@ever-works/oidc-identity 1.0.0

package/dist/index.js

@@ -0,0 +1,3244 @@
+// src/oidc-identity.plugin.ts
+import { randomBytes } from "crypto";
+
+// ../../contracts/dist/index.js
+var USER_SELECTABLE_WORK_KINDS = [
+  "website",
+  "landing-page",
+  "blog",
+  "directory",
+  "awesome-repo",
+  "repo",
+  "app"
+];
+var WORK_KINDS = [...USER_SELECTABLE_WORK_KINDS, "company", "campaign", "default"];
+var WORK_KIND_SET = new Set(WORK_KINDS);
+var GOAL_KINDS = ["metric", "delivery"];
+var GOAL_KIND_SET = new Set(GOAL_KINDS);
+var APP_DEPENDENCY_BACKUP_OVERDUE_MS = 26 * 36e5;
+var APP_DEPENDENCY_MANAGED = {
+  pgRoleConnectionLimit: 20,
+  pgDatabaseConnectionLimit: 25,
+  pgStatementTimeoutMs: 6e4,
+  pgIdleInTransactionTimeoutMs: 6e4,
+  bucketQuotaGiB: 10,
+  redisMaxMemoryMiB: 256,
+  backupMaxAgeMs: 864e5
+};
+var APP_ENV_VALIDATION_REFUSAL_CODES = [
+  "invalidName",
+  "reservedName",
+  "valueTooLarge",
+  "controlCharacter",
+  "lengthMismatch",
+  "tooShort",
+  "tooLong",
+  "patternMismatch"
+];
+var APP_ENV_API_ERROR_CODES = [
+  "generatedValueUseRotate",
+  "neverRotateNotAcknowledged",
+  "rotateConfirmationMismatch",
+  "secureStorageUnavailable",
+  "tooManyValues",
+  "valuesTooLarge",
+  "malformedLine",
+  "rotateRateLimited"
+];
+var APP_ENV_ERROR_CODES = [...APP_ENV_VALIDATION_REFUSAL_CODES, ...APP_ENV_API_ERROR_CODES];
+var APP_LAUNCHER_CLIENT_CACHE_MS = 5 * 6e4;
+var MANAGED_HOSTING_REASONS = [
+  "licenseNotGreen",
+  "upstreamAgreementMissing",
+  "entryDisallows",
+  "blueprintNotVerified",
+  "managedTierDisabled"
+];
+var MANAGED_HOSTING_AVAILABILITIES = ["available", ...MANAGED_HOSTING_REASONS];
+var APP_PRIVATE_COPY_MAX_SIZE_KB = 512e3;
+var APP_DEPLOY_MAX_DURATION_S = 7200;
+var APP_DEPLOY_LOCK_STALE_S = APP_DEPLOY_MAX_DURATION_S + 60;
+var APPS_CATALOG_LAST_GOOD_REGISTRY_MS = 7 * 864e5;
+var APP_REPOSITORY_STAGE_LIMITS = {
+  "private-copy": {
+    maxSizeKb: APP_PRIVATE_COPY_MAX_SIZE_KB,
+    fetchesLfs: false,
+    refusalCodes: ["too_large_for_private_copy", "uses_lfs"]
+  },
+  provisioning: {
+    maxSizeKb: 3 * 1024 * 1024,
+    refusalCodes: ["repository-too-large"]
+  },
+  build: {
+    refusalCodes: []
+  },
+  sandbox: {
+    refusalCodes: []
+  }
+};
+var TENANT_POSTGRES_ROLE_CONNECTION_LIMIT = APP_DEPENDENCY_MANAGED.pgRoleConnectionLimit;
+var TENANT_POSTGRES_DATABASE_CONNECTION_LIMIT = APP_DEPENDENCY_MANAGED.pgDatabaseConnectionLimit;
+var TENANT_POSTGRES_STATEMENT_TIMEOUT_MS = APP_DEPENDENCY_MANAGED.pgStatementTimeoutMs;
+var TENANT_POSTGRES_IDLE_IN_TRANSACTION_TIMEOUT_MS = APP_DEPENDENCY_MANAGED.pgIdleInTransactionTimeoutMs;
+var APP_PROVISION_LIMITS = {
+  attemptsDefault: 3,
+  attemptsMin: 1,
+  attemptsMax: 5,
+  attemptsPerAnswer: 2,
+  questionsMax: 3,
+  attemptsCeiling: 9,
+  optionsMax: 4,
+  tokenCapDefault: 3e6,
+  tokenCapMin: 5e5,
+  tokenCapMax: 1e7,
+  runnerMinuteCapDefault: 240,
+  runnerMinuteCapMin: 60,
+  runnerMinuteCapMax: 600,
+  /** Two starts of the same App Work inside this window yield one row (§4 "Start semantics"). */
+  startDedupeMs: 1e4,
+  analysisRunMs: 45 * 6e4,
+  iterateRunMs: 30 * 6e4,
+  forkWaitMs: 30 * 6e4,
+  activeDeadlineMs: 8 * 36e5,
+  /**
+   * Verification-Build reservation: `min(headSpec.build.resources.timeoutMinutes, buildMinutesMax)
+   * + runnerBootMinutesMax` — 90 minutes at the defaults, and the number §6.4 compares against the cap.
+   */
+  buildMinutesMax: 60,
+  jobSecondsMax: 900,
+  startupSecondsMax: 900,
+  smokeRequestMs: 3e4,
+  smokeTotalMs: 3e5,
+  runnerBootMinutesMax: 30,
+  runnerBootMemoryGiB: 12,
+  buildMemoryGiBMax: 14,
+  namespaceTtlMinutes: 90,
+  repoMaxBytes: 3 * 1024 ** 3,
+  diffMaxFiles: 12,
+  diffMaxLines: 3e3,
+  fileMaxBytes: 128 * 1024,
+  outputMaxBytes: 512 * 1024,
+  reportMaxChars: 4e4,
+  instructionFileMaxBytes: 32 * 1024,
+  logTailLines: 200,
+  logTailBytes: 16 * 1024,
+  evidenceCommentMaxChars: 6e4,
+  chatMessagesMax: 12,
+  questionReminderMs: 72 * 36e5,
+  questionExpiryMs: 14 * 864e5,
+  activePerUser: 3,
+  activePerOrg: 10,
+  startsPerHour: 10,
+  pollMs: 5e3,
+  infraRetries: 3,
+  infraRetryWindowMs: 30 * 6e4,
+  suggestionsPer30Days: 5,
+  autoReprovisionPerSync: 1,
+  autoReprovisionPer7Days: 2,
+  clusterProbeMs: 1e4,
+  podPendingInfraMs: 10 * 6e4
+};
+var MAX_CANDIDATE_OPTIONS = APP_PROVISION_LIMITS.optionsMax - 1;
+var KB_EXPORT_MAX_BYTES = 200 * 1024 * 1024;
+var TERMINAL_MAX_FRAME_BYTES = 1024 * 1024;
+var COMPUTER_MAX_FRAME_BYTES = 512 * 1024;
+var COMPUTER_MAX_BATCH_BYTES = 512 * 1024;
+var COMPUTER_MAX_WIRE_FRAME_BYTES = Math.ceil(COMPUTER_MAX_FRAME_BYTES * 4 / 3) + 4096;
+var COMPUTER_QUALITY_PRESETS = Object.freeze({
+  sharp: Object.freeze({ width: 1280, maxFps: 8, keyframeMs: 5e3, q: 70 }),
+  smooth: Object.freeze({ width: 960, maxFps: 15, keyframeMs: 5e3, q: 55 }),
+  steady: Object.freeze({ width: 800, maxFps: 2, keyframeMs: 2e3, q: 45 })
+});
+var COMPUTER_CONTROL_IDLE_MS_DEFAULT = 10 * 6e4;
+var COMPUTER_CONTROL_CEILING_MS_DEFAULT = 60 * 6e4;
+var COMPUTER_KEY_MODIFIER_ALT = 1;
+var COMPUTER_KEY_MODIFIER_CTRL = 2;
+var COMPUTER_KEY_MODIFIER_META = 4;
+var CTRL = COMPUTER_KEY_MODIFIER_CTRL;
+var META = COMPUTER_KEY_MODIFIER_META;
+var ALT = COMPUTER_KEY_MODIFIER_ALT;
+function withCtrlOrMeta(code, key) {
+  return [
+    { code, requires: CTRL, label: `Ctrl/\u2318+${key}` },
+    { code, requires: META, label: `Ctrl/\u2318+${key}` }
+  ];
+}
+var COMPUTER_BLOCKED_SHORTCUTS = Object.freeze([
+  ...withCtrlOrMeta("KeyC", "C"),
+  ...withCtrlOrMeta("KeyX", "X"),
+  ...withCtrlOrMeta("KeyV", "V"),
+  ...withCtrlOrMeta("KeyW", "W"),
+  ...withCtrlOrMeta("KeyT", "T"),
+  ...withCtrlOrMeta("KeyN", "N"),
+  ...withCtrlOrMeta("KeyQ", "Q"),
+  ...withCtrlOrMeta("Tab", "Tab"),
+  { code: "Tab", requires: ALT, label: "Alt+Tab" },
+  { code: "F4", requires: ALT, label: "Alt+F4" },
+  { code: "Delete", requires: CTRL | ALT, label: "Ctrl+Alt+Delete" },
+  { code: "MetaLeft", requires: 0, label: "\u2318/Win" },
+  { code: "MetaRight", requires: 0, label: "\u2318/Win" }
+]);
+var TASK_BOARD_STATUSES = [
+  "backlog",
+  "todo",
+  "in_progress",
+  "in_review",
+  "blocked",
+  "done",
+  "cancelled"
+];
+var TASK_BOARD_TERMINAL_STATUSES = ["done", "cancelled"];
+var TASK_BOARD_STATUS_COLUMNS = TASK_BOARD_STATUSES.map((status) => ({
+  key: status,
+  statuses: [status],
+  terminal: TASK_BOARD_TERMINAL_STATUSES.includes(status),
+  toggleOnly: false
+}));
+var PLATFORM_DEFAULT_MERGE_POLICY = Object.freeze({
+  allowAgentMerge: false,
+  requireGreenGate: true,
+  requireHumanApproval: true,
+  allowedMergeMethods: ["squash"],
+  protectedBranches: ["main", "master", "develop", "stage"]
+});
+var MERGE_APPROVAL_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var TOOL_GRANT_SCOPE_PRECEDENCE = Object.freeze([
+  "tenant",
+  "organization",
+  "work",
+  "agent"
+]);
+var PLATFORM_DEFAULT_TOOL_GRANT = Object.freeze({
+  allow: Object.freeze(["*"]),
+  deny: Object.freeze([])
+});
+var AGENT_INIT_SCRIPT_MAX_BYTES = 16 * 1024;
+var INGEST_EVENT_PAYLOAD_MAX_BYTES = 32 * 1024;
+var VERSION = "1.0.0";
+var GTM_SKILLS = [
+  // ── research ────────────────────────────────────────────────────────
+  {
+    slug: "lead-research",
+    title: "Lead research",
+    description: "Build a candidate lead list from seed criteria and public sources, recording a supporting source for every contact.",
+    stage: "research",
+    tags: ["gtm", "sales", "research"],
+    version: VERSION,
+    inputs: [
+      { key: "icp", description: "Ideal-customer description: segment, size, geography, role titles." },
+      { key: "seed_sources", description: "Seed lists, domains, or saved searches to start from." },
+      { key: "max_leads", description: "Hard cap on how many candidates this run may collect." }
+    ],
+    outputs: [
+      { key: "contacts", description: "Candidate contacts with name, company, title, and a source reference." }
+    ],
+    allowedTools: ["search", "content-extractor"],
+    body: [
+      "Build a candidate lead list from the supplied criteria and seed sources.",
+      "",
+      "## Rules",
+      "- NEVER invent a contact detail. An email address, phone number, or title is recorded only",
+      "  when a source supports it; otherwise leave the field empty.",
+      "- Record `source` on every contact \u2014 the URL or seed list the entry came from. A contact",
+      "  without a source is not a lead, it is a guess.",
+      "- Respect `max_leads` exactly. Stop collecting when the cap is reached and say how many",
+      "  candidates were left unexamined.",
+      "- De-duplicate by email when present, otherwise by (company, name).",
+      "- Exclude anyone who has asked not to be contacted, and any source that forbids collection.",
+      "",
+      "## Output",
+      "Write `contacts`. Each entry carries `name`, and any of `email`, `company`, `title`,",
+      "`source`, `notes` that a source supports. Report the counts examined, kept, and dropped,",
+      "with the reason for each drop category."
+    ].join("\n")
+  },
+  {
+    slug: "competitor-watch",
+    title: "Competitor watch",
+    description: "Monitor a watchlist of companies across public sources and emit dated, source-linked change signals.",
+    stage: "research",
+    tags: ["gtm", "marketing", "research"],
+    version: VERSION,
+    inputs: [
+      { key: "watchlist", description: "Companies to monitor: name, website, public repositories." },
+      { key: "focus_areas", description: "What to watch: pricing, features, positioning, hiring." },
+      { key: "since", description: "Only report changes observed after this date." }
+    ],
+    outputs: [{ key: "signals", description: "Dated observations with a source URL and the focus area they hit." }],
+    allowedTools: ["search", "content-extractor"],
+    body: [
+      "Monitor the watchlist across public sources and report what changed.",
+      "",
+      "## Rules",
+      "- Public sources only: published pages, public announcements, public repositories.",
+      "- Every signal carries a source URL and an observation date. No date or no URL means the",
+      "  signal is not reportable.",
+      "- Separate FACT (what the source says) from ANALYSIS (what you infer). Never blend them in",
+      "  the same sentence.",
+      "- Report only changes since `since`. If a focus area produced nothing, say so explicitly \u2014",
+      "  an empty period is a finding, not a gap to fill.",
+      "- Do not speculate about unannounced plans, internal metrics, or private information.",
+      "",
+      "## Output",
+      "Write `signals`. Each entry carries `title`, `url`, `publishedDate`, the focus area, and a",
+      "one-line factual summary."
+    ].join("\n")
+  },
+  {
+    slug: "news-signal-detection",
+    title: "News signal detection",
+    description: "Scan configured topics for newsworthy events and rank them by relevance to the campaign, discarding noise.",
+    stage: "research",
+    tags: ["gtm", "marketing", "research"],
+    version: VERSION,
+    inputs: [
+      { key: "topics", description: "Topics, keywords, or accounts to scan." },
+      { key: "lookback_days", description: "How far back the scan reaches." },
+      { key: "relevance_threshold", description: "Minimum relevance (0-1) an item must clear to be kept." }
+    ],
+    outputs: [{ key: "signals", description: "Relevance-ranked news items with source URL and publish date." }],
+    allowedTools: ["search", "content-extractor"],
+    body: [
+      "Scan the configured topics and keep only what is genuinely newsworthy for this campaign.",
+      "",
+      "## Rules",
+      "- Score each candidate 0-1 for relevance to the campaign brief and drop anything below",
+      "  `relevance_threshold`. State the score and the one-line reason for every item you keep.",
+      "- Prefer primary sources over aggregators; when both exist, link the primary.",
+      "- Collapse duplicate coverage of the same event into one signal with the best source.",
+      "- Nothing older than `lookback_days`. Undated items are dropped, not guessed at.",
+      "- Never restate a headline as fact when the source hedges it \u2014 carry the hedge through.",
+      "",
+      "## Output",
+      "Write `signals` ordered by descending relevance, each with `title`, `url`, `publishedDate`,",
+      "the relevance score, and the reason it matters here."
+    ].join("\n")
+  },
+  // ── qualify ─────────────────────────────────────────────────────────
+  {
+    slug: "lead-scoring",
+    title: "Lead scoring",
+    description: "Score contacts 0-100 against a declarative weight table and attach an explainable reason per point awarded.",
+    stage: "qualify",
+    tags: ["gtm", "sales", "scoring"],
+    version: VERSION,
+    inputs: [
+      { key: "contacts", description: "Candidate contacts to score." },
+      { key: "score_weights", description: "Weight table: signal name \u2192 points awarded." }
+    ],
+    outputs: [
+      { key: "scored_contacts", description: "Contacts with `score` (0-100) and `scoreReasons` per contact." }
+    ],
+    allowedTools: [],
+    body: [
+      "Score every contact against the supplied weight table.",
+      "",
+      "## Rules",
+      "- The weight table is the whole model. Award points ONLY for signals it names; never invent",
+      "  a bonus, and never award points for a signal the contact data does not actually support.",
+      "- Clamp the final score to 0-100. Record one `scoreReasons` line per point awarded, in the",
+      "  form `<signal> +<points>`, so any score can be re-derived by hand.",
+      "- A missing field is worth zero points, never an assumed value.",
+      "- Scoring is deterministic: the same contact and the same weight table must always produce",
+      "  the same score. Do not break ties with judgement calls \u2014 leave ties tied.",
+      "",
+      "## Output",
+      "Write `scored_contacts` sorted by descending score, then report the score distribution and",
+      "the three signals that moved the list most."
+    ].join("\n")
+  },
+  {
+    slug: "risk-filter",
+    title: "Risk filter",
+    description: "Flag low-quality or unsafe contacts against a risk weight table and exclude those at or above the threshold.",
+    stage: "qualify",
+    tags: ["gtm", "sales", "safety"],
+    version: VERSION,
+    inputs: [
+      { key: "scored_contacts", description: "Contacts already carrying a priority score." },
+      { key: "risk_weights", description: "Risk weight table: risk signal \u2192 points." },
+      { key: "risk_threshold", description: "Risk score at or above which a contact is excluded." }
+    ],
+    outputs: [
+      {
+        key: "scored_contacts",
+        description: "The same contacts, now carrying `riskScore`, `riskReasons`, and an excluded flag."
+      }
+    ],
+    allowedTools: [],
+    body: [
+      "Assess each scored contact for risk and mark \u2014 never silently delete \u2014 the excluded ones.",
+      "",
+      "## Rules",
+      "- Apply the risk weight table exactly as given; record one `riskReasons` line per point.",
+      "- Contacts at or above `risk_threshold` are EXCLUDED from outbound, but they stay in the",
+      "  data set with their reasons attached so a human can overturn the call.",
+      '- Never drop a contact without a recorded reason. "Looked wrong" is not a reason.',
+      "- Risk is about deliverability and safety (unverifiable identity, throwaway domains,",
+      "  do-not-contact signals) \u2014 it is not a second opinion on fit. Fit is `lead-scoring`.",
+      "",
+      "## Output",
+      "Write the enriched `scored_contacts` and report how many were excluded, grouped by the",
+      "dominant risk reason."
