@executor-js/plugin-openapi 1.4.28 → 1.4.30

package/dist/EditOpenApiSource-AOA7APR2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react/EditOpenApiSource.tsx"],"sourcesContent":["import { useEffect, useMemo, useRef, useState } from \"react\";\nimport { useAtomSet, useAtomValue } from \"@effect/atom-react\";\nimport * as Exit from \"effect/Exit\";\nimport * as Option from \"effect/Option\";\nimport * as Schema from \"effect/Schema\";\nimport * as AsyncResult from \"effect/unstable/reactivity/AsyncResult\";\n\nimport {\n  connectionsAtom,\n  configureSource,\n  setSourceCredentialBinding,\n  sourceAtom,\n  startOAuth,\n} from \"@executor-js/react/api/atoms\";\nimport { useScope, useUserScope } from \"@executor-js/react/api/scope-context\";\nimport { connectionWriteKeys, sourceWriteKeys } from \"@executor-js/react/api/reactivity-keys\";\nimport { Button } from \"@executor-js/react/components/button\";\nimport { CopyButton } from \"@executor-js/react/components/copy-button\";\nimport {\n  CardStack,\n  CardStackContent,\n  CardStackEntry,\n  CardStackEntryContent,\n  CardStackEntryDescription,\n  CardStackEntryTitle,\n  CardStackEntryField,\n} from \"@executor-js/react/components/card-stack\";\nimport { FieldLabel } from \"@executor-js/react/components/field\";\nimport { HelpTooltip } from \"@executor-js/react/components/help-tooltip\";\nimport { Input } from \"@executor-js/react/components/input\";\nimport { sourceWriteKeys as openApiWriteKeys } from \"@executor-js/react/api/reactivity-keys\";\nimport {\n  ConnectionId,\n  CredentialBindingRef,\n  ScopeId,\n  SetSourceCredentialBindingInput,\n} from \"@executor-js/sdk/shared\";\nimport { useSecretPickerSecrets } from \"@executor-js/react/plugins/use-secret-picker-secrets\";\nimport {\n  oauthCallbackUrl,\n  useOAuthPopupFlow,\n  type OAuthCompletionPayload,\n} from \"@executor-js/react/plugins/oauth-sign-in\";\nimport {\n  CredentialControlField,\n  CredentialScopeDropdown,\n  CredentialUsageRow,\n} from \"@executor-js/react/plugins/credential-target-scope\";\nimport {\n  effectiveCredentialBindingForScope,\n  exactCredentialBindingForScope,\n  isConnectionCredentialBindingValue,\n  isSecretCredentialBindingValue,\n} from \"@executor-js/react/plugins/credential-bindings\";\nimport { SecretCredentialSlotBindings } from \"@executor-js/react/plugins/credential-slot-bindings\";\nimport {\n  useSourceCredentialBindingScopes,\n  useSourceCredentialBindingWriter,\n} from \"@executor-js/react/plugins/source-credential-bindings\";\nimport { CreatableSecretPicker } from \"@executor-js/react/plugins/secret-header-auth\";\n\nimport { openApiSourceAtom, openApiSourceBindingsAtom } from \"./atoms\";\nimport { OpenApiSourceDetailsFields } from \"./OpenApiSourceDetailsFields\";\nimport {\n  OPENAPI_OAUTH_CALLBACK_PATH,\n  OPENAPI_OAUTH_POPUP_NAME,\n  inferOAuthIssuerUrl,\n  resolveOAuthUrl,\n} from \"./AddOpenApiSource\";\nimport { oauth2ClientSecretSlot } from \"../sdk/source-contracts\";\nimport { OAuth2SourceConfig } from \"../sdk/types\";\n\nconst ErrorMessage = Schema.Struct({ message: Schema.String });\nconst decodeErrorMessage = Schema.decodeUnknownOption(ErrorMessage);\n\nconst errorMessageFromExit = (exit: Exit.Exit<unknown, unknown>, fallback: string): string =>\n  Option.match(Option.flatMap(Exit.findErrorOption(exit), decodeErrorMessage), {\n    onNone: () => fallback,\n    onSome: ({ message }) => message,\n  });\n\ntype SlotDef =\n  | {\n      readonly kind: \"secret\";\n      readonly slot: string;\n      readonly label: string;\n      readonly hint?: string;\n    }\n  | {\n      readonly kind: \"oauth2\";\n      readonly slot: string;\n      readonly label: string;\n    };\n\ntype OpenApiCredentialBindingRow = CredentialBindingRef;\n\nconst slugify = (value: string): string =>\n  value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\") || \"default\";\n\nconst shortHash = (value: string): string => {\n  let hash = 0x811c9dc5;\n  for (let i = 0; i < value.length; i++) {\n    hash ^= value.charCodeAt(i);\n    hash = Math.imul(hash, 0x01000193);\n  }\n  return (hash >>> 0).toString(36).slice(0, 6);\n};\n\nconst openApiOAuthConnectionId = (\n  sourceId: string,\n  securitySchemeName: string,\n  targetScope: ScopeId,\n): ConnectionId =>\n  ConnectionId.make(\n    `openapi-oauth-${slugify(sourceId)}-${slugify(securitySchemeName)}-${shortHash(targetScope)}`,\n  );\n\nconst effectiveClientSecretSlot = (oauth2: {\n  readonly securitySchemeName: string;\n  readonly clientSecretSlot: string | null;\n}): string => oauth2.clientSecretSlot ?? oauth2ClientSecretSlot(oauth2.securitySchemeName);\n\nexport default function EditOpenApiSource(props: {\n  readonly sourceId: string;\n  readonly onSave: () => void;\n}) {\n  const displayScope = useScope();\n  const userScope = useUserScope();\n  const sourceSummaryResult = useAtomValue(sourceAtom(props.sourceId, displayScope));\n  const sourceSummary =\n    AsyncResult.isSuccess(sourceSummaryResult) && sourceSummaryResult.value\n      ? sourceSummaryResult.value\n      : null;\n  const sourceScopeId = sourceSummary?.scopeId ?? displayScope;\n  const sourceScope = ScopeId.make(sourceScopeId);\n  const {\n    credentialScopes,\n    credentialScopeOptions,\n    organizationCredentialScope,\n    secretBindingScopes,\n    scopeRanks,\n  } = useSourceCredentialBindingScopes({ sourceScope });\n\n  const sourceResult = useAtomValue(openApiSourceAtom(sourceScope, props.sourceId));\n  const bindingsResult = useAtomValue(\n    openApiSourceBindingsAtom(displayScope, props.sourceId, sourceScope),\n  );\n  const connectionsResult = useAtomValue(connectionsAtom(displayScope));\n  const secretList = useSecretPickerSecrets();\n\n  const doConfigure = useAtomSet(configureSource, { mode: \"promiseExit\" });\n  const doSetBinding = useAtomSet(setSourceCredentialBinding, {\n    mode: \"promiseExit\",\n  });\n  const doStartOAuth = useAtomSet(startOAuth, { mode: \"promiseExit\" });\n  const oauth = useOAuthPopupFlow<OAuthCompletionPayload>({\n    popupName: OPENAPI_OAUTH_POPUP_NAME,\n    popupBlockedMessage: \"OAuth popup was blocked by the browser\",\n    startErrorMessage: \"Failed to connect OAuth\",\n  });\n\n  const source =\n    AsyncResult.isSuccess(sourceResult) && sourceResult.value ? sourceResult.value : null;\n  const bindingRows: readonly OpenApiCredentialBindingRow[] = AsyncResult.isSuccess(bindingsResult)\n    ? bindingsResult.value\n    : [];\n  const connections = AsyncResult.isSuccess(connectionsResult) ? connectionsResult.value : [];\n  const oauth2RedirectUrl = oauthCallbackUrl(OPENAPI_OAUTH_CALLBACK_PATH);\n\n  const [name, setName] = useState(source?.name ?? \"\");\n  const [baseUrl, setBaseUrl] = useState(source?.config.baseUrl ?? \"\");\n  const [sourceSaveState, setSourceSaveState] = useState<\"idle\" | \"saving\" | \"saved\">(\"idle\");\n  const [error, setError] = useState<string | null>(null);\n  const [busyKey, setBusyKey] = useState<string | null>(null);\n  const sourceBindingWriter = useSourceCredentialBindingWriter({\n    displayScope,\n    source: { id: props.sourceId, scope: sourceScope },\n    onError: setError,\n    errorMessageFromExit,\n  });\n  const [pendingOAuthConnection, setPendingOAuthConnection] = useState<{\n    readonly scopeId: ScopeId;\n    readonly slot: string;\n    readonly connectionId: string;\n  } | null>(null);\n  const [loadedSourceKey, setLoadedSourceKey] = useState<string | null>(null);\n  const [selectedOAuthTokenScope, setSelectedOAuthTokenScope] = useState<string>(\n    userScope !