@ekanos/cli 0.15.0 → 0.16.0

package/dist/secret-input.d.ts

@@ -0,0 +1,96 @@
+import type { CliContext } from './context.js';
+import { type SecretFormField } from './secret-form.js';
+/**
+ * How every command that takes a secret gets it — `apps set`, `apps
+ * connect`, `teams app set`, `teams connect`, `teams mcp token|add`,
+ * `teams llm-key set` — so a coding agent or a script can run them as well
+ * as a person at a terminal, and none of them ever has the secret in argv.
+ *
+ * In order:
+ *
+ *  1. **`--browser`**: a one-shot form on this computer (`secret-form.ts`).
+ *     The person types it in their browser; the run that asked never sees it.
+ *  2. **A named source**: `--secret-env NAME`, `--secret-file PATH` (a
+ *     0600 file of yours, never through a symlink) or `--secret-stdin` (piped)
+ *     for the one secret; `--set-secret <field>=env:NAME|file:PATH|stdin` for
+ *     each field of a form. Nothing else is asked.
+ *  3. **A terminal**: hidden input, as before.
+ *  4. Otherwise a usage error naming the forms above.
+ *
+ * A literal (`--set-secret field=sk-…`) is refused: argv lands in shell
+ * history and the process list. No error, log or output here ever carries a
+ * value — not even a path or a name that might be one by mistake.
+ *
+ * `--browser` is never chosen for you. A run with no terminal is usually an
+ * agent or CI, and the CLI cannot tell whether anyone is at the desktop: a
+ * form nobody fills would stall the run for its whole timeout. So it is
+ * explicit, refused up front where it cannot work (CI, SSH, no display),
+ * and bounded by a timeout everywhere.
+ */
+export interface SecretFlags {
+    /** `--secret-stdin` */
+    stdin: boolean;
+    /** `--secret-env <NAME>` */
+    env?: string;
+    /** `--secret-file <path>` */
+    file?: string;
+    /** `--set-secret <field>=env:NAME|file:PATH|stdin`, repeatable. */
+    sets: string[];
+    /** `--browser` */
+    browser: boolean;
+}
+/** The flags, from a command's parsed flags. */
+export declare function readSecretFlags(flags: Record<string, string | boolean | string[]> | undefined): SecretFlags;
+/** Whether any way of giving a secret without a terminal was passed. */
+export declare function secretInputGiven(flags: SecretFlags): boolean;
+/** The forms, as a hint names them. */
+export declare const SINGLE_SECRET_FORMS = "--secret-env <NAME>, --secret-file <path> (a file only you can read), --secret-stdin (piped in), or --browser (a form in your browser on this computer)";
+export declare const FIELD_SECRET_FORMS = "--set-secret <field>=env:<NAME>|file:<path>|stdin for each secret (--secret-env, --secret-file or --secret-stdin when there is one), or --browser (a form in your browser on this computer)";
+export interface SecretIO {
+    env: Record<string, string | undefined>;
+    stdinIsTTY: boolean;
+    /** Test seam: the whole of stdin. */
+    readStdin?: () => Promise<string>;
+    /** Test seam: the browser opener for `--browser`. */
+    openUrl?: (url: string) => void;
+    /** Test seam: how long `--browser` waits. */
+    formTimeoutMs?: number;
+    /** Test seam: the platform `--browser` checks for a desktop. */
+    platform?: NodeJS.Platform;
+    /** Where a relative `--secret-file` resolves (default: the working directory). */
+    cwd?: string;
+}
+export type SecretField = SecretFormField;
+export interface CollectSecretsInput {
+    /** Every field this run would ask, in order. */
+    fields: readonly SecretField[];
+    flags: SecretFlags;
+    io: SecretIO;
+    /** A human at a terminal (not `--json`, stdin a TTY). */
+    interactive: boolean;
+    /** The terminal question for one field — hidden for a secret. */
+    prompt: (field: SecretField) => Promise<string>;
+    /** The secure form's heading. */
+    title: string;
+    /** What is needed, when nothing can be asked: the refusal's message. */
+    refusal: string;
+    /** The command, without `npx @ekanos/cli`, for hints. */
+    again: string;
+    /**
+     * `--set <field>=<value>` for a field that is not a secret (a subdomain, a
+     * client ID): taken as given, and never asked. A secret here is refused.
+     */
+    plain?: Record<string, string>;
+}
+/**
+ * `--set <field>=<value>` pairs. A malformed one is refused without echoing
+ * it — it may be a secret typed where a field name was meant.
+ */
+export declare function parsePlainValues(raw: string | boolean | string[] | undefined, example?: string): Record<string, string>;
+/**
+ * Each field's value by name; a field left empty is left out (its saved
+ * value stays). Refuses a required field that is neither saved nor given.
+ */
+export declare function collectSecrets(ctx: CliContext, input: CollectSecretsInput): Promise<Record<string, string>>;
+/** Why a browser form cannot be filled here, or null when it can. */
+export declare function desktopProblem(env: Record<string, string | undefined>, platform: NodeJS.Platform): string | null;

package/dist/secret-input.js

@@ -0,0 +1,299 @@
+import * as path from 'node:path';
+import { notFoundError, preconditionError, usageError, validationError, } from './errors.js';
+import { openInBrowser } from './open-url.js';
+import { readPrivateFileNoFollow } from './safe-fs.js';
+import { collectWithSecretForm } from './secret-form.js';
+/** The flags, from a command's parsed flags. */
+export function readSecretFlags(flags) {
+    const text = (name) => {
+        const value = flags === null || flags === void 0 ? void 0 : flags[name];
+        return typeof value === 'string' ? value : undefined;
+    };
+    const sets = flags === null || flags === void 0 ? void 0 : flags['set-secret'];
+    return {
+        stdin: (flags === null || flags === void 0 ? void 0 : flags['secret-stdin']) === true,
+        env: text('secret-env'),
+        file: text('secret-file'),
+        sets: Array.isArray(sets) ? sets : typeof sets === 'string' ? [sets] : [],
+        browser: (flags === null || flags === void 0 ? void 0 : flags.browser) === true,
+    };
+}
+/** Whether any way of giving a secret without a terminal was passed. */
+export function secretInputGiven(flags) {
+    return (flags.browser ||
+        flags.stdin ||
+        flags.env !== undefined ||
+        flags.file !== undefined ||
+        flags.sets.length > 0);
+}
+/** The forms, as a hint names them. */
+export const SINGLE_SECRET_FORMS = '--secret-env <NAME>, --secret-file <path> (a file only you can read), --secret-stdin (piped in), or --browser (a form in your browser on this computer)';
+export const FIELD_SECRET_FORMS = '--set-secret <field>=env:<NAME>|file:<path>|stdin for each secret (--secret-env, --secret-file or --secret-stdin when there is one), or --browser (a form in your browser on this computer)';
+/**
+ * `--set <field>=<value>` pairs. A malformed one is refused without echoing
+ * it — it may be a secret typed where a field name was meant.
