId: config.githubAppId.trim() || void 0,
+            installationId: config.githubInstallationId.trim() || void 0,
+            privateKeySecretId: config.privateKeySecretId.trim() || void 0,
+            privateKeyFile: config.privateKeyFile.trim() || void 0
+          }
+        }
+      };
+      const saved = await saveConfig(payload);
+      await syncGitHubAppCredentialPropagationForAgents({
+        selectedAgentIds: targetAgentId ? [targetAgentId] : [],
+        previousAgentIds,
+        githubAppId: config.githubAppId.trim() || void 0,
+        githubInstallationId: config.githubInstallationId.trim() || void 0,
+        privateKeySecretRef: config.privateKeySecretId.trim() || void 0,
+        privateKeyFile: config.privateKeyFile.trim() || void 0,
+        previousGithubAppId: config.previousGithubAppId || void 0,
+        previousGithubInstallationId: config.previousGithubInstallationId || void 0,
+        previousPrivateKeySecretRef: config.previousPrivateKeySecretId || void 0,
+        previousPrivateKeyFile: config.previousPrivateKeyFile || void 0
+      });
+      setSaveSuccess(true);
+      await refresh();
+      const savedEntry = saved?.agentId ? saved : null;
+      setFormState(savedEntry ? toFormState(savedEntry) : null);
+    } catch (err) {
+      setSaveError(err instanceof Error ? err.message : "Failed to save");
+    } finally {
+      setSaving(false);
+    }
+  }
+  async function handleDelete(entry) {
+    const confirmationMessage = providerSettingsUIRegistry.get(entry.provider)?.getRemovalConfirmation?.(entry) ?? `Delete agent identity mapping for ${entry.label}?`;
+    const confirmed = window.confirm(confirmationMessage);
+    if (!confirmed) return;
+    setDeletingAgentId(entry.agentId);
+    setSaveError(null);
+    setSaveSuccess(false);
+    try {
+      await deleteConfig({ agentId: entry.agentId, provider: entry.provider });
+      if (formState?.agentId === entry.agentId && formState.provider === entry.provider) {
+        setFormState(null);
+      }
+      await refresh();
+      if (hasGitHubAppPropagationValues(entry)) {
+        try {
+          await syncGitHubAppCredentialPropagationForAgents({
+            selectedAgentIds: [],
+            previousAgentIds: [entry.agentId],
+            previousGithubAppId: entry.credential?.githubApp?.appId,
+            previousGithubInstallationId: entry.credential?.githubApp?.installationId,
+            previousPrivateKeySecretRef: entry.credential?.githubApp?.privateKeySecretId,
+            previousPrivateKeyFile: entry.credential?.githubApp?.privateKeyFile
+          });
+        } catch (err) {
+          setSaveError(`Deleted identity, but could not clean the agent environment: ${err instanceof Error ? err.message : "unknown error"}`);
+        }
+      }
+    } catch (err) {
+      setSaveError(err instanceof Error ? err.message : "Failed to delete");
+    } finally {
+      setDeletingAgentId(null);
+    }
+  }
+  return /* @__PURE__ */ jsxs3(
+    "div",
+    {
+      className: "agent-identities-settings",
+      style: { ...createPaperclipThemeStyle(themeMode), ...pageStyle },
+      "data-agent-identities-theme": themeMode,
+      children: [
+        /* @__PURE__ */ jsx3("style", { children: responsiveSettingsStyle }),
+        /* @__PURE__ */ jsx3("div", { className: "agent-identities-header", style: headerStyle, children: /* @__PURE__ */ jsxs3("div", { children: [
+          /* @__PURE__ */ jsx3("h2", { style: pageTitleStyle, children: "Agent Identities" }),
+          /* @__PURE__ */ jsxs3("p", { style: descriptionStyle, children: [
+            "Connect agents in ",
+            companyDisplayName || "this company",
+            " to GitHub and Slack identities."
+          ] })
+        ] }) }),
+        /* @__PURE__ */ jsxs3("div", { className: "agent-identities-summary-grid", style: summaryGridStyle, children: [
+          /* @__PURE__ */ jsx3(SummaryTile, { label: "Identities", value: summary.total }),
+          /* @__PURE__ */ jsx3(SummaryTile, { label: "Ready", value: summary.ready, tone: "good" }),
+          /* @__PURE__ */ jsx3(SummaryTile, { label: "Need setup", value: summary.needsSetup, tone: summary.needsSetup > 0 ? "warn" : "good" })
+        ] }),
+        data?.credentialSidecarError && /* @__PURE__ */ jsxs3("div", { style: credentialErrorStyle, children: [
+          "Credential source unavailable: ",
+          data.credentialSidecarError
+        ] }),
+        /* @__PURE__ */ jsxs3("section", { style: sectionStyle, children: [
+          /* @__PURE__ */ jsxs3("div", { className: "agent-identities-section-header", style: sectionHeaderStyle, children: [
+            /* @__PURE__ */ jsxs3("div", { children: [
+              /* @__PURE__ */ jsx3("h3", { style: sectionTitleStyle, children: "Configured identities" }),
+              /* @__PURE__ */ jsx3("p", { style: sectionDescriptionStyle, children: "Each row maps one Paperclip agent to a provider account and credential source." })
+            ] }),
+            /* @__PURE__ */ jsx3("button", { onClick: startCreate, style: secondaryButtonStyle, children: "Add identity" })
+          ] }),
+          saveError && !formState && /* @__PURE__ */ jsx3("div", { style: errorStyle, children: saveError }),
+          saveSuccess && !formState && /* @__PURE__ */ jsx3("div", { style: successStyle, children: "Saved successfully." }),
+          identities.length === 0 ? /* @__PURE__ */ jsxs3("div", { style: emptyStateStyle, children: [
+            /* @__PURE__ */ jsx3("strong", { children: "No identities configured" }),
+            /* @__PURE__ */ jsx3("span", { children: "Pick an agent, connect its first provider account, then save. Defaults are filled from the selected agent and company." }),
+            /* @__PURE__ */ jsx3("button", { onClick: startCreate, style: primaryButtonStyle, children: "Create first identity" })
+          ] }) : /* @__PURE__ */ jsxs3("div", { style: listStyle, children: [
+            /* @__PURE__ */ jsxs3("div", { className: "agent-identities-list-header", style: listHeaderStyle, children: [
+              /* @__PURE__ */ jsx3("span", { children: "Agent" }),
+              /* @__PURE__ */ jsx3("span", { children: "Provider" }),
+              /* @__PURE__ */ jsx3("span", { children: "Status" }),
+              /* @__PURE__ */ jsx3("span", {})
+            ] }),
+            identities.map((entry) => /* @__PURE__ */ jsxs3("div", { className: "agent-identities-list-row", style: rowStyle, children: [
+              /* @__PURE__ */ jsxs3("div", { style: { minWidth: 0 }, children: [
+                /* @__PURE__ */ jsx3("div", { style: rowTitleStyle, children: entry.label }),
+                /* @__PURE__ */ jsx3("div", { style: rowMetaStyle, children: formatAgentName(entry.agentId, agentOptions) })
+              ] }),
+              /* @__PURE__ */ jsx3("div", { style: rowMetaStyle, children: getProviderDisplayName(entry.provider, data?.providers) }),