== sourceScopeId ? userScope : sourceScopeId,\n  );\n  const [selectedOAuthClientIdScope, setSelectedOAuthClientIdScope] =\n    useState<string>(sourceScopeId);\n  const [selectedOAuthClientSecretScope, setSelectedOAuthClientSecretScope] =\n    useState<string>(sourceScopeId);\n  const [oauthEndpointsOpen, setOAuthEndpointsOpen] = useState(false);\n  const [oauth2AuthorizationUrl, setOAuth2AuthorizationUrl] = useState(\n    source?.config.oauth2?.authorizationUrl ?? \"\",\n  );\n  const [oauth2TokenUrl, setOAuth2TokenUrl] = useState(source?.config.oauth2?.tokenUrl ?? \"\");\n  const [oauth2EndpointsSaveState, setOAuth2EndpointsSaveState] = useState<\n    \"idle\" | \"saving\" | \"saved\"\n  >(\"idle\");\n  const editIdentity = useMemo(\n    () => ({\n      name,\n      namespace: props.sourceId,\n      setName,\n      setNamespace: () => {},\n      reset: () => {},\n    }),\n    [name, props.sourceId],\n  );\n  const sourceSaveSeq = useRef(0);\n  const oauth2EndpointsSaveSeq = useRef(0);\n\n  useEffect(() => {\n    setSelectedOAuthTokenScope(userScope !== sourceScopeId ? userScope : sourceScopeId);\n    setSelectedOAuthClientIdScope(sourceScopeId);\n    setSelectedOAuthClientSecretScope(sourceScopeId);\n  }, [sourceScopeId, userScope]);\n\n  useEffect(() => {\n    if (!source) return;\n    const sourceKey = `${sourceScopeId}:${source.namespace}`;\n    if (loadedSourceKey === sourceKey) return;\n    setName(source.name);\n    setBaseUrl(source.config.baseUrl ?? \"\");\n    setOAuth2AuthorizationUrl(source.config.oauth2?.authorizationUrl ?? \"\");\n    setOAuth2TokenUrl(source.config.oauth2?.tokenUrl ?? \"\");\n    setOAuth2EndpointsSaveState(\"idle\");\n    setOAuthEndpointsOpen(false);\n    setSourceSaveState(\"idle\");\n    setLoadedSourceKey(sourceKey);\n  }, [loadedSourceKey, source, sourceScopeId]);\n\n  useEffect(() => {\n    if (!source) return;\n    const sourceKey = `${sourceScopeId}:${source.namespace}`;\n    if (loadedSourceKey !== sourceKey) return;\n\n    const nextName = name.trim();\n    const nextBaseUrl = baseUrl.trim();\n    const currentName = source.name;\n    const currentBaseUrl = source.config.baseUrl ?? \"\";\n    if ((nextName || currentName) === currentName && nextBaseUrl === currentBaseUrl) {\n      return;\n    }\n\n    const timeout = window.setTimeout(() => {\n      const seq = ++sourceSaveSeq.current;\n      setSourceSaveState(\"saving\");\n      setError(null);\n      void (async () => {\n        const exit = await doConfigure({\n          params: { scopeId: displayScope },\n          payload: {\n            source: { id: props.sourceId, scope: sourceScope },\n            scope: sourceScope,\n            type: \"openapi\",\n            config: {\n              scope: sourceScope,\n              name: nextName || undefined,\n              baseUrl: nextBaseUrl || undefined,\n            },\n          },\n          reactivityKeys: openApiWriteKeys,\n        });\n        if (sourceSaveSeq.current !== seq) return;\n        if (Exit.isFailure(exit)) {\n          setSourceSaveState(\"idle\");\n          setError(errorMessageFromExit(exit, \"Failed to save source details\"));\n          return;\n        }\n        setSourceSaveState(\"saved\");\n        window.setTimeout(() => {\n          if (sourceSaveSeq.current === seq) setSourceSaveState(\"idle\");\n        }, 1600);\n      })();\n    }, 600);\n\n    return () => window.clearTimeout(timeout);\n  }, [\n    baseUrl,\n    displayScope,\n    doConfigure,\n    loadedSourceKey,\n    name,\n    props.sourceId,\n    source,\n    sourceScope,\n    sourceScopeId,\n  ]);\n\n  const secretSlots = useMemo(() => {\n    if (!source) return [] as SlotDef[];\n    const slots: SlotDef[] = [];\n    for (const [headerName, value] of Object.entries(source.config.headers ?? {})) {\n      if (typeof value === \"string\") continue;\n      slots.push({\n        kind: \"secret\",\n        slot: value.slot,\n        label: headerName,\n        hint: value.prefix ? `Prefix: ${value.prefix}` : undefined,\n      });\n    }\n    if (source.config.oauth2) {\n      const clientSecretSlot = effectiveClientSecretSlot(source.config.oauth2);\n      slots.push({\n        kind: \"secret\",\n        slot: source.config.oauth2.clientIdSlot,\n        label: \"Client ID\",\n      });\n      slots.push({\n        kind: \"secret\",\n        slot: clientSecretSlot,\n        label: \"Client Secret\",\n        hint:\n          source.config.oauth2.flow === \"authorizationCode\"\n            ? \"Optional for public PKCE clients\"\n            : undefined,\n      });\n      slots.push({\n        kind: \"oauth2\",\n        slot: source.config.oauth2.connectionSlot,\n        label:\n          source.config.oauth2.flow === \"clientCredentials\"\n            ? \"OAuth Client Credentials\"\n            : \"OAuth Authorization Code\",\n      });\n    }\n    return slots;\n  }, [source]);\n\n  const activeOAuthTokenScope =\n    credentialScopes.find((entry) => entry.scopeId === selectedOAuthTokenScope) ??\n    credentialScopes[0]!;\n  const activeOAuthTokenScopeId = activeOAuthTokenScope.scopeId;\n  const activeOAuthTokenScopeLabel = activeOAuthTokenScope.label;\n\n  if (!source) {\n    return (\n      <div className=\"space-y-3\">\n        <h1 className=\"text-xl font-semibold text-foreground\">Edit OpenAPI Source</h1>\n        <p className=\"text-sm text-muted-foreground\">Loading configuration…</p>\n      </div>\n    );\n  }\n  const oauthClientSecretSlot = source.config.oauth2\n    ? effectiveClientSecretSlot(source.config.oauth2)\n    : null;\n  const nonOAuthSecretSlots = secretSlots.filter(\n    (slot) =>\n      slot.kind === \"secret\" &&\n      (!source.config.oauth2 ||\n        (slot.slot !== source.config.oauth2.clientIdSlot && slot.slot !== oauthClientSecretSlot)),\n  );\n\n  const connectOAuth = async (targetScope: ScopeId) => {\n    const oauth2 = source.config.oauth2;\n    if (!oauth2) return;\n    const clientIdBinding = effectiveCredentialBindingForScope(\n      bindingRows,\n      oauth2.clientIdSlot,\n      targetScope,\n      scopeRanks,\n    );\n    const clientSecretSlot = effectiveClientSecretSlot(oauth2);\n    const clientSecretBinding = effectiveCredentialBindingForScope(\n      bindingRows,\n      clientSecretSlot,\n      targetScope,\n      scopeRanks,\n    );\n    if (!clientIdBinding || !isSecretCredentialBindingValue(clientIdBinding.value)) {\n      setError(\"Client ID must be bound before connecting\");\n      return;\n    }\n    const clientIdSecretId = clientIdBinding.value.secretId;\n    const clientIdSecretScopeId = clientIdBinding.value.secretScopeId ?? clientIdBinding.scopeId;\n    if (\n      oauth2.flow === \"clientCredentials\" &&\n      (!clientSecretBinding || !isSecretCredentialBindingValue(clientSecretBinding.value))\n    ) {\n      setError(\"Client secret must be bound before connecting\");\n      return;\n    }\n    const clientSecretValue =\n      oauth2.flow === \"clientCredentials\" &&\n      clientSecretBinding &&\n      isSecretCredentialBindingValue(clientSecretBinding.value)\n        ? clientSecretBinding.value\n        : null;\n    const clientSecretSecretScopeId =\n      clientSecretBinding && isSecretCredentialBindingValue(clientSecretBinding.value)\n        ? (clientSecretBinding.value.secretScopeId ?? clientSecretBinding.scopeId)\n        : null;\n\n    const existingConnection = exactCredentialBindingForScope(\n      bindingRows,\n      oauth2.connectionSlot,\n      targetScope,\n    );\n    const connectionId =\n      existingConnection && isConnectionCredentialBindingValue(existingConnection.value)\n        ? existingConnection.value.connectionId\n        : openApiOAuthConnectionId(props.sourceId, oauth2.securitySchemeName, targetScope);\n\n    setBusyKey(`${targetScope}:${oauth2.connectionSlot}:connect`);\n    setPendingOAuthConnection({\n      scopeId: targetScope,\n      slot: oauth2.connectionSlot,\n      connectionId: connectionId,\n    });\n    setError(null);\n    const failConnect = (message: string) => {\n      setError(message);\n      setPendingOAuthConnection(null);\n      setBusyKey(null);\n    };\n    const displayName = source.name;\n    const tokenUrl = resolveOAuthUrl(oauth2.tokenUrl, source.config.baseUrl ?? \"\");\n    if (oauth2.flow === \"clientCredentials\") {\n      const startOAuthExit = await doStartOAuth({\n        params: { scopeId: targetScope },\n        payload: {\n          endpoint: tokenUrl,\n          redirectUrl: tokenUrl,\n          connectionId: connectionId,\n          tokenScope: targetScope,\n          strategy: {\n            kind: \"client-credentials\",\n            tokenEndpoint: tokenUrl,\n            clientIdSecretId,\n            clientIdSecretScopeId: String(clientIdSecretScopeId),\n            clientSecretSecretId: clientSecretValue!.secretId,\n            clientSecretSecretScopeId: clientSecretSecretScopeId\n              ? String(clientSecretSecretScopeId)\n              : null,\n            scopes: [...oauth2.scopes],\n          },\n          pluginId: \"openapi\",\n          identityLabel: `${displayName} OAuth`,\n        },\n      });\n      if (Exit.isFailure(startOAuthExit)) {\n        failConnect(errorMessageFromExit(startOAuthExit, \"Failed to connect OAuth\"));\n        return;\n      }\n      const response = startOAuthExit.value;\n      if (!response.completedConnection) {\n        failConnect(\"Unexpected OAuth response\");\n        return;\n      }\n      const setBindingExit = await doSetBinding({\n        params: { scopeId: displayScope },\n        payload: SetSourceCredentialBindingInput.make({\n          source: { id: props.sourceId, scope: sourceScope },\n          scope: targetScope,\n          slotKey: oauth2.connectionSlot,\n          value: {\n            kind: \"connection\",\n            connectionId: ConnectionId.make(response.completedConnection.connectionId),\n          },\n        }),\n        reactivityKeys: [...sourceWriteKeys, ...connectionWriteKeys],\n      });\n      if (Exit.isFailure(setBindingExit)) {\n        failConnect(errorMessageFromExit(setBindingExit, \"Failed to connect OAuth\"));\n        return;\n      }\n      setPendingOAuthConnection(null);\n      setBusyKey(null);\n      return;\n    }\n\n    const authorizationUrl = resolveOAuthUrl(\n      oauth2.authorizationUrl ?? \"\",\n      source.config.baseUrl ?? \"\",\n    );\n    const issuerUrl = oauth2.issuerUrl ?? inferOAuthIssuerUrl(authorizationUrl);\n    const startOAuthExit = await doStartOAuth({\n      params: { scopeId: targetScope },\n      payload: {\n        endpoint: authorizationUrl,\n        connectionId,\n        tokenScope: targetScope,\n        redirectUrl: oauth2RedirectUrl,\n        strategy: {\n          kind: \"authorization-code\",\n          authorizationEndpoint: authorizationUrl,\n          tokenEndpoint: tokenUrl,\n          issuerUrl,\n          clientIdSecretId,\n          clientIdSecretScopeId: String(clientIdSecretScopeId),\n          clientSecretSecretId:\n            clientSecretBinding && isSecretCredentialBindingValue(clientSecretBinding.value)\n              ? clientSecretBinding.value.secretId\n              : null,\n          clientSecretSecretScopeId: clientSecretSecretScopeId\n            ? String(clientSecretSecretScopeId)\n            : null,\n          scopes: [...oauth2.scopes],\n        },\n        pluginId: \"openapi\",\n        identityLabel: `${displayName} OAuth`,\n      },\n    });\n    if (Exit.isFailure(startOAuthExit)) {\n      failConnect(errorMessageFromExit(startOAuthExit, \"Failed to connect OAuth\"));\n      return;\n    }\n    const response = startOAuthExit.value;\n    if (response.authorizationUrl === null) {\n      failConnect(\"Unexpected OAuth response\");\n      return;\n    }\n\n    await oauth.openAuthorization({\n      tokenScope: targetScope,\n      run: async () => ({\n        sessionId: response.sessionId,\n        authorizationUrl: response.authorizationUrl,\n      }),\n      onSuccess: async (result) => {\n        const setBindingExit = await doSetBinding({\n          params: { scopeId: displayScope },\n          payload: SetSourceCredentialBindingInput.make({\n            source: { id: props.sourceId, scope: sourceScope },\n            scope: targetScope,\n            slotKey: oauth2.connectionSlot,\n            value: {\n              kind: \"connection\",\n              connectionId: ConnectionId.make(result.connectionId),\n            },\n          }),\n          reactivityKeys: [...sourceWriteKeys, ...connectionWriteKeys],\n        });\n        if (Exit.isFailure(setBindingExit)) {\n          failConnect(errorMessageFromExit(setBindingExit, \"Failed to connect OAuth\"));\n          return;\n        }\n        setPendingOAuthConnection(null);\n        setBusyKey(null);\n      },\n      onError: (message) => {\n        setError(message);\n        setPendingOAuthConnection(null);\n        setBusyKey(null);\n      },\n    });\n  };\n\n  return (\n    <div className=\"space-y-6\">\n      <div>\n        <h1 className=\"text-xl font-semibold text-foreground\">OpenAPI Source</h1>\n      </div>\n\n      <OpenApiSourceDetailsFields\n        title=\"Source Details\"\n        description=\"Name and base URL save automatically.\"\n        identity={editIdentity}\n        baseUrl={baseUrl}\n        onBaseUrlChange={setBaseUrl}\n        specUrl={source.config.sourceUrl ?? \"\"}\n        onSpecUrlChange={() => {}}\n        specUrlDisabled\n        namespaceReadOnly\n        saveState={sourceSaveState}\n        footer={\n          source.config.oauth2\n            ? `Authentication Template: OAuth2 ${source.config.oauth2.flow}`\n            : Object.keys(source.config.headers ?? {}).length > 0\n              ? `Authentication Template: ${Object.keys(source.config.headers ?? {}).length} header binding${\n                  Object.keys(source.config.headers ?? {}).length === 1 ? \"\" : \"s\"\n                }`\n              : \"Authentication Template: None\"\n        }\n      />\n\n      <CardStack>\n        <CardStackContent className=\"border-t-0\">\n          {nonOAuthSecretSlots.length > 0 && (\n            <>\n              <CardStackEntry>\n                <CardStackEntryContent>\n                  <CardStackEntryTitle>Request credentials</CardStackEntryTitle>\n                  <CardStackEntryDescription>\n                    Headers and query parameters sent with every API request.\n                  </CardStackEntryDescription>\n                </CardStackEntryContent>\n              </CardStackEntry>\n\n              <SecretCredentialSlotBindings\n                slots={nonOAuthSecretSlots}\n                bindingScopes={secretBindingScopes}\n                bindingRows={bindingRows}\n                scopeRanks={scopeRanks}\n                secrets={secretList}\n                sourceId={props.sourceId}\n                sourceName={source.name}\n                credentialScopeOptions={credentialScopeOptions}\n                busyKey={sourceBindingWriter.busyKey}\n                onSetSecretBinding={sourceBindingWriter.setSecretBinding}\n                onClearBinding={sourceBindingWriter.clearBinding}\n              />\n            </>\n          )}\n\n          {source.config.oauth2 &&\n            (() => {\n              const oauth2 = source.config.oauth2;\n              const trimmedAuthUrl = oauth2AuthorizationUrl.trim();\n              const trimmedTokenUrl = oauth2TokenUrl.trim();\n              const savedAuthUrl = oauth2.authorizationUrl ?? \"\";\n              const isAuthCode = oauth2.flow === \"authorizationCode\";\n              const endpointsDirty =\n                (isAuthCode && trimmedAuthUrl !