+    ].join("\n")
+  },
+  // ── draft ───────────────────────────────────────────────────────────
+  {
+    slug: "outreach-personalization",
+    title: "Outreach personalization",
+    description: "Write one 80-120 word personalized outbound draft per qualified contact, grounded only in known facts.",
+    stage: "draft",
+    tags: ["gtm", "sales", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "scored_contacts", description: "Qualified, non-excluded contacts to write for." },
+      { key: "campaign_brief", description: "Offer, proof points, and the single ask." },
+      { key: "tone", description: "Configured tone for the campaign." }
+    ],
+    outputs: [{ key: "drafts", description: "One draft per contact with `ref`, `channel`, `subject`, `body`." }],
+    allowedTools: [],
+    body: [
+      "Write one outbound draft per qualified contact.",
+      "",
+      "## Rules",
+      "- HARD CONSTRAINT: drafts only. Nothing is sent, scheduled, or queued for delivery here.",
+      '- 80-120 words in the body. One ask. No multi-part asks, no "quick question" openers that',
+      "  the rest of the message contradicts.",
+      "- Personalize ONLY from fields and signals actually present on the contact. If there is no",
+      "  personalization material, write the generic version and say so \u2014 a fabricated detail is",
+      "  worse than a generic opener.",
+      "- Write a subject line only for channels that carry one.",
+      "- No invented metrics, customer names, or mutual connections. Ever.",
+      "",
+      "## Output",
+      "Write `drafts`, ordered by descending contact score so the review gate sees the best",
+      "candidates first. Each draft carries a stable `ref` used later by review and the action log."
+    ].join("\n")
+  },
+  {
+    slug: "newsletter-drafting",
+    title: "Newsletter drafting",
+    description: "Turn briefs, notes, and collected signals into a scannable newsletter issue with one clear call to action.",
+    stage: "draft",
+    tags: ["gtm", "marketing", "content", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "campaign_brief", description: "Issue theme, audience, and the call to action." },
+      { key: "signals", description: "Collected source material for the issue." },
+      { key: "tone", description: "Configured editorial tone." }
+    ],
+    outputs: [{ key: "drafts", description: "A single newsletter draft: subject line plus sectioned body." }],
+    allowedTools: ["content-extractor"],
+    body: [
+      "Draft one newsletter issue from the brief and the collected material.",
+      "",
+      "## Rules",
+      "- Draft-first: the issue is produced for human review. Never send or schedule it.",
+      "- Structure: subject line, one-sentence hook, 3-5 short sections, one call to action.",
+      "  Scannable beats comprehensive.",
+      "- Every claim traces to the brief, the knowledge base, or a supplied signal. Link the",
+      "  source when the section rests on one.",
+      "- Never invent metrics, quotes, or customer names.",
+      "- When the source material is thin, say so and list what extra input would raise quality",
+      "  rather than padding the issue.",
+      "",
+      "## Output",
+      "Write `drafts` with a single entry: `subject` plus the sectioned `body`."
+    ].join("\n")
+  },
+  {
+    slug: "social-scheduling",
+    title: "Social scheduling",
+    description: "Plan a channel-fit social calendar and stage each post for review, respecting cadence and angle variety.",
+    stage: "draft",
+    tags: ["gtm", "marketing", "social", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "campaign_brief", description: "Campaign themes, channels, and cadence." },
+      { key: "signals", description: "Source material and trends to build posts from." },
+      { key: "cadence", description: "Posts per channel per period." }
+    ],
+    outputs: [
+      { key: "drafts", description: "Channel-fit post drafts, each with its planned slot in the calendar." }
+    ],
+    allowedTools: [],
+    body: [
+      "Plan the social calendar for the cadence window and draft each post.",
+      "",
+      "## Rules",
+      "- Draft-first: posts are STAGED for review. Never publish, never schedule to a live channel.",
+      "- Fit each draft to its channel: length, hashtag conventions, and link placement differ and",
+      "  a cross-posted body is a tell.",
+      "- Do not repeat the same angle inside one cadence window. Track the angle per slot and vary",
+      "  it deliberately.",
+      "- Build only from the brief, the content Works, and supplied signals. Never invent product",
+      "  claims or engagement numbers.",
+      "- Respect `cadence` exactly \u2014 proposing more slots than the operator configured is not",
+      "  ambition, it is a spam risk.",
+      "",
+      "## Output",
+      "Write `drafts` with the planned slot (channel + relative day) on each entry, plus a compact",
+      "calendar view of the window."
+    ].join("\n")
+  },
+  {
+    slug: "digest-compilation",
+    title: "Digest compilation",
+    description: "Compile collected signals into a recurring digest that separates facts from analysis and highlights change.",
+    stage: "draft",
+    tags: ["gtm", "marketing", "reporting", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "signals", description: "Signals collected this period." },
+      { key: "previous_digest", description: "The prior issue, used to compute what changed." },
+      { key: "focus_areas", description: "Sections the digest must cover." }
+    ],
+    outputs: [{ key: "drafts", description: "A digest draft: sections, change highlights, and a trend view." }],
+    allowedTools: [],
+    body: [
+      "Compile the period digest from the collected signals.",
+      "",
+      "## Rules",
+      "- One section per focus area, in the configured order, every issue. A stable shape is what",
+      "  makes a recurring digest readable.",
+      "- Every section splits FACTS (sourced, dated, linked) from ANALYSIS (your interpretation),",
+      "  under those labels.",
+      "- Lead with what CHANGED since `previous_digest`. Unchanged areas get one line, not a",
+      "  restatement of last issue.",
+      "- No fabrication and no padding: if a focus area produced no signal this period, write",
+      "  exactly that.",
+      "- Close with a short trend view over the recent periods \u2014 direction, not prophecy.",
+      "",
+      "## Output",
+      "Write `drafts` with a single digest entry for review."
+    ].join("\n")
+  },
+  // ── act ─────────────────────────────────────────────────────────────
+  {
+    slug: "crm-sync-hygiene",
+    title: "CRM sync hygiene",
+    description: "Prepare reviewed records for a customer-record sync: normalized fields, no duplicates, no destructive overwrites.",
+    stage: "act",
+    tags: ["gtm", "sales", "operations"],
+    version: VERSION,
+    inputs: [
+      { key: "approved_drafts", description: "Records cleared by the review gate." },
+      { key: "field_map", description: "Local field \u2192 destination field mapping." }
+    ],
+    outputs: [
+      { key: "action_log", description: "Prepared record writes with the field diff and the reason for each." }
+    ],
+    allowedTools: ["connector"],
+    body: [
+      "Prepare reviewed records for the destination system without losing data.",
+      "",
+      "## Rules",
+      "- Only records that passed the review gate are eligible. Nothing else, no exceptions.",
+      "- NEVER overwrite a populated destination field with an empty local value. Blank does not",
+      '  mean "clear it", it means "we do not know".',
+      "- Match before you create: search by the destination key (email, then domain + name) and",
+      "  update the existing record rather than minting a duplicate.",
+      "- Normalize on the way out \u2014 casing, phone format, domain form \u2014 per `field_map`.",
+      "- Record every intended write in `action_log` with its field-level diff BEFORE it is",
+      "  applied, so the change is auditable and reversible.",
+      "",
+      "## Output",
+      "Write `action_log` with one entry per record, status `prepared` or `skipped`, and the",
+      "reason for every skip."
+    ].join("\n")
+  },
+  // ── follow-up ───────────────────────────────────────────────────────
+  {
+    slug: "follow-up-cadence",
+    title: "Follow-up cadence",
+    description: "Schedule timed re-engagement for quiet threads, with strict caps and an unconditional stop on any reply.",
+    stage: "follow-up",
+    tags: ["gtm", "sales", "cadence"],
+    version: VERSION,
+    inputs: [
+      { key: "action_log", description: "What was prepared, for whom, and when." },
+      { key: "reply_state", description: "Which threads have received a reply." },
+      { key: "cadence", description: "Follow-up spacing and the maximum number of touches." }
+    ],
+    outputs: [
+      { key: "follow_up_queue", description: "Queued follow-ups with a due offset and the rationale for each." }
+    ],
+    allowedTools: [],
+    body: [
+      "Queue follow-ups for threads that have gone quiet.",
+      "",
+      "## Rules",
+      "- HARD STOP on any reply, bounce, or opt-out: that thread leaves the cadence immediately and",
+      "  permanently. This overrides every other rule here.",
+      "- Never exceed the configured maximum touches per contact, and never shorten the configured",
+      "  spacing to fit more in.",
+      "- Each follow-up must add something \u2014 a new angle, a new proof point, a genuine deadline.",
+      '  "Bumping this to the top of your inbox" is not a follow-up.',
+      "- Follow-ups are drafts like any other outbound: they re-enter the review gate before",
+      "  anything is prepared for delivery.",
+      "",
+      "## Output",
+      "Write `follow_up_queue` with `draftRef`, `channel`, `dueAfterDays`, and the rationale."
+    ].join("\n")
+  },
+  {
+    slug: "reply-detection",
+    title: "Reply detection",
+    description: "Classify inbound replies into interested / not-now / decline / opt-out and route each to the right next step.",
+    stage: "follow-up",
+    tags: ["gtm", "sales", "classification"],
+    version: VERSION,
+    inputs: [
+      { key: "inbound_messages", description: "Replies received against prepared outbound." },
+      { key: "action_log", description: "The outbound each reply responds to." }
+    ],
+    outputs: [
+      { key: "reply_state", description: "Per-thread classification, confidence, and the routing decision." }
+    ],
+    allowedTools: ["connector"],
+    body: [
+      "Classify each inbound reply and decide what happens to its thread.",
+      "",
+      "## Classes",
+      "`interested` \xB7 `not_now` \xB7 `decline` \xB7 `opt_out` \xB7 `auto_reply` \xB7 `unclear`",
+      "",
+      "## Rules",
+      "- `opt_out` and `decline` stop the cadence permanently. When in doubt between `opt_out` and",
+      "  anything else, choose `opt_out` \u2014 the cost of a wrong stop is far below the cost of a",
+      "  wrong send.",
+      "- `auto_reply` (out-of-office, autoresponder) does NOT count as a reply for cadence",
+      "  purposes, but it does update the contact record if it names a new owner.",
+      "- Use `unclear` rather than guessing; unclear threads route to a human, they do not route",
+      "  to the next touch.",
+      "- Record a confidence value and the phrase that drove the classification.",
+      "",
+      "## Output",
+      "Write `reply_state` with the class, confidence, evidence phrase, and routing decision per",
+      "thread."
+    ].join("\n")
+  },
+  // ── enrich ──────────────────────────────────────────────────────────
+  {
+    slug: "contact-enrichment",
+    title: "Contact enrichment",
+    description: "Backfill missing contact and account fields from verifiable sources, recording the evidence for each fill.",
+    stage: "enrich",
+    tags: ["gtm", "sales", "data"],
+    version: VERSION,
+    inputs: [
+      { key: "contacts", description: "Contacts with gaps to fill." },
+      { key: "enrichment_fields", description: "Which fields this run is allowed to fill." }
+    ],
+    outputs: [
+      { key: "enriched_contacts", description: "Contacts with filled fields and a source note per filled field." }
+    ],
+    allowedTools: ["search", "content-extractor", "connector"],
+    body: [
+      "Fill the requested gaps on each contact \u2014 and only those gaps.",
+      "",
+      "## Rules",
+      "- Evidence-bound: a field is filled ONLY when a source supports it, and the source goes in",
+      "  the contact notes alongside the value. No source, no fill.",
+      "- NEVER guess or pattern-generate an email address. Constructing `first.last@domain` because",
+      "  it usually works is fabrication, and it is the single most damaging thing this Skill can do.",
+      "- Never overwrite an existing non-empty value. Enrichment fills gaps; corrections are a",
+      "  human decision.",
+      "- Only touch fields named in `enrichment_fields`.",
+      "- When two sources disagree, leave the field empty and flag the conflict.",
+      "",
+      "## Output",
+      "Write `enriched_contacts` and report fill rate per field plus every conflict flagged."
+    ].join("\n")
+  },
+  // ── measure ─────────────────────────────────────────────────────────
+  {
+    slug: "seo-audit",
+    title: "Search-visibility audit",
+    description: "Audit a site or content Work for search visibility and return a prioritized, evidence-cited fix list.",
+    stage: "measure",
+    tags: ["gtm", "marketing", "seo", "audit"],
+    version: VERSION,
+    inputs: [
+      { key: "pages", description: "Pages or posts in scope, with their current metadata and headings." },
+      { key: "target_keywords", description: "Keywords or topics the Work is meant to rank for." },
+      { key: "previous_audit", description: "The prior audit, used to report movement and regressions." }
+    ],
+    outputs: [
+      { key: "campaign_report", description: "Prioritized findings with page reference, impact, and fix." }
+    ],
+    allowedTools: ["content-extractor", "search"],
+    body: [
+      "Audit the in-scope pages for search visibility and propose fixes.",
+      "",
+      "## What to check",
+      "Title and description metadata \xB7 heading structure and hierarchy \xB7 internal linking and",
+      "orphan pages \xB7 keyword coverage against `target_keywords` and the gaps between them \xB7",
+      "duplicate or thin content \xB7 canonical and indexability signals.",
+      "",
+      "## Rules",
+      "- Every finding cites the specific page or setting it applies to and states the expected",
+      "  impact. A finding without a page reference is an opinion.",
+      "- Return a prioritized top 5-10, quick wins first \u2014 not an exhaustive dump.",
+      "- Propose changes as reviewable edits or tasks. Never modify published pages directly.",
+      "- When `previous_audit` is present, report movement honestly, INCLUDING regressions. A",
+      "  clean report that hides a regression is worse than no report.",
+      "- No traffic or ranking projections. Estimate effort and impact qualitatively instead.",
+      "",
+      "## Output",
+      "Write `campaign_report` with the prioritized findings and the movement summary."
+    ].join("\n")
+  },
+  {
+    slug: "campaign-reporting",
+    title: "Campaign reporting",
+    description: "Summarize a campaign period into counted totals, honest insights, and concrete hints for the next cycle.",
+    stage: "measure",
+    tags: ["gtm", "reporting"],
+    version: VERSION,
+    inputs: [
+      { key: "action_log", description: "What the campaign prepared and skipped." },
+      { key: "reply_state", description: "How recipients responded." },
+      { key: "scored_contacts", description: "The qualified population the period worked from." }
+    ],
+    outputs: [{ key: "campaign_report", description: "Totals, insights, and next-cycle variant hints." }],
+    allowedTools: [],
+    body: [
+      "Report the campaign period and close the loop into the next one.",
+      "",
+      "## Rules",
+      "- Totals are COUNTED from the supplied data, never estimated: contacts, qualified, excluded,",
+      "  drafts, approved, prepared, follow-ups queued.",
+      "- State the denominator on every rate. A percentage without its base is not a metric.",
+      "- Below roughly 30 observations, report counts and refuse to draw a conclusion \u2014 small",
+      "  samples produce confident nonsense.",
+      "- Insights must be falsifiable and tied to a number in the totals.",
+      "- End with `nextVariantHints`: concrete, testable changes for the next draft cycle, one per",
+      "  line. This is the loop closing \u2014 a report that ends at description wasted the period.",
+      "",
+      "## Output",
+      "Write `campaign_report` with `summary`, `totals`, `insights`, and `nextVariantHints`."
+    ].join("\n")
+  },
+  {
+    slug: "engagement-analysis",
+    title: "Engagement analysis",
+    description: "Compare engagement across variants, channels, and segments, and say which differences are real.",
+    stage: "measure",
+    tags: ["gtm", "marketing", "reporting"],
+    version: VERSION,
+    inputs: [
+      { key: "engagement_events", description: "Per-item engagement observations for the period." },
+      { key: "drafts", description: "The variants the events belong to." },
+      { key: "comparison_window", description: "Prior period to compare against." }
+    ],
+    outputs: [
+      { key: "campaign_report", description: "Per-variant and per-segment engagement with a confidence call." }
+    ],
+    allowedTools: ["metrics"],
+    body: [
+      "Analyze engagement and report what actually differs.",
+      "",
+      "## Rules",
+      "- Compare like with like: same channel, same audience segment, comparable send window.",
+      "  Cross-channel comparisons need an explicit caveat.",
+      "- Report absolute counts alongside every rate.",
+      "- Say plainly when a difference is within noise. Declaring a winner on a handful of",
+      "  observations is the most common way this analysis misleads a campaign for months.",
+      "- Separate what changed (observation) from why (hypothesis), and label hypotheses as such.",
+      "- Surface the losing variants too \u2014 a variant that consistently underperforms is the",
+      "  cheapest thing to stop doing.",
+      "",
+      "## Output",
+      "Write `campaign_report` with the per-variant table, the segment breakdown, and an explicit",
+      "confidence statement per comparison."
+    ].join("\n")
+  }
+];
+var GTM_SKILL_SLUGS = GTM_SKILLS.map((skill) => skill.slug);
+var GTM_SKILL_BY_SLUG = new Map(
+  GTM_SKILLS.map((skill) => [skill.slug, skill])
+);
+var SKILL_READINESS_STATES = [
+  "ready",
+  "needs_setup",
+  "missing_requirements",
+  "blocked_by_access",
+  "unknown",
+  "check_failed"
+];
+var SKILL_CARD_STATES = [...SKILL_READINESS_STATES, "disabled", "needs_review"];
+var SKILL_READINESS_FILTERS = [...SKILL_CARD_STATES, "attention"];
+var FLEET_AGENT_CREDENTIAL_FAMILIES = [
+  {
+    cli: "claude-code",
+    // CLAUDE_CODE_OAUTH_TOKEN (a Claude plan) before ANTHROPIC_API_KEY
+    // (per-token Console billing) — deliberately the REVERSE of the CLI's
+    // own precedence, so the cheaper credential wins rather than the one
+    // that silently spends money.
+    envNames: ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"]
+  },
+  {
+    cli: "codex",
+    // CODEX_ACCESS_TOKEN draws the ChatGPT workspace entitlement;
+    // OPENAI_API_KEY is per-token platform billing.
+    envNames: ["CODEX_ACCESS_TOKEN", "OPENAI_API_KEY"]
+  }
+];
+var FLEET_AGENT_CREDENTIAL_ENV_NAMES = FLEET_AGENT_CREDENTIAL_FAMILIES.flatMap(
+  (family) => family.envNames
+);
+var FLEET_RUN_ENV_FILE_MAX_CONTENT_BYTES = 32 * 1024;
+var FLEET_RUN_ENV_FILES_MAX_TOTAL_BYTES = 256 * 1024;
+var FLEET_JOB_MAX_PAYLOAD_BYTES = 256 * 1024;
+var FLEET_JOB_MAX_RESULT_BYTES = 256 * 1024;
+var FLEET_JOB_DEFAULT_QUEUED_MAX_AGE_SEC = Object.freeze({
+  "agent-task": 24 * 60 * 60,
+  "acceptance-checks": 2 * 60 * 60,
+  "browser-check": 2 * 60 * 60,
+  // A live view nobody claimed is abandoned by the session service after
+  // 40 seconds, which cancels its job there and then. The queue SLA is only
+  // the backstop behind that, so it deliberately does not undercut the
+  // shortest existing default (the fallback an unknown kind fails closed to).