+ */
+export function parsePlainValues(raw, example = 'subdomain=acme') {
+    const pairs = Array.isArray(raw) ? raw : typeof raw === 'string' ? [raw] : [];
+    const values = {};
+    for (const pair of pairs) {
+        const at = pair.indexOf('=');
+        const name = at > 0 ? pair.slice(0, at).trim() : '';
+        if (!name) {
+            throw usageError('--set takes <field>=<value>, for a field that is not a secret.', `For example: --set ${example}. A secret is never passed as an argument: use --set-secret <field>=env:<NAME>|file:<path>|stdin.`);
+        }
+        values[name] = pair.slice(at + 1).trim();
+    }
+    return values;
+}
+const MAX_SECRET_BYTES = 64 * 1024;
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const FIELD_NAME = /^[A-Za-z0-9_.-]{1,64}$/;
+/**
+ * Each field's value by name; a field left empty is left out (its saved
+ * value stays). Refuses a required field that is neither saved nor given.
+ */
+export async function collectSecrets(ctx, input) {
+    var _a;
+    const { flags } = input;
+    const plain = checkPlain(input.fields, (_a = input.plain) !== null && _a !== void 0 ? _a : {});
+    // What is left to ask: every field `--set` did not give.
+    const fields = input.fields.filter((field) => plain[field.name] === undefined);
+    const singles = [
+        flags.stdin,
+        flags.env !== undefined,
+        flags.file !== undefined,
+    ].filter(Boolean).length;
+    if (singles > 1) {
+        throw usageError('Pass one of --secret-env, --secret-file and --secret-stdin, not several.', `Each names where the one secret comes from. For several, use --set-secret <field>=… per field.`);
+    }
+    if (flags.browser && (singles > 0 || flags.sets.length > 0)) {
+        throw usageError('--browser asks for every field in the form; it does not mix with --secret-* or --set-secret.', 'Drop --browser to pass them from the environment, a file or stdin, or drop those to use the form.');
+    }
+    const rest = Object.assign(Object.assign({}, input), { fields });
+    let values;
+    if (fields.length === 0) {
+        values = {};
+    }
+    else if (flags.browser) {
+        values = await viaBrowser(ctx, rest);
+    }
+    else if (singles > 0 || flags.sets.length > 0) {
+        values = await viaSources(rest);
+    }
+    else if (input.interactive) {
+        values = {};
+        for (const field of fields) {
+            const value = (await input.prompt(field)).trim();
+            if (value)
+                values[field.name] = value;
+        }
+    }
+    else if (Object.keys(plain).length > 0) {
+        // Only non-secret values were given: the rest keep what is saved.
+        values = {};
+    }
+    else {
+        throw usageError(input.refusal, `Without a terminal, pass ${fields.filter((field) => field.sensitive).length > 1 ? FIELD_SECRET_FORMS : SINGLE_SECRET_FORMS}. Or run it yourself in your terminal: npx @ekanos/cli ${input.again}`);
+    }
+    const missing = fields.filter((field) => field.required && !field.set && !values[field.name]);
+    if (missing.length > 0) {
+        throw validationError(`${missing.map((field) => field.label).join(', ')} ${missing.length === 1 ? 'is' : 'are'} needed; nothing was saved.`, flags.browser || input.interactive
+            ? `Run "ekanos ${input.again}" again and fill ${missing.length === 1 ? 'it' : 'them'} in.`
+            : `Pass ${missing.map((field) => (field.sensitive ? `--set-secret ${field.name}=env:<NAME>` : `--set ${field.name}=<value>`)).join(' ')}.`);
+    }
+    return Object.assign(Object.assign({}, plainGiven(plain)), values);
+}
+/** `--set` values, checked against the fields: known, and never a secret. */
+function checkPlain(fields, plain) {
+    const byName = new Map(fields.map((field) => [field.name, field]));
+    for (const name of Object.keys(plain)) {
+        const field = byName.get(name);
+        const shown = FIELD_NAME.test(name) ? `"${name}"` : 'That field';
+        if (!field) {
+            throw usageError(`${shown} is not a field this asks for.`, `Its fields are: ${fields.map((entry) => entry.name).join(', ') || 'none'}.`);
+        }
+        if (field.sensitive) {
+            throw usageError(`${shown} is a secret: it is never passed as an argument.`, `Pass it as --set-secret ${name}=env:<NAME>|file:<path>|stdin, or use --browser.`);
+        }
+    }
+    return plain;
+}
+/** An empty `--set name=` means nothing to change, as Enter does at a prompt. */
+function plainGiven(plain) {
+    return Object.fromEntries(Object.entries(plain).filter(([, value]) => value !== ''));
+}
+async function viaBrowser(ctx, input) {
+    var _a, _b;
+    const problem = desktopProblem(input.io.env, (_a = input.io.platform) !== null && _a !== void 0 ? _a : process.platform);
+    if (problem) {
+        throw preconditionError(`--browser needs a desktop to open a form on: ${problem}`, `Pass it as ${input.fields.filter((field) => field.sensitive).length > 1 ? '--set-secret <field>=env:<NAME>|file:<path>|stdin' : '--secret-env <NAME>, --secret-file <path> or --secret-stdin'} instead.`);
+    }
+    ctx.log(`Opened a secure form in your browser for ${input.title}… (waiting; if no browser opened, re-run with --secret-env, --secret-file or --secret-stdin)`);
+    return collectWithSecretForm({
+        title: input.title,
+        fields: input.fields,
+        open: (_b = input.io.openUrl) !== null && _b !== void 0 ? _b : openInBrowser,
+        timeoutMs: input.io.formTimeoutMs,
+    });
+}
+/** Why a browser form cannot be filled here, or null when it can. */
+export function desktopProblem(env, platform) {
+    var _a;
+    const ci = (_a = env.CI) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase();
+    if (ci && ci !== '0' && ci !== 'false') {
+        return 'this is a CI run (CI is set), with no one to fill it in.';
+    }
+    if (env.SSH_CONNECTION || env.SSH_TTY) {
+        return 'this is an SSH session, and a browser on this machine is not in front of you.';
+    }
+    if (platform !== 'darwin' &&
+        platform !== 'win32' &&
+        !env.DISPLAY &&
+        !env.WAYLAND_DISPLAY) {
+        return 'there is no desktop session (DISPLAY or WAYLAND_DISPLAY) to open a browser in.';
+    }
+    return null;
+}
+async function viaSources(input) {
+    var _a;
+    var _b;
+    const { flags, fields } = input;
+    const byName = new Map(fields.map((field) => [field.name, field]));
+    const specs = new Map();
+    for (const entry of flags.sets) {
+        const at = entry.indexOf('=');
+        const name = at > 0 ? entry.slice(0, at).trim() : '';
+        if (!name) {
+            throw usageError('--set-secret takes <field>=env:<NAME>, <field>=file:<path> or <field>=stdin.', `For example: --set-secret ${(_b = (_a = fields.find((field) => field.sensitive)) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : 'client_secret'}=env:MY_SECRET.`);
+        }
+        const shown = FIELD_NAME.test(name) ? `"${name}"` : 'that field';
+        const field = byName.get(name);
+        if (!field) {
+            throw usageError(`${shown} is not a field this asks for.`, `Its fields are: ${fields.map((entry) => entry.name).join(', ') || 'none'}.`);
+        }
+        if (specs.has(name)) {
+            throw usageError(`--set-secret names ${shown} twice.`, 'Pass each field once.');
+        }
+        specs.set(name, parseSpec(entry.slice(at + 1), `--set-secret ${name}`));
+    }
+    const single = flags.stdin
+        ? { kind: 'stdin' }
+        : flags.env !== undefined
+            ? envSpec(flags.env, '--secret-env')
+            : flags.file !== undefined
+                ? { kind: 'file', path: flags.file }
+                : null;
+    if (single) {
+        const secrets = fields.filter((field) => field.sensitive && !specs.has(field.name));
+        if (secrets.length !== 1) {
+            throw usageError(secrets.length === 0
+                ? 'There is no secret here for --secret-env, --secret-file or --secret-stdin to fill.'