+              /* @__PURE__ */ jsx3("span", { style: statusBadgeStyle(getIdentityTone(entry)), children: formatCredentialStatus(entry.credentialStatus) }),
+              /* @__PURE__ */ jsxs3("div", { className: "agent-identities-row-actions", style: rowActionsStyle, children: [
+                /* @__PURE__ */ jsx3("button", { onClick: () => startEdit(entry), style: secondaryButtonStyle, children: "Edit" }),
+                /* @__PURE__ */ jsx3(
+                  "button",
+                  {
+                    onClick: () => void handleDelete(entry),
+                    disabled: deletingAgentId === entry.agentId,
+                    style: dangerButtonStyle,
+                    children: deletingAgentId === entry.agentId ? "Deleting..." : "Delete"
+                  }
+                )
+              ] })
+            ] }, entry.id))
+          ] })
+        ] }),
+        config && /* @__PURE__ */ jsx3("div", { style: dialogBackdropStyle, role: "presentation", children: /* @__PURE__ */ jsxs3(
+          "section",
+          {
+            className: "agent-identities-dialog",
+            style: dialogStyle,
+            role: "dialog",
+            "aria-modal": "true",
+            "aria-labelledby": "agent-identity-dialog-title",
+            children: [
+              /* @__PURE__ */ jsxs3("header", { className: "agent-identities-dialog-header", style: dialogHeaderStyle, children: [
+                /* @__PURE__ */ jsxs3("div", { children: [
+                  /* @__PURE__ */ jsx3("h3", { id: "agent-identity-dialog-title", style: dialogTitleStyle, children: isEditingExistingIdentity ? "Edit agent identity" : "Add agent identity" }),
+                  /* @__PURE__ */ jsx3("p", { style: sectionDescriptionStyle, children: "Configure the agent and its provider-specific credentials." })
+                ] }),
+                /* @__PURE__ */ jsx3("button", { onClick: () => setFormState(null), disabled: saving || slackSaveInFlight, style: closeButtonStyle, "aria-label": "Close identity editor", children: "x" })
+              ] }),
+              /* @__PURE__ */ jsxs3("div", { style: dialogBodyStyle, children: [
+                /* @__PURE__ */ jsx3("div", { className: "agent-identities-wizard-steps", "aria-label": "Identity setup progress", style: wizardStepListStyle, children: activeFormSteps.map((step, index) => /* @__PURE__ */ jsx3(
+                  WizardStepIndicator,
+                  {
+                    index: index + 1,
+                    label: step.label,
+                    active: step.id === activeFormSection,
+                    complete: formValidation ? isWizardStepComplete(step.id, formValidation) : false
+                  },
+                  step.id
+                )) }),
+                activeFormSection === "identity" && /* @__PURE__ */ jsxs3(Fragment, { children: [
+                  /* @__PURE__ */ jsxs3("fieldset", { style: fieldsetStyle, children: [
+                    /* @__PURE__ */ jsx3("legend", { style: legendStyle, children: "Identity" }),
+                    formValidation && !formValidation.identityComplete && /* @__PURE__ */ jsx3("div", { style: validationNoticeStyle, children: formValidation.identityMessage }),
+                    /* @__PURE__ */ jsxs3("label", { style: fieldStyle, children: [
+                      /* @__PURE__ */ jsxs3("span", { children: [
+                        "Agent ",
+                        /* @__PURE__ */ jsx3("span", { style: requiredStyle, children: "*" })
+                      ] }),
+                      hasAgentOptions ? /* @__PURE__ */ jsxs3(
+                        "select",
+                        {
+                          value: config.agentId,
+                          onChange: (e) => updateField("agentId", e.target.value),
+                          style: inputStyle,
+                          disabled: slackSaveInFlight,
+                          children: [
+                            /* @__PURE__ */ jsx3("option", { value: "", disabled: true, children: "Select a Paperclip agent" }),
+                            hasSavedAgentOutsideOptions && /* @__PURE__ */ jsxs3("option", { value: config.agentId, children: [
+                              config.agentId,
+                              " (saved)"
+                            ] }),
+                            agentOptions.map((agent) => /* @__PURE__ */ jsx3("option", { value: agent.id, children: formatAgentOption(agent) }, agent.id))
+                          ]
+                        }
+                      ) : /* @__PURE__ */ jsx3(
+                        "input",
+                        {
+                          type: "text",
+                          value: config.agentId,
+                          onChange: (e) => updateField("agentId", e.target.value),
+                          placeholder: "UUID of the Paperclip agent",
+                          style: inputStyle,
+                          disabled: slackSaveInFlight
+                        }
+                      ),
+                      /* @__PURE__ */ jsx3("span", { style: hintStyle, children: getAgentFieldHint({ companyId, agentsLoading, agentsError, hasAgentOptions }) })
+                    ] }),
+                    /* @__PURE__ */ jsxs3("label", { style: fieldStyle, children: [
+                      /* @__PURE__ */ jsxs3("span", { children: [
+                        "Provider ",
+                        /* @__PURE__ */ jsx3("span", { style: requiredStyle, children: "*" })
+                      ] }),
+                      /* @__PURE__ */ jsx3("select", { value: config.provider, onChange: (e) => updateField("provider", e.target.value), style: inputStyle, disabled: isEditingExistingIdentity || slackSaveInFlight, children: (data?.providers ?? []).map((provider) => /* @__PURE__ */ jsxs3(
+                        "option",
+                        {
+                          value: provider.id,
+                          disabled: provider.status !== "enabled" && provider.id !== SLACK_IDENTITY_PROVIDER_ID,
+                          children: [
+                            provider.name,
+                            provider.status === "coming-soon" ? provider.id === SLACK_IDENTITY_PROVIDER_ID ? "" : " (coming soon)" : ""
+                          ]
+                        },
+                        provider.id
+                      )) }),
+                      /* @__PURE__ */ jsx3("span", { style: hintStyle, children: "Each agent can have one identity per provider. GitHub and Slack are available, with additional providers coming soon." })
+                    ] }),
+                    duplicateIdentity && /* @__PURE__ */ jsxs3("div", { style: validationNoticeStyle, children: [
+                      "This agent already has a ",
+                      getProviderDisplayName(config.provider, data?.providers),
+                      " identity. Edit the existing row instead."
