@dam-agents/cli 0.2.4-rc1 → 0.2.5-rc1

package/dist/bin.js

@@ -10879,6 +10879,15 @@ var TermsStaleAtTransportError = class extends Error {
   host;
   kind = "terms-stale";
 };
+var ForbiddenAtTransportError = class extends Error {
+  constructor(detail) {
+    super(detail || "access denied");
+    this.detail = detail;
+    this.name = "ForbiddenAtTransportError";
+  }
+  detail;
+  kind = "forbidden";
+};
 function buildAuthHeaders(deps) {
   return async () => {
     const result = await deps.tokenProvider.getValidAccessToken(deps.host);
@@ -10891,20 +10900,26 @@ function buildAuthHeaders(deps) {
     throw new Error(e2.reason ?? e2.kind);
   };
 }
-function wrapFetchWithTermsGate(host, baseFetch) {
+function wrapFetchWithServerGates(host, baseFetch) {
   const inner = baseFetch ?? fetch;
   return (async (input, init) => {
     const response = await inner(input, init);
-    if (response.status === 412) {
+    if ([401, 403, 412].includes(response.status)) {
       const clone3 = response.clone();
+      let body;
       try {
-        const body = await clone3.json();
-        if (body.error === "terms_stale") {
-          throw new TermsStaleAtTransportError(host);
-        }
-      } catch (err3) {
-        if (err3 instanceof TermsStaleAtTransportError) throw err3;
-      }
+        body = await clone3.json();
+      } catch {
+        return response;
+      }
+      if (body.error === "terms_stale")
+        throw new TermsStaleAtTransportError(host);
+      if (body.error === "unauthorized")
+        throw new AuthRequiredAtTransportError(`session expired for ${host}`);
+      if (body.error === "forbidden")
+        throw new ForbiddenAtTransportError(
+          typeof body.message === "string" ? body.message : ""
+        );
     }
     return response;
   });
@@ -10914,7 +10929,7 @@ function createTrpcClient(deps) {
     links: [
       httpBatchLink({
         url: `${deps.host.replace(/\/+$/, "")}/api/trpc`,
-        fetch: wrapFetchWithTermsGate(deps.host, deps.fetch),
+        fetch: wrapFetchWithServerGates(deps.host, deps.fetch),
         headers: buildAuthHeaders(deps)
       })
     ]
@@ -10926,7 +10941,7 @@ function createAgentTrpcClient(deps) {
     links: [
       httpBatchLink({
         url: base,
-        fetch: wrapFetchWithTermsGate(deps.host, deps.fetch),
+        fetch: wrapFetchWithServerGates(deps.host, deps.fetch),
         headers: buildAuthHeaders(deps)
       })
     ]
@@ -28765,7 +28780,7 @@ var secretTestAnthropicInputSchema = external_exports.object({
   envName: external_exports.enum(["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"])
 });
 
-// ../api-server-api/src/modules/secrets/types.ts
+// ../api-server-api/src/modules/connections/providers.ts
 var DEFAULT_ENV_PLACEHOLDER = "dummy-placeholder";
 var IBM_LITELLM_HOST = "ete-litellm.ai-models.vpc.res.ibm.com";
 var IBM_LITELLM_BASE_URL = `https://${IBM_LITELLM_HOST}`;
@@ -28809,7 +28824,8 @@ var PROVIDERS = {
       {
         key: "oauth",
         label: "OAuth Token",
-        // Claude Code SDK reads CLAUDE_CODE_OAUTH_TOKEN; sends Bearer.
+        templateId: "anthropic-oauth",
+        tokenPrefix: "sk-ant-oat",
         defaultEnvMappings: [
           {
             envName: "CLAUDE_CODE_OAUTH_TOKEN",
@@ -28820,7 +28836,9 @@ var PROVIDERS = {
       {
         key: "api-key",
         label: "API Key",
-        // @anthropic-ai/sdk reads ANTHROPIC_API_KEY; sends x-api-key.
+        templateId: "anthropic",
+        tokenPrefix: "sk-ant-api",
+        isDefault: true,
         defaultEnvMappings: [
           {
             envName: "ANTHROPIC_API_KEY",
@@ -28839,6 +28857,7 @@ var PROVIDERS = {
       {
         key: "api-key",
         label: "API Token",
+        templateId: "ibm-litellm",
         defaultEnvMappings: ibmLitellmEnvMappings()
       }
     ]
@@ -28847,14 +28866,13 @@ var PROVIDERS = {
     id: "openai",
     displayName: "OpenAI",
     hostPattern: "api.openai.com",
-    // OpenAI's API lives under /v1/*; scoping injection to that path keeps
-    // status pages and other host endpoints from getting a spurious
-    // Authorization header.
+    // Scope injection to /v1/* so other host endpoints don't get a stray Authorization header.
     pathPattern: "/v1/*",
     modes: [
       {
         key: "api-key",
         label: "API Key",
+        templateId: "openai",
         defaultEnvMappings: [
           { envName: "OPENAI_API_KEY", placeholder: DEFAULT_ENV_PLACEHOLDER }
         ]
@@ -28869,8 +28887,9 @@ var PROVIDERS = {
       {
         key: "api-key",
         label: "API Key",
+        templateId: "bob",
         defaultEnvMappings: bobEnvMappings(),
-        // Opaque api-keys go in under `Apikey`; `Bearer` triggers JWT auth.
+        // `Apikey` prefix; `Bearer` would trigger JWT auth.
         injection: {
           headerName: "Authorization",
           valueFormat: "Apikey {value}"
@@ -28885,6 +28904,29 @@ var PROVIDERS = {
 var PROVIDER_PRESET_TYPES = Object.keys(
   PROVIDERS
 );
+function isProviderPresetType(type) {
+  return type in PROVIDERS;
+}
+var TEMPLATE_TO_PROVIDER = new Map(
+  PROVIDER_PRESET_TYPES.flatMap(
+    (type) => PROVIDERS[type].modes.map(
+      (mode) => [mode.templateId, type]
+    )
+  )
+);
+var PROVIDER_TEMPLATE_IDS = new Set(
+  TEMPLATE_TO_PROVIDER.keys()
+);
+function providerTypeForTemplateId(templateId) {
+  return TEMPLATE_TO_PROVIDER.get(templateId) ?? null;
+}
+function templateIdForProvider(type, value) {
+  const modes = PROVIDERS[type].modes;
+  const matched = modes.find(
+    (mode) => mode.tokenPrefix !== void 0 && value.startsWith(mode.tokenPrefix)
+  );
+  return (matched ?? modes.find((mode) => mode.isDefault) ?? modes[0]).templateId;
+}
 
 // ../agent-runtime-api/src/modules/files/schemas.ts
 var pathSchema = external_exports.string().min(1);
@@ -29192,7 +29234,11 @@ var templateInput = external_exports.object({
   // Marks a config input the form packs into `configInputs` rather than the typed auth fields.
   configInput: external_exports.boolean().optional(),
   label: external_exports.string().optional(),
-  hint: external_exports.string().optional()
+  hint: external_exports.string().optional(),
+  // Validation a config input declares, surfaced so clients can validate before submit (the server enforces the same).
+  pattern: external_exports.string().optional(),
+  patternHint: external_exports.string().optional(),
+  enumValues: external_exports.array(external_exports.string()).optional()
 });
 var connectionTemplateView = external_exports.object({
   id: external_exports.string(),
@@ -29219,6 +29265,10 @@ var agentConnections = external_exports.object({
 var connectionIdInputSchema = external_exports.object({
   id: external_exports.string().min(1)
 });
+var connectionUpdateInputSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  value: external_exports.string().min(1)
+});
 var connectionStartOAuthInputSchema = external_exports.object({
   connectionId: external_exports.string().min(1),
   returnTo: external_exports.string().regex(
@@ -29680,10 +29730,16 @@ function classifyTrpcError(e2) {
   let cursor = e2;
   for (let depth = 0; cursor && depth < 8; depth++) {
     if (cursor instanceof TermsStaleAtTransportError) throw cursor;
+    if (cursor instanceof ForbiddenAtTransportError) throw cursor;
     if (cursor instanceof AuthRequiredAtTransportError)
       return err2({ kind: "auth-required", reason: cursor.message });
     cursor = cursor.cause;
   }
+  if (e2 instanceof TRPCClientError) {
+    const serverCode = e2.data?.code;
+    if (serverCode)
+      return err2({ kind: "transport", reason: e2.message, serverCode });
+  }
   return err2({
     kind: "transport",
     reason: e2 instanceof Error ? e2.message : typeof e2 === "string" ? e2 : "unknown transport failure"
@@ -29883,68 +29939,46 @@ function sleep2(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
-// src/modules/shared/exit-codes.ts
-var EXIT_SUCCESS = 0;
-var EXIT_RUNTIME_FAILURE = 1;
-var EXIT_INVALID_INPUT = 2;
-var EXIT_BELOW_FLOOR = 3;
-var EXIT_AUTH_STATUS_NO_VALID = 4;
-var EXIT_AGENT_NOT_RESOLVED = 5;
-var EXIT_RULE_NOT_FOUND = 6;
-var EXIT_AGENT_NOT_REACHABLE = 7;
-var EXIT_APPROVAL_NOT_ACTIONABLE = 8;
-var EXIT_SCHEDULE_NOT_FOUND = 9;
-var EXIT_SIGINT = 130;
+// src/modules/auth/infrastructure/auth-env-reader.ts
+var DAM_TOKEN_ENV_VAR = "DAM_TOKEN";
+function createProcessAuthEnvReader(env = process.env) {
+  return {
+    damToken() {
+      const v2 = env[DAM_TOKEN_ENV_VAR];
+      return v2 && v2.length > 0 ? v2 : void 0;
+    }
+  };
+}
 
-// src/modules/agent/commands/errors.ts
+// src/modules/shared/auth-message.ts
+function formatAuthRejection(reason, env = process.env) {
+  const hint = env[DAM_TOKEN_ENV_VAR] ? "DAM_TOKEN was rejected \u2014 check it is valid and unexpired" : "run `dam auth login` first";
+  return `error: not authenticated: ${reason}
+hint: ${hint}
+`;
+}
+
+// src/modules/shared/trpc/print.ts
 function formatTransportError(reason, host) {
   return `cannot reach server \`${host}\`: ${reason}`;
 }
-function exitCodeForResolveError(error51) {
-  return error51.kind === "not-found" || error51.kind === "ambiguous" ? EXIT_AGENT_NOT_RESOLVED : EXIT_RUNTIME_FAILURE;
-}
-function printServiceError(error51, host) {
+function printServiceError(error51, host, env = process.env) {
   if (error51.kind === "auth-required") {
-    process.stderr.write(`error: not authenticated: ${error51.reason}
+    process.stderr.write(formatAuthRejection(error51.reason, env));
+    return;
+  }
+  if (error51.serverCode) {
+    process.stderr.write(`error: ${error51.reason}
 `);
-    process.stderr.write("hint: run `dam auth login` first\n");
     return;
   }
   process.stderr.write(`error: ${formatTransportError(error51.reason, host)}
 `);
 }
-function printResolveError(error51, host) {
-  switch (error51.kind) {
-    case "not-found":
-      if (error51.via === "id") {
-        process.stderr.write(`error: no agent with id \`${error51.ref}\`
-`);
-      } else {
-        process.stderr.write(`error: no agent named "${error51.ref}"
-`);
-      }
-      return;
-    case "ambiguous":
-      process.stderr.write(`error: multiple agents named "${error51.ref}":
-`);
-      for (const m of error51.matches) {
-        process.stderr.write(`  - \`${m.id}\`
-`);
-      }
-      process.stderr.write("hint: specify by id instead\n");
-      return;
-    case "auth-required":
-      process.stderr.write(`error: not authenticated: ${error51.reason}
-`);
-      process.stderr.write("hint: run `dam auth login` first\n");
-      return;
-    case "transport":
-      process.stderr.write(
-        `error: ${formatTransportError(error51.reason, host)}
-`
-      );
-      return;
-  }
+function printTrpcError(e2, host) {
+  const r = classifyTrpcError(e2);
+  if (r.ok) return;
+  printServiceError(r.error, host);
 }
 