+  "computer-session": 2 * 60 * 60
+});
+var FLEET_JOB_MAX_QUEUED_MAX_AGE_SEC = 7 * 24 * 60 * 60;
+var FLEET_AGENT_EXECUTION_MAX_INSTRUCTIONS_BYTES = 160 * 1024;
+var FLEET_AGENT_TASK_QUESTION_MAX_FILE_BYTES = 64 * 1024;
+var FLEET_AGENT_TASK_QUESTION_MAX_CONTEXT_BYTES = 6 * 1024;
+var FLEET_MAX_DAILY_COST_CEILING_CENTS = 1e5 * 100;
+var FLEET_MAX_DISK_FREE_BYTES = 2 ** 60;
+var FLEET_DEFAULT_ENROLLMENT_TOKEN_TTL_MS = 15 * 6e4;
+var FLEET_DEFAULT_NODE_OFFLINE_AFTER_MS = 5 * 6e4;
+var FLEET_DEFAULT_NODE_OFFLINE_NOTICE_AFTER_MS = 30 * 6e4;
+var FLEET_DEFAULT_CREDENTIAL_ROTATION_OVERLAP_MS = 15 * 6e4;
+var FLEET_MAX_CREDENTIAL_ROTATION_OVERLAP_MS = 24 * 60 * 6e4;
+var EMAIL_INBOX_DEFAULT_DAILY_CAP = 100;
+var EMAIL_INBOX_BURST_SENDS = 10;
+var EMAIL_INBOX_BURST_RECIPIENTS = 20;
+var EMAIL_WORKSPACE_DAILY_CAP = 500;
+var EMAIL_WORKSPACE_MONTHLY_CAP = 1e4;
+var EMAIL_MAX_RECIPIENTS_PER_MESSAGE = 50;
+var EMAIL_SEND_CAP_RECOMMENDED_DEFAULTS = Object.freeze({
+  inboxDailySends: EMAIL_INBOX_DEFAULT_DAILY_CAP,
+  inboxBurstSends: EMAIL_INBOX_BURST_SENDS,
+  inboxBurstRecipients: EMAIL_INBOX_BURST_RECIPIENTS,
+  recipientsPerMessage: EMAIL_MAX_RECIPIENTS_PER_MESSAGE,
+  workspaceDailySends: EMAIL_WORKSPACE_DAILY_CAP,
+  workspaceMonthlySends: EMAIL_WORKSPACE_MONTHLY_CAP
+});
+var EMAIL_DAY_WINDOW_MS = 24 * 60 * 60 * 1e3;
+var EMAIL_MONTH_WINDOW_MS = 30 * EMAIL_DAY_WINDOW_MS;
+var EMAIL_INBOX_CAP_FIELDS = [
+  "inboxDailySends",
+  "inboxBurstSends",
+  "inboxBurstRecipients",
+  "recipientsPerMessage"
+];
+var EMAIL_SEND_CAP_FIELDS = [
+  ...EMAIL_INBOX_CAP_FIELDS,
+  "workspaceDailySends",
+  "workspaceMonthlySends"
+];
+var INBOX_CAP_FIELD_SET = new Set(EMAIL_INBOX_CAP_FIELDS);
+var DAY_MS2 = 24 * 60 * 60 * 1e3;
+var PROMOTION_GATE_DECISION_GRACE_MS = 20 * 60 * 1e3;
+var RELEASE_VERIFY_ATTEMPT_INTERVAL_MS = 10 * 60 * 1e3;
+var RELEASE_VERIFY_BUDGET_MS = 8 * 60 * 60 * 1e3;
+var MAX_CONVERSATION_BODY_BYTES = 16 * 1024;
+var CONNECTION_CREDENTIAL_ERROR_CODES = Object.freeze([
+  "credential_rejected",
+  "credential_missing",
+  "https_required"
+]);
+var CONNECTION_HEALTH_WARNING_CODES = Object.freeze([
+  "insecure_transport"
+]);
+var BACKUP_TRIM_POLICIES = Object.freeze({
+  activity: Object.freeze({ field: "createdAt", defaultDays: 365, fullHistoryDays: 1095 }),
+  runLogs: Object.freeze({ field: "createdAt", defaultDays: 90, fullHistoryDays: 1095 }),
+  terminalTranscripts: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 }),
+  notifications: Object.freeze({ field: "createdAt", defaultDays: 180, fullHistoryDays: 1095 }),
+  // `occurredAt`, not `createdAt`: `PluginUsageEvent` names its
+  // `@CreateDateColumn` `occurredAt` and has no `createdAt` at all. The trim
+  // resolver fails OPEN on an unknown column, so the wrong name here did not
+  // error — it silently exported every plugin usage event for the lifetime
+  // of the workspace, from the archive's single largest history table, while
+  // the docs page published a 180-day window.
+  pluginUsageEvents: Object.freeze({ field: "occurredAt", defaultDays: 180, fullHistoryDays: 1095 }),
+  deliveryLogs: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 }),
+  // `firedAt`, for the same reason: `InboundTriggerFire`'s creation
+  // timestamp is `firedAt` and it has no `createdAt`, so the declared
+  // 90-day window was never applied to `data/schedules/trigger-fires.jsonl`
+  // and the `schedules` domain reported `complete` where the docs promise a
+  // trim.
+  triggerFires: Object.freeze({ field: "firedAt", defaultDays: 90, fullHistoryDays: 1095 }),
+  retrievalTrail: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 }),
+  fleetJobs: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 })
+});
+var BACKUP_DOMAINS = Object.freeze([
+  Object.freeze({
+    key: "account",
+    restorability: "restorable",
+    collectorId: "account",
+    dataDir: "account"
+  }),
+  Object.freeze({
+    key: "organizations",
+    restorability: "restorable",
+    collectorId: "organizations",
+    dataDir: "organizations"
+  }),
+  Object.freeze({
+    key: "agents",
+    restorability: "restorable",
+    collectorId: "agents",
+    dataDir: "agents"
+  }),
+  Object.freeze({
+    key: "missions",
+    restorability: "restorable",
+    collectorId: "missions",
+    dataDir: "missions"
+  }),
+  Object.freeze({
+    key: "tasks",
+    restorability: "restorable",
+    collectorId: "tasks",
+    dataDir: "tasks"
+  }),
+  Object.freeze({
+    key: "works",
+    restorability: "restorable",
+    collectorId: "works",
+    dataDir: "works"
+  }),
+  Object.freeze({
+    key: "knowledge",
+    restorability: "restorable",
+    collectorId: "knowledge",
+    dataDir: "knowledge"
+  }),
+  Object.freeze({
+    key: "schedules",
+    restorability: "restorable",
+    collectorId: "schedules",
+    dataDir: "schedules"
+  }),
+  Object.freeze({
+    key: "runs",
+    restorability: "record-only",
+    collectorId: "runs",
+    dataDir: "runs"
+  }),
+  Object.freeze({
+    key: "decisions",
+    restorability: "record-only",
+    collectorId: "decisions",
+    dataDir: "decisions"
+  }),
+  Object.freeze({
+    key: "communication",
+    restorability: "partly-restorable",
+    collectorId: "communication",
+    dataDir: "communication"
+  }),
+  Object.freeze({
+    key: "connections",
+    restorability: "restorable",
+    collectorId: "connections",
+    dataDir: "connections"
+  }),
+  Object.freeze({
+    key: "fleet",
+    restorability: "partly-restorable",
+    collectorId: "fleet",
+    dataDir: "fleet"
+  }),
+  Object.freeze({
+    key: "billing",
+    restorability: "record-only",
+    collectorId: "billing",
+    dataDir: "billing"
+  }),
+  Object.freeze({
+    key: "activity",
+    restorability: "record-only",
+    collectorId: "activity",
+    dataDir: "activity",
+    trim: BACKUP_TRIM_POLICIES.activity
+  })
+]);
+var BACKUP_DOMAIN_KEYS = Object.freeze(BACKUP_DOMAINS.map((domain) => domain.key));
+var BACKUP_DOMAIN_COUNT = BACKUP_DOMAINS.length;
+var BACKUP_EXCLUSIONS = Object.freeze([
+  Object.freeze({
+    code: "auth_tokens",
+    summary: "Password hashes, password-reset tokens, magic-link tokens and email-verification tokens."
+  }),
+  Object.freeze({
+    code: "sessions",
+    summary: "Sessions, refresh tokens, and third-party auth provider access and refresh tokens."
+  }),
+  Object.freeze({
+    code: "api_key_material",
+    summary: "API key material. Keys appear as name, prefix, created date and active flag only."
+  }),
+  Object.freeze({
+    code: "stored_credentials",
+    summary: "Every stored credential, in plaintext or ciphertext \u2014 plugin secrets, connection headers, deployment secrets, webhook and trigger signing secrets, and encrypted runtime credentials. Only the names of the fields that were set are exported."
+  }),
+  Object.freeze({
+    code: "node_enrolment_secrets",
+    summary: "Node enrolment and heartbeat secrets."
+  }),
+  Object.freeze({
+    code: "payment_identifiers",
+    summary: "Payment-provider customer, subscription, payment-method and meter identifiers."
+  }),
+  Object.freeze({
+    code: "platform_admin_flag",
+    summary: "The platform-administrator flag."
+  }),
+  Object.freeze({
+    code: "vector_embeddings",
+    summary: "Vector embeddings and their coordinates, because they are derived and regenerate on demand."
+  }),
+  Object.freeze({
+    code: "internal_caches",
+    summary: "Internal caches and the delivery outbox."
+  })
+]);
+var BACKUP_DEFAULT_LIMITS = Object.freeze({
+  /** Ready archives kept for this long before their bytes are deleted. */
+  retentionDays: 14,
+  /** The record outlives its bytes by this long, so history stays legible. */
+  recordRetentionDays: 90,
+  /** Ready outcomes allowed per rolling 24 hours. Failures do not count. */
+  dailyAllowance: 3,
+  /** Rows the history list shows before "Show all". */
+  historyPageSize: 20,
+  /** Hard ceiling on a single history page. */
+  historyPageLimit: 50,
+  /** Bytes of one uploaded file that may be carried (200 MiB). */
+  maxFileBytes: 200 * 1024 * 1024,
+  /** Bytes of uploaded files in total (2 GiB). */
+  maxAttachmentBytes: 2 * 1024 * 1024 * 1024,
+  /** Bytes the finished archive may not exceed with a streaming backend (5 GiB). */
+  maxArchiveBytes: 5 * 1024 * 1024 * 1024,
+  /**
+   * The ceiling when the active storage backend cannot accept a stream and
+   * the archive has to be handed over as one buffer (512 MiB). A backend
+   * without streaming is a smaller limit, never a wrong result.
+   */
+  maxBufferedArchiveBytes: 512 * 1024 * 1024,
+  /** A manifest larger than this is refused by the check without being read (8 MiB). */
+  maxManifestBytes: 8 * 1024 * 1024,
+  /** Minutes a download link stays valid before the client re-mints it. */
+  downloadLinkTtlMinutes: 15,
+  /** Minutes without a heartbeat before a running backup is called stalled. */
+  stallMinutes: 10,
+  /** Minutes a queued backup may wait before it is called stalled. */
+  queuedStallMinutes: 15,
+  /** Minutes a backup may run before it is stopped. */
+  timeoutMinutes: 60,
+  /** Retries a single domain gets before it is marked failed and the archive finishes without it. */
+  domainRetries: 2,
+  /** Retries a storage write gets before the backup fails as `storage_unavailable`. */
+  storageRetries: 3
+});
+var HOUR_MS = 60 * 60 * 1e3;
+var MINUTE_MS = 60 * 1e3;
+var ACTION_CATEGORIES = Object.freeze([
+  "read.internal",
+  "read.external",
+  "write.internal",
+  "write.destructive",
+  "message.internal",
+  "message.external",
+  "publish.external",
+  "spend.metered",
+  "spend.commitment",
+  "access.grant",
+  "machine.run",
+  "machine.admin",
+  "agent.fanout"
+]);
+var LADDERED_CATEGORIES = Object.freeze(
+  ACTION_CATEGORIES.filter((c) => c !== "read.internal")
+);
+var DRAFTABLE_CATEGORIES = Object.freeze([
+  "write.internal",
+  "write.destructive",
+  "message.external",
+  "publish.external",
+  "machine.run",
+  "machine.admin"
+]);
+var ACTION_CATEGORY_CEILING = Object.freeze({
+  "read.external": "auto",
+  "write.internal": "auto",
+  "write.destructive": "ask",
+  "message.internal": "auto",
+  "message.external": "ask",
+  "publish.external": "ask",
+  "spend.metered": "auto",
+  "spend.commitment": "off",
+  "access.grant": "ask",
+  "machine.run": "auto",
+  "machine.admin": "ask",
+  "agent.fanout": "auto"
+});
+var ACTION_CATEGORY_DEFAULT = Object.freeze({
+  "read.external": "auto",
+  "write.internal": "auto",
+  "write.destructive": "ask",
+  "message.internal": "auto",
+  "message.external": "draft",
+  "publish.external": "ask",
+  "spend.metered": "auto",
+  "spend.commitment": "off",
+  "access.grant": "ask",
+  "machine.run": "ask",
+  "machine.admin": "ask",
+  "agent.fanout": "ask"
+});
+var ACTION_CATEGORY_RESTRICTIVENESS = Object.freeze([
+  "spend.commitment",
+  "access.grant",
+  "machine.admin",
+  "publish.external",
+  "message.external",
+  "write.destructive",
+  "machine.run",
+  "agent.fanout",
+  "spend.metered",
+  "write.internal",
+  "message.internal",
+  "read.external",
+  "read.internal"
+]);
+var ACTION_CATEGORY_I18N_KEY = Object.freeze({
+  "read.internal": "readInternal",
+  "read.external": "readExternal",
+  "write.internal": "writeInternal",
+  "write.destructive": "writeDestructive",
+  "message.internal": "messageInternal",
+  "message.external": "messageExternal",
+  "publish.external": "publishExternal",
+  "spend.metered": "spendMetered",
+  "spend.commitment": "spendCommitment",
+  "access.grant": "accessGrant",
+  "machine.run": "machineRun",
+  "machine.admin": "machineAdmin",
+  "agent.fanout": "agentFanout"
+});
+var TRUST_RUNG_ORDER = Object.freeze([
+  "off",
+  "draft",
+  "ask",
+  "auto"
+]);
+var SAFETY_RAIL_ORDER = Object.freeze([
+  "platform-stop",
+  "workspace-pause",
+  "scope-pause",
+  "grants",
+  "ladder",
+  "caps",
+  "rules"
+]);
+var SAFETY_REASON_CODES = Object.freeze([
+  "platform-stopped",
+  "workspace-paused",
+  "scope-paused",
+  "rung-off",
+  "rung-held",
+  "ceiling-refused",
+  "cap-reached",
+  "grant-denied",
+  "rule-blocked",
+  "policy-refused",
+  "unclassified-action",
+  "instruction-widening-attempt",
+  "non-human-actor",
+  "safe-mode"
+]);
+var SAFETY_ALLOW = Object.freeze({
+  decision: "allow",
+  railId: null,
+  category: null,
+  rung: null,
+  reasonCode: null,
+  summary: null
+});
+var AUTONOMY_GRANT_SCOPE_PRECEDENCE = Object.freeze([
+  "workspace",
+  "agent"
+]);
+var RAIL_REFUSAL_SUBJECT_TYPES = Object.freeze([
+  "run",
+  "agent",
+  "mission",
+  "task",
+  "schedule",
+  "trigger"
+]);
+var WORKSPACE_RUNNING = Object.freeze({
+  paused: false,
+  unverified: false,
+  reason: null,
+  pausedByUserId: null,
+  pausedAt: null,
+  refusedStarts: 0,
+  cleanlyStopped: 0
+});
+var WORKSPACE_PAUSED_UNVERIFIED = Object.freeze({
+  paused: true,
+  unverified: true,
+  reason: null,
+  pausedByUserId: null,
+  pausedAt: null,
+  refusedStarts: 0,
+  cleanlyStopped: 0
+});
+var READINESS_BLOCKERS = Object.freeze([
+  "at-ceiling",
+  "too-few-decisions",
+  "approval-rate",
+  "withdrawn",
+  "other-refusals"
+]);
+
+// ../../plugin/dist/index.js
+var DEFAULT_DIFF_MAX_BYTES = 256 * 1024;
+var HARD_DIFF_MAX_BYTES = 1024 * 1024;
+var PLUGIN_CAPABILITIES = {
+  AI_PROVIDER: "ai-provider",
+  SEARCH: "search",
+  SCREENSHOT: "screenshot",
+  CONTENT_EXTRACTOR: "content-extractor",
+  DATA_SOURCE: "data-source",
+  PIPELINE: "pipeline",
+  PIPELINE_MODIFIER: "pipeline-modifier",
+  CODE_EDIT: "code-edit",
+  FORM_SCHEMA_PROVIDER: "form-schema-provider",
+  DEPLOYMENT: "deployment",
+  GIT_PROVIDER: "git-provider",
+  OAUTH: "oauth",
+  DEVICE_AUTH: "device-auth",
+  PROMPT_PROVIDER: "prompt-provider",
+  // EW-637 — pluggable object storage. `put-object` + `get-object` are the
+  // floor; `presigned-put` is opt-in for backends that can hand the
+  // browser a direct-upload URL (S3, MinIO).
+  STORAGE: "storage",
+  PUT_OBJECT: "put-object",
+  GET_OBJECT: "get-object",
+  PRESIGNED_PUT: "presigned-put",
+  // Agents/Skills/Tasks PR #1017 — Phase 8 (ADR-012). Plugin
+  // category for Skill catalog providers. "Ever Works Skills" is
+  // the first-party default; community plugins implement the same
+  // `ISkillsProviderPlugin` contract to surface other catalogs.
+  SKILLS_PROVIDER: "skills-provider",
+  // Agents/Skills/Tasks PR #1017 — Phase 11 (ADR-013). Plugin
+  // category for external task trackers. "Ever Works Task Tracker"
+  // is the first-party default. Community plugins (Linear / Jira /
+  // GitHub Issues) implement the same contract.
+  TASK_TRACKER: "task-tracker",
+  // Notifications v2 (EW-650) — Email Providers. Plugins MAY declare
+  // `EMAIL_OUTBOUND`, `EMAIL_INBOUND`, or both. See
+  // `capabilities/email-provider.interface.ts` for the contract.
+  EMAIL_OUTBOUND: "email-outbound",
+  EMAIL_INBOUND: "email-inbound",
+  // Notifications v2 (sibling of EW-650) — Notification Channels.
+  // Plugins declare `NOTIFICATION_CHANNEL` (umbrella) plus the
+  // channel-specific constant for plugin discovery + UI grouping.