+                    ] }),
+                    /* @__PURE__ */ jsxs3("label", { style: fieldStyle, children: [
+                      /* @__PURE__ */ jsxs3("span", { children: [
+                        "Label ",
+                        /* @__PURE__ */ jsx3("span", { style: requiredStyle, children: "*" })
+                      ] }),
+                      /* @__PURE__ */ jsx3(
+                        "input",
+                        {
+                          type: "text",
+                          value: config.label,
+                          onChange: (e) => updateField("label", e.target.value),
+                          placeholder: "e.g. Cade Riven [Droidshop]",
+                          style: inputStyle,
+                          disabled: slackSaveInFlight
+                        }
+                      )
+                    ] })
+                  ] }),
+                  providerSettingsRegistry.get(config.provider).hasProviderAccountFieldsInIdentityStep && /* @__PURE__ */ jsxs3("fieldset", { style: fieldsetStyle, children: [
+                    /* @__PURE__ */ jsx3("legend", { style: legendStyle, children: "Provider account" }),
+                    /* @__PURE__ */ jsxs3("label", { style: fieldStyle, children: [
+                      /* @__PURE__ */ jsxs3("span", { children: [
+                        "GitHub Username ",
+                        /* @__PURE__ */ jsx3("span", { style: requiredStyle, children: "*" })
+                      ] }),
+                      /* @__PURE__ */ jsx3(
+                        "input",
+                        {
+                          type: "text",
+                          value: config.githubUsername,
+                          onChange: (e) => updateField("githubUsername", e.target.value),
+                          placeholder: "e.g. ouroboros-paperclip-agent[bot]",
+                          style: inputStyle
+                        }
+                      ),
+                      /* @__PURE__ */ jsx3("span", { style: hintStyle, children: "Public GitHub App login for this agent. GitHub appends [bot] to app account logins. Repository access is controlled by the GitHub App installation and provider permissions." })
+                    ] })
+                  ] })
+                ] }),
+                activeFormSection === activeProviderCredentialStepId && ActiveCredentialStep && /* @__PURE__ */ jsx3(
+                  ActiveCredentialStep,
+                  {
+                    state: activeProviderUIState,
+                    config
+                  }
+                ),
+                activeFormSection === "commit" && /* @__PURE__ */ jsxs3("fieldset", { style: fieldsetStyle, children: [
+                  /* @__PURE__ */ jsx3("legend", { style: legendStyle, children: "Commit identity (optional)" }),
+                  /* @__PURE__ */ jsx3("div", { style: inlineNoticeStyle, children: "These fields are optional. Save is available because the required identity and credential steps are complete." }),
+                  /* @__PURE__ */ jsxs3("label", { style: fieldStyle, children: [
+                    /* @__PURE__ */ jsx3("span", { children: "Commit Name" }),
+                    /* @__PURE__ */ jsx3(
+                      "input",
+                      {
+                        type: "text",
+                        value: config.commitName,
+                        onChange: (e) => updateField("commitName", e.target.value),
+                        placeholder: "e.g. Ouroboros Paperclip Agent",
+                        style: inputStyle
+                      }
+                    )
+                  ] }),
+                  /* @__PURE__ */ jsxs3("label", { style: fieldStyle, children: [
+                    /* @__PURE__ */ jsx3("span", { children: "Commit Email" }),
+                    /* @__PURE__ */ jsx3(
+                      "input",
+                      {
+                        type: "text",
+                        value: config.commitEmail,
+                        onChange: (e) => updateField("commitEmail", e.target.value),
+                        placeholder: "e.g. agent@example.com",
+                        style: inputStyle
+                      }
+                    )
+                  ] })
+                ] })
+              ] }),
+              /* @__PURE__ */ jsxs3("footer", { className: "agent-identities-dialog-footer", style: dialogFooterStyle, children: [
+                /* @__PURE__ */ jsxs3("div", { style: saveStatusStyle, children: [
+                  saveSuccess && /* @__PURE__ */ jsx3("span", { style: successStyle, children: "Saved successfully." }),
+                  saveError && /* @__PURE__ */ jsx3("span", { style: errorStyle, children: saveError }),
+                  !saveSuccess && !saveError && formValidation && !isLastFormStep && /* @__PURE__ */ jsx3("span", { style: hintStyle, children: formValidation.saveMessage }),
+                  !saveSuccess && !saveError && formValidation && isLastFormStep && !formValidation.isComplete && /* @__PURE__ */ jsx3("span", { style: hintStyle, children: formValidation.saveMessage })
+                ] }),
+                /* @__PURE__ */ jsx3(
+                  "button",
+                  {
+                    type: "button",
+                    onClick: () => setActiveFormSection(getPreviousFormStep(activeFormSection, config.provider)),
+                    disabled: saving || slackSaveInFlight || activeFormStepIndex === 0,
+                    style: buttonStyle(secondaryButtonStyle, saving || slackSaveInFlight || activeFormStepIndex === 0),
+                    children: "Previous"
+                  }
+                ),
+                !isLastFormStep ? /* @__PURE__ */ jsx3(
+                  "button",
+                  {
+                    type: "button",
+                    onClick: () => setActiveFormSection(getNextFormStep(activeFormSection, config.provider)),
+                    disabled: saving || slackSaveInFlight || !canGoNext,
+                    style: buttonStyle(primaryButtonStyle, saving || slackSaveInFlight || !canGoNext),
+                    children: "Next"
+                  }
+                ) : /* @__PURE__ */ jsx3(
+                  "button",
+                  {
+                    type: "button",
+                    onClick: () => void handleSave(),
+                    disabled: !canSave,
+                    style: buttonStyle(primaryButtonStyle, !canSave),
+                    children: saving ? "Saving..." : "Save agent"
+                  }
+                ),
+                /* @__PURE__ */ jsx3("button", { type: "button", onClick: () => setFormState(null), disabled: saving || slackSaveInFlight, style: secondaryButtonStyle, children: "Cancel" })
+              ] })
+            ]
+          }
+        ) })
+      ]
+    }
+  );
+}
+function SummaryTile(props) {
+  return /* @__PURE__ */ jsxs3("div", { style: summaryTileStyle(props.tone ?? "neutral"), children: [
+    /* @__PURE__ */ jsx3("span", { style: summaryValueStyle, children: props.value }),