 // src/modules/agent/commands/create-helpers.ts
@@ -29972,6 +30006,19 @@ function validateAgentName(name) {
   return ok2(void 0);
 }
 
+// src/modules/shared/exit-codes.ts
+var EXIT_SUCCESS = 0;
+var EXIT_RUNTIME_FAILURE = 1;
+var EXIT_INVALID_INPUT = 2;
+var EXIT_BELOW_FLOOR = 3;
+var EXIT_AUTH_STATUS_NO_VALID = 4;
+var EXIT_AGENT_NOT_RESOLVED = 5;
+var EXIT_RULE_NOT_FOUND = 6;
+var EXIT_AGENT_NOT_REACHABLE = 7;
+var EXIT_APPROVAL_NOT_ACTIONABLE = 8;
+var EXIT_SCHEDULE_NOT_FOUND = 9;
+var EXIT_SIGINT = 130;
+
 // src/modules/agent/commands/create.ts
 var DEFAULT_TIMEOUT_SECONDS = 120;
 function buildCreateCommand(deps) {
@@ -30099,11 +30146,7 @@ async function runCreate(name, opts, deps) {
     }
     const classified = classifyTrpcError(e2);
     if (!classified.ok && classified.error.kind === "auth-required") {
-      process.stderr.write(
-        `error: not authenticated: ${classified.error.reason}
-hint: run \`dam auth login\` first
-`
-      );
+      printServiceError(classified.error, host);
       process.exit(EXIT_RUNTIME_FAILURE);
     }
     process.stderr.write(`error: failed to create agent: ${errorReason(e2)}
@@ -31149,6 +31192,17 @@ ${c2}
   }
 } }).prompt();
 
+// src/modules/shared/prompt-secret.ts
+function promptSecret(message) {
+  return Ce({
+    message,
+    validate(v2) {
+      if (!v2 || v2.trim() === "") return "Required";
+      return void 0;
+    }
+  });
+}
+
 // src/modules/agent/lib/group-github-pats.ts
 var API_HOST = "api.github.com";
 var GIT_HOST = "github.com";
@@ -31178,8 +31232,119 @@ function groupGithubPats(secrets) {
   return pairs;
 }
 