+                : `This asks for ${secrets.length} secrets (${secrets.map((field) => field.name).join(', ')}), so name each one.`, secrets.length === 0
+                ? 'Drop the flag.'
+                : `Pass --set-secret <field>=env:<NAME>|file:<path>|stdin for each, e.g. --set-secret ${secrets[0].name}=env:MY_SECRET.`);
+        }
+        specs.set(secrets[0].name, single);
+    }
+    if ([...specs.values()].filter((spec) => spec.kind === 'stdin').length > 1) {
+        throw usageError('Only one secret can come from stdin.', 'Take the others from the environment (env:<NAME>) or a file (file:<path>).');
+    }
+    const values = {};
+    for (const [name, spec] of specs) {
+        const value = (await resolveSpec(spec, name, input.io)).trim();
+        if (!value) {
+            throw preconditionError(`The value for ${name} (from ${describe(spec)}) is empty; nothing was saved.`, 'Put the secret there, then run the command again.');
+        }
+        values[name] = value;
+    }
+    return values;
+}
+function parseSpec(raw, flag) {
+    if (raw === 'stdin')
+        return { kind: 'stdin' };
+    if (raw.startsWith('env:'))
+        return envSpec(raw.slice(4), flag);
+    if (raw.startsWith('file:') && raw.length > 5) {
+        return { kind: 'file', path: raw.slice(5) };
+    }
+    throw usageError(`${flag}=… is not env:<NAME>, file:<path> or stdin. A secret is never passed as an argument: it would land in your shell history and the process list.`, `Put it in an environment variable (${flag}=env:MY_SECRET), a file only you can read (${flag}=file:./secret.txt), or pipe it in (${flag}=stdin).`);
+}
+function envSpec(name, flag) {
+    if (ENV_NAME.test(name))
+        return { kind: 'env', name };
+    // Never echoed: a value that is not a name may be the secret itself.
+    throw usageError(`${flag} takes the NAME of an environment variable (letters, digits and _), never the secret itself.`, `For example: MY_SECRET=… then ${flag}${flag.startsWith('--set-secret') ? '=env:' : ' '}MY_SECRET.`);
+}
+function describe(spec) {
+    if (spec.kind === 'env')
+        return `$${spec.name}`;
+    if (spec.kind === 'file')
+        return 'the file';
+    return 'stdin';
+}
+async function resolveSpec(spec, field, io) {
+    if (spec.kind === 'env') {
+        const value = io.env[spec.name];
+        if (value === undefined || value === '') {
+            throw preconditionError(`The environment variable ${spec.name} (for ${field}) is not set; nothing was saved.`, `Set it in the environment the command runs in, then run it again.`);
+        }
+        return value;
+    }
+    if (spec.kind === 'file')
+        return readSecretFile(spec.path, field, io.cwd);
+    return readStdinSecret(io);
+}
+function readSecretFile(given, field, cwd = process.cwd()) {
+    var _a;
+    const result = readPrivateFileNoFollow(path.resolve(cwd, given), MAX_SECRET_BYTES);
+    if (result.ok)
+        return stripNewline(result.bytes.toString('utf8'));
+    // The path is not echoed: a mistyped flag may have put the secret there.
+    const what = `The file given for ${field}`;
+    switch (result.problem) {
+        case 'missing':
+            throw notFoundError(`${what} does not exist; nothing was saved.`, 'Check the path, then run the command again.');
+        case 'symlink':
+            throw preconditionError(`${what} is a symlink, and the CLI never reads a secret through one.`, 'Name the real file instead.');
+        case 'not-a-file':
+            throw preconditionError(`${what} is not a regular file.`, 'Name a file holding just the secret.');
+        case 'readable-by-others':
+            throw preconditionError(`${what} can be read by other users on this machine (mode ${((_a = result.mode) !== null && _a !== void 0 ? _a : 0).toString(8).padStart(3, '0')}), so it was not read.`, 'Make it yours alone with "chmod 600 <file>", then run the command again.');
+        case 'not-yours':
+            throw preconditionError(`${what} belongs to another user, so it was not read.`, 'Use a file you own, readable only by you (chmod 600).');
+        case 'too-large':
+            throw preconditionError(`${what} is larger than a secret (over 64 KB).`, 'Name a file holding just the secret.');
+    }
+}
+async function readStdinSecret(io) {
+    var _a;
+    if (io.stdinIsTTY) {
+        throw usageError('stdin is a terminal, so there is no piped secret to read.', 'Pipe it in (e.g. `printf %s "$MY_SECRET" | ekanos …`), or use --secret-env or --secret-file.');
+    }
+    const raw = await ((_a = io.readStdin) !== null && _a !== void 0 ? _a : readAllStdin)();
+    return stripNewline(raw);
+}
+function readAllStdin() {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        const stdin = process.stdin;
+        stdin.on('data', (chunk) => {
+            const buffer = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
+            size += buffer.length;
+            if (size > MAX_SECRET_BYTES) {
+                stdin.destroy();
+                reject(usageError('stdin holds more than a secret (over 64 KB).', 'Pipe in just the secret.'));
+                return;
+            }
+            chunks.push(buffer);
+        });
+        stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        stdin.on('error', reject);
+    });
+}
+/** One trailing newline (`echo`, an editor's final line) is not part of it. */
+function stripNewline(value) {
+    return value.replace(/\r?\n$/, '');
+}
+//# sourceMappingURL=secret-input.js.map