+    /* @__PURE__ */ jsx3("span", { style: summaryLabelStyle, children: props.label })
+  ] });
+}
+function WizardStepIndicator(props) {
+  return /* @__PURE__ */ jsxs3("div", { style: wizardStepStyle(props.active), children: [
+    /* @__PURE__ */ jsx3("span", { style: wizardStepNumberStyle(props.active, props.complete), children: props.complete ? "\u2713" : props.index }),
+    /* @__PURE__ */ jsx3("span", { children: props.label })
+  ] });
+}
+function getAgentIdentityDefaults(agent, companyDisplayName, credentialSidecarPath) {
+  const displayName = getAgentDisplayName(agent);
+  const slug = slugifyGitHubAppName(displayName);
+  return {
+    label: formatIdentityLabel(displayName, companyDisplayName),
+    githubUsername: `${slug}[bot]`,
+    commitName: `${displayName} Paperclip Agent`,
+    commitEmail: `${slug}[bot]@users.noreply.github.com`,
+    privateKeyFile: getGitHubAppPrivateKeyFile(credentialSidecarPath, agent.id)
+  };
+}
+function getGitHubAppPrivateKeyFile(credentialSidecarPath, agentId) {
+  const lastSeparator = Math.max(
+    credentialSidecarPath.lastIndexOf("/"),
+    credentialSidecarPath.lastIndexOf("\\")
+  );
+  if (lastSeparator < 0) return "";
+  const separator = credentialSidecarPath[lastSeparator];
+  const directory = credentialSidecarPath.slice(0, lastSeparator);
+  return `${directory}${separator}github-apps${separator}${agentId}${separator}private-key.pem`;
+}
+function shouldPrefillIdentityField(value, defaultValue) {
+  return value.trim() === defaultValue.trim();
+}
+function formatIdentityLabel(agentName, companyDisplayName) {
+  const companySuffix = companyDisplayName.trim();
+  return companySuffix ? agentName + " [" + companySuffix + "]" : agentName;
+}
+function getAgentDisplayName(agent) {
+  return (agent.name || agent.title || agent.role || agent.id).trim();
+}
+function getCompanyDisplayName(companyName, companyPrefix, companyId) {
+  const resolvedName = (companyName ?? "").trim();
+  if (resolvedName) return resolvedName;
+  const displayName = titleCaseSlug(companyPrefix ?? "");
+  return displayName || companyId.trim();
+}
+function titleCaseSlug(value) {
+  return value.trim().replace(/[ _-]+/g, " ").replace(/\s+/g, " ").replace(/\b\w/g, (match) => match.toUpperCase());
+}
+function slugifyGitHubAppName(value) {
+  return value.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "paperclip-agent";
+}
+function toFormState(entry) {
+  return {
+    agentId: entry?.agentId ?? DEFAULT_BOT_IDENTITY_CONFIG.agentId,
+    provider: entry?.provider ?? DEFAULT_BOT_IDENTITY_CONFIG.provider,
+    label: entry?.label ?? DEFAULT_BOT_IDENTITY_CONFIG.label,
+    githubUsername: entry?.provider === "github" ? entry.github.username : DEFAULT_BOT_IDENTITY_CONFIG.github.username,
+    commitName: entry?.provider === "github" ? entry.github.commitName ?? "" : "",
+    commitEmail: entry?.provider === "github" ? entry.github.commitEmail ?? "" : "",
+    githubAppId: entry?.credential?.githubApp?.appId ?? "",
+    githubInstallationId: entry?.credential?.githubApp?.installationId ?? "",
+    privateKeySecretId: entry?.credential?.githubApp?.privateKeySecretId ?? "",
+    privateKeyFile: entry?.credential?.githubApp?.privateKeyFile ?? "",
+    fallbackTokenSecretId: entry?.credential?.secretId ?? "",
+    tokenFile: entry?.credential?.tokenFile ?? "",
+    previousAgentId: entry?.agentId ?? "",
+    previousGithubAppId: entry?.credential?.githubApp?.appId ?? "",
+    previousGithubInstallationId: entry?.credential?.githubApp?.installationId ?? "",
+    previousPrivateKeySecretId: entry?.credential?.githubApp?.privateKeySecretId ?? "",
+    previousPrivateKeyFile: entry?.credential?.githubApp?.privateKeyFile ?? "",
+    slackTeamId: entry?.provider === "slack" ? entry.slack.teamId : "",
+    slackAppId: entry?.provider === "slack" ? entry.slack.appId : "",
+    slackBotUserId: entry?.provider === "slack" ? entry.slack.botUserId : "",
+    slackDefaultChannel: entry?.provider === "slack" ? entry.slack.defaultChannel ?? "" : "",
+    slackEventsRequestUrl: entry?.provider === "slack" ? entry.slackSetup?.eventsRequestUrl ?? "" : "",
+    slackBotTokenSecretId: entry?.provider === "slack" ? entry.slackSetup?.botTokenSecretId ?? "" : "",
+    slackSigningSecretId: entry?.provider === "slack" ? entry.slackSetup?.signingSecretId ?? "" : "",
+    slackLegacyCredentialStatus: entry?.provider === "slack" ? entry.slackSetup?.legacyCredential?.status ?? "" : "",
+    slackLegacySigningSecretRequired: entry?.provider === "slack" && entry.slackSetup?.legacyCredential?.signingSecretRequired ? "true" : ""
+  };
+}
+var providerSettingsRegistry = buildProviderSettingsRegistry([...ALL_SETTINGS_ADAPTERS], GITHUB_IDENTITY_PROVIDER_ID);
+function getFormSteps(provider) {
+  return providerSettingsRegistry.get(provider).formSteps;
+}
+function getIdentityFormValidation(config, hasDuplicate = false, slackSaveResult = null, slackSaveBusy = false) {
+  const adapter = providerSettingsRegistry.get(config.provider);
+  return adapter.getValidation(config, hasDuplicate, { slackSaveResult, slackSaveBusy });
+}
+function getFormStepIndex(step, provider) {
+  return getFormSteps(provider).findIndex((entry) => entry.id === step);
+}
+function getNextFormStep(step, provider) {
+  const steps = getFormSteps(provider);
+  return steps[Math.min(getFormStepIndex(step, provider) + 1, steps.length - 1)]?.id ?? step;
+}
+function getPreviousFormStep(step, provider) {
+  const steps = getFormSteps(provider);
+  return steps[Math.max(getFormStepIndex(step, provider) - 1, 0)]?.id ?? step;
+}
+function canAdvanceFromStep(step, validation) {
+  if (step === "identity") return validation.identityComplete;
+  if (step === "github" || step === "slack") return validation.credentialComplete;
+  return validation.isComplete;
+}
+function isWizardStepComplete(step, validation) {
+  if (step === "identity") return validation.identityComplete;
+  if (step === "github" || step === "slack") return validation.credentialComplete;
+  return validation.isComplete;
+}
+function formatAgentOption(agent) {
+  const details = [agent.role, agent.status].filter(Boolean).join(" - ");
+  return details ? `${getAgentDisplayName(agent)} (${details})` : getAgentDisplayName(agent);
+}
+function formatAgentName(agentId, agents) {
+  const agent = agents.find((entry) => entry.id === agentId);
+  return agent ? getAgentDisplayName(agent) : agentId;
+}
+function getProviderDisplayName(providerId, providers) {
+  return providers?.find((provider) => provider.id === providerId)?.name ?? providerId;
+}
+function formatSecretOption2(secret) {
+  const label = secret.name || secret.key || secret.id;
+  const details = [secret.key && secret.key !== label ? secret.key : null, secret.status, secret.provider].filter(Boolean).join(" - ");
+  return details ? `${label} (${details})` : label;
+}
+function getSecretFieldHint2(input) {
+  if (!input.companyId) {
+    return "No company context is available, so paste the Paperclip secret UUID manually.";
+  }
+  if (input.secretsLoading) {
+    return "Loading Paperclip secrets...";
+  }
+  if (input.secretsError) {