+// src/modules/connection/services/connection-service.ts
+function createConnectionService(deps) {
+  const readIds = async (agentId) => {
+    const res = await deps.trpc.connections.getAgentConnections.query({
+      agentId
+    });
+    return res.connections.map((c2) => c2.connectionId);
+  };
+  return {
+    async list() {
+      return trpcCall(() => deps.trpc.connections.list.query());
+    },
+    async listTemplates() {
+      return trpcCall(() => deps.trpc.connections.listTemplates.query());
+    },
+    async createConnection(input) {
+      return trpcCall(() => deps.trpc.connections.create.mutate(input));
+    },
+    async update(id, value) {
+      return trpcCall(async () => {
+        await deps.trpc.connections.update.mutate({ id, value });
+      });
+    },
+    async startOAuth(connectionId) {
+      return trpcCall(
+        () => deps.trpc.connections.startOAuth.mutate({ connectionId })
+      );
+    },
+    async discoverMcp(url2) {
+      return trpcCall(() => deps.trpc.connections.discoverMcp.mutate({ url: url2 }));
+    },
+    async getConnection(id) {
+      return trpcCall(() => deps.trpc.connections.get.query({ id }));
+    },
+    async agentConnectionIds(agentId) {
+      return trpcCall(() => readIds(agentId));
+    },
+    async grant(agentId, add) {
+      return trpcCall(async () => {
+        const current = await readIds(agentId);
+        const next = Array.from(/* @__PURE__ */ new Set([...current, ...add]));
+        await deps.trpc.connections.setAgentConnections.mutate({
+          agentId,
+          connectionIds: next
+        });
+        return next;
+      });
+    },
+    async revoke(agentId, remove) {
+      return trpcCall(async () => {
+        const drop = new Set(remove);
+        const current = await readIds(agentId);
+        const next = current.filter((id) => !drop.has(id));
+        await deps.trpc.connections.setAgentConnections.mutate({
+          agentId,
+          connectionIds: next
+        });
+        return next;
+      });
+    },
+    async disconnect(id) {
+      return trpcCall(async () => {
+        await deps.trpc.connections.delete.mutate({ id });
+      });
+    }
+  };
+}
+
+// src/modules/connection/domain/config-inputs.ts
+function configInputsOf(template) {
+  return template.inputs.filter((i) => i.configInput);
+}
+function validateConfigInputValue(input, value) {
+  const trimmed = value.trim();
+  if (trimmed === "") return void 0;
+  const label = input.label ?? input.name;
+  if (input.enumValues && !input.enumValues.includes(trimmed)) {
+    const opts = input.enumValues.map((v2) => `\`${v2}\``).join(", ");
+    return `${label}: must be one of ${opts}`;
+  }
+  if (input.pattern && !new RegExp(`^(?:${input.pattern})$`).test(trimmed)) {
+    const expected = input.patternHint ?? `value matching ${input.pattern}`;
+    return `${label}: expected ${expected}`;
+  }
+  return void 0;
+}
+function resolveConfigInputFlags(template, rawFlags) {
+  const byName2 = new Map(configInputsOf(template).map((i) => [i.name, i]));
+  const out = {};
+  for (const raw of rawFlags) {
+    const eq = raw.indexOf("=");
+    if (eq < 0) return err2({ kind: "missing-equals", input: raw });
+    const key = raw.slice(0, eq);
+    const value = raw.slice(eq + 1).trim();
+    const input = byName2.get(key);
+    if (!input) {
+      return err2({ kind: "unknown-key", key, validKeys: [...byName2.keys()] });
+    }
+    if (value === "") {
+      delete out[key];
+      continue;
+    }
+    const message = validateConfigInputValue(input, value);
+    if (message) return err2({ kind: "invalid-value", key, message });
+    out[key] = value;
+  }
+  return ok2(out);
+}
+
 // src/modules/agent/commands/create-interactive.ts
 var WAIT_TIMEOUT_SECONDS = 120;
+var GITHUB_PAT_TEMPLATE_ID = "github-pat";
+var CONNECTION_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
 var ROLLBACK_CODES = /* @__PURE__ */ new Set([
   "CONFLICT",
   "BAD_REQUEST",
@@ -31200,7 +31365,7 @@ function classifyFailure(e2) {
 }
 async function deleteCreated(trpc, cleanup) {
   let orphanAgent = null;
-  const orphanSecrets = [];
+  const orphanConnections = [];
   if (cleanup.agentId) {
     try {
       await trpc.agents.delete.mutate({ id: cleanup.agentId });
@@ -31208,26 +31373,26 @@ async function deleteCreated(trpc, cleanup) {
       orphanAgent = cleanup.agentId;
     }
   }
-  for (const id of cleanup.newSecretIds) {
+  for (const id of cleanup.newConnectionIds) {
     try {
-      await trpc.secrets.delete.mutate({ id });
+      await trpc.connections.delete.mutate({ id });
     } catch {
-      orphanSecrets.push(id);
+      orphanConnections.push(id);
     }
   }
-  return { orphanAgent, orphanSecrets };
+  return { orphanAgent, orphanConnections };
 }
-function formatOrphans(orphanAgent, orphanSecrets) {
-  if (!orphanAgent && orphanSecrets.length === 0) return null;
+function formatOrphans(orphanAgent, orphanConnections) {
+  if (!orphanAgent && orphanConnections.length === 0) return null;
   const lines = ["Cleanup partially failed. Manual cleanup needed:"];
   if (orphanAgent) {
     lines.push(
       `  Agent: ${orphanAgent} (delete via web UI or \`dam agent delete\`)`
     );
   }
-  if (orphanSecrets.length > 0) {
+  if (orphanConnections.length > 0) {
     lines.push(
-      `  Secrets: ${orphanSecrets.join(", ")} (delete via web UI's secrets page)`
+      `  Connections: ${orphanConnections.join(", ")} (delete via \`dam connection disconnect\`)`
     );
   }
   return lines.join("\n");
@@ -31296,7 +31461,7 @@ hint: run \`dam auth login\` first`
   });
   if (q(templateId)) return cancelAndExit();
   const trpc = deps.createTrpcClient(host);
-  const cleanup = { newSecretIds: [], agentId: null };
+  const cleanup = { newConnectionIds: [], agentId: null };
   const provider = await pickProvider(trpc, cleanup);
   const githubPat = await pickGithubPat(trpc, cleanup);
   const spin = ft();
@@ -31319,19 +31484,39 @@ hint: run \`dam auth login\` first`
     await handleStage1Failure(trpc, cleanup, e2);
     process.exit(EXIT_RUNTIME_FAILURE);
   }
-  spin.message("Granting provider access...");
-  const grantedIds = [provider.secretId];
-  if (githubPat) grantedIds.push(githubPat.apiSecretId, githubPat.gitSecretId);
+  spin.message("Granting credentials...");
+  const connectionIds = [];
+  const secretIds = [];
+  if (provider.routing.kind === "connection") {
+    connectionIds.push(provider.routing.id);
+  } else {
+    secretIds.push(provider.routing.id);
+  }
+  if (githubPat) {
+    if (githubPat.source === "connection") {
+      connectionIds.push(githubPat.connectionId);
+    } else {
+      secretIds.push(githubPat.apiSecretId, githubPat.gitSecretId);
+    }
+  }
   try {
-    await withRetry(
-      () => trpc.secrets.setAgentAccess.mutate({
-        agentId: cleanup.agentId,
-        secretIds: grantedIds
-      })
-    );
+    await withRetry(async () => {
+      if (connectionIds.length > 0) {
+        await trpc.connections.setAgentConnections.mutate({
+          agentId: cleanup.agentId,
+          connectionIds
+        });
+      }
+      if (secretIds.length > 0) {
+        await trpc.secrets.setAgentAccess.mutate({
+          agentId: cleanup.agentId,
+          secretIds
+        });
+      }
+    });
   } catch (e2) {
     spin.stop("Grant failed");
-    R2.error(`Failed to grant provider access: ${errorReason2(e2)}`);
+    R2.error(`Failed to grant credentials: ${errorReason2(e2)}`);
     R2.warn(
       `Agent ${name} was created but the credential grant did not land. Configure access via the web UI, or run \`dam agent delete ${name}\` to start over.`
     );
@@ -31403,9 +31588,9 @@ async function cancelAndCleanup(trpc, cleanup) {
   process.exit(0);
 }
 async function flushCleanup(trpc, cleanup) {
-  if (cleanup.agentId === null && cleanup.newSecretIds.length === 0) return;
-  const { orphanAgent, orphanSecrets } = await deleteCreated(trpc, cleanup);
-  const summary = formatOrphans(orphanAgent, orphanSecrets);
+  if (cleanup.agentId === null && cleanup.newConnectionIds.length === 0) return;
+  const { orphanAgent, orphanConnections } = await deleteCreated(trpc, cleanup);
+  const summary = formatOrphans(orphanAgent, orphanConnections);
   if (summary) R2.warn(summary);
 }
 async function handleStage1Failure(trpc, cleanup, originalError) {
@@ -31418,8 +31603,8 @@ async function handleStage1Failure(trpc, cleanup, originalError) {
   R2.error(`Failed to create agent: ${reason}`);
   const lines = [];
   if (cleanup.agentId) lines.push(`  Agent: ${cleanup.agentId}`);
-  if (cleanup.newSecretIds.length > 0) {
-    lines.push(`  Secrets: ${cleanup.newSecretIds.join(", ")}`);
+  if (cleanup.newConnectionIds.length > 0) {
+    lines.push(`  Connections: ${cleanup.newConnectionIds.join(", ")}`);
   }
   if (lines.length > 0) {
     R2.warn(
@@ -31430,229 +31615,304 @@ async function handleStage1Failure(trpc, cleanup, originalError) {
     );
   }
 }
-async function pickProvider(trpc, cleanup) {
-  let list;
+async function listCredentials(trpc, cleanup) {
   try {
-    list = await trpc.secrets.list.query();
+    return {
+      conns: await trpc.connections.list.query(),
+      secrets: await trpc.secrets.list.query(),
+      templates: await trpc.connections.listTemplates.query()
+    };
   } catch (e2) {
-    me(`failed to list secrets: ${errorReason2(e2)}`);
+    me(`failed to list credentials: ${errorReason2(e2)}`);
     await flushCleanup(trpc, cleanup);
     process.exit(EXIT_RUNTIME_FAILURE);
   }
-  const existing = list.filter(
-    (s) => s.type === "anthropic" || s.type === "ibm-litellm" || s.type === "openai"
+}
+async function pickProvider(trpc, cleanup) {
+  const { conns, secrets, templates } = await listCredentials(trpc, cleanup);
+  const existingConns = providerConns(conns);
+  const existingSecrets = secrets.filter(
+    (s) => isProviderPresetType(s.type)
   ).map((s) => ({ id: s.id, name: s.name, type: s.type }));
-  if (existing.length === 0) {
+  if (existingConns.length === 0 && existingSecrets.length === 0) {
     R2.info("No model providers configured yet \u2014 let's add one.");
-    return addOrReplaceProvider(trpc, cleanup, existing);
+    return addOrReplaceProvider(trpc, cleanup, existingConns, templates);
   }
   const NEW = "__new__";
   const picked = await Ee({
     message: "Model provider",
     options: [
-      ...existing.map((s) => ({ value: s.id, label: `${s.name} (${s.type})` })),
+      ...existingConns.map((c2) => ({
+        value: `conn:${c2.id}`,
+        label: `${c2.name} (${c2.type})`
+      })),
+      ...existingSecrets.map((s) => ({
+        value: `secret:${s.id}`,
+        label: `${s.name} (${s.type}) (legacy)`
+      })),
       { value: NEW, label: "Add new..." }
     ]
   });
   if (q(picked)) return cancelAndCleanup(trpc, cleanup);
-  if (picked === NEW) return addOrReplaceProvider(trpc, cleanup, existing);
-  const found = existing.find((s) => s.id === picked);
-  if (!found) {
-    me("internal: picked provider not in list");
-    await flushCleanup(trpc, cleanup);
-    process.exit(EXIT_RUNTIME_FAILURE);
+  if (picked === NEW) {
+    return addOrReplaceProvider(trpc, cleanup, existingConns, templates);
+  }
+  if (picked.startsWith("conn:")) {
+    const found2 = existingConns.find((c2) => `conn:${c2.id}` === picked);
+    return {
+      routing: { kind: "connection", id: found2.id },
+      name: found2.name,
+      type: found2.type
+    };
   }
+  const found = existingSecrets.find((s) => `secret:${s.id}` === picked);
   return {
-    secretId: found.id,
+    routing: { kind: "secret", id: found.id },
     name: found.name,
-    type: found.type,
-    createdNew: false
+    type: found.type
   };
 }
-async function addOrReplaceProvider(trpc, cleanup, existing) {
+function providerConns(conns) {
+  return conns.filter((c2) => PROVIDER_TEMPLATE_IDS.has(c2.templateId)).map((c2) => {
+    const type = providerTypeForTemplateId(c2.templateId);
+    return type ? { id: c2.id, name: c2.name, templateId: c2.templateId, type } : null;
+  }).filter((c2) => c2 !== null);
+}
+async function addOrReplaceProvider(trpc, cleanup, existingConns, templates) {
   while (true) {
     const type = await Ee({
       message: "Provider type",
-      options: [
-        { value: "anthropic", label: "Anthropic" },
-        { value: "ibm-litellm", label: "IBM LiteLLM" },
-        { value: "openai", label: "OpenAI" }
-      ]
+      options: PROVIDER_PRESET_TYPES.map((t) => ({
+        value: t,
+        label: PROVIDERS[t].displayName