package/dist/secret-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-input.js","sourceRoot":"","sources":["../src/secret-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAwB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AA2C5E,gDAAgD;AAChD,MAAM,UAAU,eAAe,CAC7B,KAA8D;IAE9D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,IAAI,CAAC,CAAC;QAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,YAAY,CAAC,CAAC;IACnC,OAAO;QACL,KAAK,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,cAAc,CAAC,MAAK,IAAI;QACvC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC;QACzB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACzE,OAAO,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,MAAK,IAAI;KACjC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,OAAO,CACL,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,GAAG,KAAK,SAAS;QACvB,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CACtB,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAC9B,yJAAyJ,CAAC;AAC5J,MAAM,CAAC,MAAM,kBAAkB,GAC7B,6LAA6L,CAAC;AAyChM;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAA4C,EAC5C,OAAO,GAAG,gBAAgB;IAE1B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,UAAU,CACd,gEAAgE,EAChE,sBAAsB,OAAO,mGAAmG,CACjI,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAC5C,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAO5C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAe,EACf,KAA0B;;IAE1B,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,QAAE,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC;IAC1D,yDAAyD;IACzD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAC3C,CAAC;IACF,MAAM,OAAO,GAAG;QACd,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,GAAG,KAAK,SAAS;QACvB,KAAK,CAAC,IAAI,KAAK,SAAS;KACzB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACzB,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,UAAU,CACd,0EAA0E,EAC1E,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,UAAU,CACd,8FAA8F,EAC9F,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,mCAAQ,KAAK,KAAE,MAAM,GAAE,CAAC;IAClC,IAAI,MAA8B,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,kEAAkE;QAClE,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,CACd,KAAK,CAAC,OAAO,EACb,4BAA4B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,0DAA0D,KAAK,CAAC,KAAK,EAAE,CACnM,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAC/D,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,eAAe,CACnB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,6BAA6B,EACrH,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW;YAChC,CAAC,CAAC,eAAe,KAAK,CAAC,KAAK,oBAAoB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM;YAC1F,CAAC,CAAC,QAAQ,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAC7I,CAAC;IACJ,CAAC;IACD,uCAAY,UAAU,CAAC,KAAK,CAAC,GAAK,MAAM,EAAG;AAC7C,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CACjB,MAA8B,EAC9B,KAA6B;IAE7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,UAAU,CACd,GAAG,KAAK,gCAAgC,EACxC,mBAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,UAAU,CACd,GAAG,KAAK,kDAAkD,EAC1D,2BAA2B,IAAI,kDAAkD,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,KAA6B;IAC/C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAe,EACf,KAA0B;;IAE1B,MAAM,OAAO,GAAG,cAAc,CAC5B,KAAK,CAAC,EAAE,CAAC,GAAG,QACZ,KAAK,CAAC,EAAE,CAAC,QAAQ,mCAAI,OAAO,CAAC,QAAQ,CACtC,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,iBAAiB,CACrB,gDAAgD,OAAO,EAAE,EACzD,cAAc,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,6DAA6D,WAAW,CAC1M,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,CACL,4CAA4C,KAAK,CAAC,KAAK,8FAA8F,CACtJ,CAAC;IACF,OAAO,qBAAqB,CAAC;QAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,QAAE,KAAK,CAAC,EAAE,CAAC,OAAO,mCAAI,aAAa;QACvC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa;KAClC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAC5B,GAAuC,EACvC,QAAyB;;IAEzB,MAAM,EAAE,GAAG,MAAA,GAAG,CAAC,EAAE,0CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;IACxC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACvC,OAAO,0DAA0D,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,+EAA+E,CAAC;IACzF,CAAC;IACD,IACE,QAAQ,KAAK,QAAQ;QACrB,QAAQ,KAAK,OAAO;QACpB,CAAC,GAAG,CAAC,OAAO;QACZ,CAAC,GAAG,CAAC,eAAe,EACpB,CAAC;QACD,OAAO,gFAAgF,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA0B;;;IAE1B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,UAAU,CACd,8EAA8E,EAC9E,6BAA6B,MAAA,MAAA,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,0CAAE,IAAI,mCAAI,eAAe,iBAAiB,CAC/G,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,UAAU,CACd,GAAG,KAAK,gCAAgC,EACxC,mBAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,UAAU,CACd,sBAAsB,KAAK,SAAS,EACpC,uBAAuB,CACxB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,MAAM,GAAgB,KAAK,CAAC,KAAK;QACrC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACnB,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS;YACvB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;YACpC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;gBACpC,CAAC,CAAC,IAAI,CAAC;IACb,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CACrD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,UAAU,CACd,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,oFAAoF;gBACtF,CAAC,CAAC,iBAAiB,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EACnH,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,sFAAsF,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,iBAAiB,CAC5H,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,UAAU,CACd,sCAAsC,EACtC,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,iBAAiB,CACrB,iBAAiB,IAAI,UAAU,QAAQ,CAAC,IAAI,CAAC,gCAAgC,EAC7E,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,UAAU,CACd,GAAG,IAAI,gJAAgJ,EACvJ,sCAAsC,IAAI,8CAA8C,IAAI,uCAAuC,IAAI,UAAU,CAClJ,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACtD,qEAAqE;IACrE,MAAM,UAAU,CACd,GAAG,IAAI,8FAA8F,EACrG,iCAAiC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,YAAY,CACpG,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU;IAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAU,EACV,KAAa,EACb,EAAY;IAEZ,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,iBAAiB,CACrB,4BAA4B,IAAI,CAAC,IAAI,SAAS,KAAK,kCAAkC,EACrF,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1E,OAAO,eAAe,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,KAAa,EACb,GAAG,GAAW,OAAO,CAAC,GAAG,EAAE;;IAE3B,MAAM,MAAM,GAAG,uBAAuB,CACpC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EACxB,gBAAgB,CACjB,CAAC;IACF,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,yEAAyE;IACzE,MAAM,IAAI,GAAG,sBAAsB,KAAK,EAAE,CAAC;IAC3C,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,SAAS;YACZ,MAAM,aAAa,CACjB,GAAG,IAAI,qCAAqC,EAC5C,6CAA6C,CAC9C,CAAC;QACJ,KAAK,SAAS;YACZ,MAAM,iBAAiB,CACrB,GAAG,IAAI,8DAA8D,EACrE,6BAA6B,CAC9B,CAAC;QACJ,KAAK,YAAY;YACf,MAAM,iBAAiB,CACrB,GAAG,IAAI,yBAAyB,EAChC,sCAAsC,CACvC,CAAC;QACJ,KAAK,oBAAoB;YACvB,MAAM,iBAAiB,CACrB,GAAG,IAAI,qDAAqD,OAAC,MAAM,CAAC,IAAI,mCAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,wBAAwB,EACnI,0EAA0E,CAC3E,CAAC;QACJ,KAAK,WAAW;YACd,MAAM,iBAAiB,CACrB,GAAG,IAAI,+CAA+C,EACtD,uDAAuD,CACxD,CAAC;QACJ,KAAK,WAAW;YACd,MAAM,iBAAiB,CACrB,GAAG,IAAI,wCAAwC,EAC/C,sCAAsC,CACvC,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAY;;IACzC,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,UAAU,CACd,2DAA2D,EAC3D,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAC,EAAE,CAAC,SAAS,mCAAI,YAAY,CAAC,EAAE,CAAC;IACnD,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACtE,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC;YACtB,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;gBAC5B,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,MAAM,CACJ,UAAU,CACR,8CAA8C,EAC9C,0BAA0B,CAC3B,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import * as path from 'node:path';\n\nimport type { CliContext } from './context';\nimport {\n  notFoundError,\n  preconditionError,\n  usageError,\n  validationError,\n} from './errors';\nimport { openInBrowser } from './open-url';\nimport { readPrivateFileNoFollow } from './safe-fs';\nimport { type SecretFormField, collectWithSecretForm } from './secret-form';\n\n/**\n * How every command that takes a secret gets it — `apps set`, `apps\n * connect`, `teams app set`, `teams connect`, `teams mcp token|add`,\n * `teams llm-key set` — so a coding agent or a script can run them as well\n * as a person at a terminal, and none of them ever has the secret in argv.