+    return `Could not load Paperclip secrets (${input.secretsError}); paste the secret UUID manually.`;
+  }
+  if (!input.hasSecretOptions) {
+    return "No Paperclip secrets were found; paste the private key secret UUID manually or use a private key file fallback.";
+  }
+  return "Saved as a Paperclip secret reference for the GitHub App private key and optionally propagated to agent environments.";
+}
+function getFallbackTokenSecretFieldHint(input) {
+  if (!input.companyId) {
+    return "No company context is available, so paste the fallback token secret UUID manually.";
+  }
+  if (input.secretsLoading) {
+    return "Loading Paperclip secrets...";
+  }
+  if (input.secretsError) {
+    return `Could not load Paperclip secrets (${input.secretsError}); paste the fallback token secret UUID manually.`;
+  }
+  if (!input.hasSecretOptions) {
+    return "No Paperclip secrets were found; paste the fallback token secret UUID manually or use a fallback token file.";
+  }
+  return "Optional fallback token secret. Prefer GitHub App credentials above.";
+}
+async function loadSecretOptions(companyId) {
+  const encodedCompanyId = encodeURIComponent(companyId);
+  const paths = [
+    `/api/companies/${encodedCompanyId}/secrets`,
+    `/api/companies/${encodedCompanyId}/me/user-secrets`
+  ];
+  let lastError = null;
+  for (const path of paths) {
+    try {
+      const response = await fetch(path, {
+        credentials: "include",
+        headers: { accept: "application/json" }
+      });
+      if (!response.ok) {
+        lastError = new Error(`${response.status} ${response.statusText}`.trim());
+        continue;
+      }
+      return normalizeSecretOptions(await response.json());
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+    }
+  }
+  throw lastError ?? new Error("Paperclip secrets API unavailable");
+}
+function normalizeSecretOptions(raw) {
+  const candidates = Array.isArray(raw) ? raw : isRecord2(raw) && Array.isArray(raw.secrets) ? raw.secrets : isRecord2(raw) && Array.isArray(raw.userSecrets) ? raw.userSecrets : isRecord2(raw) && Array.isArray(raw.companySecrets) ? raw.companySecrets : isRecord2(raw) && Array.isArray(raw.items) ? raw.items : isRecord2(raw) && Array.isArray(raw.results) ? raw.results : isRecord2(raw) && Array.isArray(raw.data) ? raw.data : [];
+  return candidates.map((entry) => normalizeSecretOption(entry)).filter((entry) => Boolean(entry)).filter((entry) => !entry.status || entry.status === "active").sort((left, right) => (left.name || left.key || left.id).localeCompare(right.name || right.key || right.id));
+}
+function normalizeSecretOption(raw) {
+  const entry = isRecord2(raw) && isRecord2(raw.secret) ? raw.secret : raw;
+  if (!isRecord2(entry)) return null;
+  const id = readString2(entry.id) || readString2(entry.secretId);
+  if (!id) return null;
+  return {
+    id,
+    name: readString2(entry.name) || readString2(entry.label) || readString2(entry.key) || id,
+    key: readString2(entry.key) || void 0,
+    description: readString2(entry.description) || void 0,
+    provider: readString2(entry.provider) || void 0,
+    status: readString2(entry.status) || void 0
+  };
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readString2(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function formatCredentialStatus(status) {
+  if (status === "configured") return "Configured";
+  if (status === "rebind-required") return "Rebind required";
+  if (status === "cleanup-pending") return "Cleanup pending";
+  if (status === "conflict") return "Conflict";
+  if (status === "sidecar-unavailable") return "Unavailable";
+  return "Missing";
+}
+function getIdentityTone(entry) {
+  if (entry.credentialStatus === "configured") return "good";
+  if (entry.credentialStatus !== "missing") return "warn";
+  return "neutral";
+}
+function summarizeIdentitySettings(identities) {
+  const ready = identities.filter((identity) => identity.credentialStatus === "configured").length;
+  return {
+    total: identities.length,
+    ready,
+    needsSetup: identities.filter((identity) => identity.credentialStatus !== "configured").length
+  };
+}
+function hasGitHubAppPropagationValues(entry) {
+  const githubApp = entry.credential?.githubApp;
+  return Boolean(githubApp?.appId && githubApp.installationId && (githubApp.privateKeySecretId || githubApp.privateKeyFile));
+}
+var GITHUB_APP_PROPAGATION_CONCURRENCY_LIMIT = 4;
+async function syncGitHubAppCredentialPropagationForAgents(input) {
+  const selectedAgentIds = normalizeAgentIds(input.selectedAgentIds);
+  const previousAgentIds = normalizeAgentIds(input.previousAgentIds);
+  const selectedAgentIdSet = new Set(selectedAgentIds);
+  const removeAgentIds = previousAgentIds.filter((agentId) => !selectedAgentIdSet.has(agentId));
+  const operations = [];
+  if (selectedAgentIds.length > 0) {
+    const selectedConfig = {
+      appId: input.githubAppId,
+      installationId: input.githubInstallationId,
+      privateKeySecretRef: input.privateKeySecretRef,
+      privateKeyFile: input.privateKeyFile
+    };
+    if (hasCompleteGitHubAppValues(selectedConfig)) {
+      const githubApp = buildGitHubAppPropagationConfig(selectedConfig);
+      operations.push(...selectedAgentIds.map((agentId) => ({ agentId, mode: "ensure", githubApp })));
+    }
+  }
+  if (removeAgentIds.length > 0) {
+    const removeConfig = {
+      appId: input.previousGithubAppId ?? input.githubAppId,
+      installationId: input.previousGithubInstallationId ?? input.githubInstallationId,
+      privateKeySecretRef: input.previousPrivateKeySecretRef ?? input.privateKeySecretRef,
+      privateKeyFile: input.previousPrivateKeyFile ?? input.privateKeyFile
+    };
+    if (hasCompleteGitHubAppValues(removeConfig)) {
+      const githubApp = buildGitHubAppPropagationConfig(removeConfig);
+      operations.push(...removeAgentIds.map((agentId) => ({ agentId, mode: "remove", githubApp })));
+    }
+  }
+  const failures = /* @__PURE__ */ new Set();
+  await runWithConcurrencyLimit(operations, GITHUB_APP_PROPAGATION_CONCURRENCY_LIMIT, async (operation) => {
+    try {
+      await applyGitHubAppPropagationUpdate(operation);
+    } catch {
+      failures.add(operation.agentId);
+    }
+  });
+  if (failures.size > 0) {
+    throw new Error(`GitHub App credential propagation could not update these agents: ${[...failures].join(", ")}.`);
+  }
+}
+function hasCompleteGitHubAppValues(input) {
+  const appId = input.appId?.trim();
+  const installationId = input.installationId?.trim();
+  const privateKeySecretRef = input.privateKeySecretRef?.trim();
+  const privateKeyFile = input.privateKeyFile?.trim();
+  return Boolean(appId && installationId && (privateKeySecretRef || privateKeyFile));
+}
+function buildGitHubAppPropagationConfig(input) {
+  const appId = input.appId?.trim();
+  const installationId = input.installationId?.trim();
+  const privateKeySecretRef = input.privateKeySecretRef?.trim();
+  const privateKeyFile = input.privateKeyFile?.trim();
+  if (!appId || !installationId || !privateKeySecretRef && !privateKeyFile) {