== savedAuthUrl) ||\n                trimmedTokenUrl !== oauth2.tokenUrl;\n              const saving = oauth2EndpointsSaveState === \"saving\";\n              const tokenUrlMissing = trimmedTokenUrl.length === 0;\n              const authUrlMissing = isAuthCode && trimmedAuthUrl.length === 0;\n              const canSave = endpointsDirty && !saving && !tokenUrlMissing && !authUrlMissing;\n\n              const saveOAuth2Endpoints = async () => {\n                const seq = ++oauth2EndpointsSaveSeq.current;\n                setOAuth2EndpointsSaveState(\"saving\");\n                setError(null);\n                const exit = await doConfigure({\n                  params: { scopeId: displayScope },\n                  payload: {\n                    source: { id: props.sourceId, scope: sourceScope },\n                    scope: sourceScope,\n                    type: \"openapi\",\n                    config: {\n                      scope: sourceScope,\n                      oauth2Source: OAuth2SourceConfig.make({\n                        kind: \"oauth2\",\n                        securitySchemeName: oauth2.securitySchemeName,\n                        flow: oauth2.flow,\n                        tokenUrl: trimmedTokenUrl,\n                        authorizationUrl: isAuthCode ? trimmedAuthUrl || null : null,\n                        issuerUrl: oauth2.issuerUrl ?? null,\n                        clientIdSlot: oauth2.clientIdSlot,\n                        clientSecretSlot: oauth2.clientSecretSlot,\n                        connectionSlot: oauth2.connectionSlot,\n                        scopes: [...oauth2.scopes],\n                      }),\n                    },\n                  },\n                  reactivityKeys: openApiWriteKeys,\n                });\n                if (oauth2EndpointsSaveSeq.current !== seq) return;\n                if (Exit.isFailure(exit)) {\n                  setOAuth2EndpointsSaveState(\"idle\");\n                  setError(errorMessageFromExit(exit, \"Failed to save OAuth endpoints\"));\n                  return;\n                }\n                setOAuth2EndpointsSaveState(\"saved\");\n                window.setTimeout(() => {\n                  if (oauth2EndpointsSaveSeq.current === seq) {\n                    setOAuth2EndpointsSaveState(\"idle\");\n                  }\n                }, 1600);\n              };\n\n              const exact = exactCredentialBindingForScope(\n                bindingRows,\n                oauth2.connectionSlot,\n                activeOAuthTokenScopeId,\n              );\n              const binding =\n                exact ??\n                effectiveCredentialBindingForScope(\n                  bindingRows,\n                  oauth2.connectionSlot,\n                  activeOAuthTokenScopeId,\n                  scopeRanks,\n                );\n              const connectionBinding =\n                binding && isConnectionCredentialBindingValue(binding.value) ? binding.value : null;\n              const connection = connectionBinding\n                ? connections.find((entry) => entry.id === connectionBinding.connectionId)\n                : null;\n              const bindingScopeId = connectionBinding && binding ? binding.scopeId : null;\n              const isConnecting =\n                busyKey === `${activeOAuthTokenScopeId}:${oauth2.connectionSlot}:connect`;\n              const isPendingOAuthConnection =\n                pendingOAuthConnection?.scopeId === activeOAuthTokenScopeId &&\n                pendingOAuthConnection !== null &&\n                pendingOAuthConnection.slot === oauth2.connectionSlot;\n              const isConnected = connection !== null && connection !== undefined;\n              const statusText =\n                isConnecting || isPendingOAuthConnection\n                  ? \"Saving OAuth connection...\"\n                  : connectionBinding && bindingScopeId\n                    ? connection\n                      ? bindingScopeId === activeOAuthTokenScopeId\n                        ? `Connected in ${activeOAuthTokenScopeLabel.toLowerCase()} as ${\n                            connection.identityLabel ?? connection.id\n                          }`\n                        : `Using organization connection ${\n                            connection.identityLabel ?? connection.id\n                          }`\n                      : bindingScopeId === activeOAuthTokenScopeId\n                        ? `Saved connection is missing in ${activeOAuthTokenScopeLabel.toLowerCase()}`\n                        : \"Organization connection is missing\"\n                    : `No ${activeOAuthTokenScopeLabel.toLowerCase()} connection`;\n              const connectDisabled = isConnecting || endpointsDirty || saving;\n              const clientSecretSlot = effectiveClientSecretSlot(oauth2);\n              const renderAppSecret = (input: {\n                readonly slot: string;\n                readonly label: string;\n                readonly hint?: string;\n                readonly scopeId: ScopeId;\n                readonly onScopeChange: (scope: ScopeId) => void;\n              }) => {\n                const activeScope =\n                  credentialScopes.find((entry) => entry.scopeId === input.scopeId) ??\n                  organizationCredentialScope;\n                const exactSecret = exactCredentialBindingForScope(\n                  bindingRows,\n                  input.slot,\n                  activeScope.scopeId,\n                );\n                const effectiveSecret = effectiveCredentialBindingForScope(\n                  bindingRows,\n                  input.slot,\n                  activeScope.scopeId,\n                  scopeRanks,\n                );\n                const exactSecretId =\n                  exactSecret && isSecretCredentialBindingValue(exactSecret.value)\n                    ? exactSecret.value.secretId\n                    : null;\n                const inheritedSecret =\n                  !exactSecretId &&\n                  effectiveSecret &&\n                  effectiveSecret.scopeId !== activeScope.scopeId &&\n                  isSecretCredentialBindingValue(effectiveSecret.value)\n                    ? effectiveSecret\n                    : null;\n                const status = exactSecretId\n                  ? `${activeScope.label} credential set`\n                  : inheritedSecret\n                    ? \"Using organization credential\"\n                    : \"Not set\";\n                const inputKey = `${activeScope.scopeId}:${input.slot}`;\n                const clearKey = `${activeScope.scopeId}:${input.slot}:clear`;\n\n                return (\n                  <div className=\"space-y-1.5\">\n                    <FieldLabel className=\"text-[11px]\">\n                      {input.label}{\" \"}\n                      {input.hint && <span className=\"text-muted-foreground\">· {input.hint}</span>}\n                    </FieldLabel>\n                    <div className=\"grid gap-2 md:grid-cols-2\">\n                      <div className=\"space-y-1.5\">\n                        <div className=\"flex items-center gap-1.5\">\n                          <FieldLabel className=\"text-[11px]\">Secret</FieldLabel>\n                          <HelpTooltip label={`${input.label} secret`}>\n                            Select or create the OAuth {input.label.toLowerCase()} secret.