\n *\n * In order:\n *\n *  1. **`--browser`**: a one-shot form on this computer (`secret-form.ts`).\n *     The person types it in their browser; the run that asked never sees it.\n *  2. **A named source**: `--secret-env NAME`, `--secret-file PATH` (a\n *     0600 file of yours, never through a symlink) or `--secret-stdin` (piped)\n *     for the one secret; `--set-secret <field>=env:NAME|file:PATH|stdin` for\n *     each field of a form. Nothing else is asked.\n *  3. **A terminal**: hidden input, as before.\n *  4. Otherwise a usage error naming the forms above.\n *\n * A literal (`--set-secret field=sk-…`) is refused: argv lands in shell\n * history and the process list. No error, log or output here ever carries a\n * value — not even a path or a name that might be one by mistake.\n *\n * `--browser` is never chosen for you. A run with no terminal is usually an\n * agent or CI, and the CLI cannot tell whether anyone is at the desktop: a\n * form nobody fills would stall the run for its whole timeout. So it is\n * explicit, refused up front where it cannot work (CI, SSH, no display),\n * and bounded by a timeout everywhere.\n */\n\nexport interface SecretFlags {\n  /** `--secret-stdin` */\n  stdin: boolean;\n  /** `--secret-env <NAME>` */\n  env?: string;\n  /** `--secret-file <path>` */\n  file?: string;\n  /** `--set-secret <field>=env:NAME|file:PATH|stdin`, repeatable. */\n  sets: string[];\n  /** `--browser` */\n  browser: boolean;\n}\n\n/** The flags, from a command's parsed flags. */\nexport function readSecretFlags(\n  flags: Record<string, string | boolean | string[]> | undefined,\n): SecretFlags {\n  const text = (name: string) => {\n    const value = flags?.[name];\n    return typeof value === 'string' ? value : undefined;\n  };\n  const sets = flags?.['set-secret'];\n  return {\n    stdin: flags?.['secret-stdin'] === true,\n    env: text('secret-env'),\n    file: text('secret-file'),\n    sets: Array.isArray(sets) ? sets : typeof sets === 'string' ? [sets] : [],\n    browser: flags?.browser === true,\n  };\n}\n\n/** Whether any way of giving a secret without a terminal was passed. */\nexport function secretInputGiven(flags: SecretFlags): boolean {\n  return (\n    flags.browser ||\n    flags.stdin ||\n    flags.env !== undefined ||\n    flags.file !== undefined ||\n    flags.sets.length > 0\n  );\n}\n\n/** The forms, as a hint names them. */\nexport const SINGLE_SECRET_FORMS =\n  '--secret-env <NAME>, --secret-file <path> (a file only you can read), --secret-stdin (piped in), or --browser (a form in your browser on this computer)';\nexport const FIELD_SECRET_FORMS =\n  '--set-secret <field>=env:<NAME>|file:<path>|stdin for each secret (--secret-env, --secret-file or --secret-stdin when there is one), or --browser (a form in your browser on this computer)';\n\nexport interface SecretIO {\n  env: Record<string, string | undefined>;\n  stdinIsTTY: boolean;\n  /** Test seam: the whole of stdin. */\n  readStdin?: () => Promise<string>;\n  /** Test seam: the browser opener for `--browser`. */\n  openUrl?: (url: string) => void;\n  /** Test seam: how long `--browser` waits. */\n  formTimeoutMs?: number;\n  /** Test seam: the platform `--browser` checks for a desktop. */\n  platform?: NodeJS.Platform;\n  /** Where a relative `--secret-file` resolves (default: the working directory). */\n  cwd?: string;\n}\n\nexport type SecretField = SecretFormField;\n\nexport interface CollectSecretsInput {\n  /** Every field this run would ask, in order. */\n  fields: readonly SecretField[];\n  flags: SecretFlags;\n  io: SecretIO;\n  /** A human at a terminal (not `--json`, stdin a TTY). */\n  interactive: boolean;\n  /** The terminal question for one field — hidden for a secret. */\n  prompt: (field: SecretField) => Promise<string>;\n  /** The secure form's heading. */\n  title: string;\n  /** What is needed, when nothing can be asked: the refusal's message. */\n  refusal: string;\n  /** The command, without `npx @ekanos/cli`, for hints. */\n  again: string;\n  /**\n   * `--set <field>=<value>` for a field that is not a secret (a subdomain, a\n   * client ID): taken as given, and never asked. A secret here is refused.\n   */\n  plain?: Record<string, string>;\n}\n\n/**\n * `--set <field>=<value>` pairs. A malformed one is refused without echoing\n * it — it may be a secret typed where a field name was meant.\n */\nexport function parsePlainValues(\n  raw: string | boolean | string[] | undefined,\n  example = 'subdomain=acme',\n): Record<string, string> {\n  const pairs = Array.isArray(raw) ? raw : typeof raw === 'string' ? [raw] : [];\n  const values: Record<string, string> = {};\n  for (const pair of pairs) {\n    const at = pair.indexOf('=');\n    const name = at > 0 ? pair.slice(0, at).trim() : '';\n    if (!name) {\n      throw usageError(\n        '--set takes <field>=<value>, for a field that is not a secret.',\n        `For example: --set ${example}. A secret is never passed as an argument: use --set-secret <field>=env:<NAME>|file:<path>|stdin.`,\n      );\n    }\n    values[name] = pair.slice(at + 1).trim();\n  }\n  return values;\n}\n\nconst MAX_SECRET_BYTES = 64 * 1024;\nconst ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;\nconst FIELD_NAME = /^[A-Za-z0-9_.-]{1,64}$/;\n\ntype Spec =\n  | { kind: 'env'; name: string }\n  | { kind: 'file'; path: string }\n  | { kind: 'stdin' };\n\n/**\n * Each field's value by name; a field left empty is left out (its saved\n * value stays). Refuses a required field that is neither saved nor given.