+    throw new Error("GitHub App credential propagation requires app ID, installation ID, and a private key secret or file.");
+  }
+  return {
+    appId,
+    installationId,
+    ...privateKeySecretRef ? { privateKeySecretRef } : {},
+    ...privateKeyFile ? { privateKeyFile } : {}
+  };
+}
+function normalizeAgentIds(value) {
+  return value.map((entry) => entry.trim()).filter(Boolean).filter((entry, index, entries) => entries.indexOf(entry) === index);
+}
+async function runWithConcurrencyLimit(items, concurrencyLimit, worker) {
+  if (items.length === 0) return;
+  let nextIndex = 0;
+  const runnerCount = Math.min(concurrencyLimit, items.length);
+  await Promise.all(Array.from({ length: runnerCount }, async () => {
+    while (nextIndex < items.length) {
+      const currentIndex = nextIndex;
+      nextIndex += 1;
+      await worker(items[currentIndex]);
+    }
+  }));
+}
+async function applyGitHubAppPropagationUpdate(input) {
+  const agent = await fetchJson(`/api/agents/${encodeURIComponent(input.agentId)}`);
+  const nextAdapterConfig = getAgentPropagationPatch({
+    adapterConfig: isRecord2(agent) ? agent.adapterConfig : void 0,
+    githubApp: input.githubApp,
+    mode: input.mode
+  });
+  if (!nextAdapterConfig) {
+    return;
+  }
+  await fetchJson(`/api/agents/${encodeURIComponent(input.agentId)}`, {
+    method: "PATCH",
+    body: JSON.stringify({
+      adapterConfig: nextAdapterConfig,
+      replaceAdapterConfig: true
+    })
+  });
+}
+function getAgentPropagationPatch(input) {
+  const adapterConfig = isRecord2(input.adapterConfig) ? { ...input.adapterConfig } : {};
+  const currentEnv = isRecord2(adapterConfig.env) ? { ...adapterConfig.env } : {};
+  if (input.mode === "ensure") {
+    const nextEnv2 = {
+      ...currentEnv,
+      GITHUB_APP_ID: input.githubApp.appId,
+      GITHUB_INSTALLATION_ID: input.githubApp.installationId
+    };
+    if (input.githubApp.privateKeySecretRef) {
+      nextEnv2.GITHUB_APP_PRIVATE_KEY = {
+        type: "secret_ref",
+        secretId: input.githubApp.privateKeySecretRef,
+        version: "latest"
+      };
+      delete nextEnv2.GITHUB_APP_PRIVATE_KEY_FILE;
+    } else if (input.githubApp.privateKeyFile) {
+      nextEnv2.GITHUB_APP_PRIVATE_KEY_FILE = input.githubApp.privateKeyFile;
+      delete nextEnv2.GITHUB_APP_PRIVATE_KEY;
+    }
+    if (JSON.stringify(nextEnv2) === JSON.stringify(currentEnv)) {
+      return null;
+    }
+    return { ...adapterConfig, env: nextEnv2 };
+  }
+  if (!isMatchingGitHubAppEnvBindings(currentEnv, input.githubApp)) {
+    return null;
+  }
+  const nextEnv = { ...currentEnv };
+  delete nextEnv.GITHUB_APP_ID;
+  delete nextEnv.GITHUB_INSTALLATION_ID;
+  delete nextEnv.GITHUB_APP_PRIVATE_KEY;
+  delete nextEnv.GITHUB_APP_PRIVATE_KEY_FILE;
+  const nextAdapterConfig = { ...adapterConfig };
+  if (Object.keys(nextEnv).length > 0) {
+    nextAdapterConfig.env = nextEnv;
+  } else {
+    delete nextAdapterConfig.env;
+  }
+  return nextAdapterConfig;
+}
+function isMatchingGitHubAppEnvBindings(env, githubApp) {
+  if (env.GITHUB_APP_ID !== githubApp.appId || env.GITHUB_INSTALLATION_ID !== githubApp.installationId) {
+    return false;
+  }
+  if (githubApp.privateKeySecretRef) {
+    return isMatchingSecretRefEnvBinding(env.GITHUB_APP_PRIVATE_KEY, githubApp.privateKeySecretRef);
+  }
+  return Boolean(githubApp.privateKeyFile && env.GITHUB_APP_PRIVATE_KEY_FILE === githubApp.privateKeyFile);
+}
+function isMatchingSecretRefEnvBinding(value, secretId) {
+  return isRecord2(value) && value.type === "secret_ref" && value.secretId === secretId;
+}
+async function fetchJson(path, init) {
+  const response = await fetch(path, {
+    ...init,
+    credentials: "include",
+    headers: {
+      accept: "application/json",
+      ...init?.body ? { "content-type": "application/json" } : {},
+      ...init?.headers
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`${response.status} ${response.statusText}`.trim());
+  }
+  return await response.json();
+}
+function getAgentFieldHint(input) {
+  if (!input.companyId) {
+    return "No company context is available, so paste the Paperclip agent UUID manually.";
+  }
+  if (input.agentsLoading) {
+    return "Loading Paperclip agents...";
+  }
+  if (input.agentsError) {
+    return "Could not load Paperclip agents; paste the agent UUID manually.";
+  }
+  if (!input.hasAgentOptions) {
+    return "No Paperclip agents were found for this company; paste the agent UUID manually.";
+  }
+  return "The Paperclip agent that will use this identity.";
+}
+var responsiveSettingsStyle = `
+.agent-identities-settings,
+.agent-identities-settings * {
+  box-sizing: border-box;
+}
+
+.agent-identities-summary-grid {
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+}
+
+.agent-identities-list-header,
+.agent-identities-list-row {
+  grid-template-columns: minmax(0, 1fr) 8rem 8rem 13rem;
+}
+
+.agent-identities-row-actions {
+  justify-content: flex-end;
+}
+
+.agent-identities-wizard-steps {
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+}
+
+@container (max-width: 720px) {
+  .agent-identities-list-header {
+    display: none !important;
+  }
+
+  .agent-identities-list-row {
+    grid-template-columns: minmax(0, 1fr) auto;
+  }
+
+  .agent-identities-list-row > :nth-child(1) {
+    grid-column: 1;
+    grid-row: 1;
+  }
+
+  .agent-identities-list-row > :nth-child(2) {
+    grid-column: 1 / -1;
+    grid-row: 2;
+  }
+
+  .agent-identities-list-row > :nth-child(3) {
+    grid-column: 2;
+    grid-row: 1;
+  }
+
+  .agent-identities-list-row > :nth-child(4) {
+    grid-column: 1 / -1;
+    grid-row: 3;
+    justify-content: flex-start;
+  }
+}
+
+@container (max-width: 520px) {
+  .agent-identities-summary-grid,
+  .agent-identities-wizard-steps {
+    grid-template-columns: minmax(0, 1fr);
+  }
+}
+`;
+var pageStyle = {
+  width: "100%",
+  minWidth: 0,
+  maxWidth: 1160,
+  display: "grid",
+  gap: "1rem",
+  color: uiText,
+  containerType: "inline-size"
+};
+var pageTitleStyle = {
+  margin: 0,
+  fontSize: "1.125rem",
+  lineHeight: 1.2,
+  letterSpacing: "-0.02em"
+};
+var headerStyle = {
+  display: "flex",
+  justifyContent: "space-between",
+  alignItems: "flex-start",
+  gap: "1rem",
+  flexWrap: "wrap"
+};
+var descriptionStyle = {
+  margin: "0.35rem 0 0",
+  color: uiMutedText,
+  fontSize: "0.875rem"
+};
+var summaryGridStyle = {
+  display: "grid",
+  gap: "0.75rem"
+};
+function summaryTileStyle(tone) {
+  return {
+    display: "grid",
+    gap: "0.25rem",
+    padding: "0.85rem 1rem",
+    border: `1px solid ${toneBorder(tone)}`,
+    borderRadius: 12,
+    backgroundColor: toneBackground(tone)
+  };
+}
+var summaryValueStyle = {
+  fontSize: "1.125rem",
+  fontWeight: 700,
+  lineHeight: 1
+};
+var summaryLabelStyle = {
+  color: uiMutedText,
+  fontSize: "0.8125rem",
+  fontWeight: 600
+};
+var credentialErrorStyle = {
+  padding: "0.75rem 0.9rem",
+  backgroundColor: "color-mix(in srgb, var(--agent-identities-danger) 12%, transparent)",
+  border: "1px solid color-mix(in srgb, var(--agent-identities-danger) 45%, transparent)",