+      }))
     });
     if (q(type)) return cancelAndCleanup(trpc, cleanup);
-    const existingOfType = existing.find((s) => s.type === type);
+    const existingOfType = existingConns.find((c2) => c2.type === type);
     if (existingOfType) {
       const replace = await ue({
-        message: `A ${PROVIDERS[type].displayName} key already exists. Replace its API key?`,
+        message: `A ${PROVIDERS[type].displayName} connection already exists. Replace its credential?`,
         initialValue: false
       });
       if (q(replace)) return cancelAndCleanup(trpc, cleanup);
       if (!replace) {
         return {
-          secretId: existingOfType.id,
+          routing: { kind: "connection", id: existingOfType.id },
           name: existingOfType.name,
-          type,
-          createdNew: false
+          type
         };
       }
-      const apiKey2 = await Ce({
-        message: `New ${PROVIDERS[type].displayName} API key`,
-        validate(v2) {
-          if (!v2 || v2.trim() === "") return "Required";
-          return void 0;
-        }
-      });
-      if (q(apiKey2)) return cancelAndCleanup(trpc, cleanup);
-      const updateInput = await parseOrExit(
-        secretUpdateInputSchema,
-        { id: existingOfType.id, value: apiKey2 },
-        EXIT_INVALID_INPUT,
-        () => flushCleanup(trpc, cleanup)
+      const value2 = await promptSecret(
+        `New ${PROVIDERS[type].displayName} credential`
       );
+      if (q(value2)) return cancelAndCleanup(trpc, cleanup);
+      const templateId2 = templateIdForProvider(type, value2);
+      if (templateId2 !== existingOfType.templateId) {
+        const have = existingOfType.templateId === "anthropic-oauth" ? "an OAuth token" : "an API key";
+        const got = templateId2 === "anthropic-oauth" ? "an OAuth token" : "an API key";
+        R2.error(
+          `This connection expects ${have}, but that looks like ${got}. Paste a matching credential, or disconnect it and add a new one to switch.`
+        );
+        continue;
+      }
       try {
-        await trpc.secrets.update.mutate(updateInput);
+        await trpc.connections.update.mutate({
+          id: existingOfType.id,
+          value: value2
+        });
         return {
-          secretId: existingOfType.id,
+          routing: { kind: "connection", id: existingOfType.id },
           name: existingOfType.name,
-          type,
-          createdNew: false
+          type
         };
       } catch (e2) {
-        R2.error(`Failed to replace API key: ${errorReason2(e2)}`);
+        R2.error(`Failed to replace credential: ${errorReason2(e2)}`);
         continue;
       }
     }
-    const name = PROVIDERS[type].displayName;
-    const apiKey = await Ce({
-      message: `${PROVIDERS[type].displayName} API key`,
-      validate(v2) {
-        if (!v2 || v2.trim() === "") return "Required";
-        return void 0;
-      }
-    });
-    if (q(apiKey)) return cancelAndCleanup(trpc, cleanup);
-    const createInput = await parseOrExit(
-      secretCreateInputSchema,
-      { type, name, value: apiKey },
-      EXIT_INVALID_INPUT,
-      () => flushCleanup(trpc, cleanup)
+    const value = await promptSecret(
+      `${PROVIDERS[type].displayName} credential`
+    );
+    if (q(value)) return cancelAndCleanup(trpc, cleanup);
+    const templateId = templateIdForProvider(type, value);
+    const template = templates.find((t) => t.id === templateId);
+    const configInputs = template ? await promptConfigInputs(trpc, cleanup, template) : {};
+    const created = await createProviderConnection(
+      trpc,
+      cleanup,
+      type,
+      templateId,
+      value,
+      configInputs
     );
+    if (created) return created;
+  }
+}
+async function promptConfigInputs(trpc, cleanup, template) {
+  const inputs = configInputsOf(template);
+  if (inputs.length === 0) return {};
+  Se("Optional configuration \u2014 press Enter to skip each.");
+  const out = {};
+  for (const input of inputs) {
+    const label = input.label ?? input.name;
+    if (input.enumValues) {
+      const SKIP = "__skip__";
+      const choice = await Ee({
+        message: input.hint ? `${label} \u2014 ${input.hint}` : label,
+        options: [
+          ...input.enumValues.map((v2) => ({ value: v2, label: v2 })),
+          { value: SKIP, label: "Skip" }
+        ],
+        initialValue: SKIP
+      });
+      if (q(choice)) return cancelAndCleanup(trpc, cleanup);
+      if (choice !== SKIP) out[input.name] = choice;
+      continue;
+    }
+    const answer = await Re({
+      message: input.hint ? `${label} \u2014 ${input.hint}` : label,
+      validate: (v2) => validateConfigInputValue(input, v2 ?? "")
+    });
+    if (q(answer)) return cancelAndCleanup(trpc, cleanup);
+    const trimmed = answer.trim();
+    if (trimmed) out[input.name] = trimmed;
+  }
+  return out;
+}
+async function createConnectionWithRename(trpc, cleanup, params) {
+  let name = params.name;
+  const hasConfig = params.configInputs && Object.keys(params.configInputs).length > 0;
+  while (true) {
     try {
-      const created = await trpc.secrets.create.mutate(createInput);
-      cleanup.newSecretIds.push(created.id);
-      return {
-        secretId: created.id,
-        name: created.name,
-        type,
-        createdNew: true
-      };
+      const created = await trpc.connections.create.mutate({
+        templateId: params.templateId,
+        name,
+        authKind: "header",
+        value: params.value,
+        ...hasConfig ? { configInputs: params.configInputs } : {}
+      });
+      cleanup.newConnectionIds.push(created.id);
+      return { id: created.id, name };
     } catch (e2) {
-      R2.error(`Failed to create secret: ${errorReason2(e2)}`);
+      if (trpcCode(e2) === "CONFLICT") {
+        const renamed = await Re({
+          message: `A connection named "${name}" already exists. Choose a different name`,
+          validate(v2) {
+            if (!v2 || !CONNECTION_NAME_RE.test(v2)) {
+              return `lowercase letters, digits, and single hyphens (e.g. ${params.nameExample})`;
+            }
+            return void 0;
+          }
+        });
+        if (q(renamed)) return cancelAndCleanup(trpc, cleanup);
+        name = renamed;
+        continue;
+      }
+      R2.error(`Failed to create connection: ${errorReason2(e2)}`);
+      return null;
     }
   }
 }
+async function createProviderConnection(trpc, cleanup, type, templateId, value, configInputs) {
+  const created = await createConnectionWithRename(trpc, cleanup, {
+    templateId,
+    name: templateId,
+    value,
+    nameExample: "my-anthropic",
+    configInputs
+  });
+  if (!created) return null;
+  return {
+    routing: { kind: "connection", id: created.id },
+    name: created.name,
+    type
+  };
+}
+var DEFAULT_GITHUB_PAT_NAME = GITHUB_PAT_TEMPLATE_ID;
 async function pickGithubPat(trpc, cleanup) {
-  let list;
-  try {
-    list = await trpc.secrets.list.query();
-  } catch (e2) {
-    me(`failed to list secrets: ${errorReason2(e2)}`);
-    await flushCleanup(trpc, cleanup);
-    process.exit(EXIT_RUNTIME_FAILURE);
-  }
-  const pairs = groupGithubPats(list);
-  if (pairs.length === 0) {
+  const { conns, secrets } = await listCredentials(trpc, cleanup);
+  const patConns = conns.filter((c2) => c2.templateId === GITHUB_PAT_TEMPLATE_ID);
+  const pairs = groupGithubPats(secrets);
+  if (patConns.length === 0 && pairs.length === 0) {
     R2.info("No GitHub PAT configured yet.");
     const add = await ue({ message: "Add one?", initialValue: true });
     if (q(add)) return cancelAndCleanup(trpc, cleanup);
     if (!add) return null;
-    return addOrReplaceGithubPat(trpc, cleanup, pairs);
+    return addOrReplaceGithubPat(trpc, cleanup, patConns);
   }
   const NEW = "__new__";
   const SKIP = "__skip__";
   const picked = await Ee({
     message: "GitHub PAT",
     options: [
-      ...pairs.map((p2) => ({ value: p2.name, label: p2.name })),
+      ...patConns.map((c2) => ({ value: `conn:${c2.id}`, label: c2.name })),
+      ...pairs.map((p2) => ({
+        value: `secret:${p2.name}`,
+        label: `${p2.name} (legacy)`
+      })),
       { value: NEW, label: "Add new..." },
       { value: SKIP, label: "Skip" }
     ]
   });
   if (q(picked)) return cancelAndCleanup(trpc, cleanup);
   if (picked === SKIP) return null;
-  if (picked === NEW) return addOrReplaceGithubPat(trpc, cleanup, pairs);
-  const found = pairs.find((p2) => p2.name === picked);
-  if (!found) {
-    me("internal: picked PAT not in list");
-    await flushCleanup(trpc, cleanup);
-    process.exit(EXIT_RUNTIME_FAILURE);
+  if (picked === NEW) return addOrReplaceGithubPat(trpc, cleanup, patConns);
+  if (picked.startsWith("conn:")) {
+    const found2 = patConns.find((c2) => `conn:${c2.id}` === picked);
+    return { source: "connection", connectionId: found2.id, name: found2.name };
   }
-  return { ...found, createdNew: false };
+  const found = pairs.find((p2) => `secret:${p2.name}` === picked);
+  return {
+    source: "secret",
+    apiSecretId: found.apiSecretId,
+    gitSecretId: found.gitSecretId,
+    name: found.name
+  };
 }
-var DEFAULT_GITHUB_PAT_NAME = "GitHub";
 async function addOrReplaceGithubPat(trpc, cleanup, existing) {
-  const collide = existing.find((p2) => p2.name === DEFAULT_GITHUB_PAT_NAME);
+  const collide = existing.find((c2) => c2.name === DEFAULT_GITHUB_PAT_NAME);
   while (true) {
     if (collide) {
       const replace = await ue({
-        message: `A GitHub PAT named "${DEFAULT_GITHUB_PAT_NAME}" already exists. Replace its token?`,
+        message: `A GitHub PAT connection named "${DEFAULT_GITHUB_PAT_NAME}" already exists. Replace its token?`,
         initialValue: false
       });
       if (q(replace)) return cancelAndCleanup(trpc, cleanup);
       if (!replace) {
-        return { ...collide, createdNew: false };
+        return {
+          source: "connection",
+          connectionId: collide.id,
+          name: collide.name
+        };
       }
-      const token2 = await Ce({
-        message: "New GitHub personal access token",
-        validate(v2) {
-          if (!v2 || v2.trim() === "") return "Required";
-          return void 0;
-        }
-      });
+      const token2 = await promptSecret("New GitHub personal access token");
       if (q(token2)) return cancelAndCleanup(trpc, cleanup);
-      const updateInput = await parseOrExit(
-        secretUpdateGithubPatInputSchema,
-        {
-          apiSecretId: collide.apiSecretId,
-          gitSecretId: collide.gitSecretId,
-          token: token2
-        },
-        EXIT_INVALID_INPUT,
-        () => flushCleanup(trpc, cleanup)
-      );
       try {
-        await trpc.secrets.updateGithubPat.mutate(updateInput);
-        return { ...collide, createdNew: false };
+        await trpc.connections.update.mutate({ id: collide.id, value: token2 });
+        return {
+          source: "connection",
+          connectionId: collide.id,
+          name: collide.name
+        };
       } catch (e2) {
         R2.error(`Failed to replace GitHub PAT: ${errorReason2(e2)}`);
         continue;
       }
     }
-    const token = await Ce({
-      message: "GitHub personal access token",
-      validate(v2) {
-        if (!v2 || v2.trim() === "") return "Required";
-        return void 0;
-      }
-    });
+    const token = await promptSecret("GitHub personal access token");
     if (q(token)) return cancelAndCleanup(trpc, cleanup);
-    const createInput = await parseOrExit(
-      secretCreateGithubPatInputSchema,
-      { name: DEFAULT_GITHUB_PAT_NAME, token },
-      EXIT_INVALID_INPUT,
-      () => flushCleanup(trpc, cleanup)
-    );
-    try {
-      const created = await trpc.secrets.createGithubPat.mutate(createInput);
-      cleanup.newSecretIds.push(created.apiSecretId, created.gitSecretId);
+    const created = await createConnectionWithRename(trpc, cleanup, {
+      templateId: GITHUB_PAT_TEMPLATE_ID,
+      name: DEFAULT_GITHUB_PAT_NAME,
+      value: token,
+      nameExample: "my-github"
+    });
+    if (created) {
       return {
-        name: created.name,
-        apiSecretId: created.apiSecretId,
-        gitSecretId: created.gitSecretId,
-        createdNew: true
+        source: "connection",
+        connectionId: created.id,
+        name: created.name
       };
-    } catch (e2) {
-      R2.error(`Failed to create GitHub PAT: ${errorReason2(e2)}`);
     }
   }
 }
@@ -31701,6 +31961,37 @@ function createAgentResolver(deps) {
   };
 }
 