\n */\nexport async function collectSecrets(\n  ctx: CliContext,\n  input: CollectSecretsInput,\n): Promise<Record<string, string>> {\n  const { flags } = input;\n  const plain = checkPlain(input.fields, input.plain ?? {});\n  // What is left to ask: every field `--set` did not give.\n  const fields = input.fields.filter(\n    (field) => plain[field.name] === undefined,\n  );\n  const singles = [\n    flags.stdin,\n    flags.env !== undefined,\n    flags.file !== undefined,\n  ].filter(Boolean).length;\n  if (singles > 1) {\n    throw usageError(\n      'Pass one of --secret-env, --secret-file and --secret-stdin, not several.',\n      `Each names where the one secret comes from. For several, use --set-secret <field>=… per field.`,\n    );\n  }\n  if (flags.browser && (singles > 0 || flags.sets.length > 0)) {\n    throw usageError(\n      '--browser asks for every field in the form; it does not mix with --secret-* or --set-secret.',\n      'Drop --browser to pass them from the environment, a file or stdin, or drop those to use the form.',\n    );\n  }\n\n  const rest = { ...input, fields };\n  let values: Record<string, string>;\n  if (fields.length === 0) {\n    values = {};\n  } else if (flags.browser) {\n    values = await viaBrowser(ctx, rest);\n  } else if (singles > 0 || flags.sets.length > 0) {\n    values = await viaSources(rest);\n  } else if (input.interactive) {\n    values = {};\n    for (const field of fields) {\n      const value = (await input.prompt(field)).trim();\n      if (value) values[field.name] = value;\n    }\n  } else if (Object.keys(plain).length > 0) {\n    // Only non-secret values were given: the rest keep what is saved.\n    values = {};\n  } else {\n    throw usageError(\n      input.refusal,\n      `Without a terminal, pass ${fields.filter((field) => field.sensitive).length > 1 ? FIELD_SECRET_FORMS : SINGLE_SECRET_FORMS}. Or run it yourself in your terminal: npx @ekanos/cli ${input.again}`,\n    );\n  }\n\n  const missing = fields.filter(\n    (field) => field.required && !field.set && !values[field.name],\n  );\n  if (missing.length > 0) {\n    throw validationError(\n      `${missing.map((field) => field.label).join(', ')} ${missing.length === 1 ? 'is' : 'are'} needed; nothing was saved.`,\n      flags.browser || input.interactive\n        ? `Run \"ekanos ${input.again}\" again and fill ${missing.length === 1 ? 'it' : 'them'} in.`\n        : `Pass ${missing.map((field) => (field.sensitive ? `--set-secret ${field.name}=env:<NAME>` : `--set ${field.name}=<value>`)).join(' ')}.`,\n    );\n  }\n  return { ...plainGiven(plain), ...values };\n}\n\n/** `--set` values, checked against the fields: known, and never a secret. */\nfunction checkPlain(\n  fields: readonly SecretField[],\n  plain: Record<string, string>,\n): Record<string, string> {\n  const byName = new Map(fields.map((field) => [field.name, field]));\n  for (const name of Object.keys(plain)) {\n    const field = byName.get(name);\n    const shown = FIELD_NAME.test(name) ? `\"${name}\"` : 'That field';\n    if (!field) {\n      throw usageError(\n        `${shown} is not a field this asks for.`,\n        `Its fields are: ${fields.map((entry) => entry.name).join(', ') || 'none'}.`,\n      );\n    }\n    if (field.sensitive) {\n      throw usageError(\n        `${shown} is a secret: it is never passed as an argument.`,\n        `Pass it as --set-secret ${name}=env:<NAME>|file:<path>|stdin, or use --browser.`,\n      );\n    }\n  }\n  return plain;\n}\n\n/** An empty `--set name=` means nothing to change, as Enter does at a prompt. */\nfunction plainGiven(plain: Record<string, string>): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries(plain).filter(([, value]) => value !== ''),\n  );\n}\n\nasync function viaBrowser(\n  ctx: CliContext,\n  input: CollectSecretsInput,\n): Promise<Record<string, string>> {\n  const problem = desktopProblem(\n    input.io.env,\n    input.io.platform ?? process.platform,\n  );\n  if (problem) {\n    throw preconditionError(\n      `--browser needs a desktop to open a form on: ${problem}`,\n      `Pass it as ${input.fields.filter((field) => field.sensitive).length > 1 ? '--set-secret <field>=env:<NAME>|file:<path>|stdin' : '--secret-env <NAME>, --secret-file <path> or --secret-stdin'} instead.`,\n    );\n  }\n  ctx.log(\n    `Opened a secure form in your browser for ${input.title}… (waiting; if no browser opened, re-run with --secret-env, --secret-file or --secret-stdin)`,\n  );\n  return collectWithSecretForm({\n    title: input.title,\n    fields: input.fields,\n    open: input.io.openUrl ?? openInBrowser,\n    timeoutMs: input.io.formTimeoutMs,\n  });\n}\n\n/** Why a browser form cannot be filled here, or null when it can. */\nexport function desktopProblem(\n  env: Record<string, string | undefined>,\n  platform: NodeJS.Platform,\n): string | null {\n  const ci = env.CI?.trim().toLowerCase();\n  if (ci && ci !== '0' && ci !== 'false') {\n    return 'this is a CI run (CI is set), with no one to fill it in.';\n  }\n  if (env.SSH_CONNECTION || env.SSH_TTY) {\n    return 'this is an SSH session, and a browser on this machine is not in front of you.';\n  }\n  if (\n    platform !== 'darwin' &&\n    platform !== 'win32' &&\n    !env.DISPLAY &&\n    !env.WAYLAND_DISPLAY\n  ) {\n    return 'there is no desktop session (DISPLAY or WAYLAND_DISPLAY) to open a browser in.';\n  }\n  return null;\n}\n\nasync function viaSources(\n  input: CollectSecretsInput,\n): Promise<Record<string, string>> {\n  const { flags, fields } = input;\n  const byName = new Map(fields.map((field) => [field.name, field]));\n  const specs = new Map<string, Spec>();\n\n  for (const entry of flags.sets) {\n    const at = entry.indexOf('=');\n    const name = at > 0 ? entry.slice(0, at).trim() : '';\n    if (!name) {\n      throw usageError(\n        '--set-secret takes <field>=env:<NAME>, <field>=file:<path> or <field>=stdin.',\n        `For example: --set-secret ${fields.find((field) => field.sensitive)?.name ?? 'client_secret'}=env:MY_SECRET.`,\n      );\n    }\n    const shown = FIELD_NAME.test(name) ? `\"${name}\"` : 'that field';\n    const field = byName.get(name);\n    if (!field) {\n      throw usageError(\n        `${shown} is not a field this asks for.`,\n        `Its fields are: ${fields.map((entry) => entry.name).join(', ') || 'none'}.`,\n      );\n    }\n    if (specs.has(name)) {\n      throw usageError(\n        `--set-secret names ${shown} twice.