+  borderRadius: 10,
+  color: uiDanger,
+  fontSize: "0.875rem"
+};
+var sectionStyle = {
+  minWidth: 0,
+  border: `1px solid ${uiBorder}`,
+  borderRadius: 14,
+  padding: "1rem",
+  display: "grid",
+  gap: "0.9rem",
+  backgroundColor: uiSurface
+};
+var sectionHeaderStyle = {
+  display: "flex",
+  alignItems: "flex-start",
+  justifyContent: "space-between",
+  gap: "1rem",
+  flexWrap: "wrap"
+};
+var sectionTitleStyle = {
+  margin: 0,
+  fontSize: "0.875rem",
+  lineHeight: 1.25
+};
+var sectionDescriptionStyle = {
+  margin: "0.25rem 0 0",
+  color: uiMutedText,
+  fontSize: "0.875rem"
+};
+var listStyle = {
+  display: "grid",
+  gap: "0.35rem",
+  minWidth: 0
+};
+var listHeaderStyle = {
+  display: "grid",
+  gap: "0.75rem",
+  padding: "0 0.75rem 0.25rem",
+  color: uiMutedText,
+  fontSize: "0.8125rem",
+  fontWeight: 650
+};
+var rowStyle = {
+  display: "grid",
+  gap: "0.75rem",
+  alignItems: "center",
+  border: `1px solid ${uiBorder}`,
+  borderRadius: 10,
+  padding: "0.75rem",
+  backgroundColor: uiPanel
+};
+var rowTitleStyle = {
+  fontWeight: 650,
+  overflowWrap: "anywhere"
+};
+var rowMetaStyle = {
+  color: uiMutedText,
+  fontSize: "0.875rem",
+  overflowWrap: "anywhere"
+};
+var rowActionsStyle = {
+  display: "flex",
+  gap: "0.5rem",
+  flexWrap: "wrap"
+};
+var emptyStateStyle = {
+  display: "grid",
+  justifyItems: "start",
+  gap: "0.5rem",
+  padding: "1.25rem",
+  border: `1px dashed ${uiBorderStrong}`,
+  borderRadius: 12,
+  color: uiMutedText,
+  backgroundColor: uiPanel
+};
+var dialogBackdropStyle = {
+  position: "fixed",
+  inset: 0,
+  zIndex: 1e3,
+  display: "grid",
+  placeItems: "start center",
+  padding: "7vh 1rem 1rem",
+  backgroundColor: uiOverlay,
+  overflowY: "auto"
+};
+var dialogStyle = {
+  width: "min(760px, 100%)",
+  maxHeight: "86vh",
+  display: "grid",
+  gridTemplateRows: "auto minmax(0, 1fr) auto",
+  border: `1px solid ${uiBorder}`,
+  borderRadius: 16,
+  backgroundColor: uiCanvas,
+  color: uiText,
+  boxShadow: `0 24px 80px ${uiShadow}`,
+  overflow: "hidden"
+};
+var dialogHeaderStyle = {
+  display: "flex",
+  alignItems: "flex-start",
+  justifyContent: "space-between",
+  gap: "1rem",
+  padding: "1.1rem 1.25rem 0.9rem",
+  borderBottom: `1px solid ${uiBorder}`
+};
+var dialogTitleStyle = {
+  margin: 0,
+  fontSize: "1.125rem",
+  lineHeight: 1.2,
+  letterSpacing: "-0.015em"
+};
+var closeButtonStyle = {
+  width: 32,
+  height: 32,
+  border: `1px solid ${uiBorder}`,
+  borderRadius: 8,
+  backgroundColor: "transparent",
+  color: uiMutedText,
+  cursor: "pointer",
+  fontSize: "0.875rem"
+};
+var dialogBodyStyle = {
+  display: "grid",
+  gap: "0.85rem",
+  padding: "1rem 1.25rem",
+  overflowY: "auto"
+};
+var wizardStepListStyle = {
+  display: "grid",
+  gap: "0.5rem"
+};
+function wizardStepStyle(active) {
+  return {
+    display: "flex",
+    alignItems: "center",
+    gap: "0.5rem",
+    minHeight: 36,
+    padding: "0.45rem 0.6rem",
+    border: `1px solid ${active ? uiBorderStrong : uiBorder}`,
+    borderRadius: 8,
+    backgroundColor: active ? uiSurface : "transparent",
+    color: active ? uiText : uiMutedText,
+    fontSize: "0.875rem",
+    fontWeight: active ? 600 : 500
+  };
+}
+function wizardStepNumberStyle(active, complete) {
+  return {
+    display: "inline-grid",
+    placeItems: "center",
+    width: 22,
+    height: 22,
+    borderRadius: 999,
+    border: `1px solid ${complete ? uiSuccess : active ? uiBorderStrong : uiBorder}`,
+    backgroundColor: complete ? "color-mix(in srgb, var(--agent-identities-success) 14%, transparent)" : uiPanel,
+    color: complete ? uiSuccess : active ? uiText : uiMutedText,
+    fontSize: "0.8125rem",
+    fontWeight: 600
+  };
+}
+var dialogFooterStyle = {
+  display: "flex",
+  justifyContent: "flex-end",
+  alignItems: "center",
+  gap: "0.75rem",
+  flexWrap: "wrap",
+  padding: "0.9rem 1.25rem",
+  borderTop: `1px solid ${uiBorder}`,
+  backgroundColor: uiPanel
+};
+var saveStatusStyle = {
+  marginRight: "auto",
+  fontSize: "0.875rem"
+};
+var validationNoticeStyle = {
+  padding: "0.65rem 0.75rem",
+  border: "1px solid color-mix(in srgb, var(--agent-identities-warning) 36%, transparent)",
+  borderRadius: 8,
+  backgroundColor: "color-mix(in srgb, var(--agent-identities-warning) 8%, transparent)",
+  color: uiText,
+  fontSize: "0.875rem"
+};
+var fieldsetStyle = {
+  border: `1px solid ${uiBorder}`,
+  borderRadius: 12,
+  padding: "1rem",
+  display: "grid",
+  gap: "0.75rem"
+};
+var legendStyle = {
+  padding: "0 0.25rem",
+  color: uiText,
+  fontSize: "0.875rem",
+  fontWeight: 600
+};
+var fieldStyle = {
+  display: "grid",
+  gap: "0.35rem",
+  fontSize: "0.875rem",
+  fontWeight: 600
+};
+var inputStyle = {
+  minHeight: 38,
+  padding: "0.45rem 0.65rem",
+  border: `1px solid ${uiBorderStrong}`,
+  borderRadius: 8,
+  fontSize: "0.875rem",
+  backgroundColor: uiInput,
+  color: uiText
+};
+var textareaStyle = {
+  ...inputStyle,
+  fontFamily: "ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace"
+};
+var manifestPanelStyle = {
+  display: "grid",
+  gap: "0.75rem",
+  padding: "0.85rem",
+  border: `1px dashed ${uiBorderStrong}`,
+  borderRadius: 10,
+  backgroundColor: uiPanel
+};
+var linkStyle = {
+  color: uiLink,
+  fontWeight: 600
+};
+var inlineNoticeStyle = {
+  padding: "0.75rem 0.9rem",
+  border: `1px solid ${uiBorder}`,
+  borderRadius: 10,
+  backgroundColor: uiPanel,
+  color: uiMutedText,
+  fontSize: "0.875rem"
+};
+var hintStyle = {
+  fontSize: "0.8125rem",
+  fontWeight: 400,
+  color: uiMutedText
+};
+var formActionsStyle = {
+  display: "flex",
+  alignItems: "center",
+  gap: "0.75rem",
+  flexWrap: "wrap"
+};
+var primaryButtonStyle = {
+  minHeight: 38,
+  padding: "0.48rem 0.9rem",
+  backgroundColor: uiPrimary,
+  color: uiPrimaryText,
+  border: `1px solid ${uiBorderStrong}`,
+  borderRadius: 8,
+  cursor: "pointer",
+  fontWeight: 650
+};
+var secondaryButtonStyle = {
+  minHeight: 34,
+  padding: "0.4rem 0.75rem",
+  backgroundColor: uiSurface,
+  color: uiText,
+  border: `1px solid ${uiBorderStrong}`,
+  borderRadius: 8,
+  cursor: "pointer",
+  fontWeight: 600
+};
+var dangerButtonStyle = {
+  ...secondaryButtonStyle,
+  color: uiDanger
+};
+var requiredStyle = {
+  color: uiDanger
+};
+var successStyle = {
+  color: uiSuccess
+};
+var errorStyle = {
+  color: uiDanger
+};
+function statusBadgeStyle(tone) {
+  return {
+    justifySelf: "start",
+    border: `1px solid ${toneBorder(tone)}`,
+    borderRadius: 999,
+    padding: "0.2rem 0.55rem",
+    color: toneText(tone),
+    backgroundColor: toneBackground(tone),
+    fontSize: "0.8125rem",
+    fontWeight: 650,
+    whiteSpace: "nowrap"
+  };
+}
+function buttonStyle(base, disabled) {
+  return disabled ? { ...base, opacity: 0.55, cursor: "not-allowed" } : base;
+}
+function toneText(tone) {
+  if (tone === "good") return uiSuccess;
+  if (tone === "warn") return uiWarning;
+  return uiMutedText;
+}
+function toneBorder(tone) {
+  if (tone === "good") return "color-mix(in srgb, var(--agent-identities-success) 42%, transparent)";