+// src/modules/agent/commands/errors.ts
+function exitCodeForResolveError(error51) {
+  return error51.kind === "not-found" || error51.kind === "ambiguous" ? EXIT_AGENT_NOT_RESOLVED : EXIT_RUNTIME_FAILURE;
+}
+function printResolveError(error51, host) {
+  switch (error51.kind) {
+    case "not-found":
+      if (error51.via === "id") {
+        process.stderr.write(`error: no agent with id \`${error51.ref}\`
+`);
+      } else {
+        process.stderr.write(`error: no agent named "${error51.ref}"
+`);
+      }
+      return;
+    case "ambiguous":
+      process.stderr.write(`error: multiple agents named "${error51.ref}":
+`);
+      for (const m of error51.matches) {
+        process.stderr.write(`  - \`${m.id}\`
+`);
+      }
+      process.stderr.write("hint: specify by id instead\n");
+      return;
+    case "auth-required":
+    case "transport":
+      printServiceError(error51, host);
+      return;
+  }
+}
+
 // src/modules/shared/prompt.ts
 import { createInterface as createInterface2 } from "readline/promises";
 var DEFAULT_PROMPT_TIMEOUT_MS = 3e4;
@@ -32136,6 +32427,24 @@ function createAgentService(deps) {
       } catch (e2) {
         return notFoundOnMutate(e2, id);
       }
+    },
+    async updateAllowedUserEmails(id, emails) {
+      try {
+        return ok2(
+          await deps.trpc.agents.update.mutate({
+            id,
+            allowedUserEmails: [...emails]
+          })
+        );
+      } catch (e2) {
+        if (e2?.data?.code === "BAD_REQUEST") {
+          return err2({
+            kind: "invalid-input",
+            message: e2 instanceof Error ? e2.message : String(e2)
+          });
+        }
+        return notFoundOnMutate(e2, id);
+      }
     }
   };
 }
@@ -32299,6 +32608,20 @@ function buildDenyCommand(deps) {
   );
 }
 
+// src/modules/agent/domain/allowed-users.ts
+function mergeAllowedUserEmails(current, opts) {
+  const removeSet = new Set((opts.remove ?? []).map((e2) => e2.toLowerCase()));
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const email3 of [...current, ...opts.add ?? []]) {
+    const key = email3.toLowerCase();
+    if (removeSet.has(key) || seen.has(key)) continue;
+    seen.add(key);
+    result.push(email3);
+  }
+  return result;
+}
+
 // src/modules/shared/relative-time.ts
 var MINUTE_MS = 6e4;
 var HOUR_MS = 36e5;
@@ -32819,10 +33142,7 @@ function buildTokenCreateCommand(deps) {
 `);
         }
       } catch (err3) {
-        process.stderr.write(
-          `error: ${err3 instanceof Error ? err3.message : String(err3)}
-`
-        );
+        printTrpcError(err3, resolved.value.server);
         process.exit(EXIT_RUNTIME_FAILURE);
       }
     }
@@ -32863,10 +33183,7 @@ function buildTokenListCommand(deps) {
         );
       }
     } catch (err3) {
-      process.stderr.write(
-        `error: ${err3 instanceof Error ? err3.message : String(err3)}
-`
-      );
+      printTrpcError(err3, resolved.value.server);
       process.exit(EXIT_RUNTIME_FAILURE);
     }
   });
@@ -32890,10 +33207,7 @@ function buildTokenRevokeCommand(deps) {
       process.stdout.write(`\u2713 Revoked ${id}
 `);
     } catch (err3) {
-      process.stderr.write(
-        `error: ${err3 instanceof Error ? err3.message : String(err3)}
-`
-      );
+      printTrpcError(err3, resolved.value.server);
       process.exit(EXIT_RUNTIME_FAILURE);
     }
   });
@@ -32967,17 +33281,6 @@ function createAuthConfigProbe(opts = {}) {
   };
 }
 