+  // See `capabilities/notification-channel.interface.ts`.
+  NOTIFICATION_CHANNEL: "notification-channel",
+  NOTIFICATION_CHANNEL_DISCORD: "notification-channel-discord",
+  NOTIFICATION_CHANNEL_SLACK: "notification-channel-slack",
+  NOTIFICATION_CHANNEL_TELEGRAM: "notification-channel-telegram",
+  NOTIFICATION_CHANNEL_WHATSAPP: "notification-channel-whatsapp",
+  NOTIFICATION_CHANNEL_NOVU: "notification-channel-novu",
+  // Connectors ("Connector fabric") — first-party BIDIRECTIONAL
+  // communication-channel plugins. Each connector declares `CONNECTOR`
+  // (umbrella, for discovery/grouping) plus its `CONNECTOR_<provider>`
+  // constant. Superset of the outbound-only notification channels; see
+  // `capabilities/connector.interface.ts`.
+  CONNECTOR: "connector",
+  CONNECTOR_SLACK: "connector-slack",
+  CONNECTOR_DISCORD: "connector-discord",
+  CONNECTOR_WHATSAPP: "connector-whatsapp",
+  CONNECTOR_LINEAR: "connector-linear",
+  CONNECTOR_NOTION: "connector-notion",
+  CONNECTOR_MICROSOFT_365: "connector-microsoft-365",
+  // CRM / enrichment connectors — first-party native connectors over
+  // the vendors' own Node SDKs. Outbound writes CRM records/notes,
+  // the event-source leg streams record changes into the ingest spine.
+  CONNECTOR_HUBSPOT: "connector-hubspot",
+  CONNECTOR_PIPEDRIVE: "connector-pipedrive",
+  // Social connectors — public-timeline surfaces. Outbound publishes a
+  // post; the event-source leg streams mentions/replies + the account's
+  // own timeline into the ingest spine.
+  CONNECTOR_BLUESKY: "connector-bluesky",
+  CONNECTOR_MASTODON: "connector-mastodon",
+  // Pluggable persistent memory for AI coding / generation agents.
+  // First-party implementation: `@ever-works/agentmemory-plugin`
+  // (talks to the `agentmemory` standalone Node server on :3111 —
+  // runs locally OR hosted via a configurable `baseUrl` + bearer
+  // token). Community plugins (mem0, zep, langmem) implement the
+  // same `IAgentMemoryPlugin` contract.
+  AGENT_MEMORY: "agent-memory",
+  // Goals feature PR-7 — read-only metrics collectors. First-party
+  // providers: `custom-http` (GET-only, SSRF-guarded) and `stripe`
+  // (official SDK; balance + income windows). See
+  // `capabilities/metrics-provider.interface.ts` for the contract.
+  METRICS_PROVIDER: "metrics-provider",
+  // Streaming-terminal session hosts (Wave 1 M5). First-party:
+  // pty-local (node-pty in the executing job-runtime worker, with a
+  // child_process pipe floor). Future: pty-ssh (user's own box),
+  // k8s-exec. See capabilities/terminal-stream.interface.ts.
+  TERMINAL_STREAM: "terminal-stream",
+  // Isolated git working contexts for agent Tasks (Wave 2).
+  WORKSPACE: "workspace",
+  // Headless browser drivers (audit item G22). navigate / extract /
+  // screenshot / act, headless by default, behind a default-deny
+  // navigation allowlist re-checked on every redirect hop. First-party:
+  // `browser-automation` (Playwright). See
+  // capabilities/browser-automation.interface.ts.
+  BROWSER_AUTOMATION: "browser-automation",
+  // Event-ingest spine (Wave 6) — plugins that pull/push normalized
+  // external events into the platform ingest pipeline. See
+  // capabilities/event-source.interface.ts.
+  EVENT_SOURCE: "event-source",
+  // Capability & playbook catalogue (AW-21) — plugins that supply Playbook
+  // catalogue entries (packaged outcomes: trigger, steps, required
+  // capabilities, artefacts, escalation points). Consumed only through
+  // PlaybookCatalogFacadeService. See
+  // capabilities/playbook-provider.interface.ts.
+  PLAYBOOK_PROVIDER: "playbook-provider",
+  // AW-15 — optional access-level declaration ("Read only" / "Read and
+  // write") mapped onto the tool-grant lattice. Declared alongside a
+  // provider's main capability; see
+  // capabilities/connection-scopes.interface.ts.
+  CONNECTION_SCOPES: "connection-scopes",
+  // App Works (APW-07 T3) — App dependency providers: the `k8s` plugin serves
+  // the three in-cluster ids, `app-dependencies-external` the external ones,
+  // and P2's `apps-tier-dependencies` the managed ones. Consumed only through
+  // `AppDependencyFacadeService`; see
+  // capabilities/app-dependency.interface.ts.
+  APP_DEPENDENCY: "app-dependency",
+  // App Works (APW-05 T2) — producing a container image from a commit. The
+  // `github-actions-build` plugin declares it (`IBuildPlugin`, `buildKind
+  // 'github-actions'`), and P3's `apps-builder` declares the same capability
+  // with the other `buildKind`. Consumed only through `BuildFacadeService`
+  // (APW-05 T16); see `capabilities/build.interface.ts`. Resolution R-13 keeps
+  // `build` a CAPABILITY while the strategy (`dockerfile` / `image` / `auto` /
+  // `none`) stays the App spec's own choice.
+  BUILD: "build",
+  // App Works (APW-12 T4) — the Ever ID relying-party capability. The
+  // `oidc-identity` plugin declares it (APW-12 T5/T6), and it is consumed only
+  // through `IdentityProviderFacadeService` (APW-12 plan §4.4); see
+  // `capabilities/identity-provider.interface.ts`. Appended after `build`, and
+  // landed in the same change as the `identity` category in
+  // `plugin-manifest.types.ts` — a plugin contract with no category to be
+  // discovered under is a manifest the loader rejects.
+  IDENTITY_PROVIDER: "identity-provider",
+  // App Works (APW-10 T2) — the managed hosting tier's zone capability. The
+  // `ever-works-apps` plugin declares it together with `deployment`
+  // (plan §5.2:602) and is consumed only through `AppsTierFacadeService`
+  // (APW-10 plan §5.3:655); see `capabilities/apps-tier.interface.ts`.
+  // Appended after `identity-provider`, and appended **last** on purpose:
+  // every existing constant keeps its value and its position, because the
+  // capability list is an append-only surface — a member that moves silently
+  // changes what a persisted manifest means. Deliberately NOT paired with a
+  // new category: the tier's plugin is a `deployment` plugin, so
+  // `PLUGIN_CATEGORIES` is untouched and every exhaustive map over it in
+  // `apps/web` stays total.
+  APPS_TIER: "apps-tier"
+};
+var ALL_PLUGIN_CAPABILITIES = Object.values(PLUGIN_CAPABILITIES);
+var IdentityTokenRejectedError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "IdentityTokenRejectedError";
+  }
+};
+var ITEM_SCHEMA_PROMPT_TEXT = `
+Each item must be a JSON file with the following structure:
+
+{
+  "name": "string (required) - The item's canonical display name",
+  "description": "string (required) - A concise, informative summary of the item and its relevance to the work topic (2-4 sentences). Generate from page content if not directly available.",
+  "source_url": "string (required) - The most direct, canonical URL for the item itself (homepage or official page). Must be real and working. Never use blog posts or articles *about* the item.",
+  "category": "string (required) - ONE primary category based on the item's core function (e.g., 'Monitoring', 'CI/CD', 'Data Visualization')",
+  "tags": ["string"] - 1-3 specific, descriptive tags (e.g., "open-source", "real-time", "cloud-native"),
+  "featured": boolean - Whether this is a notable/featured item (optional, default false),
+  "slug": "string - URL-friendly identifier (optional, auto-generated from name if omitted)",
+  "brand": "string - At most one brand/company name per item (optional)",
+  "brand_logo_url": "string - Canonical logo URL from official domain, prefer SVG/PNG (optional)",
+  "images": ["string"] - Multiple high-quality image URLs (screenshots, product imagery) from official sources (optional),
+  "markdown": "string - Detailed product/service information in markdown: features, pricing, use cases (see Markdown Rules below). Do not repeat category, tags, or other metadata fields."
+}
+
+Required fields: name, description, source_url, category
+
+### Example
+
+\`\`\`json
+{
+  "name": "Prometheus",
+  "description": "Open-source monitoring and alerting toolkit designed for reliability and scalability, widely adopted in cloud-native environments.",
+  "source_url": "https://prometheus.io",
+  "category": "Monitoring",
+  "tags": ["open-source", "metrics", "cloud-native"],
+  "featured": false,
+  "brand": "Cloud Native Computing Foundation",
+  "brand_logo_url": "https://www.cncf.io/wp-content/uploads/2022/07/cncf-color-bg.svg",
+  "images": ["https://prometheus.io/assets/architecture.png"],
+  "markdown": "## Overview\\n\\nPrometheus is an open-source systems monitoring and alerting toolkit originally built at SoundCloud.\\n\\n## Features\\n\\n- Multi-dimensional data model with time series data identified by metric name and key/value pairs\\n- PromQL, a flexible query language\\n- No reliance on distributed storage; single server nodes are autonomous\\n- Time series collection via a pull model over HTTP\\n- Targets discovered via service discovery or static configuration\\n\\n## Pricing\\n\\nFree and open-source under the Apache 2.0 license."
+}
+\`\`\`
+`.trim();
+
+// src/oidc-identity.plugin.ts
+import {
+  ClientSecretBasic,
+  Configuration,
+  allowInsecureRequests,
+  buildAuthorizationUrl,
+  calculatePKCECodeChallenge
+} from "openid-client";
+
+// src/discovery.ts
+var OIDC_OUTBOUND_TIMEOUT_MS = 5e3;
+var OIDC_OUTBOUND_RETRY_DELAY_MS = 1e3;
+var OIDC_OUTBOUND_MAX_ATTEMPTS = 2;
+var OIDC_DISCOVERY_CACHE_SECONDS = 3600;
+var OIDC_JWKS_CACHE_SECONDS = 600;
+var OIDC_JWKS_UNKNOWN_KID_COOLDOWN_SECONDS = 30;
+var OIDC_JWKS_MAX_STALE_SECONDS = 21600;
+var OIDC_IDENTITY_SIGNING_ALGS = ["RS256", "ES256", "EdDSA"];
+var OidcProviderUnavailableError = class extends Error {
+  constructor(reason) {
+    super("providerUnavailable");
+    this.reason = reason;
+    this.code = "providerUnavailable";
+    this.name = "OidcProviderUnavailableError";
+  }
+};
+var oidcDefaultFetch = (url, init) => fetch(url, init);
+async function fetchJsonOnce(request, options = {}) {
+  const now = options.now ?? Date.now;
+  const startedAt = now();
+  const attempts = { count: 0 };
+  const work = (async () => {
+    attempts.count += 1;
+    return {
+      ...await readJsonOnce(
+        request,
+        options.fetchImpl ?? oidcDefaultFetch,
+        options.timeoutMs ?? OIDC_OUTBOUND_TIMEOUT_MS
+      ),
+      attempts: attempts.count
+    };
+  })();
+  if (options.deadlineAt === void 0) return work;
+  const remaining = Math.max(0, options.deadlineAt - startedAt);
+  return settleWithin(work, remaining, () => ({ ok: false, failure: "timeout", attempts: attempts.count }));
+}
+async function fetchJsonWithOneRetry(request, options = {}) {
+  const now = options.now ?? Date.now;
+  const startedAt = now();
+  const attempts = { count: 0 };
+  const work = attemptJsonFetch(request, options, attempts);
+  if (options.deadlineAt === void 0) return work;
+  const remaining = Math.max(0, options.deadlineAt - startedAt);
+  return settleWithin(work, remaining, () => ({ ok: false, failure: "timeout", attempts: attempts.count }));
+}
+async function attemptJsonFetch(request, options, attempts) {
+  const now = options.now ?? Date.now;
+  const timeoutMs = options.timeoutMs ?? OIDC_OUTBOUND_TIMEOUT_MS;
+  const retryDelayMs = options.retryDelayMs ?? OIDC_OUTBOUND_RETRY_DELAY_MS;
+  const deadlineAt = options.deadlineAt;
+  let last = { ok: false, failure: "timeout", attempts: 0 };
+  try {
+    for (let attempt = 1; attempt <= OIDC_OUTBOUND_MAX_ATTEMPTS; attempt += 1) {
+      if (attempt > 1) {
+        if (deadlineAt !== void 0 && now() + retryDelayMs >= deadlineAt) break;
+        await delayFor(retryDelayMs);
+      }
+      if (deadlineAt !== void 0 && now() >= deadlineAt) break;
+      const perAttemptMs = deadlineAt === void 0 ? timeoutMs : Math.max(1, Math.min(timeoutMs, deadlineAt - now()));
+      attempts.count = attempt;
+      last = {
+        ...await readJsonOnce(request, options.fetchImpl ?? oidcDefaultFetch, perAttemptMs),
+        attempts: attempt
+      };
+      if (last.ok) return last;
+    }
+  } catch {
+  }
+  return { ...last, attempts: attempts.count };
+}
+async function readJsonOnce(request, fetchImpl, timeoutMs) {
+  const controller = new AbortController();
+  const timer = scheduleTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(request.url, {
+      signal: controller.signal,
+      method: request.method ?? "GET",
+      ...request.body === void 0 ? {} : { body: request.body },
+      headers: {
+        accept: "application/json",
+        ...request.contentType === void 0 ? {} : { "content-type": request.contentType },
+        ...request.headers
+      }
+    });
+    if (!response || typeof response.status !== "number" || response.ok !== true) {
+      return { ok: false, failure: "httpStatus", status: response?.status };
+    }
+    try {
+      return { ok: true, status: response.status, body: await response.json() };
+    } catch {
+      return { ok: false, failure: "invalidBody", status: response.status };
+    }
+  } catch {
+    return { ok: false, failure: controller.signal.aborted ? "timeout" : "network" };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function settleWithin(work, ms, fallback) {
+  return new Promise((resolve) => {
+    const timer = scheduleTimeout(() => resolve(fallback()), ms);
+    const done = (value) => {
+      clearTimeout(timer);
+      resolve(value);
+    };
+    work.then(done, () => done(fallback()));
+  });
+}
+function scheduleTimeout(callback, ms) {
+  const timer = setTimeout(callback, ms);
+  const unref = timer.unref;
+  if (typeof unref === "function") unref.call(timer);
+  return timer;
+}
+function delayFor(ms) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve) => {
+    scheduleTimeout(resolve, ms);
+  });
+}
+function buildDiscoveryUrl(issuerUrl) {
+  const url = new URL(issuerUrl);
+  url.pathname = `${url.pathname.replace(/\/+$/, "")}/.well-known/openid-configuration`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+var OidcDiscoveryReader = class {
+  constructor(options) {
+    this.options = options;
+    this.document = null;
+    this.fetchedAtMs = null;
+  }
+  /** The configured issuer this reader answers for (FR-7: one issuer set per installation). */
+  get issuerUrl() {
+    return this.options.issuerUrl;
+  }
+  /**
+   * When the last successful read happened, in epoch ms, or `null`.
+   *
+   * This is the in-process source of plan §4.2's `availability.discoveryRefreshedAt`
+   * and of plan §9.1's health view; T32 persists it.
+   */
+  get lastRefreshedAt() {
+    return this.fetchedAtMs;
+  }
+  /** The cached document while FR-14's 3,600 seconds have not elapsed, else `null`. */
+  cachedDocument() {
+    if (this.document === null || this.fetchedAtMs === null) return null;
+    const cacheMs = (this.options.cacheSeconds ?? OIDC_DISCOVERY_CACHE_SECONDS) * 1e3;
+    return this.now() - this.fetchedAtMs < cacheMs ? this.document : null;
+  }
+  /**
+   * Read the document from the provider now (FR-3's read, FR-14's 3,600-second cache
+   * entry point).
+   *
+   * A successful read replaces the cache even when the issuer drifts: the drift is
+   * what an administrator needs to see, and {@link get} refuses it either way.
+   */
+  async read(options = {}) {
+    let url;
+    try {
+      url = buildDiscoveryUrl(this.options.issuerUrl);
+    } catch {
+      return { ok: false, failure: "invalidIssuer", attempts: 0 };
+    }
+    const result = await fetchJsonWithOneRetry(
+      { url },
+      {
+        fetchImpl: this.options.fetchImpl,
+        now: this.options.now,
+        timeoutMs: this.options.timeoutMs,
+        retryDelayMs: this.options.retryDelayMs,
+        deadlineAt: options.deadlineAt
+      }
+    );
+    if (!result.ok) {
+      return {
+        ok: false,
+        failure: result.failure ?? "network",
+        attempts: result.attempts,
+        status: result.status
+      };
+    }
+    const document = asDiscoveryDocument(result.body);
+    if (document === null) {
+      return { ok: false, failure: "invalidDocument", attempts: result.attempts, status: result.status };
+    }
+    const fetchedAt = this.now();
+    this.document = document;
+    this.fetchedAtMs = fetchedAt;
+    return {
+      ok: true,
+      document,
+      fetchedAt,
+      issuerMatches: document.issuer === this.options.issuerUrl,
+      attempts: result.attempts
+    };
+  }
+  /**
+   * The document, from the cache while it is fresh and from the provider once it is
+   * not (FR-14). Throws {@link OidcProviderUnavailableError} rather than returning
+   * `null`: every caller of this method is on a path that must not continue without
+   * a document.
+   */
+  async get() {
+    const cached = this.cachedDocument();
+    if (cached !== null) {
+      this.assertIssuerMatches(cached);
+      return cached;
+    }
+    const read = await this.read();
+    if (!read.ok) throw new OidcProviderUnavailableError("discoveryFailed");
+    this.assertIssuerMatches(read.document);
+    return read.document;
+  }
+  /** FR-14: a different issuer turns sign-in off until an administrator re-tests. */
+  assertIssuerMatches(document) {
+    if (document.issuer !== this.options.issuerUrl) throw new OidcProviderUnavailableError("issuerDrift");
+  }
+  now() {
+    return (this.options.now ?? Date.now)();
+  }
+};
+function asDiscoveryDocument(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const candidate = value;
+  if (typeof candidate.issuer !== "string" || candidate.issuer.length === 0) return null;
+  return value;
+}
+
+// src/jwks-cache.ts
+import { compactVerify, createLocalJWKSet, decodeProtectedHeader, errors } from "jose";
+var OidcJwksVerificationError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "OidcJwksVerificationError";
+  }
+};
+var OidcJwksCache = class {
+  constructor(options) {
+    this.options = options;
+    this.jwks = null;
+    this.resolveKey = null;
+    this.refreshedAtMs = null;
+    this.lastAttemptAtMs = null;
+    this.lastUnknownKidRefreshAtMs = null;
+    this.lastFailure = null;
+    this.availableKeyCount = 0;
+  }
+  /**
+   * When the last **successful** fetch happened, in epoch ms, or `null`.