+  if (tone === "warn") return "color-mix(in srgb, var(--agent-identities-warning) 48%, transparent)";
+  return uiBorder;
+}
+function toneBackground(tone) {
+  if (tone === "good") return "color-mix(in srgb, var(--agent-identities-success) 10%, transparent)";
+  if (tone === "warn") return "color-mix(in srgb, var(--agent-identities-warning) 12%, transparent)";
+  return uiPanel;
+}
+
+// src/ui/index.tsx
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+function DashboardWidget({ context }) {
+  const themeMode = usePaperclipThemeMode();
+  const { data, loading, error } = usePluginData2("bot-identity-config", {
+    companyId: context.companyId
+  });
+  if (loading) return /* @__PURE__ */ jsx4("div", { children: "Loading agent identities..." });
+  if (error) return /* @__PURE__ */ jsxs4("div", { children: [
+    "Agent identities unavailable: ",
+    error.message
+  ] });
+  const identities = data?.identities ?? [];
+  const summary = summarizeIdentities(identities);
+  return /* @__PURE__ */ jsxs4("div", { style: { ...createPaperclipThemeStyle(themeMode), ...widgetStyle }, "data-agent-identities-theme": themeMode, children: [
+    /* @__PURE__ */ jsxs4("div", { children: [
+      /* @__PURE__ */ jsx4("strong", { children: "Agent Identities" }),
+      /* @__PURE__ */ jsx4("div", { style: mutedStyle, children: "Identity provider coverage" })
+    ] }),
+    /* @__PURE__ */ jsxs4("div", { style: metricGridStyle, children: [
+      /* @__PURE__ */ jsx4(Metric, { label: "Identities", value: summary.total, tone: "neutral" }),
+      /* @__PURE__ */ jsx4(Metric, { label: "GitHub Apps", value: summary.githubApps, tone: summary.githubApps > 0 ? "good" : "neutral" }),
+      /* @__PURE__ */ jsx4(Metric, { label: "Need setup", value: summary.needsSetup, tone: summary.needsSetup > 0 ? "warn" : "good" })
+    ] }),
+    data?.credentialSidecarError && /* @__PURE__ */ jsx4("div", { style: warningStyle, children: "GitHub credential sidecar unavailable. GitHub saves may not update private key references." }),
+    identities.length === 0 ? /* @__PURE__ */ jsx4("div", { style: hintBoxStyle, children: "No agent identities configured yet. Open plugin settings to add a provider-backed agent identity." }) : /* @__PURE__ */ jsxs4("div", { style: identityListStyle, children: [
+      identities.slice(0, 3).map((identity) => /* @__PURE__ */ jsxs4("div", { style: identityRowStyle, children: [
+        /* @__PURE__ */ jsxs4("div", { style: { minWidth: 0 }, children: [
+          /* @__PURE__ */ jsx4("div", { style: identityNameStyle, children: identity.label }),
+          /* @__PURE__ */ jsx4("div", { style: mutedStyle, children: formatProviderIdentity(identity) })
+        ] }),
+        /* @__PURE__ */ jsx4("span", { style: badgeStyle(identityTone(identity)), children: formatIdentityCredential(identity) })
+      ] }, identity.id)),
+      identities.length > 3 && /* @__PURE__ */ jsxs4("div", { style: mutedStyle, children: [
+        "+",
+        identities.length - 3,
+        " more configured"
+      ] })
+    ] })
+  ] });
+}
+function summarizeIdentities(identities) {
+  const githubApps = identities.filter((identity) => hasCompleteGitHubApp(identity)).length;
+  return {
+    total: identities.length,
+    githubApps,
+    needsSetup: identities.filter((identity) => identity.credentialStatus !== "configured").length
+  };
+}
+function hasCompleteGitHubApp(identity) {
+  const githubApp = identity.credential?.githubApp;
+  return Boolean(githubApp?.appId && githubApp.installationId && (githubApp.privateKeySecretId || githubApp.privateKeyFile));
+}
+function hasFallbackCredential(identity) {
+  return Boolean(identity.credential?.secretId || identity.credential?.tokenFile);
+}
+function formatProviderIdentity(identity) {
+  if (identity.provider === "github") return `GitHub: ${identity.github.username}`;
+  if (identity.provider === "slack") return `Slack: ${identity.slack.teamId}`;
+  return identity.provider;
+}
+function formatIdentityCredential(identity) {
+  if (hasCompleteGitHubApp(identity)) return "GitHub App";
+  if (hasFallbackCredential(identity)) return "Fallback";
+  if (identity.credentialStatus === "configured") return "Configured";
+  if (identity.credentialStatus === "rebind-required") return "Rebind required";
+  if (identity.credentialStatus === "cleanup-pending") return "Cleanup pending";
+  if (identity.credentialStatus === "conflict") return "Conflict";
+  if (identity.credentialStatus === "sidecar-unavailable") return "Unavailable";
+  return "Missing";
+}
+function identityTone(identity) {
+  if (hasCompleteGitHubApp(identity)) return "good";
+  if (hasFallbackCredential(identity)) return "neutral";
+  if (identity.credentialStatus === "configured") return "good";
+  return "warn";
+}
+function Metric(props) {
+  return /* @__PURE__ */ jsxs4("div", { style: metricStyle(props.tone), children: [
+    /* @__PURE__ */ jsx4("div", { style: metricValueStyle, children: props.value }),
+    /* @__PURE__ */ jsx4("div", { style: metricLabelStyle, children: props.label })
+  ] });
+}
+var widgetStyle = {
+  display: "grid",
+  gap: "0.75rem"
+};
+var mutedStyle = {
+  color: uiMutedText,
+  fontSize: "0.85rem",
+  overflowWrap: "anywhere"
+};
+var metricGridStyle = {
+  display: "grid",
+  gridTemplateColumns: "repeat(3, minmax(0, 1fr))",
+  gap: "0.5rem"
+};
+function metricStyle(tone) {
+  return {
+    border: `1px solid ${toneColor(tone)}`,
+    borderRadius: 8,
+    padding: "0.6rem",
+    background: toneBackground2(tone)
+  };
+}
+var metricValueStyle = {
+  fontSize: "1.35rem",
+  fontWeight: 700,
+  lineHeight: 1
+};
+var metricLabelStyle = {
+  color: uiMutedText,
+  fontSize: "0.75rem",
+  marginTop: "0.25rem"
+};
+var identityListStyle = {
+  display: "grid",
+  gap: "0.45rem"
+};
+var identityRowStyle = {
+  display: "flex",
+  justifyContent: "space-between",
+  alignItems: "center",
+  gap: "0.75rem"
+};
+var identityNameStyle = {
+  fontWeight: 600,
+  overflowWrap: "anywhere"
+};
+function badgeStyle(tone) {
+  return {
+    border: `1px solid ${toneColor(tone)}`,
+    borderRadius: 999,
+    padding: "0.15rem 0.5rem",
+    color: toneColor(tone),
+    fontSize: "0.75rem",
+    whiteSpace: "nowrap"
+  };
+}
+var hintBoxStyle = {
+  border: `1px dashed ${uiBorderStrong}`,
+  borderRadius: 8,
+  padding: "0.65rem",
+  color: uiMutedText,
+  fontSize: "0.9rem"
+};
+var warningStyle = {
+  border: `1px solid ${uiWarning}`,
+  borderRadius: 8,
+  padding: "0.65rem",
+  color: uiWarning,
+  background: "color-mix(in srgb, var(--agent-identities-warning) 12%, transparent)",
+  fontSize: "0.9rem"
+};
+function toneColor(tone) {
+  if (tone === "good") return uiSuccess;
+  if (tone === "warn") return uiWarning;
+  return uiMutedText;
+}
+function toneBackground2(tone) {
+  if (tone === "good") return "color-mix(in srgb, var(--agent-identities-success) 10%, transparent)";
+  if (tone === "warn") return "color-mix(in srgb, var(--agent-identities-warning) 12%, transparent)";
+  return uiPanel;
+}
+export {
+  DashboardWidget,
+  SettingsPage
+};
+//# sourceMappingURL=index.js.map