`,\n        'Pass each field once.',\n      );\n    }\n    specs.set(name, parseSpec(entry.slice(at + 1), `--set-secret ${name}`));\n  }\n\n  const single: Spec | null = flags.stdin\n    ? { kind: 'stdin' }\n    : flags.env !== undefined\n      ? envSpec(flags.env, '--secret-env')\n      : flags.file !== undefined\n        ? { kind: 'file', path: flags.file }\n        : null;\n  if (single) {\n    const secrets = fields.filter(\n      (field) => field.sensitive && !specs.has(field.name),\n    );\n    if (secrets.length !== 1) {\n      throw usageError(\n        secrets.length === 0\n          ? 'There is no secret here for --secret-env, --secret-file or --secret-stdin to fill.'\n          : `This asks for ${secrets.length} secrets (${secrets.map((field) => field.name).join(', ')}), so name each one.`,\n        secrets.length === 0\n          ? 'Drop the flag.'\n          : `Pass --set-secret <field>=env:<NAME>|file:<path>|stdin for each, e.g. --set-secret ${secrets[0]!.name}=env:MY_SECRET.`,\n      );\n    }\n    specs.set(secrets[0]!.name, single);\n  }\n\n  if ([...specs.values()].filter((spec) => spec.kind === 'stdin').length > 1) {\n    throw usageError(\n      'Only one secret can come from stdin.',\n      'Take the others from the environment (env:<NAME>) or a file (file:<path>).',\n    );\n  }\n\n  const values: Record<string, string> = {};\n  for (const [name, spec] of specs) {\n    const value = (await resolveSpec(spec, name, input.io)).trim();\n    if (!value) {\n      throw preconditionError(\n        `The value for ${name} (from ${describe(spec)}) is empty; nothing was saved.`,\n        'Put the secret there, then run the command again.',\n      );\n    }\n    values[name] = value;\n  }\n  return values;\n}\n\nfunction parseSpec(raw: string, flag: string): Spec {\n  if (raw === 'stdin') return { kind: 'stdin' };\n  if (raw.startsWith('env:')) return envSpec(raw.slice(4), flag);\n  if (raw.startsWith('file:') && raw.length > 5) {\n    return { kind: 'file', path: raw.slice(5) };\n  }\n  throw usageError(\n    `${flag}=… is not env:<NAME>, file:<path> or stdin. A secret is never passed as an argument: it would land in your shell history and the process list.`,\n    `Put it in an environment variable (${flag}=env:MY_SECRET), a file only you can read (${flag}=file:./secret.txt), or pipe it in (${flag}=stdin).`,\n  );\n}\n\nfunction envSpec(name: string, flag: string): Spec {\n  if (ENV_NAME.test(name)) return { kind: 'env', name };\n  // Never echoed: a value that is not a name may be the secret itself.\n  throw usageError(\n    `${flag} takes the NAME of an environment variable (letters, digits and _), never the secret itself.`,\n    `For example: MY_SECRET=… then ${flag}${flag.startsWith('--set-secret') ? '=env:' : ' '}MY_SECRET.`,\n  );\n}\n\nfunction describe(spec: Spec): string {\n  if (spec.kind === 'env') return `$${spec.name}`;\n  if (spec.kind === 'file') return 'the file';\n  return 'stdin';\n}\n\nasync function resolveSpec(\n  spec: Spec,\n  field: string,\n  io: SecretIO,\n): Promise<string> {\n  if (spec.kind === 'env') {\n    const value = io.env[spec.name];\n    if (value === undefined || value === '') {\n      throw preconditionError(\n        `The environment variable ${spec.name} (for ${field}) is not set; nothing was saved.`,\n        `Set it in the environment the command runs in, then run it again.`,\n      );\n    }\n    return value;\n  }\n  if (spec.kind === 'file') return readSecretFile(spec.path, field, io.cwd);\n  return readStdinSecret(io);\n}\n\nfunction readSecretFile(\n  given: string,\n  field: string,\n  cwd: string = process.cwd(),\n): string {\n  const result = readPrivateFileNoFollow(\n    path.resolve(cwd, given),\n    MAX_SECRET_BYTES,\n  );\n  if (result.ok) return stripNewline(result.bytes.toString('utf8'));\n  // The path is not echoed: a mistyped flag may have put the secret there.\n  const what = `The file given for ${field}`;\n  switch (result.problem) {\n    case 'missing':\n      throw notFoundError(\n        `${what} does not exist; nothing was saved.`,\n        'Check the path, then run the command again.',\n      );\n    case 'symlink':\n      throw preconditionError(\n        `${what} is a symlink, and the CLI never reads a secret through one.`,\n        'Name the real file instead.',\n      );\n    case 'not-a-file':\n      throw preconditionError(\n        `${what} is not a regular file.`,\n        'Name a file holding just the secret.',\n      );\n    case 'readable-by-others':\n      throw preconditionError(\n        `${what} can be read by other users on this machine (mode ${(result.mode ?? 0).toString(8).padStart(3, '0')}), so it was not read.`,\n        'Make it yours alone with \"chmod 600 <file>\", then run the command again.',\n      );\n    case 'not-yours':\n      throw preconditionError(\n        `${what} belongs to another user, so it was not read.`,\n        'Use a file you own, readable only by you (chmod 600).',\n      );\n    case 'too-large':\n      throw preconditionError(\n        `${what} is larger than a secret (over 64 KB).`,\n        'Name a file holding just the secret.',\n      );\n  }\n}\n\nasync function readStdinSecret(io: SecretIO): Promise<string> {\n  if (io.stdinIsTTY) {\n    throw usageError(\n      'stdin is a terminal, so there is no piped secret to read.',\n      'Pipe it in (e.g. `printf %s \"$MY_SECRET\" | ekanos …`), or use --secret-env or --secret-file.',\n    );\n  }\n  const raw = await (io.readStdin ?? readAllStdin)();\n  return stripNewline(raw);\n}\n\nfunction readAllStdin(): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    const stdin = process.stdin;\n    stdin.on('data', (chunk: Buffer | string) => {\n      const buffer = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;\n      size += buffer.length;\n      if (size > MAX_SECRET_BYTES) {\n        stdin.destroy();\n        reject(\n          usageError(\n            'stdin holds more than a secret (over 64 KB).',\n            'Pipe in just the secret.',\n          ),\n        );\n        return;\n      }\n      chunks.push(buffer);\n    });\n    stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));\n    stdin.on('error', reject);\n  });\n}\n\n/** One trailing newline (`echo`, an editor's final line) is not part of it. */\nfunction stripNewline(value: string): string {\n  return value.replace(/\\r?\\n$/, '');\n}\n"]}

package/dist/team-connect-api.d.ts

@@ -7,9 +7,9 @@ import { type TeamsApiResult } from './teams-api.js';
  *   GET  /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>[&as=<email>][&connection=<id>]