\n                          </HelpTooltip>\n                          <span className=\"ml-auto truncate text-xs text-muted-foreground\">\n                            {status}\n                          </span>\n                        </div>\n                        <div className=\"flex items-center gap-2\">\n                          <div className=\"min-w-0 flex-1\">\n                            <CreatableSecretPicker\n                              value={exactSecretId}\n                              onSelect={(secretId, secretScopeId) =>\n                                void sourceBindingWriter.setSecretBinding(\n                                  activeScope.scopeId,\n                                  input.slot,\n                                  secretId,\n                                  secretScopeId ?? activeScope.scopeId,\n                                )\n                              }\n                              secrets={secretList}\n                              placeholder=\"Select or create a secret\"\n                              targetScope={activeScope.scopeId}\n                              credentialScopeOptions={credentialScopeOptions}\n                              suggestedId={`source-binding-${slugify(props.sourceId)}-${slugify(\n                                input.slot,\n                              )}-${slugify(activeScope.scopeId)}`}\n                              sourceName={source.name}\n                              secretLabel={input.label}\n                            />\n                          </div>\n                          {exactSecretId && (\n                            <Button\n                              variant=\"outline\"\n                              size=\"sm\"\n                              onClick={() =>\n                                void sourceBindingWriter.clearBinding(\n                                  activeScope.scopeId,\n                                  input.slot,\n                                )\n                              }\n                              disabled={sourceBindingWriter.busyKey === clearKey}\n                            >\n                              Clear\n                            </Button>\n                          )}\n                          {sourceBindingWriter.busyKey === inputKey && (\n                            <span className=\"text-xs text-muted-foreground\">Saving…</span>\n                          )}\n                        </div>\n                      </div>\n                      <CredentialScopeDropdown\n                        value={activeScope.scopeId}\n                        options={credentialScopeOptions}\n                        onChange={input.onScopeChange}\n                        label=\"Used by\"\n                        help={`Choose where this OAuth ${input.label.toLowerCase()} credential lives.`}\n                      />\n                    </div>\n                  </div>\n                );\n              };\n\n              return (\n                <>\n                  <CardStackEntry>\n                    <CardStackEntryContent>\n                      <CardStackEntryTitle>OAuth</CardStackEntryTitle>\n                      <CardStackEntryDescription>\n                        Configure app credentials and connect accounts for this source.\n                      </CardStackEntryDescription>\n                    </CardStackEntryContent>\n                  </CardStackEntry>\n                  <CardStackEntryField label=\"OAuth app credentials\">\n                    <div className=\"space-y-4 rounded-lg border border-border/60 bg-muted/10 p-3\">\n                      {renderAppSecret({\n                        slot: oauth2.clientIdSlot,\n                        label: \"Client ID\",\n                        scopeId: ScopeId.make(selectedOAuthClientIdScope),\n                        onScopeChange: setSelectedOAuthClientIdScope,\n                      })}\n                      {renderAppSecret({\n                        slot: clientSecretSlot,\n                        label: \"Client secret\",\n                        hint:\n                          oauth2.flow === \"authorizationCode\"\n                            ? \"Optional for public clients with PKCE\"\n                            : undefined,\n                        scopeId: ScopeId.make(selectedOAuthClientSecretScope),\n                        onScopeChange: setSelectedOAuthClientSecretScope,\n                      })}\n                    </div>\n                  </CardStackEntryField>\n                  <CardStackEntryField label=\"Account connection\">\n                    <CredentialUsageRow\n                      value={activeOAuthTokenScopeId}\n                      options={credentialScopeOptions}\n                      onChange={setSelectedOAuthTokenScope}\n                      label=\"Connection saved to\"\n                      help=\"Choose where the signed-in OAuth token is saved.\"\n                    >\n                      <CredentialControlField\n                        label=\"OAuth connection\"\n                        help=\"Start the provider OAuth flow.\"\n                      >\n                        <div className=\"flex min-h-9 items-center gap-2 rounded-md border border-border bg-muted/30 px-3 py-2\">\n                          <span className=\"min-w-0 flex-1 truncate text-xs text-muted-foreground\">\n                            {statusText}\n                          </span>\n                          <Button\n                            size=\"sm\"\n                            onClick={() => void connectOAuth(activeOAuthTokenScopeId)}\n                            disabled={connectDisabled}\n                          >\n                            {isConnecting ? \"Connecting…\" : isConnected ? \"Reconnect\" : \"Connect\"}\n                          </Button>\n                        </div>\n                        {endpointsDirty && (\n                          <p className=\"text-xs text-muted-foreground\">\n                            Save endpoint changes before reconnecting.\n                          </p>\n                        )}\n                      </CredentialControlField>\n                    </CredentialUsageRow>\n                  </CardStackEntryField>\n                  <CardStackEntry>\n                    <CardStackEntryContent>\n                      <CardStackEntryTitle>Advanced endpoints</CardStackEntryTitle>\n                      <CardStackEntryDescription>\n                        Override provider URLs only when the OpenAPI spec is wrong.\n                      </CardStackEntryDescription>\n                    </CardStackEntryContent>\n                    <div className=\"flex items-center gap-2\">\n                      {oauth2EndpointsSaveState !