+   *
+   * FR-13's staleness clock starts here: an attempt that failed does not move
+   * this value, which is exactly why cached keys survive a provider outage.
+   */
+  get lastRefreshedAt() {
+    return this.refreshedAtMs;
+  }
+  /** When the last fetch was **attempted**, successful or not, or `null`. */
+  get lastAttemptAt() {
+    return this.lastAttemptAtMs;
+  }
+  /** Why the last fetch failed, or `null` when the last one succeeded. */
+  get lastFetchFailure() {
+    return this.lastFailure;
+  }
+  /** How many keys the cached set holds; `0` until the first successful fetch. */
+  get keyCount() {
+    return this.availableKeyCount;
+  }
+  /**
+   * Verify a compact JWS against the cached key set, and answer its claims.
+   *
+   * The order is the plan §4.3 order and each step is load-bearing:
+   *
+   *   1. the protected header must parse (a truncated token is `badSignature`);
+   *   2. `alg` must be one of FR-11's three — `none` and `HS256` are refused
+   *      **before** any key lookup, so a token can never talk us into treating a
+   *      public key as a shared secret;
+   *   3. the key comes from the cache, refreshing once under FR-13's rules;
+   *   4. `compactVerify` checks the signature, with the same allow-list handed to
+   *      it so the two can never disagree.
+   *
+   * Claim rules are the caller's (see the class docstring).
+   */
+  async verify(token) {
+    const header = decodeProtectedHeaderOrNull(token);
+    if (header === null) throw new OidcJwksVerificationError("badSignature");
+    const algorithms = this.algorithms();
+    const alg = header.alg;
+    if (typeof alg !== "string" || !algorithms.includes(alg)) {
+      throw new OidcJwksVerificationError("badAlg");
+    }
+    const key = await this.resolveSigningKey(header, token);
+    try {
+      const { payload } = await compactVerify(token, key, { algorithms: [...algorithms] });
+      return {
+        header,
+        payload: JSON.parse(new TextDecoder().decode(payload)),
+        kid: typeof header.kid === "string" ? header.kid : null
+      };
+    } catch {
+      throw new OidcJwksVerificationError("badSignature");
+    }
+  }
+  /**
+   * The key for a token's header, refreshing at most once when the `kid` is unknown
+   * (FR-13).
+   *
+   * A `kid` nobody published cannot be served from the cache, and the two ways out
+   * are ranked: refresh if FR-13's cooldown allows it, and otherwise refuse. A
+   * refusal is `badSignature` — never `providerUnavailable` — while the cached set
+   * is still inside its 21,600 seconds, because the set *is* trustworthy and the
+   * token is simply not signed by anything in it.
+   */
+  async resolveSigningKey(header, token) {
+    await this.ensureUsableKeySet();
+    const direct = await this.findKey(header, token);
+    if (direct !== null) return direct;
+    if (this.canRefreshForUnknownKid()) {
+      this.lastUnknownKidRefreshAtMs = this.now();
+      const refreshed = await this.refresh();
+      if (refreshed) {
+        const afterRefresh = await this.findKey(header, token);
+        if (afterRefresh !== null) return afterRefresh;
+      }
+    }
+    this.assertTrusted();
+    throw new OidcJwksVerificationError("badSignature");
+  }
+  /**
+   * Fetch the key set now, replacing the cache **only** on success.
+   *
+   * Answers whether a usable set is in place afterwards. A failed fetch leaves the
+   * previous set exactly as it was, which is what FR-13's 21,600-second window
+   * describes; it never clears the cache and it never throws to a caller that has a
+   * token to refuse.
+   */
+  async refresh() {
+    this.lastAttemptAtMs = this.now();
+    const result = await fetchJsonWithOneRetry(
+      { url: this.options.jwksUri },
+      {
+        fetchImpl: this.options.fetchImpl,
+        now: this.options.now,
+        timeoutMs: this.options.timeoutMs ?? OIDC_OUTBOUND_TIMEOUT_MS,
+        retryDelayMs: this.options.retryDelayMs
+      }
+    );
+    if (!result.ok) {
+      this.lastFailure = result.failure ?? "network";
+      return false;
+    }
+    const jwks = asJwks(result.body);
+    if (jwks === null) {
+      this.lastFailure = "invalidDocument";
+      return false;
+    }
+    this.jwks = jwks;
+    this.resolveKey = createLocalJWKSet(jwks);
+    this.refreshedAtMs = this.now();
+    this.availableKeyCount = jwks.keys.length;
+    this.lastFailure = null;
+    this.options.onRefreshed?.(this.refreshedAtMs);
+    return true;
+  }
+  /**
+   * Make sure the cache is fresh enough to answer from (FR-13's 600 seconds).
+   *
+   * An expired cache is refreshed; a cache that cannot be refreshed stays usable
+   * while {@link assertTrusted} allows it, and throws `providerUnavailable` once it
+   * does not.
+   */
+  async ensureUsableKeySet() {
+    if (this.jwks !== null && this.isCacheFresh()) return;
+    await this.refresh();
+    this.assertTrusted();
+  }
+  /** FR-13's 600 seconds: `age < cacheSeconds`. */
+  isCacheFresh() {
+    if (this.refreshedAtMs === null) return false;
+    return this.now() - this.refreshedAtMs < this.cacheSeconds() * 1e3;
+  }
+  /**
+   * FR-13's 21,600 seconds, and the fail-closed end of the ladder.
+   *
+   * Two distinct refusals, because they are two distinct operational facts: no key
+   * set has ever been fetched (`keysUnavailable` — usually a provider that has
+   * never answered), or the last good fetch is older than plan §4.3's window
+   * (`keysStale` — plan §9.2's "JWKS stale beyond 21,600 s: every validation fails
+   * closed").
+   */
+  assertTrusted() {
+    if (this.jwks === null || this.refreshedAtMs === null) {
+      throw new OidcProviderUnavailableError("keysUnavailable");
+    }
+    if (this.now() - this.refreshedAtMs > this.maxStaleSeconds() * 1e3) {
+      throw new OidcProviderUnavailableError("keysStale");
+    }
+  }
+  /**
+   * FR-13's "at most one refresh per 30 seconds" for an unknown key id.
+   *
+   * Read as the rule it protects: the unknown-`kid` refetch is the one an attacker
+   * can trigger at will by presenting a token with a made-up `kid`, so that trigger
+   * is the one the cooldown bounds. A *successful* cache refresh is not counted
+   * against it, because the 600-second cache already bounds those — counting them
+   * would refuse the first token signed by a freshly rotated key for up to 30
+   * seconds after any refresh, which is the opposite of ACC-12-08 ("a token signed
+   * with a newly rotated key validates after one key refresh").
+   */
+  canRefreshForUnknownKid() {
+    if (this.lastUnknownKidRefreshAtMs === null) return true;
+    return this.now() - this.lastUnknownKidRefreshAtMs >= this.unknownKidCooldownSeconds() * 1e3;
+  }
+  /**
+   * Ask jose for the key matching a header, or `null` when nothing matches.
+   *
+   * `JWKSNoMatchingKey` is the expected "unknown kid" answer and becomes `null` so
+   * the caller can try FR-13's one refresh. Every other jose failure — a malformed
+   * set, several keys matching one header — is a refusal, and none of them ever
+   * surfaces with jose's message attached (FR-16).
+   */
+  async findKey(header, token) {
+    const resolve = this.resolveKey;
+    if (resolve === null) return null;
+    try {
+      return await resolve(header, token);
+    } catch (error) {
+      if (error instanceof errors.JWKSNoMatchingKey) return null;
+      throw new OidcJwksVerificationError("badSignature");
+    }
+  }
+  algorithms() {
+    return this.options.algorithms ?? OIDC_IDENTITY_SIGNING_ALGS;
+  }
+  cacheSeconds() {
+    return this.options.cacheSeconds ?? OIDC_JWKS_CACHE_SECONDS;
+  }
+  maxStaleSeconds() {
+    return this.options.maxStaleSeconds ?? OIDC_JWKS_MAX_STALE_SECONDS;
+  }
+  unknownKidCooldownSeconds() {
+    return this.options.unknownKidCooldownSeconds ?? OIDC_JWKS_UNKNOWN_KID_COOLDOWN_SECONDS;
+  }
+  now() {
+    return (this.options.now ?? Date.now)();
+  }
+};
+function decodeProtectedHeaderOrNull(token) {
+  try {
+    return decodeProtectedHeader(token);
+  } catch {
+    return null;
+  }
+}
+function asJwks(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const keys = value.keys;
+  if (!Array.isArray(keys)) return null;
+  return value;
+}
+
+// src/scopes.ts
+var OIDC_SIGN_IN_SCOPES = ["openid", "email", "profile"];
+var OIDC_SIGN_IN_SCOPE = OIDC_SIGN_IN_SCOPES.join(" ");
+var OIDC_NEVER_REQUESTED_SCOPES = ["offline_access"];
+var OIDC_DELEGATED_READ_SCOPE = "apps:read";
+var OIDC_SESSION_EXCHANGE_SCOPE = "ever-works:session";
+var OIDC_TOKEN_SCOPES = [OIDC_DELEGATED_READ_SCOPE, OIDC_SESSION_EXCHANGE_SCOPE];
+function isSignInScope(value) {
+  const requested = value.split(/\s+/u).filter((scope) => scope.length > 0);
+  if (requested.length !== OIDC_SIGN_IN_SCOPES.length) return false;
+  const unique = new Set(requested);
+  if (unique.size !== requested.length) return false;
+  return OIDC_SIGN_IN_SCOPES.every((scope) => unique.has(scope));
+}
+
+// src/settings.schema.ts
+var oidcIdentityIssuerUrlPattern = "^(https://[^\\s]+|http://(localhost|127\\.0\\.0\\.1)(:\\d{1,5})?(/[^\\s]*)?)$";
+var oidcIdentityHttpsUrlPattern = "^https://[^\\s]+$";
+var OIDC_IDENTITY_SETTING_KEYS = [
+  "issuerUrl",
+  "clientId",
+  "clientSecret",
+  "allowedIssuers",
+  "apiAudience",
+  "localClients",
+  "delegatedClientNames",
+  "accountManagementUrl",
+  "signUpAllowed",
+  "clockSkewSeconds",
+  "displayName",
+  "availability"
+];
+var oidcIdentitySettingsSchema = {
+  type: "object",
+  title: "Ever ID",
+  description: "OpenID Connect relying-party configuration for Ever ID. One issuer set per installation: browser sign-in, connected identities and delegated reads all use it (FR-2, FR-7).",
+  properties: {
+    issuerUrl: {
+      type: "string",
+      title: "Issuer address",
+      description: "The provider issuer, e.g. https://auth.ever.co. Must be https; http is accepted only for localhost and is refused outside development (FR-2). Register exactly one redirect address at the provider (FR-10).",
+      pattern: oidcIdentityIssuerUrlPattern,
+      "x-envVar": "EVER_ID_ISSUER_URL",
+      "x-scope": "global"
+    },
+    clientId: {
+      type: "string",
+      title: "Client ID",
+      description: "The relying-party client identifier Ever ID issued to this installation (FR-2).",
+      maxLength: 255,
+      "x-envVar": "EVER_ID_CLIENT_ID",
+      "x-scope": "global"
+    },
+    clientSecret: {
+      type: "string",
+      title: "Client secret",
+      description: "The client secret used with client_secret_basic. Write-only: never returned by any response, log, Activity row or telemetry payload (FR-16, ACC-12-03).",
+      "x-secret": true,
+      "x-envVar": "EVER_ID_CLIENT_SECRET",
+      "x-scope": "global"
+    },
+    allowedIssuers: {
+      type: "array",
+      title: "Allowed issuers",
+      description: "1\u20133 exact issuer strings accepted at once, so a planned provider move stays reversible. Defaults to the configured issuer address when unset (FR-2, FR-14).",
+      items: { type: "string" },
+      minItems: 1,
+      maxItems: 3,
+      "x-envVar": "EVER_ID_ALLOWED_ISSUERS",
+      "x-scope": "global"
+    },
+    apiAudience: {
+      type: "string",
+      title: "API audience",
+      description: "The audience a delegated or exchanged access token must contain (FR-40, FR-45). Defaults to ever-works.",
+      maxLength: 255,
+      default: "ever-works",
+      "x-envVar": "EVER_ID_API_AUDIENCE",
+      "x-scope": "global"
+    },
+    localClients: {
+      type: "array",
+      title: "Local clients",
+      description: "Public clients (CLI, node) allowed to exchange an Ever ID access token for an Ever Works session, at most 5 (FR-2, FR-39, FR-40).",
+      items: {
+        type: "object",
+        properties: {
+          kind: {
+            type: "string",
+            title: "Client kind",
+            description: "Which local client this entry configures.",
+            enum: ["cli", "node"]
+          },
+          clientId: {
+            type: "string",
+            title: "Client ID",
+            description: "The public client identifier registered at the provider."
+          }
+        },
+        required: ["kind", "clientId"]
+      },
+      maxItems: 5,
+      default: [],
+      "x-scope": "global"
+    },
+    delegatedClientNames: {
+      type: "array",
+      title: "Delegated client names",
+      description: "The names the Connected identities card shows for apps that used a delegated read, at most 10 (FR-48). A client id with no name here is shown as the client id itself.",
+      items: {
+        type: "object",
+        properties: {
+          clientId: {
+            type: "string",
+            title: "Client ID",
+            maxLength: 255
+          },
+          displayName: {
+            type: "string",
+            title: "Display name",
+            maxLength: 60
+          }
+        },
+        required: ["clientId"]
+      },
+      maxItems: 10,
+      default: [],
+      "x-scope": "global"
+    },
+    accountManagementUrl: {
+      type: "string",
+      title: "Account management address",
+      description: "The target of the Manage in Ever ID link on the Connected identities card (FR-48). Must be https; when unset the link is hidden.",
+      pattern: oidcIdentityHttpsUrlPattern,
+      "x-scope": "global"
+    },
+    signUpAllowed: {
+      type: "boolean",
+      title: "Allow sign-up with Ever ID",
+      description: "Whether an unknown, verified Ever ID identity may create an account (FR-2, FR-23). Defaults to on.",
+      default: true,
+      "x-envVar": "EVER_ID_SIGN_UP_ALLOWED",
+      "x-scope": "global"
+    },
+    clockSkewSeconds: {
+      type: "integer",
+      title: "Clock skew tolerance (seconds)",
+      description: "Tolerance applied to every token time check, 0\u2013120 seconds (FR-2, FR-11). Defaults to 60.",
+      minimum: 0,
+      maximum: 120,
+      default: 60,
+      "x-envVar": "EVER_ID_CLOCK_SKEW_SECONDS",
+      "x-scope": "global"
+    },
+    displayName: {
+      type: "string",
+      title: "Display name",
+      description: "The button and heading label, at most 40 characters (FR-2). Defaults to Ever ID.",
+      maxLength: 40,
+      default: "Ever ID",
+      "x-scope": "global"
+    },
+    availability: {
+      type: "object",
+      title: "Availability",
+      description: "Platform-written availability state: when the provider was last seen unavailable and when discovery, the key set and the last sign-out notice were refreshed. Not user-writable; stored so every replica agrees within 60 seconds (FR-5, plan \xA79.2).",
+      properties: {
+        unavailableSince: {
+          type: "string",
+          description: "Set when Test connection fails; cleared by the next passing run (FR-3, FR-5).",
+          format: "date-time"
+        },
+        discoveryRefreshedAt: {
+          type: "string",
+          description: "When the discovery document was last fetched successfully (FR-14).",
+          format: "date-time"
+        },
+        jwksRefreshedAt: {
+          type: "string",
+          description: "When the provider key set was last fetched successfully (FR-13).",
+          format: "date-time"
+        },
+        lastLogoutNoticeAt: {
+          type: "string",
+          description: "When the last back-channel logout notice was accepted (FR-33).",
+          format: "date-time"
+        }
+      },
+      "x-hidden": true,
+      "x-scope": "global"
+    }
+  },
+  required: ["issuerUrl", "clientId", "clientSecret"]
+};
+
+// src/oidc-identity.plugin.ts
+var FR3_CHECK_IDS = [
+  "discovery",
+  "issuerMatch",
+  "endpoints",
+  "pkceS256",
+  "signingAlg",
+  "backchannelLogout",
+  "deviceAuthorization"
+];
+var FR3_REQUIRED_CHECK_IDS = [
+  "discovery",
+  "issuerMatch",
+  "endpoints",
+  "pkceS256",
+  "signingAlg"
+];
+var OIDC_STATE_BYTES = 32;
+var OIDC_NONCE_BYTES = 32;
+var OIDC_CODE_VERIFIER_LENGTH = 64;
+var OIDC_CODE_VERIFIER_BYTES = 48;
+var OIDC_DEFAULT_CLOCK_SKEW_SECONDS = 60;
+var OIDC_MAX_CLOCK_SKEW_SECONDS = 120;
+var OIDC_ID_TOKEN_MAX_AGE_SECONDS = 600;
+var OIDC_SUBJECT_MAX_LENGTH = 255;
+var OIDC_DEFAULT_API_AUDIENCE = "ever-works";
+var OIDC_ACCESS_TOKEN_MAX_LIFETIME_SECONDS = 3600;
+var OIDC_ACCESS_TOKEN_MAX_AGE_SECONDS = 300;
+var OIDC_LOGOUT_TOKEN_MAX_AGE_SECONDS = 300;
+var OIDC_LOGOUT_TOKEN_REPLAY_WINDOW_SECONDS = 600;
+var OIDC_BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+var OidcIdentityPlugin = class {
+  constructor(options = {}) {
+    this.id = "oidc-identity";
+    this.name = "OpenID Connect identity (Ever ID)";
+    this.version = "1.0.0";
+    /**
+     * The plan §4.2 category, `'identity'`.
+     *
+     * The assertion is needed only because this package lands **before T4**,
+     * which appends `'identity'` to `PLUGIN_CATEGORIES`
+     * (`packages/plugin/src/contracts/plugin-manifest.types.ts:5-117` — the tuple
+     * currently closes with `'build'`). Until that append lands the loader's own
+     * `isPluginCategory` check rejects the manifest, so this plugin is
+     * discoverable only after T4; the value itself is already exact, and the
+     * assertion is the one place the type union is narrower than the plan.
+     *
+     * **Landed 2026-09-18 (T4).** `'identity'` is now the **last** member of
+     * `PLUGIN_CATEGORIES`, so the loader's `isPluginCategory` accepts this
+     * manifest and discovery finds the package instead of skipping it with
+     * `Invalid category` (T4's report measures it: 103 → 104 plugins). The
+     * paragraph above is kept because that is what this file had to say while
+     * the append was missing, and the cast below stays — it resolves to the
+     * same member, and dropping it would remove an assertion for nothing.