-// src/modules/auth/infrastructure/auth-env-reader.ts
-var DAM_TOKEN_ENV_VAR = "DAM_TOKEN";
-function createProcessAuthEnvReader(env = process.env) {
-  return {
-    damToken() {
-      const v2 = env[DAM_TOKEN_ENV_VAR];
-      return v2 && v2.length > 0 ? v2 : void 0;
-    }
-  };
-}
-
 // src/modules/auth/infrastructure/auth-path.ts
 import { homedir } from "os";
 import { join } from "path";
@@ -35339,60 +35642,679 @@ function composeAuthModule(opts) {
   const authService = createAuthService({
     compatService: opts.compatService,
     configService: opts.configService,
-    authConfigProbe,
-    oidcDiscovery,
-    deviceFlowClient,
-    tokenEndpointClient,
-    revokeClient,
-    browserOpener,
-    authStore,
-    authEnvReader
-  });
-  const authParent = new Command("auth").description(
-    "Authenticate against a Platform deployment (OAuth 2.0 Device Authorization Grant)"
+    authConfigProbe,
+    oidcDiscovery,
+    deviceFlowClient,
+    tokenEndpointClient,
+    revokeClient,
+    browserOpener,
+    authStore,
+    authEnvReader
+  });
+  const authParent = new Command("auth").description(
+    "Authenticate against a Platform deployment (OAuth 2.0 Device Authorization Grant)"
+  );
+  authParent.addCommand(
+    buildLoginCommand({
+      authService,
+      configService: opts.configService,
+      authEnvReader
+    })
+  );
+  authParent.addCommand(
+    buildLogoutCommand({
+      authService,
+      configService: opts.configService
+    })
+  );
+  authParent.addCommand(buildStatusCommand({ authService }));
+  const buildTrpc = (host) => createTrpcClient({ host, tokenProvider });
+  const tokenParent = new Command("token").description(
+    "Manage API keys for headless / CI use"
+  );
+  tokenParent.addCommand(
+    buildTokenCreateCommand({
+      configService: opts.configService,
+      buildTrpc
+    })
+  );
+  tokenParent.addCommand(
+    buildTokenListCommand({
+      configService: opts.configService,
+      buildTrpc
+    })
+  );
+  tokenParent.addCommand(
+    buildTokenRevokeCommand({
+      configService: opts.configService,
+      buildTrpc
+    })
+  );
+  authParent.addCommand(tokenParent);
+  return {
+    commands: [authParent],
+    exports: { tokenProvider },
+    internals: { authStore, authPath, authEnvReader }
+  };
+}
+
+// src/modules/channel/commands/allow.ts
+var collect = (v2, acc) => [...acc, v2];
+var emailSchema = external_exports.email();
+function buildAllowCommand(deps) {
+  return new Command("allow").description(
+    "Add one or more users to an Agent's allowed-user list (gates Slack drivers)"
+  ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
+    "--user <email>",
+    "user email to allow (repeatable)",
+    collect,
+    []
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit { ok, agentId, allowedUserEmails } as JSON").addHelpText(
+    "after",
+    "\nExamples:\n  dam channel allow my-agent --user teammate@example.com\n  dam channel allow my-agent --user a@x.com --user b@y.com\n"
+  ).action(
+    async (ref, opts) => {
+      const users = opts.user;
+      if (users.length === 0) {
+        process.stderr.write("error: pass at least one --user <email>\n");
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      const invalid = users.filter((u) => !emailSchema.safeParse(u).success);
+      if (invalid.length > 0) {
+        process.stderr.write(
+          `error: invalid email(s): ${invalid.join(", ")}
+`
+        );
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const svc = deps.createAgentService(host);
+      const resolver = createAgentResolver({ agentService: svc });
+      const resolved = await resolver.resolve(ref);
+      if (!resolved.ok) {
+        printResolveError(resolved.error, host);
+        process.exit(exitCodeForResolveError(resolved.error));
+      }
+      const merged = mergeAllowedUserEmails(
+        resolved.value.allowedUserEmails,
+        {
+          add: users
+        }
+      );
+      const res = await svc.updateAllowedUserEmails(
+        resolved.value.id,
+        merged
+      );
+      if (!res.ok) {
+        if (res.error.kind === "invalid-input") {
+          process.stderr.write(`error: ${res.error.message}
+`);
+          process.exit(EXIT_INVALID_INPUT);
+        }
+        if (res.error.kind === "not-found") {
+          process.stderr.write(
+            `error: no agent with id \`${resolved.value.id}\`
+`
+          );
+          process.exit(EXIT_AGENT_NOT_RESOLVED);
+        }
+        printServiceError(res.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (opts.json) {
+        process.stdout.write(
+          `${JSON.stringify({ ok: true, agentId: resolved.value.id, allowedUserEmails: res.value.allowedUserEmails })}
+`
+        );
+      } else {
+        process.stdout.write(
+          `\u2713 Allowed ${users.length} user(s) on ${resolved.value.name}. Agent now has ${res.value.allowedUserEmails.length} allowed user(s).
+`
+        );
+      }
+      process.exit(EXIT_SUCCESS);
+    }
+  );
+}
+
+// src/modules/channel/commands/available.ts
+var PROVIDER_ORDER = [
+  "slack" /* Slack */,
+  "telegram" /* Telegram */
+];
+function buildAvailableCommand(deps) {
+  return new Command("available").description(
+    "List the messenger providers the operator enabled on this host"
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit the raw { slack?, telegram? } object as JSON").addHelpText(
+    "after",
+    "\nExamples:\n  dam channel available\n  dam channel available --json\n"
+  ).action(async (opts) => {
+    const host = await resolveActiveHost(deps, {
+      flag: opts.server ? { server: opts.server } : void 0,
+      exitCodes: {
+        runtimeFailure: EXIT_RUNTIME_FAILURE,
+        belowFloor: EXIT_BELOW_FLOOR
+      }
+    });
+    const svc = deps.createChannelService(host);
+    const res = await svc.available();
+    if (!res.ok) {
+      printServiceError(res.error, host);
+      process.exit(EXIT_RUNTIME_FAILURE);
+    }
+    if (opts.json) {
+      return writeStdoutAndExit(
+        `${JSON.stringify(res.value)}
+`,
+        EXIT_SUCCESS
+      );
+    }
+    const enabled = PROVIDER_ORDER.filter((p2) => res.value[p2]);
+    if (enabled.length === 0) {
+      process.stderr.write("No messenger channels enabled on this host.\n");
+      process.exit(EXIT_SUCCESS);
+    }
+    const lines = enabled.map((p2) => `${p2.padEnd(10)}enabled`).join("\n");
+    return writeStdoutAndExit(`${lines}
+`, EXIT_SUCCESS);
+  });
+}
+
+// src/modules/channel/commands/disallow.ts
+var collect2 = (v2, acc) => [...acc, v2];
+function buildDisallowCommand(deps) {
+  return new Command("disallow").description(
+    "Remove one or more users from an Agent's allowed-user list. Idempotent."
+  ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
+    "--user <email>",
+    "user email to remove (repeatable)",
+    collect2,
+    []
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit { ok, agentId, allowedUserEmails } as JSON").addHelpText(
+    "after",
+    "\nExamples:\n  dam channel disallow my-agent --user teammate@example.com\n"
+  ).action(
+    async (ref, opts) => {
+      const users = opts.user;
+      if (users.length === 0) {
+        process.stderr.write("error: pass at least one --user <email>\n");
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const svc = deps.createAgentService(host);
+      const resolver = createAgentResolver({ agentService: svc });
+      const resolved = await resolver.resolve(ref);
+      if (!resolved.ok) {
+        printResolveError(resolved.error, host);
+        process.exit(exitCodeForResolveError(resolved.error));
+      }
+      const merged = mergeAllowedUserEmails(
+        resolved.value.allowedUserEmails,
+        {
+          remove: users
+        }
+      );
+      const res = await svc.updateAllowedUserEmails(
+        resolved.value.id,
+        merged
+      );
+      if (!res.ok) {
+        if (res.error.kind === "invalid-input") {
+          process.stderr.write(`error: ${res.error.message}
+`);
+          process.exit(EXIT_INVALID_INPUT);
+        }
+        if (res.error.kind === "not-found") {
+          process.stderr.write(
+            `error: no agent with id \`${resolved.value.id}\`
+`
+          );
+          process.exit(EXIT_AGENT_NOT_RESOLVED);
+        }
+        printServiceError(res.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (opts.json) {
+        process.stdout.write(
+          `${JSON.stringify({ ok: true, agentId: resolved.value.id, allowedUserEmails: res.value.allowedUserEmails })}
+`
+        );
+      } else {
+        process.stdout.write(
+          `\u2713 Disallowed ${users.length} user(s) from ${resolved.value.name}. Agent now has ${res.value.allowedUserEmails.length} allowed user(s).
+`
+        );
+      }
+      process.exit(EXIT_SUCCESS);
+    }
+  );
+}
+
+// src/modules/channel/commands/list.ts
+function renderHuman(channels, allowedUserEmails) {
+  const channelsBlock = channels.length === 0 ? "No channels connected.\n" : renderTable([
+    ["TYPE", "IDENTIFIER"],
+    ...channels.map(
+      (c2) => (
+        // Telegram has no readable identifier — the bot token is write-only.
+        c2.type === "slack" /* Slack */ ? ["slack", c2.slackChannelId] : ["telegram", "\u2014"]
+      )
+    )
+  ]);
+  const allowed = allowedUserEmails.length === 0 ? "  (unrestricted)\n" : `${allowedUserEmails.map((e2) => `  ${e2}`).join("\n")}
+`;
+  return `${channelsBlock}
+Allowed users:
+${allowed}`;
+}
+function buildListCommand3(deps) {
+  return new Command("list").description("List an Agent's connected channels and its Slack allow-list").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option(
+    "--json",
+    "emit { channels, allowedUserEmails } as JSON instead of the default tables"
+  ).addHelpText(
+    "after",
+    "\nExamples:\n  dam channel list my-agent\n  dam channel list my-agent --json\n"
+  ).action(async (ref, opts) => {
+    const host = await resolveActiveHost(deps, {
+      flag: opts.server ? { server: opts.server } : void 0,
+      exitCodes: {
+        runtimeFailure: EXIT_RUNTIME_FAILURE,
+        belowFloor: EXIT_BELOW_FLOOR
+      }
+    });
+    const resolver = createAgentResolver({
+      agentService: deps.createAgentService(host)
+    });
+    const resolved = await resolver.resolve(ref);
+    if (!resolved.ok) {
+      printResolveError(resolved.error, host);
+      process.exit(exitCodeForResolveError(resolved.error));
+    }
+    const { channels, allowedUserEmails } = resolved.value;
+    if (opts.json) {
+      return writeStdoutAndExit(
+        `${JSON.stringify({ channels, allowedUserEmails })}
+`,
+        EXIT_SUCCESS
+      );
+    }
+    return writeStdoutAndExit(
+      renderHuman(channels, allowedUserEmails),
+      EXIT_SUCCESS
+    );
+  });
+}
+
+// src/modules/channel/commands/precheck.ts
+var UNAVAILABLE_MESSAGE = {
+  ["slack" /* Slack */]: "Slack app token not configured",
+  ["telegram" /* Telegram */]: "Telegram channel not enabled"
+};
+async function ensureProviderAvailable(svc, provider, host) {
+  const res = await svc.available();
+  if (!res.ok) {
+    printServiceError(res.error, host);
+    process.exit(EXIT_RUNTIME_FAILURE);
+  }
+  if (!res.value[provider]) {
+    process.stderr.write(`error: ${UNAVAILABLE_MESSAGE[provider]}
+`);
+    process.exit(EXIT_INVALID_INPUT);
+  }
+}
+
+// src/modules/channel/commands/slack-connect.ts
+function buildSlackConnectCommand(deps) {
+  return new Command("connect").description("Bind a Slack channel to an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").requiredOption("--channel-id <id>", "Slack channel id (e.g. C0123ABCD)").option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit the updated ChannelConfig[] as JSON").addHelpText(
+    "after",
+    "\nExamples:\n  dam channel slack connect my-agent --channel-id C0123ABCD\n"
+  ).action(
+    async (ref, opts) => {
+      const channelId = opts.channelId.trim();
+      if (channelId.length === 0) {
+        process.stderr.write("error: --channel-id must not be empty\n");
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const resolver = createAgentResolver({
+        agentService: deps.createAgentService(host)
+      });
+      const resolved = await resolver.resolve(ref);
+      if (!resolved.ok) {
+        printResolveError(resolved.error, host);
+        process.exit(exitCodeForResolveError(resolved.error));
+      }
+      const svc = deps.createChannelService(host);
+      await ensureProviderAvailable(svc, "slack" /* Slack */, host);
+      const res = await svc.connectSlack(resolved.value.id, channelId);
+      if (!res.ok) {
+        if (res.error.kind === "channel-conflict") {
+          process.stderr.write(
+            "error: Slack channel already bound to another agent\n"
+          );
+          process.exit(EXIT_INVALID_INPUT);
+        }
+        if (res.error.kind === "channel-precondition" || res.error.kind === "invalid-input") {
+          process.stderr.write(`error: ${res.error.message}
+`);
+          process.exit(EXIT_INVALID_INPUT);
+        }
+        printServiceError(res.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify(res.value)}
+`);
+      } else {
+        process.stdout.write(
+          `\u2713 Slack channel ${channelId} connected to ${resolved.value.name}.
+`
+        );
+        process.stderr.write(
+          "hint: users must run `/platform login` inside Slack before they can drive this agent\n"
+        );
+      }
+      process.exit(EXIT_SUCCESS);
+    }
+  );
+}
+
+// src/modules/channel/commands/slack-disconnect.ts
+function buildSlackDisconnectCommand(deps) {
+  return new Command("disconnect").description(
+    "Unbind an Agent's Slack channel. Idempotent \u2014 a not-connected agent exits 0."
+  ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit the updated ChannelConfig[] as JSON").addHelpText(
+    "after",
+    "\nExamples:\n  dam channel slack disconnect my-agent\n"
+  ).action(async (ref, opts) => {
+    const host = await resolveActiveHost(deps, {
+      flag: opts.server ? { server: opts.server } : void 0,
+      exitCodes: {
+        runtimeFailure: EXIT_RUNTIME_FAILURE,
+        belowFloor: EXIT_BELOW_FLOOR
+      }
+    });
+    const resolver = createAgentResolver({
+      agentService: deps.createAgentService(host)
+    });
+    const resolved = await resolver.resolve(ref);
+    if (!resolved.ok) {
+      printResolveError(resolved.error, host);
+      process.exit(exitCodeForResolveError(resolved.error));
+    }
+    const svc = deps.createChannelService(host);
+    const res = await svc.disconnectSlack(resolved.value.id);
+    if (!res.ok) {
+      printServiceError(res.error, host);
+      process.exit(EXIT_RUNTIME_FAILURE);
+    }
+    if (opts.json) {
+      process.stdout.write(`${JSON.stringify(res.value)}
+`);
+    } else {
+      process.stdout.write(
+        `\u2713 Slack disconnected from ${resolved.value.name}.
+`
+      );
+    }
+    process.exit(EXIT_SUCCESS);
+  });
+}
+
+// src/modules/channel/commands/telegram-connect.ts
+function buildTelegramConnectCommand(deps) {
+  return new Command("connect").description("Bind a Telegram bot to an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
+    "--bot-token <token>",
+    "bot token from @BotFather (prompted, masked, if omitted on a TTY)"
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit the updated ChannelConfig[] as JSON").addHelpText(
+    "after",
+    "\nExamples:\n  dam channel telegram connect my-agent\n  dam channel telegram connect my-agent --bot-token 123:ABC\n"
+  ).action(
+    async (ref, opts) => {
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const resolver = createAgentResolver({
+        agentService: deps.createAgentService(host)
+      });
+      const resolved = await resolver.resolve(ref);
+      if (!resolved.ok) {
+        printResolveError(resolved.error, host);
+        process.exit(exitCodeForResolveError(resolved.error));
+      }
+      const token = await resolveToken(opts);
+      const svc = deps.createChannelService(host);
+      await ensureProviderAvailable(svc, "telegram" /* Telegram */, host);
+      const res = await svc.connectTelegram(resolved.value.id, token);
+      if (!res.ok) {
+        if (res.error.kind === "channel-precondition" || res.error.kind === "invalid-input") {
+          process.stderr.write(`error: ${res.error.message}
+`);
+          process.exit(EXIT_INVALID_INPUT);
+        }
+        printServiceError(res.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify(res.value)}
+`);
+      } else {
+        process.stdout.write(
+          `\u2713 Telegram bot connected to ${resolved.value.name}.
+`
+        );
+      }
+      process.exit(EXIT_SUCCESS);
+    }
+  );
+}
+async function resolveToken(opts) {
+  const flag = opts.botToken?.trim();
+  if (flag) return flag;
+  if (!process.stdin.isTTY) {
+    process.stderr.write("error: --bot-token is required on a non-TTY\n");
+    process.exit(EXIT_INVALID_INPUT);
+  }
+  const answer = await Ce({
+    message: "Telegram bot token (from @BotFather)",
+    validate: (v2) => v2 && v2.trim().length > 0 ? void 0 : "Required"
+  });
+  if (q(answer)) exitCancelled({ json: opts.json });
+  return String(answer).trim();
+}
+
+// src/modules/channel/commands/telegram-disconnect.ts
+function buildTelegramDisconnectCommand(deps) {
+  return new Command("disconnect").description(
+    "Unbind an Agent's Telegram bot (deletes its k8s Secret). Idempotent \u2014 a not-connected agent exits 0."
+  ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit the updated ChannelConfig[] as JSON").addHelpText(
+    "after",
+    "\nExamples:\n  dam channel telegram disconnect my-agent\n"
+  ).action(async (ref, opts) => {
+    const host = await resolveActiveHost(deps, {
+      flag: opts.server ? { server: opts.server } : void 0,
+      exitCodes: {
+        runtimeFailure: EXIT_RUNTIME_FAILURE,
+        belowFloor: EXIT_BELOW_FLOOR
+      }
+    });
+    const resolver = createAgentResolver({
+      agentService: deps.createAgentService(host)
+    });
+    const resolved = await resolver.resolve(ref);
+    if (!resolved.ok) {
+      printResolveError(resolved.error, host);
+      process.exit(exitCodeForResolveError(resolved.error));
+    }
+    const svc = deps.createChannelService(host);
+    const res = await svc.disconnectTelegram(resolved.value.id);
+    if (!res.ok) {
+      printServiceError(res.error, host);
+      process.exit(EXIT_RUNTIME_FAILURE);
+    }
+    if (opts.json) {
+      process.stdout.write(`${JSON.stringify(res.value)}
+`);
+    } else {
+      process.stdout.write(
+        `\u2713 Telegram disconnected from ${resolved.value.name}.
+`
+      );
+    }
+    process.exit(EXIT_SUCCESS);
+  });
+}
+
+// src/modules/channel/services/channel-service.ts
+function createChannelService(deps) {
+  return {
+    async available() {
+      return trpcCall(() => deps.trpc.channels.available.query());
+    },
+    async connectSlack(id, slackChannelId) {
+      try {
+        const agent = await deps.trpc.agents.connectSlack.mutate({
+          id,
+          slackChannelId
+        });
+        return ok2(agent.channels);
+      } catch (e2) {
+        const code = e2?.data?.code;
+        const message = e2 instanceof Error ? e2.message : String(e2);
+        if (code === "CONFLICT")
+          return err2({ kind: "channel-conflict", message });
+        if (code === "PRECONDITION_FAILED")
+          return err2({ kind: "channel-precondition", message });
+        if (code === "BAD_REQUEST")
+          return err2({ kind: "invalid-input", message });
+        return classifyTrpcError(e2);
+      }
+    },
+    async disconnectSlack(id) {
+      return trpcCall(async () => {
+        const agent = await deps.trpc.agents.disconnectSlack.mutate({ id });
+        return agent.channels;
+      });
+    },
+    async connectTelegram(id, botToken) {
+      try {
+        const agent = await deps.trpc.agents.connectTelegram.mutate({
+          id,
+          botToken
+        });
+        return ok2(agent.channels);
+      } catch (e2) {
+        const code = e2?.data?.code;
+        const message = e2 instanceof Error ? e2.message : String(e2);
+        if (code === "PRECONDITION_FAILED")
+          return err2({ kind: "channel-precondition", message });
+        if (code === "BAD_REQUEST")
+          return err2({ kind: "invalid-input", message });
+        return classifyTrpcError(e2);
+      }
+    },
+    async disconnectTelegram(id) {
+      return trpcCall(async () => {
+        const agent = await deps.trpc.agents.disconnectTelegram.mutate({ id });
+        return agent.channels;
+      });
+    }
+  };
+}
+
+// src/modules/channel/compose.ts
+function composeChannelModule(opts) {
+  const buildTrpc = (host) => createTrpcClient({ host, tokenProvider: opts.tokenProvider });
+  const createService = (host) => createChannelService({ trpc: buildTrpc(host) });
+  const agentScoped = {
+    compatService: opts.compatService,
+    configService: opts.configService,
+    createAgentService: opts.createAgentService,
+    createChannelService: createService
+  };
+  const parent = new Command("channel").description(
+    "Manage messenger channel bindings (Slack, Telegram)"
   );
-  authParent.addCommand(
-    buildLoginCommand({
-      authService,
+  parent.addCommand(
+    buildAvailableCommand({
+      compatService: opts.compatService,
       configService: opts.configService,
-      authEnvReader
-    })
-  );
-  authParent.addCommand(
-    buildLogoutCommand({
-      authService,
-      configService: opts.configService
+      createChannelService: createService
     })
   );
-  authParent.addCommand(buildStatusCommand({ authService }));
-  const buildTrpc = (host) => createTrpcClient({ host, tokenProvider });
-  const tokenParent = new Command("token").description(
-    "Manage API keys for headless / CI use"
-  );
-  tokenParent.addCommand(
-    buildTokenCreateCommand({
+  parent.addCommand(
+    buildListCommand3({
+      compatService: opts.compatService,
       configService: opts.configService,
-      buildTrpc
+      createAgentService: opts.createAgentService
     })
   );
-  tokenParent.addCommand(
-    buildTokenListCommand({
-      configService: opts.configService,
-      buildTrpc
-    })
+  const slack = new Command("slack").description(
+    "Bind or unbind an Agent's Slack channel"
   );
-  tokenParent.addCommand(
-    buildTokenRevokeCommand({
-      configService: opts.configService,
-      buildTrpc
-    })
+  slack.addCommand(buildSlackConnectCommand(agentScoped));
+  slack.addCommand(buildSlackDisconnectCommand(agentScoped));
+  parent.addCommand(slack);
+  const telegram = new Command("telegram").description(
+    "Bind or unbind an Agent's Telegram bot"
   );
-  authParent.addCommand(tokenParent);
-  return {
-    commands: [authParent],
-    exports: { tokenProvider },
-    internals: { authStore, authPath, authEnvReader }
+  telegram.addCommand(buildTelegramConnectCommand(agentScoped));
+  telegram.addCommand(buildTelegramDisconnectCommand(agentScoped));
+  parent.addCommand(telegram);
+  const allowScoped = {
+    compatService: opts.compatService,
+    configService: opts.configService,
+    createAgentService: opts.createAgentService
   };
+  parent.addCommand(buildAllowCommand(allowScoped));
+  parent.addCommand(buildDisallowCommand(allowScoped));
+  return { commands: [parent], exports: { createService } };
 }
 