== \"idle\" && (\n                        <span className=\"text-xs text-muted-foreground\">\n                          {saving ? \"Saving…\" : \"Saved\"}\n                        </span>\n                      )}\n                      <Button\n                        variant=\"outline\"\n                        size=\"sm\"\n                        onClick={() => setOAuthEndpointsOpen((open) => !open)}\n                      >\n                        {oauthEndpointsOpen ? \"Hide\" : endpointsDirty ? \"Review\" : \"Show\"}\n                      </Button>\n                    </div>\n                  </CardStackEntry>\n                  {oauthEndpointsOpen && (\n                    <>\n                      {isAuthCode && (\n                        <CardStackEntryField label=\"Authorization URL\">\n                          <Input\n                            value={oauth2AuthorizationUrl}\n                            onChange={(e) =>\n                              setOAuth2AuthorizationUrl((e.target as HTMLInputElement).value)\n                            }\n                            className=\"font-mono text-sm\"\n                          />\n                        </CardStackEntryField>\n                      )}\n                      <CardStackEntryField label=\"Token URL\">\n                        <Input\n                          value={oauth2TokenUrl}\n                          onChange={(e) => setOAuth2TokenUrl((e.target as HTMLInputElement).value)}\n                          className=\"font-mono text-sm\"\n                        />\n                      </CardStackEntryField>\n                      <CardStackEntryField label=\"Redirect URL\">\n                        <div className=\"space-y-1.5\">\n                          <div className=\"flex items-center gap-1 rounded-md border border-border bg-background/50 px-2.5 py-1.5 font-mono text-[11px]\">\n                            <span className=\"truncate flex-1 text-foreground\">\n                              {oauth2RedirectUrl}\n                            </span>\n                            <CopyButton value={oauth2RedirectUrl} />\n                          </div>\n                          <p className=\"text-xs text-muted-foreground\">\n                            Add this to your OAuth app&apos;s allowed redirects.\n                          </p>\n                        </div>\n                      </CardStackEntryField>\n                      <CardStackEntry>\n                        <CardStackEntryContent>\n                          <CardStackEntryDescription>\n                            Save endpoint changes before reconnecting.\n                          </CardStackEntryDescription>\n                        </CardStackEntryContent>\n                        <Button\n                          size=\"sm\"\n                          onClick={() => void saveOAuth2Endpoints()}\n                          disabled={!canSave}\n                        >\n                          Save endpoints\n                        </Button>\n                      </CardStackEntry>\n                    </>\n                  )}\n                </>\n              );\n            })()}\n        </CardStackContent>\n      </CardStack>\n\n      {error && (\n        <div className=\"rounded-lg border border-destructive/30 bg-destructive/5 px-3 py-2\">\n          <p className=\"text-sm text-destructive\">{error}</p>\n        </div>\n      )}\n\n      <div className=\"flex items-center justify-start border-t border-border pt-4\">\n        <Button variant=\"ghost\" onClick={props.onSave}>\n          Back\n        </Button>\n      </div>\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,WAAW,SAAS,QAAQ,gBAAgB;AACrD,SAAS,YAAY,oBAAoB;AACzC,YAAY,UAAU;AACtB,YAAY,YAAY;AACxB,YAAY,YAAY;AACxB,YAAY,iBAAiB;AAE7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,UAAU,oBAAoB;AACvC,SAAS,qBAAqB,uBAAuB;AACrD,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB;AAC3B,SAAS,mBAAmB;AAC5B,SAAS,aAAa;AACtB,SAAS,mBAAmB,wBAAwB;AACpD;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,6BAA6B;AA6RhC,SAkPM,UAjPJ,KADF;AAhRN,IAAM,eAAsB,cAAO,EAAE,SAAgB,cAAO,CAAC;AAC7D,IAAM,qBAA4B,2BAAoB,YAAY;AAElE,IAAM,uBAAuB,CAAC,MAAmC,aACxD,aAAa,eAAa,qBAAgB,IAAI,GAAG,kBAAkB,GAAG;AAAA,EAC3E,QAAQ,MAAM;AAAA,EACd,QAAQ,CAAC,EAAE,QAAQ,MAAM;AAC3B,CAAC;AAiBH,IAAM,UAAU,CAAC,UACf,MACG,KAAK,EACL,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE,KAAK;AAEhC,IAAM,YAAY,CAAC,UAA0B;AAC3C,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAQ,MAAM,WAAW,CAAC;AAC1B,WAAO,KAAK,KAAK,MAAM,QAAU;AAAA,EACnC;AACA,UAAQ,SAAS,GAAG,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC;AAC7C;AAEA,IAAM,2BAA2B,CAC/B,UACA,oBACA,gBAEA,aAAa;AAAA,EACX,iBAAiB,QAAQ,QAAQ,CAAC,IAAI,QAAQ,kBAAkB,CAAC,IAAI,UAAU,WAAW,CAAC;AAC7F;AAEF,IAAM,4BAA4B,CAAC,WAGrB,OAAO,oBAAoB,uBAAuB,OAAO,kBAAkB;AAE1E,SAAR,kBAAmC,OAGvC;AACD,QAAM,eAAe,SAAS;AAC9B,QAAM,YAAY,aAAa;AAC/B,QAAM,sBAAsB,aAAa,WAAW,MAAM,UAAU,YAAY,CAAC;AACjF,QAAM,gBACQ,sBAAU,mBAAmB,KAAK,oBAAoB,QAC9D,oBAAoB,QACpB;AACN,QAAM,gBAAgB,eAAe,WAAW;AAChD,QAAM,cAAc,QAAQ,KAAK,aAAa;AAC9C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,iCAAiC,EAAE,YAAY,CAAC;AAEpD,QAAM,eAAe,aAAa,kBAAkB,aAAa,MAAM,QAAQ,CAAC;AAChF,QAAM,iBAAiB;AAAA,IACrB,0BAA0B,cAAc,MAAM,UAAU,WAAW;AAAA,EACrE;AACA,QAAM,oBAAoB,aAAa,gBAAgB,YAAY,CAAC;AACpE,QAAM,aAAa,uBAAuB;AAE1C,QAAM,cAAc,WAAW,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACvE,QAAM,eAAe,WAAW,4BAA4B;AAAA,IAC1D,MAAM;AAAA,EACR,CAAC;AACD,QAAM,eAAe,WAAW,YAAY,EAAE,MAAM,cAAc,CAAC;AACnE,QAAM,QAAQ,kBAA0C;AAAA,IACtD,WAAW;AAAA,IACX,qBAAqB;AAAA,IACrB,mBAAmB;AAAA,EACrB,CAAC;AAED,QAAM,SACQ,sBAAU,YAAY,KAAK,aAAa,QAAQ,aAAa,QAAQ;AACnF,QAAM,cAAkE,sBAAU,cAAc,IAC5F,eAAe,QACf,CAAC;AACL,QAAM,cAA0B,sBAAU,iBAAiB,IAAI,kBAAkB,QAAQ,CAAC;AAC1F,QAAM,oBAAoB,iBAAiB,2BAA2B;AAEtE,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,QAAQ,QAAQ,EAAE;AACnD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,QAAQ,OAAO,WAAW,EAAE;AACnE,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,SAAsC,MAAM;AAC1F,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAwB,IAAI;AAC1D,QAAM,sBAAsB,iCAAiC;AAAA,IAC3D;AAAA,IACA,QAAQ,EAAE,IAAI,MAAM,UAAU,OAAO,YAAY;AAAA,IACjD,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACD,QAAM,CAAC,wBAAwB,yBAAyB,IAAI,SAIlD,IAAI;AACd,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,SAAwB,IAAI;AAC1E,QAAM,CAAC,yBAAyB,0BAA0B,IAAI;AAAA,IAC5D,cAAc,gBAAgB,YAAY;AAAA,EAC5C;AACA,QAAM,CAAC,4BAA4B,6BAA6B,IAC9D,SAAiB,aAAa;AAChC,QAAM,CAAC,gCAAgC,iCAAiC,IACtE,SAAiB,aAAa;AAChC,QAAM,CAAC,oBAAoB,qBAAqB,IAAI,SAAS,KAAK;AAClE,QAAM,CAAC,wBAAwB,yBAAyB,IAAI;AAAA,IAC1D,QAAQ,OAAO,QAAQ,oBAAoB;AAAA,EAC7C;AACA,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,SAAS,QAAQ,OAAO,QAAQ,YAAY,EAAE;AAC1F,QAAM,CAAC,0BAA0B,2BAA2B,IAAI,SAE9D,MAAM;AACR,QAAM,eAAe;AAAA,IACnB,OAAO;AAAA,MACL;AAAA,MACA,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,cAAc,MAAM;AAAA,MAAC;AAAA,MACrB,OAAO,MAAM;AAAA,MAAC;AAAA,IAChB;AAAA,IACA,CAAC,MAAM,MAAM,QAAQ;AAAA,EACvB;AACA,QAAM,gBAAgB,OAAO,CAAC;AAC9B,QAAM,yBAAyB,OAAO,CAAC;AAEvC,YAAU,MAAM;AACd,+BAA2B,cAAc,gBAAgB,YAAY,aAAa;AAClF,kCAA8B,aAAa;AAC3C,sCAAkC,aAAa;AAAA,EACjD,GAAG,CAAC,eAAe,SAAS,CAAC;AAE7B,YAAU,MAAM;AACd,QAAI,CAAC,OAAQ;AACb,UAAM,YAAY,GAAG,aAAa,IAAI,OAAO,SAAS;AACtD,QAAI,oBAAoB,UAAW;AACnC,YAAQ,OAAO,IAAI;AACnB,eAAW,OAAO,OAAO,WAAW,EAAE;AACtC,8BAA0B,OAAO,OAAO,QAAQ,oBAAoB,EAAE;AACtE,sBAAkB,OAAO,OAAO,QAAQ,YAAY,EAAE;AACtD,gCAA4B,MAAM;AAClC,0BAAsB,KAAK;AAC3B,uBAAmB,MAAM;AACzB,uBAAmB,SAAS;AAAA,EAC9B,GAAG,CAAC,iBAAiB,QAAQ,aAAa,CAAC;AAE3C,YAAU,MAAM;AACd,QAAI,CAAC,OAAQ;AACb,UAAM,YAAY,GAAG,aAAa,IAAI,OAAO,SAAS;AACtD,QAAI,oBAAoB,UAAW;AAEnC,UAAM,WAAW,KAAK,KAAK;AAC3B,UAAM,cAAc,QAAQ,KAAK;AACjC,UAAM,cAAc,OAAO;AAC3B,UAAM,iBAAiB,OAAO,OAAO,WAAW;AAChD,SAAK,YAAY,iBAAiB,eAAe,gBAAgB,gBAAgB;AAC/E;AAAA,IACF;AAEA,UAAM,UAAU,OAAO,WAAW,MAAM;AACtC,YAAM,MAAM,EAAE,cAAc;AAC5B,yBAAmB,QAAQ;AAC3B,eAAS,IAAI;AACb,YAAM,YAAY;AAChB,cAAM,OAAO,MAAM,YAAY;AAAA,UAC7B,QAAQ,EAAE,SAAS,aAAa;AAAA,UAChC,SAAS;AAAA,YACP,QAAQ,EAAE,IAAI,MAAM,UAAU,OAAO,YAAY;AAAA,YACjD,OAAO;AAAA,YACP,MAAM;AAAA,YACN,QAAQ;AAAA,cACN,OAAO;AAAA,cACP,MAAM,YAAY;AAAA,cAClB,SAAS,eAAe;AAAA,YAC1B;AAAA,UACF;AAAA,UACA,gBAAgB;AAAA,QAClB,CAAC;AACD,YAAI,cAAc,YAAY,IAAK;AACnC,YAAS,eAAU,IAAI,GAAG;AACxB,6BAAmB,MAAM;AACzB,mBAAS,qBAAqB,MAAM,+BAA+B,CAAC;AACpE;AAAA,QACF;AACA,2BAAmB,OAAO;AAC1B,eAAO,WAAW,MAAM;AACtB,cAAI,cAAc,YAAY,IAAK,oBAAmB,MAAM;AAAA,QAC9D,GAAG,IAAI;AAAA,MACT,GAAG;AAAA,IACL,GAAG,GAAG;AAEN,WAAO,MAAM,OAAO,aAAa,OAAO;AAAA,EAC1C,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,cAAc,QAAQ,MAAM;AAChC,QAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,UAAM,QAAmB,CAAC;AAC1B,eAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,WAAW,CAAC,CAAC,GAAG;AAC7E,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,MAAM,MAAM;AAAA,QACZ,OAAO;AAAA,QACP,MAAM,MAAM,SAAS,WAAW,MAAM,MAAM,KAAK;AAAA,MACnD,CAAC;AAAA,IACH;AACA,QAAI,OAAO,OAAO,QAAQ;AACxB,YAAM,mBAAmB,0BAA0B,OAAO,OAAO,MAAM;AACvE,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,MAAM,OAAO,OAAO,OAAO;AAAA,QAC3B,OAAO;AAAA,MACT,CAAC;AACD,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,QACP,MACE,OAAO,OAAO,OAAO,SAAS,sBAC1B,qCACA;AAAA,MACR,CAAC;AACD,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,MAAM,OAAO,OAAO,OAAO;AAAA,QAC3B,OACE,OAAO,OAAO,OAAO,SAAS,sBAC1B,6BACA;AAAA,MACR,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,wBACJ,iBAAiB,KAAK,CAAC,UAAU,MAAM,YAAY,uBAAuB,KAC1E,iBAAiB,CAAC;AACpB,QAAM,0BAA0B,sBAAsB;AACtD,QAAM,6BAA6B,sBAAsB;AAEzD,MAAI,CAAC,QAAQ;AACX,WACE,qBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,QAAG,WAAU,yCAAwC,iCAAmB;AAAA,MACzE,oBAAC,OAAE,WAAU,iCAAgC,yCAAsB;AAAA,OACrE;AAAA,EAEJ;AACA,QAAM,wBAAwB,OAAO,OAAO,SACxC,0BAA0B,OAAO,OAAO,MAAM,IAC9C;AACJ,QAAM,sBAAsB,YAAY;AAAA,IACtC,CAAC,SACC,KAAK,SAAS,aACb,CAAC,OAAO,OAAO,UACb,KAAK,SAAS,OAAO,OAAO,OAAO,gBAAgB,KAAK,SAAS;AAAA,EACxE;AAEA,QAAM,eAAe,OAAO,gBAAyB;AACnD,UAAM,SAAS,OAAO,OAAO;AAC7B,QAAI,CAAC,OAAQ;AACb,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA;AAAA,IACF;AACA,UAAM,mBAAmB,0BAA0B,MAAM;AACzD,UAAM,sBAAsB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB,CAAC,+BAA+B,gBAAgB,KAAK,GAAG;AAC9E,eAAS,2CAA2C;AACpD;AAAA,IACF;AACA,UAAM,mBAAmB,gBAAgB,MAAM;AAC/C,UAAM,wBAAwB,gBAAgB,MAAM,iBAAiB,gBAAgB;AACrF,QACE,OAAO,SAAS,wBACf,CAAC,uBAAuB,CAAC,+BAA+B,oBAAoB,KAAK,IAClF;AACA,eAAS,+CAA+C;AACxD;AAAA,IACF;AACA,UAAM,oBACJ,OAAO,SAAS,uBAChB,uBACA,+BAA+B,oBAAoB,KAAK,IACpD,oBAAoB,QACpB;AACN,UAAM,4BACJ,uBAAuB,+BAA+B,oBAAoB,KAAK,IAC1E,oBAAoB,MAAM,iBAAiB,oBAAoB,UAChE;AAEN,UAAM,qBAAqB;AAAA,MACzB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,IACF;AACA,UAAM,eACJ,sBAAsB,mCAAmC,mBAAmB,KAAK,IAC7E,mBAAmB,MAAM,eACzB,yBAAyB,MAAM,UAAU,OAAO,oBAAoB,WAAW;AAErF,eAAW,GAAG,WAAW,IAAI,OAAO,cAAc,UAAU;AAC5D,8BAA0B;AAAA,MACxB,SAAS;AAAA,MACT,MAAM,OAAO;AAAA,MACb;AAAA,IACF,CAAC;AACD,aAAS,IAAI;AACb,UAAM,cAAc,CAAC,YAAoB;AACvC,eAAS,OAAO;AAChB,gCAA0B,IAAI;AAC9B,iBAAW,IAAI;AAAA,IACjB;AACA,UAAM,cAAc,OAAO;AAC3B,UAAM,WAAW,gBAAgB,OAAO,UAAU,OAAO,OAAO,WAAW,EAAE;AAC7E,QAAI,OAAO,SAAS,qBAAqB;AACvC,YAAMA,kBAAiB,MAAM,aAAa;AAAA,QACxC,QAAQ,EAAE,SAAS,YAAY;AAAA,QAC/B,SAAS;AAAA,UACP,UAAU;AAAA,UACV,aAAa;AAAA,UACb;AAAA,UACA,YAAY;AAAA,UACZ,UAAU;AAAA,YACR,MAAM;AAAA,YACN,eAAe;AAAA,YACf;AAAA,YACA,uBAAuB,OAAO,qBAAqB;AAAA,YACnD,sBAAsB,kBAAmB;AAAA,YACzC,2BAA2B,4BACvB,OAAO,yBAAyB,IAChC;AAAA,YACJ,QAAQ,CAAC,GAAG,OAAO,MAAM;AAAA,UAC3B;AAAA,UACA,UAAU;AAAA,UACV,eAAe,GAAG,WAAW;AAAA,QAC/B;AAAA,MACF,CAAC;AACD,UAAS,eAAUA,eAAc,GAAG;AAClC,oBAAY,qBAAqBA,iBAAgB,yBAAyB,CAAC;AAC3E;AAAA,MACF;AACA,YAAMC,YAAWD,gBAAe;AAChC,UAAI,CAACC,UAAS,qBAAqB;AACjC,oBAAY,2BAA2B;AACvC;AAAA,MACF;AACA,YAAM,iBAAiB,MAAM,aAAa;AAAA,QACxC,QAAQ,EAAE,SAAS,aAAa;AAAA,QAChC,SAAS,gCAAgC,KAAK;AAAA,UAC5C,QAAQ,EAAE,IAAI,MAAM,UAAU,OAAO,YAAY;AAAA,UACjD,OAAO;AAAA,UACP,SAAS,OAAO;AAAA,UAChB,OAAO;AAAA,YACL,MAAM;AAAA,YACN,cAAc,aAAa,KAAKA,UAAS,oBAAoB,YAAY;AAAA,UAC3E;AAAA,QACF,CAAC;AAAA,QACD,gBAAgB,CAAC,GAAG,iBAAiB,GAAG,mBAAmB;AAAA,MAC7D,CAAC;AACD,UAAS,eAAU,cAAc,GAAG;AAClC,oBAAY,qBAAqB,gBAAgB,yBAAyB,CAAC;AAC3E;AAAA,MACF;AACA,gCAA0B,IAAI;AAC9B,iBAAW,IAAI;AACf;AAAA,IACF;AAEA,UAAM,mBAAmB;AAAA,MACvB,OAAO,oBAAoB;AAAA,MAC3B,OAAO,OAAO,WAAW;AAAA,IAC3B;AACA,UAAM,YAAY,OAAO,aAAa,oBAAoB,gBAAgB;AAC1E,UAAM,iBAAiB,MAAM,aAAa;AAAA,MACxC,QAAQ,EAAE,SAAS,YAAY;AAAA,MAC/B,SAAS;AAAA,QACP,UAAU;AAAA,QACV;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,UAAU;AAAA,UACR,MAAM;AAAA,UACN,uBAAuB;AAAA,UACvB,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA,uBAAuB,OAAO,qBAAqB;AAAA,UACnD,sBACE,uBAAuB,+BAA+B,oBAAoB,KAAK,IAC3E,oBAAoB,MAAM,WAC1B;AAAA,UACN,2BAA2B,4BACvB,OAAO,yBAAyB,IAChC;AAAA,UACJ,QAAQ,CAAC,GAAG,OAAO,MAAM;AAAA,QAC3B;AAAA,QACA,UAAU;AAAA,QACV,eAAe,GAAG,WAAW;AAAA,MAC/B;AAAA,IACF,CAAC;AACD,QAAS,eAAU,cAAc,GAAG;AAClC,kBAAY,qBAAqB,gBAAgB,yBAAyB,CAAC;AAC3E;AAAA,IACF;AACA,UAAM,WAAW,eAAe;AAChC,QAAI,SAAS,qBAAqB,MAAM;AACtC,kBAAY,2BAA2B;AACvC;AAAA,IACF;AAEA,UAAM,MAAM,kBAAkB;AAAA,MAC5B,YAAY;AAAA,MACZ,KAAK,aAAa;AAAA,QAChB,WAAW,SAAS;AAAA,QACpB,kBAAkB,SAAS;AAAA,MAC7B;AAAA,MACA,WAAW,OAAO,WAAW;AAC3B,cAAM,iBAAiB,MAAM,aAAa;AAAA,UACxC,QAAQ,EAAE,SAAS,aAAa;AAAA,UAChC,SAAS,gCAAgC,KAAK;AAAA,YAC5C,QAAQ,EAAE,IAAI,MAAM,UAAU,OAAO,YAAY;AAAA,YACjD,OAAO;AAAA,YACP,SAAS,OAAO;AAAA,YAChB,OAAO;AAAA,cACL,MAAM;AAAA,cACN,cAAc,aAAa,KAAK,OAAO,YAAY;AAAA,YACrD;AAAA,UACF,CAAC;AAAA,UACD,gBAAgB,CAAC,GAAG,iBAAiB,GAAG,mBAAmB;AAAA,QAC7D,CAAC;AACD,YAAS,eAAU,cAAc,GAAG;AAClC,sBAAY,qBAAqB,gBAAgB,yBAAyB,CAAC;AAC3E;AAAA,QACF;AACA,kCAA0B,IAAI;AAC9B,mBAAW,IAAI;AAAA,MACjB;AAAA,MACA,SAAS,CAAC,YAAY;AACpB,iBAAS,OAAO;AAChB,kCAA0B,IAAI;AAC9B,mBAAW,IAAI;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SACE,qBAAC,SAAI,WAAU,aACb;AAAA,wBAAC,SACC,8BAAC,QAAG,WAAU,yCAAwC,4BAAc,GACtE;AAAA,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,OAAM;AAAA,QACN,aAAY;AAAA,QACZ,UAAU;AAAA,QACV;AAAA,QACA,iBAAiB;AAAA,QACjB,SAAS,OAAO,OAAO,aAAa;AAAA,QACpC,iBAAiB,MAAM;AAAA,QAAC;AAAA,QACxB,iBAAe;AAAA,QACf,mBAAiB;AAAA,QACjB,WAAW;AAAA,QACX,QACE,OAAO,OAAO,SACV,mCAAmC,OAAO,OAAO,OAAO,IAAI,KAC5D,OAAO,KAAK,OAAO,OAAO,WAAW,CAAC,CAAC,EAAE,SAAS,IAChD,4BAA4B,OAAO,KAAK,OAAO,OAAO,WAAW,CAAC,CAAC,EAAE,MAAM,kBACzE,OAAO,KAAK,OAAO,OAAO,WAAW,CAAC,CAAC,EAAE,WAAW,IAAI,KAAK,GAC/D,KACA;AAAA;AAAA,IAEV;AAAA,IAEA,oBAAC,aACC,+BAAC,oBAAiB,WAAU,cACzB;AAAA,0BAAoB,SAAS,KAC5B,iCACE;AAAA,4BAAC,kBACC,+BAAC,yBACC;AAAA,8BAAC,uBAAoB,iCAAmB;AAAA,UACxC,oBAAC,6BAA0B,uEAE3B;AAAA,WACF,GACF;AAAA,QAEA;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,YACP,eAAe;AAAA,YACf;AAAA,YACA;AAAA,YACA,SAAS;AAAA,YACT,UAAU,MAAM;AAAA,YAChB,YAAY,OAAO;AAAA,YACnB;AAAA,YACA,SAAS,oBAAoB;AAAA,YAC7B,oBAAoB,oBAAoB;AAAA,YACxC,gBAAgB,oBAAoB;AAAA;AAAA,QACtC;AAAA,SACF;AAAA,MAGD,OAAO,OAAO,WACZ,MAAM;AACL,cAAM,SAAS,OAAO,OAAO;AAC7B,cAAM,iBAAiB,uBAAuB,KAAK;AACnD,cAAM,kBAAkB,eAAe,KAAK;AAC5C,cAAM,eAAe,OAAO,oBAAoB;AAChD,cAAM,aAAa,OAAO,SAAS;AACnC,cAAM,iBACH,cAAc,mBAAmB,gBAClC,oBAAoB,OAAO;AAC7B,cAAM,SAAS,6BAA6B;AAC5C,cAAM,kBAAkB,gBAAgB,WAAW;AACnD,cAAM,iBAAiB,cAAc,eAAe,WAAW;AAC/D,cAAM,UAAU,kBAAkB,CAAC,UAAU,CAAC,mBAAmB,CAAC;AAElE,cAAM,sBAAsB,YAAY;AACtC,gBAAM,MAAM,EAAE,uBAAuB;AACrC,sCAA4B,QAAQ;AACpC,mBAAS,IAAI;AACb,gBAAM,OAAO,MAAM,YAAY;AAAA,YAC7B,QAAQ,EAAE,SAAS,aAAa;AAAA,YAChC,SAAS;AAAA,cACP,QAAQ,EAAE,IAAI,MAAM,UAAU,OAAO,YAAY;AAAA,cACjD,OAAO;AAAA,cACP,MAAM;AAAA,cACN,QAAQ;AAAA,gBACN,OAAO;AAAA,gBACP,cAAc,mBAAmB,KAAK;AAAA,kBACpC,MAAM;AAAA,kBACN,oBAAoB,OAAO;AAAA,kBAC3B,MAAM,OAAO;AAAA,kBACb,UAAU;AAAA,kBACV,kBAAkB,aAAa,kBAAkB,OAAO;AAAA,kBACxD,WAAW,OAAO,aAAa;AAAA,kBAC/B,cAAc,OAAO;AAAA,kBACrB,kBAAkB,OAAO;