+     */
+    this.category = "identity";
+    /** Plan §4.2: exactly one capability, `identity-provider`. */
+    this.capabilities = ["identity-provider"];
+    /** One issuer set per installation, configured by a platform admin (FR-7, FR-2). */
+    this.configurationMode = "admin-only";
+    this.settingsSchema = oidcIdentitySettingsSchema;
+    /** FR-13 / plan §9.2: when the key set was last fetched successfully, in epoch ms. T32 persists it. */
+    this.jwksRefreshedAtMs = null;
+    /** FR-14/FR-5: when the provider was first seen unusable, in epoch ms. T32 persists it. */
+    this.unavailableSinceMs = null;
+    /** Which rule made it unusable — a closed set, never a provider's own text (FR-16). */
+    this.unavailableReason = null;
+    this.fetchImpl = options.fetchImpl;
+    this.now = options.now ?? Date.now;
+    this.randomBytes = options.randomBytes;
+    this.nodeEnv = options.nodeEnv;
+  }
+  async onLoad(context) {
+    this.context = context;
+    context.logger.log(
+      "OpenID Connect identity (Ever ID) plugin loaded \u2014 discovery, key cache, Test connection, the sign-in flow and the token verifiers (access, logout, end-session) are all available"
+    );
+  }
+  async onUnload() {
+    this.context = void 0;
+    this.discoveryReader = void 0;
+    this.discoveryIssuerUrl = void 0;
+    this.jwksCache = void 0;
+    this.jwksUri = void 0;
+    this.jwksRefreshedAtMs = null;
+  }
+  /**
+   * FR-3 — read the provider's discovery document and report every check.
+   *
+   * The rules this method exists to keep, in the order they matter:
+   *
+   *   - **5 seconds, always** (FR-3, ACC-12-03). The read is handed a deadline
+   *     computed when the run starts, so FR-15's single retry can only ever fit
+   *     inside that budget, and the answer is reported at the deadline whether or
+   *     not the provider answered in time.
+   *   - **A row per check, always** — the same seven ids in FR-3's order, an
+   *     unconfigured integration and an unreachable provider included. A short or
+   *     varying list would make spec §6.7's admin surface render differently
+   *     depending on what went wrong.
+   *   - **Never the secret** (FR-16). No `detail` quotes a value the provider sent
+   *     except a numeric HTTP status; every one of them names a field, and the
+   *     settings object — which is where `clientSecret` lives — is never returned,
+   *     logged or embedded.
+   *
+   * The run also writes the availability record plan §4.2 keeps: the five checks
+   * of {@link FR3_REQUIRED_CHECK_IDS} passing clears `unavailableSince`, any of them
+   * failing sets it (FR-14's "until an administrator re-tests"). T32 persists it;
+   * {@link getAvailability} is the in-process view until then.
+   */
+  async testConnection() {
+    const resolved = await this.resolveSettings();
+    if (!resolved.ok) {
+      this.recordUnavailable("notConfigured");
+      return unavailableRows(
+        `Not configured: ${resolved.missing.join(", ")}.`,
+        "Not checked \u2014 the integration is not configured."
+      );
+    }
+    const issuerUrl = resolved.settings.issuerUrl;
+    const deadlineAt = this.now() + OIDC_OUTBOUND_TIMEOUT_MS;
+    const read = await this.readerFor(issuerUrl).read({ deadlineAt });
+    const checks = read.ok ? checksFromDocument(read.document, issuerUrl) : unavailableRows(
+      discoveryFailureDetail(read.failure, read.status),
+      "Not checked \u2014 the discovery document could not be read."
+    );
+    this.applyAvailability(checks);
+    this.logChecks(checks);
+    return checks;
+  }
+  /**
+   * FR-2's non-secret projection — what the web needs to render the button and
+   * what a local client needs before it can sign in.
+   *
+   * The contract's five fields and nothing else: the client secret is not among
+   * them (FR-16), and neither is anything that would let a caller address the
+   * provider differently from the configuration an administrator saved (FR-7). The
+   * defaults are FR-2's: display name `Ever ID`, audience `ever-works`, sign-up on.
+   */
+  async getPublicConfig() {
+    const resolved = await this.resolveSettings();
+    if (!resolved.ok) {
+      throw new OidcProviderUnavailableError("notConfigured");
+    }
+    const settings = resolved.settings;
+    return {
+      issuer: settings.issuerUrl,
+      displayName: nonEmpty(settings.displayName) ?? "Ever ID",
+      localClients: localClientsOf(settings.localClients),
+      apiAudience: nonEmpty(settings.apiAudience) ?? OIDC_DEFAULT_API_AUDIENCE,
+      // FR-2's default is on, so only an explicit `false` turns sign-up off.
+      signUpAllowed: settings.signUpAllowed !== false
+    };
+  }
+  /**
+   * FR-8/FR-9/FR-10/FR-12's first half — the authorization request a browser is
+   * sent to, and the three secrets the transaction cookie carries.
+   *
+   * What this method is responsible for, and what it is deliberately not:
+   *
+   *   - **PKCE S256 only** (FR-8). `code_challenge_method=S256` is a literal in
+   *     the parameters below and the challenge is the SHA-256 of the verifier,
+   *     computed by `openid-client`'s `calculatePKCECodeChallenge` — the same
+   *     transformation the provider will apply to the verifier at the token
+   *     endpoint. `plain` is never offered and never sent; a provider that
+   *     advertises only `plain` is refused by FR-3's check row and by the
+   *     availability record, not by this method.
+   *   - **Fresh `state` and `nonce` of 32 random bytes, and a 64-character
+   *     verifier, per call** (FR-9). Every call draws new bytes from
+   *     {@link OidcIdentityPluginOptions.randomBytes} (the platform CSPRNG by
+   *     default) and encodes them base64url: 32 bytes → a 43-character value
+   *     whose decoded length is exactly the 32 FR-9 asks for, 48 bytes → exactly
+   *     the 64 characters FR-9 asks of the verifier. Nothing is reused between
+   *     calls and nothing is derived from the clock, the issuer or the client
+   *     id — a `state` an attacker can predict is a `state` that binds nothing.
+   *   - **The exact redirect address, never rebuilt** (FR-10). `redirectUri` is
+   *     copied into the query parameter byte-for-byte: no trailing-slash
+   *     normalisation, no parsing and re-serialising, no default. Deriving that
+   *     address from the configured public web address — and refusing anything
+   *     that came from request input — is the caller's rule (plan §5.1's
+   *     `POST /authorize`), and this method cannot enforce it because the
+   *     address is not part of the plugin's settings (plan §4.2 has no redirect
+   *     key: the one address per deployment lives in platform configuration).
+   *   - **`openid email profile`, and never `offline_access`** (plan §4.2,
+   *     FR-38) — the scope comes from `src/scopes.ts` as one constant rather
+   *     than being assembled here.
+   *
+   * The endpoint comes from the discovery document this plugin already read
+   * (FR-14's 3,600-second cache, and its issuer-drift refusal): a request is
+   * never built against an issuer whose document advertises a different issuer,
+   * so a provider cannot move this installation's sign-in by publishing a
+   * document somewhere else.
+   *
+   * Errors are T6's availability vocabulary rather than token rejections —
+   * nothing here verifies a token, and a caller needs to know *which*
+   * configuration or document problem stopped the sign-in from starting:
+   * `notConfigured`, `discoveryFailed`, `issuerDrift` or `discoveryIncomplete`
+   * (a document with no `authorization_endpoint`). Every one of them maps to
+   * plan §5.2's `404 everIdDisabled` / `503 providerUnavailable` at the façade.
+   */
+  async buildAuthorizationRequest(input) {
+    const resolved = await this.resolveSettings();
+    if (!resolved.ok) throw new OidcProviderUnavailableError("notConfigured");
+    const settings = resolved.settings;
+    const document = await this.readerFor(settings.issuerUrl).get();
+    if (typeof document.authorization_endpoint !== "string" || document.authorization_endpoint.length === 0) {
+      throw new OidcProviderUnavailableError("discoveryIncomplete");
+    }
+    const state = encodeBase64Url(this.random(OIDC_STATE_BYTES));
+    const nonce = encodeBase64Url(this.random(OIDC_NONCE_BYTES));
+    const codeVerifier = encodeBase64Url(this.random(OIDC_CODE_VERIFIER_BYTES));
+    const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
+    const url = buildAuthorizationUrl(this.configurationFor(document, settings), {
+      response_type: "code",
+      client_id: settings.clientId,
+      redirect_uri: input.redirectUri,
+      scope: OIDC_SIGN_IN_SCOPE,
+      state,
+      nonce,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
+      // FR-25's connect path asks for a fresh authentication (`prompt=login`) and
+      // bounds how old it may be (`max_age`); a plain sign-in sends neither, and
+      // an absent parameter is not the same wire value as an empty one.
+      ...input.prompt === void 0 ? {} : { prompt: input.prompt },
+      ...input.maxAgeSeconds === void 0 ? {} : { max_age: String(input.maxAgeSeconds) }
+    });
+    return { url: url.toString(), state, nonce, codeVerifier };
+  }
+  /**
+   * FR-11/FR-12 — redeem an authorization code and answer the ID token's claims,
+   * or refuse.
+   *
+   * The order below is the spec's order, and each step is load-bearing:
+   *
+   *   1. **the settings resolve** — an unconfigured integration cannot exchange
+   *      anything, and this method has no way to say so except
+   *      `providerUnavailable` (see the error contract below);
+   *   2. **FR-12's `iss` equality, before anything is redeemed.** When the
+   *      authorization response carries `iss`, it must equal the configured
+   *      issuer exactly. Checking it first is not an optimisation: a code whose
+   *      response named another issuer is a code this installation must not
+   *      spend, and a refusal here touches the network zero times;
+   *   3. **the discovery document** (FR-14's cache, and its issuer-drift
+   *      refusal) — the token endpoint and `jwks_uri` come from it;
+   *   4. **the code exchange** — one POST, `client_secret_basic`, 5,000 ms, and
+   *      **no retry** (FR-15's "the code exchange is never retried": a second
+   *      attempt would be a second redemption of a single-use code, which is
+   *      FR-19's "a sign-in transaction completes at most once" seen from the
+   *      provider's side);
+   *   5. **the signature and the algorithm**, through T6's key cache
+   *      (`jwks-cache.ts`), whose three codes and whose 21,600-second
+   *      fail-closed end are reported with the same codes here;
+   *   6. **FR-11's claim rules** (plan §4.3), against the injected clock and the
+   *      administrator's `clockSkewSeconds` (default
+   *      {@link OIDC_DEFAULT_CLOCK_SKEW_SECONDS}).
+   *
+   * ## The error contract, and why it differs from {@link buildAuthorizationRequest}
+   *
+   * **Everything this method throws is an `IdentityTokenRejectedError`** — the
+   * contract's single refusal type, `message` equal to `code` and nothing else
+   * (FR-16). That includes the provider-unavailable conditions: T6's discovery
+   * and key-cache errors are caught below and rethrown as
+   * `providerUnavailable`, and any `jwks-cache` refusal keeps its own code
+   * (`badAlg`, `badSignature`). The reason is the caller: the callback handler
+   * has one decision to make — plan §5.2's "ID token rejected → 401" versus
+   * "endpoint unavailable → 503" — and one error type with a closed code set is
+   * the shape that decision is written against. The builder, which answers a
+   * question rather than a verdict, keeps the precise availability reason
+   * instead.
+   *
+   * A refusal never partially succeeds: nothing is returned, nothing is stored,
+   * and no claim of a refused token reaches the caller.
+   *
+   * ## `maxAuthAgeSeconds` (FR-25)
+   *
+   * Supplied, it applies FR-25's rule — `auth_time` no older than 300 seconds
+   * plus the skew — and answers `tooOld`, including when the token carries no
+   * `auth_time` at all: a connect flow that cannot show the authentication was
+   * recent must re-authenticate rather than proceed. Absent (a plain sign-in),
+   * `auth_time` is not required and is passed through as `null` when missing.
+   */
+  async exchangeAuthorizationCode(input) {
+    const resolved = await this.resolveSettings();
+    if (!resolved.ok) throw new IdentityTokenRejectedError("providerUnavailable");
+    const settings = resolved.settings;
+    if (input.receivedIssuer !== void 0 && input.receivedIssuer !== settings.issuerUrl) {
+      throw new IdentityTokenRejectedError("badIssuer");
+    }
+    const document = await this.discoveryForVerification(settings.issuerUrl);
+    const tokenEndpoint = nonEmpty(document.token_endpoint);
+    const jwksUri = nonEmpty(document.jwks_uri);
+    if (tokenEndpoint === void 0 || jwksUri === void 0) {
+      throw new IdentityTokenRejectedError("providerUnavailable");
+    }
+    const idToken = await this.redeemAuthorizationCode(input, settings, tokenEndpoint);
+    const verification = await this.verifyProviderSignature(idToken, jwksUri);
+    return idTokenClaims(verification.payload, {
+      issuer: document.issuer,
+      clientId: settings.clientId,
+      // FR-2's default when an administrator configured no allow-list: the one
+      // issuer this installation accepts is its own.
+      allowedIssuers: settings.allowedIssuers ?? [settings.issuerUrl],
+      expectedNonce: input.expectedNonce,
+      skewSeconds: settings.clockSkewSeconds ?? OIDC_DEFAULT_CLOCK_SKEW_SECONDS,
+      nowSeconds: Math.floor(this.now() / 1e3),
+      maxAuthAgeSeconds: input.maxAuthAgeSeconds
+    });
+  }
+  /**
+   * FR-40 (the local-client exchange) and FR-45 (the App Launcher's delegated
+   * read) — verify an Ever ID access token and answer the claims both callers
+   * branch on.
+   *
+   * The rules, in the order they are applied, and where each one comes from:
+   *
+   *   1. **the settings resolve** — as in {@link exchangeAuthorizationCode}, an
+   *      unconfigured integration answers `providerUnavailable`, the only code
+   *      this method has for "the plugin cannot ask the provider anything";
+   *   2. **the discovery document** (FR-14's cache and issuer-drift refusal) and
+   *      its `jwks_uri` — the same read the exchange performs, and the same
+   *      `providerUnavailable` when the document names no key set;
+   *   3. **the signature and the algorithm** through T6's key cache, including
+   *      FR-13's ladder and its fail-closed end (`badAlg`, `badSignature`,
+   *      `providerUnavailable`);
+   *   4. **FR-11's issuer rule**, which FR-45 makes a rule for access tokens too:
+   *      `iss` equals the discovery issuer **and** is allow-listed (`badIssuer`);
+   *   5. **the audience** — `aud` contains the configured API audience, or plan
+   *      §4.2's `ever-works` default (`badAudience`);
+   *   6. **the scopes** — every entry of `requiredScopes` is present (`missingScope`,
+   *      FR-46's code: a valid token that lacks the scope its caller needs);
+   *   7. **the times** — a readable `exp` that has not passed (with the skew), an
+   *      `iat` no later than now plus the skew, and an `iat` no older than
+   *      `maxAgeSeconds` when the caller gives one (`expired`, `notYetValid`,
+   *      `tooOld`);
+   *   8. **the lifetime ceiling** — `exp − iat ≤ maxLifetimeSeconds`
+   *      (`lifetimeTooLong`; ACC-12-35's "lifetime over 3,600 seconds");
+   *   9. **the authorised party** — when `allowedAuthorizedParties` is given (the
+   *      exchange path, FR-40), `azp` must be one of them
+   *      (`badAuthorizedParty`); absent, the claim is not read at all, which is
+   *      FR-45's rule set exactly.
+   *
+   * ## The two arguments that make one method serve both token families
+   *
+   * The contract has one `verifyAccessToken` and two rules of §4.3: the delegated
+   * read passes `{ requiredScopes: ['apps:read'], maxLifetimeSeconds: 3_600 }`
+   * (FR-44/FR-45), the exchange passes
+   * `{ requiredScopes: ['ever-works:session'], maxLifetimeSeconds: 3_600, maxAgeSeconds: 300, allowedAuthorizedParties: <the configured local client ids> }`
+   * (FR-40). Nothing here decides which family a token belongs to — that is the
+   * caller's, and it is a decision about *why* the token is being presented, not
+   * about the token.
+   *
+   * ## What is deliberately left to the caller
+   *
+   * **The `jti` replay window** (FR-40/FR-33's 600 seconds). The parsed `jti` is
+   * returned and never enforced: it needs a store with a unique index, which is
+   * T13's `ever-id-replay.service.ts`, and a plugin that held that state in
+   * process memory would enforce a different window per replica. Plan §4.1 says
+   * the same thing from the contract side ("the caller keeps the 600-second replay
+   * window, not the plugin").
+   *
+   * **Whether the subject is a connected identity of an active account** — FR-40's
+   * last clause and FR-45's. That is a database question and it belongs to the
+   * services that own those rows.
+   *
+   * A refusal never partially succeeds: no claim of a refused token is returned.
+   */
+  async verifyAccessToken(token, input) {
+    const resolved = await this.resolveSettings();
+    if (!resolved.ok) throw new IdentityTokenRejectedError("providerUnavailable");
+    const settings = resolved.settings;
+    const document = await this.discoveryForVerification(settings.issuerUrl);
+    const jwksUri = nonEmpty(document.jwks_uri);
+    if (jwksUri === void 0) throw new IdentityTokenRejectedError("providerUnavailable");
+    const verification = await this.verifyProviderSignature(token, jwksUri);
+    return accessTokenClaims(verification.payload, {
+      issuer: document.issuer,
+      // FR-2's default when an administrator configured no allow-list: the one
+      // issuer this installation accepts is its own.
+      allowedIssuers: settings.allowedIssuers ?? [settings.issuerUrl],
+      apiAudience: nonEmpty(settings.apiAudience) ?? OIDC_DEFAULT_API_AUDIENCE,
+      requiredScopes: input.requiredScopes,
+      maxLifetimeSeconds: input.maxLifetimeSeconds,
+      maxAgeSeconds: input.maxAgeSeconds,
+      allowedAuthorizedParties: input.allowedAuthorizedParties,
+      skewSeconds: settings.clockSkewSeconds ?? OIDC_DEFAULT_CLOCK_SKEW_SECONDS,
+      nowSeconds: Math.floor(this.now() / 1e3)
+    });
+  }
+  /**
+   * FR-33 — verify a back-channel logout notice and answer the three claims the
+   * session teardown keys on.