 // src/modules/chat/compose.ts
@@ -37890,7 +38812,7 @@ function createProcessEnvReader() {
 
 // src/modules/cli/infrastructure/package-version.ts
 function readPackageVersion() {
-  return true ? "0.2.4-rc1" : DEV_VERSION;
+  return true ? "0.2.5-rc1" : DEV_VERSION;
 }
 
 // src/modules/cli/infrastructure/version-probe.ts
@@ -38121,6 +39043,11 @@ function buildConnectCommand(deps) {
     "--env-name <name>",
     "input: expose the credential to the agent as this env var (custom header credentials)"
   ).option("--value <value>", "input: header secret value").option(
+    "-c, --config <key=value>",
+    "set an optional template config input (e.g. -c model=premium-shell), repeatable",
+    (val, prev) => [...prev, val],
+    []
+  ).option(
     "--server <url>",
     "override the configured server URL for this call"
   ).option(
@@ -38132,7 +39059,7 @@ function buildConnectCommand(deps) {
     String(DEFAULT_TIMEOUT_SECONDS3)
   ).addHelpText(
     "after",
-    "\nExamples:\n  dam connection connect github\n  dam connection connect github --client-id Iv1.\u2026 --client-secret \u2026  # use your own OAuth app\n  dam connection connect github --no-browser\n  dam connection connect my-api --header-name X-API-Key --value sk-\u2026\n  dam connection connect https://mcp.example.com\n  dam connection connect https://mcp.example.com --auth none\n"
+    "\nExamples:\n  dam connection connect github\n  dam connection connect github --client-id Iv1.\u2026 --client-secret \u2026  # use your own OAuth app\n  dam connection connect github --no-browser\n  dam connection connect my-api --header-name X-API-Key --value sk-\u2026\n  dam connection connect bob --value sk-\u2026 --config model=premium-shell --config chatMode=code\n  dam connection connect https://mcp.example.com\n  dam connection connect https://mcp.example.com --auth none\n"
   ).action(async (providerOrUrl, opts) => {
     const json2 = opts.json ?? false;
     const timeoutSeconds = parseTimeout2(opts.timeout);
@@ -38171,7 +39098,18 @@ function buildConnectCommand(deps) {
       opts,
       json: json2
     });
-    const payload = buildPayload(template, name, values);
+    const configRes = resolveConfigInputFlags(template, opts.config ?? []);
+    if (!configRes.ok) {
+      process.stderr.write(
+        `error: ${formatConfigFlagError(configRes.error)}
+`
+      );
+      process.exit(EXIT_INVALID_INPUT);
+    }
+    const payload = buildPayload(template, name, {
+      ...values,
+      ...configRes.value
+    });
     if ("error" in payload) {
       process.stderr.write(`error: ${payload.error}
 `);
@@ -38471,6 +39409,18 @@ var FIELD_LABELS = {
 function labelFor(key) {
   return FIELD_LABELS[key] ?? key;
 }
+function formatConfigFlagError(e2) {
+  switch (e2.kind) {
+    case "missing-equals":
+      return `invalid --config value \`${e2.input}\`; expected key=value`;
+    case "unknown-key": {
+      const accepts = e2.validKeys.map((k2) => `\`${k2}\``).join(", ");
+      return accepts ? `unknown --config key \`${e2.key}\`; this template accepts: ${accepts}` : `unknown --config key \`${e2.key}\`; this template has no config inputs`;
+    }
+    case "invalid-value":
+      return e2.message;
+  }
+}
 function formatPresetNote(inputs) {
   const fields = inputs.map((i) => labelFor(i.name)).join(", ");
   return `Using preset values (${fields}). Pass ${flagListFor(inputs)} to use your own.
@@ -38539,12 +39489,12 @@ function buildDisconnectCommand(deps) {
 }
 
 // src/modules/connection/commands/grant.ts
-var collect = (v2, acc) => [...acc, v2];
+var collect3 = (v2, acc) => [...acc, v2];
 function buildGrantCommand(deps) {
   return new Command("grant").description("Grant one or more connections to an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
     "--connection <id-or-name>",
     "connection id or unique name to grant (repeatable)",
-    collect,
+    collect3,
     []
   ).option(
     "--server <url>",
@@ -38643,7 +39593,7 @@ function tableFor(views) {
     ])
   ]);
 }
-function buildListCommand3(deps) {
+function buildListCommand4(deps) {
   return new Command("list").description(
     "List team connections, or the connections granted to one Agent"
   ).argument("[agent]", "Agent Ref \u2014 name or 'agent-\u2026' ID (optional)").option(
@@ -38740,14 +39690,14 @@ function buildListCommand3(deps) {
 }
 
 // src/modules/connection/commands/revoke.ts
-var collect2 = (v2, acc) => [...acc, v2];
+var collect4 = (v2, acc) => [...acc, v2];
 function buildRevokeCommand(deps) {
   return new Command("revoke").description(
     "Revoke one or more connections from an Agent. Idempotent \u2014 revoking an ungranted id exits 0."
   ).argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
     "--connection <id-or-name>",
     "connection id or unique name to revoke (repeatable)",
-    collect2,
+    collect4,
     []
   ).option(
     "--server <url>",
@@ -38885,67 +39835,87 @@ function buildTemplatesCommand(deps) {
   });
 }
 
-// src/modules/connection/services/connection-service.ts
-function createConnectionService(deps) {
-  const readIds = async (agentId) => {
-    const res = await deps.trpc.connections.getAgentConnections.query({
-      agentId
-    });
-    return res.connections.map((c2) => c2.connectionId);
-  };
-  return {
-    async list() {
-      return trpcCall(() => deps.trpc.connections.list.query());
-    },
-    async listTemplates() {
-      return trpcCall(() => deps.trpc.connections.listTemplates.query());
-    },
-    async createConnection(input) {
-      return trpcCall(() => deps.trpc.connections.create.mutate(input));
-    },
-    async startOAuth(connectionId) {
-      return trpcCall(
-        () => deps.trpc.connections.startOAuth.mutate({ connectionId })
-      );
-    },
-    async discoverMcp(url2) {
-      return trpcCall(() => deps.trpc.connections.discoverMcp.mutate({ url: url2 }));
-    },
-    async getConnection(id) {
-      return trpcCall(() => deps.trpc.connections.get.query({ id }));
-    },
-    async agentConnectionIds(agentId) {
-      return trpcCall(() => readIds(agentId));
-    },
-    async grant(agentId, add) {
-      return trpcCall(async () => {
-        const current = await readIds(agentId);
-        const next = Array.from(/* @__PURE__ */ new Set([...current, ...add]));
-        await deps.trpc.connections.setAgentConnections.mutate({
-          agentId,
-          connectionIds: next
-        });
-        return next;
-      });
-    },
-    async revoke(agentId, remove) {
-      return trpcCall(async () => {
-        const drop = new Set(remove);
-        const current = await readIds(agentId);
-        const next = current.filter((id) => !drop.has(id));
-        await deps.trpc.connections.setAgentConnections.mutate({
-          agentId,
-          connectionIds: next
-        });
-        return next;
-      });
-    },
-    async disconnect(id) {
-      return trpcCall(async () => {
-        await deps.trpc.connections.delete.mutate({ id });
+// src/modules/connection/commands/update.ts
+function buildUpdateCommand(deps) {
+  return new Command("update").description("Replace a connection's stored credential value").argument(
+    "<id-or-name>",
+    "Connection id ('conn-\u2026') or unique name (from `dam connection list`)"
+  ).option(
+    "--value <value>",
+    "the new credential value (prompts securely if omitted)"
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit { ok, id, name } as JSON").addHelpText(
+    "after",
+    "\nExamples:\n  dam connection update conn-61cc7b9137b0 --value sk-ant-...\n  dam connection update anthropic   # prompts for the value\n"
+  ).action(
+    async (ref, opts) => {
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
       });
+      const svc = deps.createConnectionService(host);
+      const listed = await svc.list();
+      if (!listed.ok) {
+        printServiceError(listed.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      const match = resolveConnectionRef(listed.value, ref);
+      if (!match) {
+        process.stderr.write(
+          `error: no connection with id or name '${ref}'
+`
+        );
+        process.stderr.write(
+          "hint: run `dam connection list` to see ids and names\n"
+        );
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      if (match.authKind !== "header") {
+        process.stderr.write(
+          `error: only header-credential connections can be updated; '${match.name}' uses ${match.authKind} auth
+`
+        );
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      let value = opts.value;
+      if (value === void 0) {
+        if (!process.stdin.isTTY) {
+          process.stderr.write(
+            "error: pass --value <value> when not running interactively\n"
+          );
+          process.exit(EXIT_INVALID_INPUT);
+        }
+        const entered = await promptSecret(
+          `New credential value for ${match.name}`
+        );
+        if (q(entered)) {
+          me("Cancelled");
+          process.exit(EXIT_SUCCESS);
+        }
+        value = entered;
+      }
+      const result = await svc.update(match.id, value);
+      if (!result.ok) {
+        printServiceError(result.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (opts.json) {
+        process.stdout.write(
+          `${JSON.stringify({ ok: true, id: match.id, name: match.name })}
+`
+        );
+      } else {
+        process.stdout.write(`\u2713 Updated ${match.name} (${match.id}).
+`);
+      }
+      process.exit(EXIT_SUCCESS);
     }
-  };
+  );
 }
 