  *     → { plan }
  *   POST /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>
- *        { as?, fields?, connection? }
+ *        { as?, fields?, set?, connection? }
  *     → { plan, result: "activated" }                         fields / no-fields
- *     → { plan, result: "consent", authorizeUrl, expiresAt }  oauth
+ *     → { plan, result: "consent", authorizeUrl, expiresAt }  oauth (fields too, for signIn "app")
  *
  * The plan's `mode`, decided by the host, says how the product is
  * connected. The shapes are read here rather than from
@@ -49,6 +49,10 @@ export declare const TeamConnectPlanSchema: z.ZodObject<{
         unsupported: "unsupported";
         "works-as-shipped": "works-as-shipped";
     }>;
+    signIn: z.ZodOptional<z.ZodEnum<{
+        app: "app";
+        partner: "partner";
+    }>>;
     reason: z.ZodNullable<z.ZodString>;
     fields: z.ZodArray<z.ZodObject<{
         name: z.ZodString;
@@ -56,6 +60,19 @@ export declare const TeamConnectPlanSchema: z.ZodObject<{
         description: z.ZodNullable<z.ZodString>;
         sensitive: z.ZodBoolean;
         required: z.ZodBoolean;
+        type: z.ZodDefault<z.ZodEnum<{
+            boolean: "boolean";
+            json: "json";
+            list: "list";
+            number: "number";
+            select: "select";
+            text: "text";
+        }>>;
+        options: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        itemType: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+            number: "number";
+            text: "text";
+        }>>>;
     }, z.core.$strip>>;
     teamApp: z.ZodBoolean;
     member: z.ZodNullable<z.ZodObject<{
@@ -78,6 +95,11 @@ export declare const TeamConnectPlanSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type TeamConnectPlan = z.infer<typeof TeamConnectPlanSchema>;
+export type TeamConnectField = TeamConnectPlan['fields'][number];
+/** A field's value as sent: text, or typed by `connect-fields.ts`. */
+export type FieldValue = string | number | boolean | null | FieldValue[] | {
+    [key: string]: FieldValue;
+};
 declare const ShowSchema: z.ZodObject<{
     plan: z.ZodObject<{
         source: z.ZodObject<{
@@ -112,6 +134,10 @@ declare const ShowSchema: z.ZodObject<{
             unsupported: "unsupported";
             "works-as-shipped": "works-as-shipped";
         }>;
+        signIn: z.ZodOptional<z.ZodEnum<{
+            app: "app";
+            partner: "partner";
+        }>>;
         reason: z.ZodNullable<z.ZodString>;
         fields: z.ZodArray<z.ZodObject<{
             name: z.ZodString;
@@ -119,6 +145,19 @@ declare const ShowSchema: z.ZodObject<{
             description: z.ZodNullable<z.ZodString>;
             sensitive: z.ZodBoolean;
             required: z.ZodBoolean;
+            type: z.ZodDefault<z.ZodEnum<{
+                boolean: "boolean";
+                json: "json";
+                list: "list";
+                number: "number";
+                select: "select";
+                text: "text";
+            }>>;
+            options: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            itemType: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+                number: "number";
+                text: "text";
+            }>>>;
         }, z.core.$strip>>;
         teamApp: z.ZodBoolean;
         member: z.ZodNullable<z.ZodObject<{
@@ -175,6 +214,10 @@ declare const StartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             unsupported: "unsupported";
             "works-as-shipped": "works-as-shipped";
         }>;
+        signIn: z.ZodOptional<z.ZodEnum<{
+            app: "app";
+            partner: "partner";
+        }>>;
         reason: z.ZodNullable<z.ZodString>;
         fields: z.ZodArray<z.ZodObject<{
             name: z.ZodString;
@@ -182,6 +225,19 @@ declare const StartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             description: z.ZodNullable<z.ZodString>;
             sensitive: z.ZodBoolean;
             required: z.ZodBoolean;
+            type: z.ZodDefault<z.ZodEnum<{
+                boolean: "boolean";
+                json: "json";
+                list: "list";
+                number: "number";
+                select: "select";
+                text: "text";
+            }>>;
+            options: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            itemType: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+                number: "number";
+                text: "text";
+            }>>>;
         }, z.core.$strip>>;
         teamApp: z.ZodBoolean;
         member: z.ZodNullable<z.ZodObject<{
@@ -238,6 +294,10 @@ declare const StartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             unsupported: "unsupported";
             "works-as-shipped": "works-as-shipped";
         }>;
+        signIn: z.ZodOptional<z.ZodEnum<{
+            app: "app";
+            partner: "partner";
+        }>>;
         reason: z.ZodNullable<z.ZodString>;
         fields: z.ZodArray<z.ZodObject<{
             name: z.ZodString;
@@ -245,6 +305,19 @@ declare const StartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             description: z.ZodNullable<z.ZodString>;
             sensitive: z.ZodBoolean;
             required: z.ZodBoolean;
+            type: z.ZodDefault<z.ZodEnum<{
+                boolean: "boolean";
+                json: "json";
+                list: "list";
+                number: "number";
+                select: "select";
+                text: "text";
+            }>>;
+            options: z.ZodDefault<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            itemType: z.ZodDefault<z.ZodNullable<z.ZodEnum<{
+                number: "number";
+                text: "text";
+            }>>>;
         }, z.core.$strip>>;
         teamApp: z.ZodBoolean;
         member: z.ZodNullable<z.ZodObject<{
@@ -281,6 +354,8 @@ interface Target {
 export declare function showTeamConnect(host: string, accessToken: string, target: Target, asEmail?: string): Promise<TeamsApiResult<z.infer<typeof ShowSchema>>>;
 export declare function startTeamConnect(host: string, accessToken: string, target: Target, body: {
     as?: string;
-    fields?: Record<string, string>;
+    fields?: Record<string, FieldValue>;
+    /** The field names given by `--set`, not a prompt: the host refuses a secret among them. */
+    set?: string[];
 }): Promise<TeamsApiResult<TeamConnectStart>>;
 export {};