+   *
+   * Validated exactly like an ID token (FR-33's "validated like FR-11 and FR-13":
+   * the algorithm allow-list, the signature against Ever ID's published keys,
+   * FR-13's ladder, FR-11's issuer rule, and the times), plus FR-33's own five:
+   *
+   *   - the **back-channel logout event** is present ({@link OIDC_BACKCHANNEL_LOGOUT_EVENT});
+   *   - **no `nonce`** — the claim's mere presence is refused
+   *     (`nonceInLogoutToken`), because a notice is not an authentication and a
+   *     token that can be replayed as one is a token that should never verify;
+   *   - **`sid` or `sub`**, at least one, or there is no session to end
+   *     (`badLogoutEvent`);
+   *   - **`jti` required** (`badLogoutEvent`) — without it the 600-second replay
+   *     window has no key, and a notice that cannot be bounded must be refused
+   *     rather than treated as new;
+   *   - **`iat` within the skew and no older than 300 seconds** (`notYetValid`,
+   *     `tooOld`).
+   *
+   * ## `exp`, and the one place a logout token differs from an ID token
+   *
+   * Plan §4.3's ID-token row requires a readable `exp`; FR-33's logout-token row
+   * does not mention one, and OpenID Connect Back-Channel Logout 1.0 §2.4 does not
+   * put `exp` in the claim set a logout token **must** carry (`iss`, `aud`, `iat`,
+   * `jti`, `events`). FR-53 makes that difference load-bearing: a provider that
+   * publishes a standards-compliant notice would have every sign-out refused as
+   * `expired` if this method demanded an `exp` the provider never promised, and a
+   * refused sign-out is a session that stays open. So `exp` is **checked when it
+   * is there** and not required, and the freshness bound FR-33 does state — `iat`
+   * within the skew and no older than 300 seconds — is enforced either way. This
+   * is a deliberate reading and is pinned by a case in
+   * `src/__tests__/logout-token.spec.ts` in both directions.
+   *
+   * ## What is deliberately left to the caller
+   *
+   * The `jti` **replay window** (FR-33's 600 seconds; see
+   * {@link verifyAccessToken}) and everything that happens to a session once this
+   * method has answered — FR-34's "ends the sessions carrying it", FR-35's "never
+   * ends a session opened by another method" and the 5-second bound are the
+   * API's, not a token verifier's.
+   */
+  async verifyLogoutToken(token) {
+    const resolved = await this.resolveSettings();
+    if (!resolved.ok) throw new IdentityTokenRejectedError("providerUnavailable");
+    const settings = resolved.settings;
+    const document = await this.discoveryForVerification(settings.issuerUrl);
+    const jwksUri = nonEmpty(document.jwks_uri);
+    if (jwksUri === void 0) throw new IdentityTokenRejectedError("providerUnavailable");
+    const verification = await this.verifyProviderSignature(token, jwksUri);
+    return logoutTokenClaims(verification.payload, {
+      issuer: document.issuer,
+      allowedIssuers: settings.allowedIssuers ?? [settings.issuerUrl],
+      skewSeconds: settings.clockSkewSeconds ?? OIDC_DEFAULT_CLOCK_SKEW_SECONDS,
+      nowSeconds: Math.floor(this.now() / 1e3)
+    });
+  }
+  /**
+   * FR-36 — the address that ends the person's Ever ID session, or **`null`** when
+   * the provider publishes no end-session endpoint.
+   *
+   * The `null` is the one answer in this plugin that is neither a set of claims
+   * nor a refusal, and it means one thing only: the discovery document the plugin
+   * already read has no `end_session_endpoint`, so there is nowhere to send the
+   * person and the caller renders "sign out of Ever Works" alone. It is **not**
+   * an error path — inventing a URL, or answering the issuer's address and hoping,
+   * would send a browser somewhere the provider never agreed to serve.
+   *
+   * What is sent, and what is not:
+   *
+   *   - `client_id` — how the provider knows which relying party is asking. The
+   *     alternative identifier, `id_token_hint`, is deliberately **not** sent:
+   *     FR-31 forbids this platform from storing an Ever ID token, so there is no
+   *     ID token to hint with, and OpenID Connect RP-Initiated Logout 1.0 names
+   *     `client_id` as the parameter to use in exactly that case.
+   *   - `post_logout_redirect_uri` — copied **byte for byte**, the same rule
+   *     FR-10 puts on the authorization request's `redirect_uri` and for the same
+   *     reason: the address an administrator registered is the address that
+   *     travels, never one this package rebuilt.
+   *   - `state` — carried verbatim. "Validated" in FR-36 is about the value the
+   *     API sealed into the sign-out transaction (plan §3.4/§3.5, T13's seal
+   *     service) being the value that comes back; the plugin neither mints nor
+   *     checks it, and must not, because it holds no per-session state.
+   *
+   * Errors are {@link OidcProviderUnavailableError} — T6's availability
+   * vocabulary, exactly as in {@link buildAuthorizationRequest} — rather than an
+   * `IdentityTokenRejectedError`: nothing here verifies a token, and a caller
+   * needs to know which configuration or document problem stopped the sign-out:
+   * `notConfigured`, `discoveryFailed`, `issuerDrift`, or `discoveryIncomplete`
+   * (an `end_session_endpoint` that is published but is not a URL).
+   */
+  async buildEndSessionUrl(input) {
+    const resolved = await this.resolveSettings();
+    if (!resolved.ok) throw new OidcProviderUnavailableError("notConfigured");
+    const settings = resolved.settings;
+    const document = await this.readerFor(settings.issuerUrl).get();
+    const endpoint = nonEmpty(document.end_session_endpoint);
+    if (endpoint === void 0) return null;
+    let url;
+    try {
+      url = new URL(endpoint);
+    } catch {
+      throw new OidcProviderUnavailableError("discoveryIncomplete");
+    }
+    url.searchParams.set("client_id", settings.clientId);
+    url.searchParams.set("post_logout_redirect_uri", input.postLogoutRedirectUri);
+    url.searchParams.set("state", input.state);
+    return url.toString();
+  }
+  /**
+   * Plan §9.2's plugin health view, in the platform's own lifecycle shape
+   * (`PluginHealthCheck`, `packages/plugin/src/contracts/lifecycle.types.ts:24`).
+   *
+   * The three states, and why each one is the honest answer:
+   *
+   *   - **`unhealthy`** — an administrator's configuration could not be read (a
+   *     required setting is missing or blank, or `resolveSettings` refused a set
+   *     value: a non-TLS issuer outside development, or a `clockSkewSeconds`
+   *     outside FR-2's bound — the `configuration` row names the field, never the
+   *     value), or FR-14/FR-5's availability record
+   *     says the provider was last seen unusable. The second is a real outage of
+   *     this capability: sign-in is off until a **Test connection** passes.
+   *   - **`healthy`** — the settings resolve and this process has successfully
+   *     read the discovery document or the key set.
+   *   - **`unknown`** — the settings resolve but nothing has been read yet. A
+   *     plugin that has not been called is not a broken plugin, and reporting
+   *     `unhealthy` for it would make every installation that does not use Ever ID
+   *     render a red health row (the plugin ships `autoEnable: false`).
+   *
+   * Everything it answers is a **name, a closed code or a number** (FR-16): the
+   * check ids are this file's own, the unavailability reason is
+   * {@link OidcProviderUnavailableReason}'s closed set, the timestamps are epoch
+   * milliseconds, and no message carries the issuer, the client id, the client
+   * secret or any part of a token. `duration` is measured on the injected clock
+   * around the one await this method performs, so a caller (and a spec) can see
+   * how long the settings read took.
+   */
+  async healthCheck() {
+    const startedAt = this.now();
+    const resolved = await this.resolveSettings();
+    const configured = resolved.ok;
+    const discoveryRefreshedAt = this.discoveryReader?.lastRefreshedAt ?? null;
+    const jwksRefreshedAt = this.jwksRefreshedAtMs;
+    const unavailable = configured && this.unavailableSinceMs !== null;
+    const overall = !configured || unavailable ? "unhealthy" : discoveryRefreshedAt !== null || jwksRefreshedAt !== null ? "healthy" : "unknown";
+    const checks = [
+      {
+        name: "configuration",
+        status: configured ? "healthy" : "unhealthy",
+        // The refused fields by NAME, exactly as `testConnection` reports them:
+        // `resolveSettings` also refuses a set issuer (the non-TLS gate) and a set
+        // `clockSkewSeconds` (the FR-2 bound), and a fixed "issuer, client id or
+        // client secret is missing" would send the operator to the wrong field.
+        message: resolved.ok ? "The issuer, client id and client secret are set." : `Not configured: ${resolved.missing.join(", ")}.`
+      },
+      {
+        name: "availability",
+        status: unavailable ? "unhealthy" : configured ? "healthy" : "unknown",
+        message: unavailable ? `The provider was last seen unusable (${this.unavailableReason ?? "discoveryFailed"}); sign-in stays off until Test connection passes.` : "No unusable run has been recorded.",
+        data: {
+          unavailableSince: this.unavailableSinceMs === null ? null : new Date(this.unavailableSinceMs).toISOString(),
+          unavailableReason: this.unavailableReason,
+          discoveryCacheSeconds: OIDC_DISCOVERY_CACHE_SECONDS
+        }
+      },
+      {
+        name: "discovery",
+        status: discoveryRefreshedAt === null ? "unknown" : "healthy",
+        message: discoveryRefreshedAt === null ? "The discovery document has not been read by this process yet." : "The discovery document has been read by this process.",
+        data: {
+          refreshedAt: discoveryRefreshedAt === null ? null : new Date(discoveryRefreshedAt).toISOString(),
+          cacheSeconds: OIDC_DISCOVERY_CACHE_SECONDS
+        }
+      },
+      {
+        name: "keys",
+        status: jwksRefreshedAt === null ? "unknown" : "healthy",
+        message: jwksRefreshedAt === null ? "No signing key set has been fetched by this process yet." : "A signing key set has been fetched by this process.",
+        data: {
+          refreshedAt: jwksRefreshedAt === null ? null : new Date(jwksRefreshedAt).toISOString(),
+          cacheSeconds: OIDC_JWKS_CACHE_SECONDS,
+          maxStaleSeconds: OIDC_JWKS_MAX_STALE_SECONDS
+        }
+      }
+    ];
+    return {
+      status: overall,
+      message: healthMessage(overall, this.unavailableReason),
+      checks,
+      checkedAt: this.now(),
+      duration: this.now() - startedAt
+    };
+  }
+  /**
+   * The in-process availability record plan §4.2 stores under `availability`.
+   *
+   * Additive surface for T32, which persists these into the plugin's settings row so
+   * every replica agrees within 60 seconds (FR-5): this is the same record one
+   * process holds, exposed so the persistence task does not have to re-derive when a
+   * run passed.
+   *
+   * `jwksRefreshedAt` is T7's addition — plan §9.2's health view has carried the
+   * field since T5 wrote it into the settings schema
+   * (`settings.schema.ts:262`) and nothing produced it until the key cache was
+   * wired to the flow; it is `null` until a key set has been fetched, which is
+   * exactly what plan §9.2's admin surface renders as "unknown".
+   */
+  getAvailability() {
+    const refreshedAt = this.discoveryReader?.lastRefreshedAt ?? null;
+    return {
+      unavailableSince: this.unavailableSinceMs === null ? null : new Date(this.unavailableSinceMs).toISOString(),
+      unavailableReason: this.unavailableReason,
+      discoveryRefreshedAt: refreshedAt === null ? null : new Date(refreshedAt).toISOString(),
+      jwksRefreshedAt: this.jwksRefreshedAtMs === null ? null : new Date(this.jwksRefreshedAtMs).toISOString(),
+      discoveryCacheSeconds: OIDC_DISCOVERY_CACHE_SECONDS
+    };
+  }
+  /**
+   * The settings this plugin reads, or the field names that are missing.
+   *
+   * `context.getSettings()` resolves the admin-tier values, secrets included
+   * (`SettingsSchemaValidatorService`, plan §4.2); a throw from the platform is
+   * treated exactly like an absent configuration, because the fail-closed answer is
+   * the same and neither path may surface the platform's own error text (FR-16).
+   */
+  async resolveSettings() {
+    let raw = {};
+    try {
+      raw = await this.context?.getSettings() ?? {};
+    } catch {
+      raw = {};
+    }
+    const missing = REQUIRED_SETTING_KEYS.filter(
+      (key) => typeof raw[key] !== "string" || raw[key].trim() === ""
+    );
+    if (missing.length > 0) return { ok: false, missing: [...missing] };
+    if (isInsecureIssuer(raw.issuerUrl ?? "") && !allowsInsecureIssuer(this.nodeEnv)) {
+      this.context?.logger?.error?.(
+        "OpenID Connect identity (Ever ID): `issuerUrl` is a non-TLS (http://) address and NODE_ENV is production. Refusing the integration \u2014 an http issuer would send the ID token, the client secret and the key set in clear text. Configure an https issuer."
+      );
+      return { ok: false, missing: ["issuerUrl"] };
+    }
+    if (!isClockSkewInBounds(raw.clockSkewSeconds)) {
+      this.context?.logger?.error?.(
+        `OpenID Connect identity (Ever ID): \`clockSkewSeconds\` is not a whole number of seconds from 0 to ${OIDC_MAX_CLOCK_SKEW_SECONDS} (FR-2). Refusing the integration \u2014 a tolerance outside that bound would widen or disable every token time check. Set EVER_ID_CLOCK_SKEW_SECONDS inside the bound, or unset it to use the default.`
+      );
+      return { ok: false, missing: ["clockSkewSeconds"] };
+    }
+    return { ok: true, settings: raw };
+  }
+  /** One reader per configured issuer: a settings change starts a fresh cache (FR-14). */
+  readerFor(issuerUrl) {
+    if (this.discoveryReader === void 0 || this.discoveryIssuerUrl !== issuerUrl) {
+      this.discoveryReader = new OidcDiscoveryReader({ issuerUrl, fetchImpl: this.fetchImpl, now: this.now });
+      this.discoveryIssuerUrl = issuerUrl;
+    }
+    return this.discoveryReader;
+  }
+  /**
+   * The discovery document the exchange and T8's two verifiers run against, with
+   * T6's availability errors translated to the one refusal type their callers
+   * branch on (see {@link exchangeAuthorizationCode}'s error contract).
+   *
+   * Named for the verification path rather than the exchange since T8: the read is
+   * the same one FR-14's cache and issuer-drift refusal describe, and an access
+   * token or a sign-out notice needs the same document for the same reason — the
+   * `jwks_uri` and the issuer its claims are compared against.
+   */
+  async discoveryForVerification(issuerUrl) {
+    try {
+      return await this.readerFor(issuerUrl).get();
+    } catch (error) {
+      if (error instanceof OidcProviderUnavailableError) {
+        throw new IdentityTokenRejectedError("providerUnavailable");
+      }
+      throw error;
+    }
+  }
+  /**
+   * The one POST of the sign-in flow (FR-15, FR-19).
+   *
+   * `client_secret_basic` is plan §4.2's authentication method for this provider,
+   * and `ClientSecretBasic` from `openid-client` is what produces the header —
+   * the same function the library's own grant calls use, so the encoding of the
+   * credentials (`application/x-www-form-urlencoded` then base64, RFC 6749
+   * §2.3.1) is not re-implemented here. `client_id` is therefore **not** in the
+   * body: RFC 6749 §4.1.3 requires it only "if the client is not authenticating
+   * with the authorization server", and sending it twice is a habit providers
+   * tolerate rather than a requirement they state.
+   *
+   * The response is read as JSON and the `id_token` taken from it. Every way the
+   * call can fail is one code — `providerUnavailable` — because the closed
+   * vocabulary has no code for "the provider refused the grant" and a precise
+   * code with the wrong meaning is worse than a coarse one that is right (see the
+   * report for T4/T25: an `invalid_grant` therefore reaches the API as 503 today).
+   */
+  async redeemAuthorizationCode(input, settings, tokenEndpoint) {
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code: input.code,
+      redirect_uri: input.redirectUri,
+      code_verifier: input.codeVerifier
+    });
+    const headers = new Headers();
+    ClientSecretBasic(settings.clientSecret)(
+      { issuer: settings.issuerUrl, token_endpoint: tokenEndpoint },
+      { client_id: settings.clientId, token_endpoint_auth_method: "client_secret_basic" },
+      body,
+      headers
+    );
+    const result = await fetchJsonOnce(
+      {
+        url: tokenEndpoint,
+        method: "POST",
+        body: body.toString(),
+        contentType: "application/x-www-form-urlencoded",
+        headers: { authorization: headers.get("authorization") ?? "" }
+      },
+      { fetchImpl: this.fetchImpl, now: this.now }
+    );
+    if (!result.ok) throw new IdentityTokenRejectedError("providerUnavailable");
+    const idToken = idTokenOf(result.body);
+    if (idToken === null) throw new IdentityTokenRejectedError("providerUnavailable");
+    return idToken;
+  }
+  /**
+   * FR-11's first two clauses, through T6's key cache: the algorithm allow-list
+   * and the signature, with the cache's own ladder (600 s, 30 s, 21,600 s) and
+   * its `providerUnavailable` end.
+   *
+   * **One implementation for all three token kinds.** T7 wrote it for the ID token
+   * and named it for one; T8's `verifyAccessToken` and `verifyLogoutToken` call the
+   * same method, because "the algorithm is one of RS256/ES256/EdDSA and the
+   * signature verifies against a key Ever ID published, inside FR-13's ladder" is
+   * one rule and FR-45/FR-33 both adopt it by reference ("validated like FR-11 and
+   * FR-13"). A second copy would be a second place for the ladder to drift.
+   *
+   * Both of T6's error types become `IdentityTokenRejectedError`: `badAlg` and
+   * `badSignature` keep their code, and anything the cache could not answer
+   * because the provider is unreachable or its keys are stale is
+   * `providerUnavailable`. An error that is neither is a bug in this package
+   * rather than a verdict about a token, so it propagates instead of being
+   * disguised as a provider outage — no claims are returned either way, which is
+   * what fail-closed means here.
+   */
+  async verifyProviderSignature(compactJws, jwksUri) {
+    try {
+      return await this.jwksFor(jwksUri).verify(compactJws);
+    } catch (error) {
+      if (error instanceof OidcJwksVerificationError) throw new IdentityTokenRejectedError(error.code);
+      if (error instanceof OidcProviderUnavailableError) {
+        throw new IdentityTokenRejectedError("providerUnavailable");
+      }
+      throw error;
+    }
+  }
+  /** One key cache per resolved `jwks_uri`; a provider that moves its keys starts a fresh one (FR-13). */
+  jwksFor(jwksUri) {
+    if (this.jwksCache === void 0 || this.jwksUri !== jwksUri) {
+      this.jwksCache = new OidcJwksCache({
+        jwksUri,
+        fetchImpl: this.fetchImpl,
+        now: this.now,
+        // Plan §9.2's `jwksRefreshedAt`, and nothing else: a *failed* fetch
+        // does not move it, which is what makes FR-13's staleness window
+        // readable from outside the cache.