 // src/modules/connection/compose.ts
@@ -38961,7 +39931,7 @@ function composeConnectionModule(opts) {
   const parent = new Command("connection").description(
     "Manage OAuth connections and agent connection grants"
   );
-  parent.addCommand(buildListCommand3(agentScoped));
+  parent.addCommand(buildListCommand4(agentScoped));
   parent.addCommand(
     buildTemplatesCommand({
       compatService: opts.compatService,
@@ -38984,6 +39954,13 @@ function composeConnectionModule(opts) {
       createConnectionService: createService
     })
   );
+  parent.addCommand(
+    buildUpdateCommand({
+      compatService: opts.compatService,
+      configService: opts.configService,
+      createConnectionService: createService
+    })
+  );
   parent.addCommand(buildGrantCommand(agentScoped));
   parent.addCommand(buildRevokeCommand(agentScoped));
   return { commands: [parent], exports: { createService } };
@@ -39125,7 +40102,7 @@ function buildCreateCommand2(deps) {
 }
 
 // src/modules/egress/commands/list.ts
-function buildListCommand4(deps) {
+function buildListCommand5(deps) {
   return new Command("list").description("List network access rules for an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
     "--server <url>",
     "override the configured server URL for this call"
@@ -39294,7 +40271,7 @@ function buildTrustedHostsCommand(deps) {
 }
 
 // src/modules/egress/commands/update.ts
-function buildUpdateCommand(deps) {
+function buildUpdateCommand2(deps) {
   return new Command("update").description(
     "Update a network access rule; flips source to 'manual'. Partial \u2014 pass only the fields you want to change."
   ).argument("<rule-id>", "Rule UUID (copy from `dam network list`)").option("--method <m>", "new HTTP method").option("--path <p>", "new path pattern").addOption(
@@ -39425,9 +40402,9 @@ function composeEgressModule(opts) {
   const parent = new Command("network").description(
     "Manage per-Agent network access rules (the pre-approvals that let an Agent reach external hosts)"
   );
-  parent.addCommand(buildListCommand4(agentScoped));
+  parent.addCommand(buildListCommand5(agentScoped));
   parent.addCommand(buildCreateCommand2(agentScoped));
-  parent.addCommand(buildUpdateCommand(idScoped));
+  parent.addCommand(buildUpdateCommand2(idScoped));
   parent.addCommand(buildRevokeCommand2(idScoped));
   parent.addCommand(buildPresetCommand(agentScoped));
   parent.addCommand(buildApplyPresetCommand(agentScoped));
@@ -39536,15 +40513,6 @@ async function fileExists(path2) {
   }
 }
 function printTrpcReadError(e2, path2, host) {
-  const classified = classifyTrpcError(e2);
-  if (!classified.ok && classified.error.kind === "auth-required") {
-    process.stderr.write(
-      `error: not authenticated: ${classified.error.reason}
-hint: run \`dam auth login\` first
-`
-    );
-    return;
-  }
   const code = e2 instanceof TRPCClientError ? e2.data?.code : void 0;
   if (code === "NOT_FOUND") {
     process.stderr.write(`error: not found: ${path2}
@@ -39558,9 +40526,7 @@ hint: run \`dam auth login\` first
     );
     return;
   }
-  const msg = e2 instanceof Error ? e2.message : String(e2);
-  process.stderr.write(`error: cannot reach server \`${host}\`: ${msg}
-`);
+  printTrpcError(e2, host);
 }
 
 // src/modules/file/commands/list.ts
@@ -39623,20 +40589,6 @@ function buildFileListCommand(deps) {
     }
   );
 }
-function printTrpcError(e2, host) {
-  const classified = classifyTrpcError(e2);
-  if (!classified.ok && classified.error.kind === "auth-required") {
-    process.stderr.write(
-      `error: not authenticated: ${classified.error.reason}
-hint: run \`dam auth login\` first
-`
-    );
-    return;
-  }
-  const msg = e2 instanceof Error ? e2.message : String(e2);
-  process.stderr.write(`error: cannot reach server \`${host}\`: ${msg}
-`);
-}
 
 // src/modules/file/commands/put.ts
 import { open as open2 } from "fs/promises";
@@ -39721,15 +40673,6 @@ function buildFilePutCommand(deps) {
   );
 }
 function printTrpcUploadError(e2, remotePath, host) {
-  const classified = classifyTrpcError(e2);
-  if (!classified.ok && classified.error.kind === "auth-required") {
-    process.stderr.write(
-      `error: not authenticated: ${classified.error.reason}
-hint: run \`dam auth login\` first
-`
-    );
-    return;
-  }
   const trpcErr = e2 instanceof TRPCClientError ? e2 : void 0;
   const code = trpcErr?.data?.code;
   const message = trpcErr?.data?.message ?? "";
@@ -39752,9 +40695,7 @@ hint: run \`dam auth login\` first
     );
     return;
   }
-  const msg = e2 instanceof Error ? e2.message : String(e2);
-  process.stderr.write(`error: cannot reach server \`${host}\`: ${msg}
-`);
+  printTrpcError(e2, host);
 }
 
 // src/modules/file/compose.ts
@@ -40016,9 +40957,7 @@ async function uploadAndReport(args) {
     const e2 = tokenResult.error;
     if (e2.kind === "not-logged-in" || e2.kind === "session-expired") {
       const reason = e2.kind === "not-logged-in" ? `not logged in to ${e2.host}` : `session expired for ${e2.host}`;
-      process.stderr.write(`error: not authenticated: ${reason}
-`);
-      process.stderr.write("hint: run `dam auth login` first\n");
+      process.stderr.write(formatAuthRejection(reason));
     } else {
       process.stderr.write(`error: ${e2.reason}
 `);
@@ -40071,11 +41010,7 @@ async function uploadAndReport(args) {
   const serverMessage = extractServerError(body) ?? res.statusText;
   switch (res.status) {
     case 401:
-      process.stderr.write(
-        `error: not authenticated: ${serverMessage}
-       run "dam auth login" first
-`
-      );
+      process.stderr.write(formatAuthRejection(serverMessage));
       return EXIT_RUNTIME_FAILURE;
     case 404:
       process.stderr.write("error: agent no longer exists\n");
@@ -40096,7 +41031,7 @@ async function uploadAndReport(args) {
       return EXIT_RUNTIME_FAILURE;
     default:
       process.stderr.write(
-        `error: cannot reach server: HTTP ${res.status} ${serverMessage}
+        `error: ${serverMessage || `the server rejected the request (HTTP ${res.status})`}
 `
       );
       return EXIT_RUNTIME_FAILURE;
@@ -40524,7 +41459,7 @@ function buildGetCommand2(deps) {
 function recurrenceText(view) {
   return view.rrule !== null ? rruleToText(view.rrule) : view.cron ?? "";
 }
-function buildListCommand5(deps) {
+function buildListCommand6(deps) {
   return new Command("list").description("List the schedules attached to an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
     "--server <url>",
     "override the configured server URL for this call"
@@ -40655,7 +41590,7 @@ function buildResetSessionCommand(deps) {
 }
 
 // src/modules/schedule/commands/update.ts
-function buildUpdateCommand2(deps) {
+function buildUpdateCommand3(deps) {
   return new Command("update").description(
     "Update an RRULE schedule (read-merge-write). Partial \u2014 pass only the fields to change. Legacy cron schedules are read-only."
   ).argument("<schedule-id>", "Schedule id (from `dam schedule list`)").option("--name <name>", "new schedule name").option("--task <task>", "new task prompt").option("--daily <HH:MM>", "rebuild recurrence: daily at HH:MM").option("--every <interval>", "rebuild recurrence: every Nm/Nh").option("--rrule <body>", "rebuild recurrence: raw RFC 5545 RRULE body").option(
@@ -40885,10 +41820,10 @@ function composeScheduleModule(opts) {
   const parent = new Command("schedule").description(
     "Manage time-triggered tasks (schedules) attached to an Agent"
   );
-  parent.addCommand(buildListCommand5(agentScoped));
+  parent.addCommand(buildListCommand6(agentScoped));
   parent.addCommand(buildGetCommand2(idScoped));
   parent.addCommand(buildCreateCommand3(agentScoped));
-  parent.addCommand(buildUpdateCommand2(idScoped));
+  parent.addCommand(buildUpdateCommand3(idScoped));
   parent.addCommand(buildEnableCommand(idScoped));
   parent.addCommand(buildDisableCommand(idScoped));
   parent.addCommand(buildDeleteCommand2(idScoped));
@@ -41167,7 +42102,7 @@ function buildInstallCommand(deps) {
 // src/modules/skill/commands/list.ts
 var INSTALLED_HEADER = ["SOURCE", "NAME", "VERSION"];
 var STANDALONE_HEADER = ["NAME", "PUBLISHED"];
-function buildListCommand6(deps) {
+function buildListCommand7(deps) {
   return new Command("list").description("List the skills on an Agent \u2014 installed and standalone").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
     "--server <url>",
     "override the configured server URL for this call"
@@ -41925,7 +42860,7 @@ function composeSkillModule(opts) {
   sourceGroup.addCommand(buildSourceRefreshCommand(shared));
   parent.addCommand(sourceGroup);
   parent.addCommand(buildCatalogCommand(shared));
-  parent.addCommand(buildListCommand6(shared));
+  parent.addCommand(buildListCommand7(shared));
   parent.addCommand(buildInstallCommand(shared));
   parent.addCommand(buildUninstallCommand(shared));
   parent.addCommand(buildPublishCommand(shared));
@@ -42490,7 +43425,7 @@ function composeSshModule(opts) {
 
 // src/modules/template/commands/list.ts
 var DESCRIPTION_MAX = 60;
-function buildListCommand7(deps) {
+function buildListCommand8(deps) {
   return new Command("list").description("List agent templates available on the active host").option(
     "--server <url>",
     "override the configured server URL for this call"
@@ -42575,7 +43510,7 @@ function composeTemplateModule(opts) {
     "Discover agent templates on the active host"
   );
   parent.addCommand(
-    buildListCommand7({
+    buildListCommand8({
       compatService: opts.compatService,
       configService: opts.configService,
       createTemplateService: createService
@@ -42668,6 +43603,12 @@ function compose(opts = {}) {
     createAgentService: agent.exports.createService,
     createEgressService: egress.exports.createService
   });
+  const channel = composeChannelModule({
+    tokenProvider: auth.exports.tokenProvider,
+    configService: cli.services.configService,
+    compatService: cli.services.compatService,
+    createAgentService: agent.exports.createService
+  });
   const program3 = new Command();
   program3.name("dam").description("Command-line client for a Platform deployment").version(cli.cliVersion);
   for (const command of cli.commands) program3.addCommand(command);
@@ -42683,6 +43624,7 @@ function compose(opts = {}) {
   for (const command of schedule.commands) program3.addCommand(command);
   for (const command of skill.commands) program3.addCommand(command);
   for (const command of ssh.commands) program3.addCommand(command);
+  for (const command of channel.commands) program3.addCommand(command);
   return program3;
 }
 
@@ -42695,6 +43637,13 @@ try {
     process.stderr.write(
       `error: Terms of Use acceptance required
 hint: open ${err3.host} to accept
+`
+    );
+    process.exit(1);
+  }
+  if (err3 instanceof ForbiddenAtTransportError) {
+    process.stderr.write(
+      `error: access denied${err3.detail ? `: ${err3.detail}` : ""}
 `
     );
     process.exit(1);