+        onRefreshed: (refreshedAt) => {
+          this.jwksRefreshedAtMs = refreshedAt;
+        }
+      });
+      this.jwksUri = jwksUri;
+    }
+    return this.jwksCache;
+  }
+  /**
+   * The `openid-client` configuration for one document and one resolved settings
+   * object — used for `buildAuthorizationUrl`, which is a pure URL builder (no
+   * socket, no timer), and for nothing else.
+   *
+   * The rest of the flow does not go through `openid-client`'s `authorizationCodeGrant`,
+   * and that is a measured decision rather than an omission: that call validates
+   * the ID token itself against its own remote key set, which caches for 600
+   * seconds and **keeps using a stale set indefinitely** — the opposite of FR-13's
+   * 21,600-second fail-closed end that `jwks-cache.ts` exists to enforce — and it
+   * applies its own `clockTolerance` to the time claims, which would decide
+   * FR-11's skew edges instead of the administrator's configured
+   * `clockSkewSeconds`. Plan §4.2 names the library for this flow; where its
+   * built-in policy contradicts the spec, the spec's own module wins and the
+   * library keeps the parts that are exactly right (`buildAuthorizationUrl`,
+   * `calculatePKCECodeChallenge`, `ClientSecretBasic`) — the same trade T6
+   * documented for `discovery()`.
+   */
+  configurationFor(document, settings) {
+    const configuration = new Configuration(
+      // The document was read from the wire, so the cast is the same one
+      // `asDiscoveryDocument` makes on the way in: the fields this flow reads are
+      // the ones typed above, and every other claim is passed through as published.
+      document,
+      settings.clientId,
+      settings.clientSecret,
+      // Plan §4.2's `client_secret_basic`. Passing the secret as metadata would
+      // select `openid-client`'s default, which is `client_secret_post` — a
+      // different authentication method than the one this installation registers.
+      ClientSecretBasic(settings.clientSecret)
+    );
+    if (isInsecureIssuer(settings.issuerUrl)) {
+      if (!allowsInsecureIssuer(this.nodeEnv)) {
+        throw new OidcProviderUnavailableError("notConfigured");
+      }
+      allowInsecureRequests(configuration);
+    }
+    return configuration;
+  }
+  /** Exactly `length` random bytes, from the injected seam or the platform CSPRNG (FR-9). */
+  random(length) {
+    return (this.randomBytes ?? defaultRandomBytes)(length);
+  }
+  /** Set or clear plan §4.2's `unavailableSince` from the five checks that gate it. */
+  applyAvailability(checks) {
+    const failed = checks.find((check) => FR3_REQUIRED_CHECK_IDS.includes(check.id) && !check.ok);
+    if (failed === void 0) {
+      this.unavailableSinceMs = null;
+      this.unavailableReason = null;
+      return;
+    }
+    this.recordUnavailable(failed.id === "issuerMatch" ? "issuerDrift" : "discoveryFailed");
+  }
+  /** FR-14/FR-5: the provider is off from the first failing run until a passing one. */
+  recordUnavailable(reason) {
+    if (this.unavailableSinceMs === null) this.unavailableSinceMs = this.now();
+    this.unavailableReason = reason;
+  }
+  /**
+   * One log line per run, and it carries counts and check **ids** only.
+   *
+   * Ids come from the closed contract set, never from the provider, so nothing a
+   * provider chose to send can reach a log through this path (FR-16).
+   */
+  logChecks(checks) {
+    const passed = checks.filter((check) => check.ok).length;
+    const failing = checks.filter((check) => !check.ok).map((check) => check.id);
+    const suffix = failing.length === 0 ? "" : ` \u2014 failing: ${failing.join(", ")}`;
+    this.context?.logger.log(`Test connection: ${passed}/${checks.length} checks passed${suffix}`);
+  }
+  getManifest() {
+    return {
+      id: this.id,
+      name: this.name,
+      version: this.version,
+      description: "OpenID Connect relying party for Ever ID: browser sign-in, connected identities, delegated reads and back-channel logout",
+      category: this.category,
+      capabilities: [...this.capabilities],
+      author: { name: "Ever Works Team" },
+      license: "AGPL-3.0",
+      builtIn: true,
+      // The installation opts in explicitly: discovery lists it disabled (FR-5's
+      // kill switch is the plugin toggle, plan §9.2).
+      autoEnable: false
+    };
+  }
+};
+var oidc_identity_plugin_default = OidcIdentityPlugin;
+var REQUIRED_SETTING_KEYS = ["issuerUrl", "clientId", "clientSecret"];
+var defaultRandomBytes = (length) => new Uint8Array(randomBytes(length));
+function encodeBase64Url(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+var NON_PRODUCTION_NODE_ENVS = /* @__PURE__ */ new Set(["development", "test"]);
+function allowsInsecureIssuer(nodeEnv) {
+  return NON_PRODUCTION_NODE_ENVS.has((nodeEnv ?? process.env.NODE_ENV ?? "").trim().toLowerCase());
+}
+function isInsecureIssuer(issuerUrl) {
+  try {
+    return new URL(issuerUrl).protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+function isClockSkewInBounds(value) {
+  if (value === void 0 || value === null) return true;
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= OIDC_MAX_CLOCK_SKEW_SECONDS;
+}
+function idTokenOf(body) {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) return null;
+  return nonEmpty(body.id_token) ?? null;
+}
+function idTokenClaims(payload, rules) {
+  const issuer = trustedIssuer(payload, rules);
+  const audiences = audiencesOf(payload.aud);
+  if (audiences === null || !audiences.includes(rules.clientId)) {
+    throw new IdentityTokenRejectedError("badAudience");
+  }
+  if (audiences.length > 1 && payload.azp !== rules.clientId) {
+    throw new IdentityTokenRejectedError("badAuthorizedParty");
+  }
+  tokenTimes(payload, rules, OIDC_ID_TOKEN_MAX_AGE_SECONDS);
+  if (payload.nonce !== rules.expectedNonce) throw new IdentityTokenRejectedError("badNonce");
+  const subject = subjectOf(payload);
+  const authTime = secondsClaim(payload.auth_time);
+  if (rules.maxAuthAgeSeconds !== void 0) {
+    if (authTime === null || authTime < rules.nowSeconds - rules.maxAuthAgeSeconds - rules.skewSeconds) {
+      throw new IdentityTokenRejectedError("tooOld");
+    }
+  }
+  const claims = {
+    issuer,
+    subject,
+    // FR-23/FR-24/FR-25 branch on the pair (`email`, `email_verified`), and the
+    // contract's "absent or unusable is `null`" is what makes `email: null` and
+    // `emailVerified: false` two different states rather than one.
+    email: nonEmpty(payload.email) ?? null,
+    emailVerified: payload.email_verified === true,
+    name: nonEmpty(payload.name) ?? null,
+    authTime,
+    sid: nonEmpty(payload.sid) ?? null
+  };
+  const hints = everHintClaims(payload);
+  if (hints !== void 0) claims.hints = hints;
+  return claims;
+}
+var OIDC_HINT_CLAIM_PREFIX = "urn:ever:";
+var OIDC_HINT_CLAIMS_MAX = 32;
+function everHintClaims(payload) {
+  const out = {};
+  let count = 0;
+  for (const [key, value] of Object.entries(payload)) {
+    if (!key.startsWith(OIDC_HINT_CLAIM_PREFIX)) continue;
+    if (count >= OIDC_HINT_CLAIMS_MAX) break;
+    out[key] = value;
+    count += 1;
+  }
+  return count === 0 ? void 0 : Object.freeze(out);
+}
+function trustedIssuer(payload, rules) {
+  const issuer = payload.iss;
+  if (typeof issuer !== "string" || issuer !== rules.issuer || !rules.allowedIssuers.includes(issuer)) {
+    throw new IdentityTokenRejectedError("badIssuer");
+  }
+  return issuer;
+}
+function assertNotExpired(payload, rules) {
+  const expiresAt = secondsClaim(payload.exp);
+  if (expiresAt !== null && expiresAt <= rules.nowSeconds - rules.skewSeconds) {
+    throw new IdentityTokenRejectedError("expired");
+  }
+  return expiresAt;
+}
+function assertIssuedAt(payload, rules, maxAgeSeconds) {
+  const issuedAt = secondsClaim(payload.iat);
+  if (issuedAt === null) throw new IdentityTokenRejectedError("tooOld");
+  if (issuedAt > rules.nowSeconds + rules.skewSeconds) throw new IdentityTokenRejectedError("notYetValid");
+  if (maxAgeSeconds !== void 0 && issuedAt < rules.nowSeconds - maxAgeSeconds) {
+    throw new IdentityTokenRejectedError("tooOld");
+  }
+  return issuedAt;
+}
+function tokenTimes(payload, rules, maxAgeSeconds) {
+  const expiresAt = assertNotExpired(payload, rules);
+  if (expiresAt === null) throw new IdentityTokenRejectedError("expired");
+  return { issuedAt: assertIssuedAt(payload, rules, maxAgeSeconds), expiresAt };
+}
+function subjectOf(payload) {
+  const subject = payload.sub;
+  if (typeof subject !== "string" || subject.length < 1 || subject.length > OIDC_SUBJECT_MAX_LENGTH) {
+    throw new IdentityTokenRejectedError("badSignature");
+  }
+  return subject;
+}
+function scopesOf(value) {
+  if (typeof value !== "string") return [];
+  return [...new Set(value.split(/\s+/u).filter((scope) => scope.length > 0))];
+}
+function accessTokenClaims(payload, rules) {
+  const issuer = trustedIssuer(payload, rules);
+  const audiences = audiencesOf(payload.aud);
+  if (audiences === null || !audiences.includes(rules.apiAudience)) {
+    throw new IdentityTokenRejectedError("badAudience");
+  }
+  const scopes = scopesOf(payload.scope);
+  if (rules.requiredScopes.some((scope) => !scopes.includes(scope))) {
+    throw new IdentityTokenRejectedError("missingScope");
+  }
+  const { issuedAt, expiresAt } = tokenTimes(payload, rules, rules.maxAgeSeconds);
+  if (expiresAt - issuedAt > rules.maxLifetimeSeconds) {
+    throw new IdentityTokenRejectedError("lifetimeTooLong");
+  }
+  const authorizedParty = nonEmpty(payload.azp) ?? null;
+  if (rules.allowedAuthorizedParties !== void 0 && (authorizedParty === null || !rules.allowedAuthorizedParties.includes(authorizedParty))) {
+    throw new IdentityTokenRejectedError("badAuthorizedParty");
+  }
+  return {
+    issuer,
+    subject: subjectOf(payload),
+    audience: audiences,
+    scopes,
+    authorizedParty,
+    issuedAt,
+    expiresAt,
+    jti: nonEmpty(payload.jti) ?? null
+  };
+}
+function logoutTokenClaims(payload, rules) {
+  const issuer = trustedIssuer(payload, rules);
+  assertNotExpired(payload, rules);
+  assertIssuedAt(payload, rules, OIDC_LOGOUT_TOKEN_MAX_AGE_SECONDS);
+  const events = payload.events;
+  if (typeof events !== "object" || events === null || Array.isArray(events)) {
+    throw new IdentityTokenRejectedError("badLogoutEvent");
+  }
+  if (!Object.prototype.hasOwnProperty.call(events, OIDC_BACKCHANNEL_LOGOUT_EVENT)) {
+    throw new IdentityTokenRejectedError("badLogoutEvent");
+  }
+  if (payload.nonce !== void 0) throw new IdentityTokenRejectedError("nonceInLogoutToken");
+  const subject = optionalSubjectOf(payload.sub);
+  const sid = nonEmpty(payload.sid) ?? null;
+  if (subject === null && sid === null) {
+    throw new IdentityTokenRejectedError("badLogoutEvent");
+  }
+  const jti = nonEmpty(payload.jti);
+  if (jti === void 0) throw new IdentityTokenRejectedError("badLogoutEvent");
+  return { issuer, subject, sid, jti };
+}
+function optionalSubjectOf(value) {
+  const subject = nonEmpty(value);
+  if (subject === void 0) return null;
+  return subject.length <= OIDC_SUBJECT_MAX_LENGTH ? subject : null;
+}
+function healthMessage(status, reason) {
+  switch (status) {
+    case "healthy":
+      return "Ever ID is configured and this process has read the provider.";
+    case "unhealthy":
+      return `Ever ID is unavailable (${reason ?? "notConfigured"}); Test connection must pass before sign-in works again.`;
+    case "degraded":
+      return "Ever ID is degraded.";
+    default:
+      return "Ever ID has not been read by this process yet.";
+  }
+}
+function audiencesOf(value) {
+  if (typeof value === "string") return [value];
+  if (!Array.isArray(value) || value.length === 0) return null;
+  return value.every((entry) => typeof entry === "string") ? [...value] : null;
+}
+function secondsClaim(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function row(id, ok, detail) {
+  if (ok) return { id, ok };
+  return { id, ok, detail: detail ?? "The check failed." };
+}
+function unavailableRows(discoveryDetail, otherDetail) {
+  return FR3_CHECK_IDS.map((id, index) => row(id, false, index === 0 ? discoveryDetail : otherDetail));
+}
+function checksFromDocument(document, issuerUrl) {
+  const missingEndpoints = ["authorization_endpoint", "token_endpoint", "jwks_uri"].filter(
+    (name) => typeof document[name] !== "string" || document[name].length === 0
+  );
+  const challengeMethods = Array.isArray(document.code_challenge_methods_supported) ? document.code_challenge_methods_supported : [];
+  const signingAlgorithms = Array.isArray(document.id_token_signing_alg_values_supported) ? document.id_token_signing_alg_values_supported : [];
+  return [
+    row("discovery", true),
+    // FR-3's word is "exactly": no trailing-slash normalisation, no case folding.
+    // The allow-list (`allowedIssuers`, FR-2) is what makes a planned provider
+    // move reversible, and it is checked on the token's `iss` (§4.3), not here.
+    row(
+      "issuerMatch",
+      document.issuer === issuerUrl,
+      "The issuer the provider advertises does not match the configured issuer exactly."
+    ),
+    row(
+      "endpoints",
+      missingEndpoints.length === 0,
+      `The discovery document is missing ${missingEndpoints.join(", ")}.`
+    ),
+    row(
+      "pkceS256",
+      challengeMethods.includes("S256"),
+      "The provider does not advertise S256 code challenge support."
+    ),
+    row(
+      "signingAlg",
+      OIDC_IDENTITY_SIGNING_ALGS.some((alg) => signingAlgorithms.includes(alg)),
+      "The provider advertises none of RS256, ES256 or EdDSA."
+    ),
+    // FR-3 asks whether these two are supported; they are reported and never gate
+    // availability (see FR3_REQUIRED_CHECK_IDS).
+    row(
+      "backchannelLogout",
+      document.backchannel_logout_supported === true,
+      "The provider does not advertise back-channel logout."
+    ),
+    row(
+      "deviceAuthorization",
+      typeof document.device_authorization_endpoint === "string" && document.device_authorization_endpoint.length > 0,
+      "The provider does not advertise a device authorization endpoint."
+    )
+  ];
+}
+function discoveryFailureDetail(failure, status) {
+  switch (failure) {
+    case "timeout":
+      return "The discovery document did not answer within 5 seconds.";
+    case "httpStatus":
+      return typeof status === "number" ? `The discovery document answered HTTP ${status}.` : "The discovery document answered an error status.";
+    case "network":
+      return "The discovery document could not be reached.";
+    case "invalidBody":
+      return "The discovery document is not JSON.";
+    case "invalidDocument":
+      return "The discovery document carries no issuer.";
+    case "invalidIssuer":
+      return "The configured issuer address is not a valid URL.";
+  }
+}
+function nonEmpty(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed === "" ? void 0 : trimmed;
+}
+function localClientsOf(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    if (typeof entry !== "object" || entry === null) return [];
+    const { kind, clientId } = entry;
+    if (kind !== "cli" && kind !== "node") return [];
+    const id = nonEmpty(clientId);
+    return id === void 0 ? [] : [{ kind, clientId: id }];
+  });
+}
+export {
+  OIDC_ACCESS_TOKEN_MAX_AGE_SECONDS,
+  OIDC_ACCESS_TOKEN_MAX_LIFETIME_SECONDS,
+  OIDC_BACKCHANNEL_LOGOUT_EVENT,
+  OIDC_CODE_VERIFIER_BYTES,
+  OIDC_CODE_VERIFIER_LENGTH,
+  OIDC_DEFAULT_API_AUDIENCE,
+  OIDC_DEFAULT_CLOCK_SKEW_SECONDS,
+  OIDC_DELEGATED_READ_SCOPE,
+  OIDC_DISCOVERY_CACHE_SECONDS,
+  OIDC_IDENTITY_SETTING_KEYS,
+  OIDC_IDENTITY_SIGNING_ALGS,
+  OIDC_ID_TOKEN_MAX_AGE_SECONDS,
+  OIDC_JWKS_CACHE_SECONDS,
+  OIDC_JWKS_MAX_STALE_SECONDS,
+  OIDC_JWKS_UNKNOWN_KID_COOLDOWN_SECONDS,
+  OIDC_LOGOUT_TOKEN_MAX_AGE_SECONDS,
+  OIDC_LOGOUT_TOKEN_REPLAY_WINDOW_SECONDS,
+  OIDC_MAX_CLOCK_SKEW_SECONDS,
+  OIDC_NEVER_REQUESTED_SCOPES,
+  OIDC_NONCE_BYTES,
+  OIDC_OUTBOUND_MAX_ATTEMPTS,
+  OIDC_OUTBOUND_RETRY_DELAY_MS,
+  OIDC_OUTBOUND_TIMEOUT_MS,
+  OIDC_SESSION_EXCHANGE_SCOPE,
+  OIDC_SIGN_IN_SCOPE,
+  OIDC_SIGN_IN_SCOPES,
+  OIDC_STATE_BYTES,
+  OIDC_SUBJECT_MAX_LENGTH,
+  OIDC_TOKEN_SCOPES,
+  OidcDiscoveryReader,
+  OidcIdentityPlugin,
+  OidcJwksCache,
+  OidcJwksVerificationError,
+  OidcProviderUnavailableError,
+  oidc_identity_plugin_default as default,
+  fetchJsonOnce,
+  isSignInScope,
+  oidcIdentityHttpsUrlPattern,
+  oidcIdentityIssuerUrlPattern,
+  oidcIdentitySettingsSchema
+};
+/**
+ * One header finding of the licence scan (plan §2.6:324-325, FR-54): the
+ * `SPDX-License-Identifier:` / `@license` tag a file declares in its first
+ * `LICENSE_HEADER_SCAN_BYTES` bytes.
+ *
+ * **Gap, named rather than guessed:** plan §3.1:437 writes the column's third
+ * field as `headerFindings: …` without a shape. `path` is certain — it is the
+ * first field of the scan's input — and the detected identifier is the second
+ * fact the scan produces, so both are declared; anything further an
+ * implementation adds is additive.
+ */