AAAA,kBACzB,gBAAgB,OAAO;AAAA,kBACvB,QAAQ,CAAC,GAAG,OAAO,MAAM;AAAA,gBAC3B,CAAC;AAAA,cACH;AAAA,YACF;AAAA,YACA,gBAAgB;AAAA,UAClB,CAAC;AACD,cAAI,uBAAuB,YAAY,IAAK;AAC5C,cAAS,eAAU,IAAI,GAAG;AACxB,wCAA4B,MAAM;AAClC,qBAAS,qBAAqB,MAAM,gCAAgC,CAAC;AACrE;AAAA,UACF;AACA,sCAA4B,OAAO;AACnC,iBAAO,WAAW,MAAM;AACtB,gBAAI,uBAAuB,YAAY,KAAK;AAC1C,0CAA4B,MAAM;AAAA,YACpC;AAAA,UACF,GAAG,IAAI;AAAA,QACT;AAEA,cAAM,QAAQ;AAAA,UACZ;AAAA,UACA,OAAO;AAAA,UACP;AAAA,QACF;AACA,cAAM,UACJ,SACA;AAAA,UACE;AAAA,UACA,OAAO;AAAA,UACP;AAAA,UACA;AAAA,QACF;AACF,cAAM,oBACJ,WAAW,mCAAmC,QAAQ,KAAK,IAAI,QAAQ,QAAQ;AACjF,cAAM,aAAa,oBACf,YAAY,KAAK,CAAC,UAAU,MAAM,OAAO,kBAAkB,YAAY,IACvE;AACJ,cAAM,iBAAiB,qBAAqB,UAAU,QAAQ,UAAU;AACxE,cAAM,eACJ,YAAY,GAAG,uBAAuB,IAAI,OAAO,cAAc;AACjE,cAAM,2BACJ,wBAAwB,YAAY,2BACpC,2BAA2B,QAC3B,uBAAuB,SAAS,OAAO;AACzC,cAAM,cAAc,eAAe,QAAQ,eAAe;AAC1D,cAAM,aACJ,gBAAgB,2BACZ,+BACA,qBAAqB,iBACnB,aACE,mBAAmB,0BACjB,gBAAgB,2BAA2B,YAAY,CAAC,OACtD,WAAW,iBAAiB,WAAW,EACzC,KACA,iCACE,WAAW,iBAAiB,WAAW,EACzC,KACF,mBAAmB,0BACjB,kCAAkC,2BAA2B,YAAY,CAAC,KAC1E,uCACJ,MAAM,2BAA2B,YAAY,CAAC;AACtD,cAAM,kBAAkB,gBAAgB,kBAAkB;AAC1D,cAAM,mBAAmB,0BAA0B,MAAM;AACzD,cAAM,kBAAkB,CAAC,UAMnB;AACJ,gBAAM,cACJ,iBAAiB,KAAK,CAAC,UAAU,MAAM,YAAY,MAAM,OAAO,KAChE;AACF,gBAAM,cAAc;AAAA,YAClB;AAAA,YACA,MAAM;AAAA,YACN,YAAY;AAAA,UACd;AACA,gBAAM,kBAAkB;AAAA,YACtB;AAAA,YACA,MAAM;AAAA,YACN,YAAY;AAAA,YACZ;AAAA,UACF;AACA,gBAAM,gBACJ,eAAe,+BAA+B,YAAY,KAAK,IAC3D,YAAY,MAAM,WAClB;AACN,gBAAM,kBACJ,CAAC,iBACD,mBACA,gBAAgB,YAAY,YAAY,WACxC,+BAA+B,gBAAgB,KAAK,IAChD,kBACA;AACN,gBAAM,SAAS,gBACX,GAAG,YAAY,KAAK,oBACpB,kBACE,kCACA;AACN,gBAAM,WAAW,GAAG,YAAY,OAAO,IAAI,MAAM,IAAI;AACrD,gBAAM,WAAW,GAAG,YAAY,OAAO,IAAI,MAAM,IAAI;AAErD,iBACE,qBAAC,SAAI,WAAU,eACb;AAAA,iCAAC,cAAW,WAAU,eACnB;AAAA,oBAAM;AAAA,cAAO;AAAA,cACb,MAAM,QAAQ,qBAAC,UAAK,WAAU,yBAAwB;AAAA;AAAA,gBAAG,MAAM;AAAA,iBAAK;AAAA,eACvE;AAAA,YACA,qBAAC,SAAI,WAAU,6BACb;AAAA,mCAAC,SAAI,WAAU,eACb;AAAA,qCAAC,SAAI,WAAU,6BACb;AAAA,sCAAC,cAAW,WAAU,eAAc,oBAAM;AAAA,kBAC1C,qBAAC,eAAY,OAAO,GAAG,MAAM,KAAK,WAAW;AAAA;AAAA,oBACf,MAAM,MAAM,YAAY;AAAA,oBAAE;AAAA,qBACxD;AAAA,kBACA,oBAAC,UAAK,WAAU,kDACb,kBACH;AAAA,mBACF;AAAA,gBACA,qBAAC,SAAI,WAAU,2BACb;AAAA,sCAAC,SAAI,WAAU,kBACb;AAAA,oBAAC;AAAA;AAAA,sBACC,OAAO;AAAA,sBACP,UAAU,CAAC,UAAU,kBACnB,KAAK,oBAAoB;AAAA,wBACvB,YAAY;AAAA,wBACZ,MAAM;AAAA,wBACN;AAAA,wBACA,iBAAiB,YAAY;AAAA,sBAC/B;AAAA,sBAEF,SAAS;AAAA,sBACT,aAAY;AAAA,sBACZ,aAAa,YAAY;AAAA,sBACzB;AAAA,sBACA,aAAa,kBAAkB,QAAQ,MAAM,QAAQ,CAAC,IAAI;AAAA,wBACxD,MAAM;AAAA,sBACR,CAAC,IAAI,QAAQ,YAAY,OAAO,CAAC;AAAA,sBACjC,YAAY,OAAO;AAAA,sBACnB,aAAa,MAAM;AAAA;AAAA,kBACrB,GACF;AAAA,kBACC,iBACC;AAAA,oBAAC;AAAA;AAAA,sBACC,SAAQ;AAAA,sBACR,MAAK;AAAA,sBACL,SAAS,MACP,KAAK,oBAAoB;AAAA,wBACvB,YAAY;AAAA,wBACZ,MAAM;AAAA,sBACR;AAAA,sBAEF,UAAU,oBAAoB,YAAY;AAAA,sBAC3C;AAAA;AAAA,kBAED;AAAA,kBAED,oBAAoB,YAAY,YAC/B,oBAAC,UAAK,WAAU,iCAAgC,0BAAO;AAAA,mBAE3D;AAAA,iBACF;AAAA,cACA;AAAA,gBAAC;AAAA;AAAA,kBACC,OAAO,YAAY;AAAA,kBACnB,SAAS;AAAA,kBACT,UAAU,MAAM;AAAA,kBAChB,OAAM;AAAA,kBACN,MAAM,2BAA2B,MAAM,MAAM,YAAY,CAAC;AAAA;AAAA,cAC5D;AAAA,eACF;AAAA,aACF;AAAA,QAEJ;AAEA,eACE,iCACE;AAAA,8BAAC,kBACC,+BAAC,yBACC;AAAA,gCAAC,uBAAoB,mBAAK;AAAA,YAC1B,oBAAC,6BAA0B,6EAE3B;AAAA,aACF,GACF;AAAA,UACA,oBAAC,uBAAoB,OAAM,yBACzB,+BAAC,SAAI,WAAU,gEACZ;AAAA,4BAAgB;AAAA,cACf,MAAM,OAAO;AAAA,cACb,OAAO;AAAA,cACP,SAAS,QAAQ,KAAK,0BAA0B;AAAA,cAChD,eAAe;AAAA,YACjB,CAAC;AAAA,YACA,gBAAgB;AAAA,cACf,MAAM;AAAA,cACN,OAAO;AAAA,cACP,MACE,OAAO,SAAS,sBACZ,0CACA;AAAA,cACN,SAAS,QAAQ,KAAK,8BAA8B;AAAA,cACpD,eAAe;AAAA,YACjB,CAAC;AAAA,aACH,GACF;AAAA,UACA,oBAAC,uBAAoB,OAAM,sBACzB;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,cACP,SAAS;AAAA,cACT,UAAU;AAAA,cACV,OAAM;AAAA,cACN,MAAK;AAAA,cAEL;AAAA,gBAAC;AAAA;AAAA,kBACC,OAAM;AAAA,kBACN,MAAK;AAAA,kBAEL;AAAA,yCAAC,SAAI,WAAU,yFACb;AAAA,0CAAC,UAAK,WAAU,yDACb,sBACH;AAAA,sBACA;AAAA,wBAAC;AAAA;AAAA,0BACC,MAAK;AAAA,0BACL,SAAS,MAAM,KAAK,aAAa,uBAAuB;AAAA,0BACxD,UAAU;AAAA,0BAET,yBAAe,qBAAgB,cAAc,cAAc;AAAA;AAAA,sBAC9D;AAAA,uBACF;AAAA,oBACC,kBACC,oBAAC,OAAE,WAAU,iCAAgC,wDAE7C;AAAA;AAAA;AAAA,cAEJ;AAAA;AAAA,UACF,GACF;AAAA,UACA,qBAAC,kBACC;AAAA,iCAAC,yBACC;AAAA,kCAAC,uBAAoB,gCAAkB;AAAA,cACvC,oBAAC,6BAA0B,yEAE3B;AAAA,eACF;AAAA,YACA,qBAAC,SAAI,WAAU,2BACZ;AAAA,2CAA6B,UAC5B,oBAAC,UAAK,WAAU,iCACb,mBAAS,iBAAY,SACxB;AAAA,cAEF;AAAA,gBAAC;AAAA;AAAA,kBACC,SAAQ;AAAA,kBACR,MAAK;AAAA,kBACL,SAAS,MAAM,sBAAsB,CAAC,SAAS,CAAC,IAAI;AAAA,kBAEnD,+BAAqB,SAAS,iBAAiB,WAAW;AAAA;AAAA,cAC7D;AAAA,eACF;AAAA,aACF;AAAA,UACC,sBACC,iCACG;AAAA,0BACC,oBAAC,uBAAoB,OAAM,qBACzB;AAAA,cAAC;AAAA;AAAA,gBACC,OAAO;AAAA,gBACP,UAAU,CAAC,MACT,0BAA2B,EAAE,OAA4B,KAAK;AAAA,gBAEhE,WAAU;AAAA;AAAA,YACZ,GACF;AAAA,YAEF,oBAAC,uBAAoB,OAAM,aACzB;AAAA,cAAC;AAAA;AAAA,gBACC,OAAO;AAAA,gBACP,UAAU,CAAC,MAAM,kBAAmB,EAAE,OAA4B,KAAK;AAAA,gBACvE,WAAU;AAAA;AAAA,YACZ,GACF;AAAA,YACA,oBAAC,uBAAoB,OAAM,gBACzB,+BAAC,SAAI,WAAU,eACb;AAAA,mCAAC,SAAI,WAAU,gHACb;AAAA,oCAAC,UAAK,WAAU,mCACb,6BACH;AAAA,gBACA,oBAAC,cAAW,OAAO,mBAAmB;AAAA,iBACxC;AAAA,cACA,oBAAC,OAAE,WAAU,iCAAgC,6DAE7C;AAAA,eACF,GACF;AAAA,YACA,qBAAC,kBACC;AAAA,kCAAC,yBACC,8BAAC,6BAA0B,wDAE3B,GACF;AAAA,cACA;AAAA,gBAAC;AAAA;AAAA,kBACC,MAAK;AAAA,kBACL,SAAS,MAAM,KAAK,oBAAoB;AAAA,kBACxC,UAAU,CAAC;AAAA,kBACZ;AAAA;AAAA,cAED;AAAA,eACF;AAAA,aACF;AAAA,WAEJ;AAAA,MAEJ,GAAG;AAAA,OACP,GACF;AAAA,IAEC,SACC,oBAAC,SAAI,WAAU,sEACb,8BAAC,OAAE,WAAU,4BAA4B,iBAAM,GACjD;AAAA,IAGF,oBAAC,SAAI,WAAU,+DACb,8BAAC,UAAO,SAAQ,SAAQ,SAAS,MAAM,QAAQ,kBAE/C,GACF;AAAA,KACF;AAEJ;","names":["startOAuthExit","response"]}

package/dist/{OpenApiSourceSummary-CM46DB4L.js → OpenApiSourceSummary-Y3S6ZBOZ.js}

@@ -1,10 +1,10 @@
 import {
   openApiSourceAtom,
   openApiSourceBindingsAtom
-} from "./chunk-GFQUEZUW.js";
+} from "./chunk-ZZBTLFTA.js";
 import {
   oauth2ClientSecretSlot
-} from "./chunk-E7PZ2QGD.js";
+} from "./chunk-EOXXE5DG.js";
 
 // src/react/OpenApiSourceSummary.tsx
 import { useAtomValue } from "@effect/atom-react";
@@ -12,7 +12,7 @@ import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
 import { connectionsAtom, sourceAtom } from "@executor-js/react/api/atoms";
 import { Badge } from "@executor-js/react/components/badge";
 import { useScope, useScopeStack, useUserScope } from "@executor-js/react/api/scope-context";
-import { ScopeId } from "@executor-js/sdk/core";
+import { ScopeId } from "@executor-js/sdk/shared";
 import {
   SourceCredentialNotice,
   SourceCredentialStatusBadge,
@@ -119,4 +119,4 @@ function OpenApiSourceSummary(props) {
 export {
   OpenApiSourceSummary as default
 };
-//# sourceMappingURL=OpenApiSourceSummary-CM46DB4L.js.map
+//# sourceMappingURL=OpenApiSourceSummary-Y3S6ZBOZ.js.map

package/dist/OpenApiSourceSummary-Y3S6ZBOZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react/OpenApiSourceSummary.tsx","../src/sdk/credential-status.ts"],"sourcesContent":["import { useAtomValue } from \"@effect/atom-react\";\nimport * as AsyncResult from \"effect/unstable/reactivity/AsyncResult\";\n\nimport { connectionsAtom, sourceAtom } from \"@executor-js/react/api/atoms\";\nimport { Badge } from \"@executor-js/react/components/badge\";\nimport { useScope, useScopeStack, useUserScope } from \"@executor-js/react/api/scope-context\";\nimport { ScopeId } from \"@executor-js/sdk/shared\";\nimport {\n  SourceCredentialNotice,\n  SourceCredentialStatusBadge,\n  missingSourceCredentialLabels,\n  type SourceCredentialSlot,\n} from \"@executor-js/react/plugins/source-credential-status\";\n\nimport { openApiSourceAtom, openApiSourceBindingsAtom } from \"./atoms\";\nimport { effectiveBindingForScope } from \"../sdk/credential-status\";\nimport { oauth2ClientSecretSlot, type StoredSourceSchemaType } from \"../sdk/source-contracts\";\n\nfunction OAuthBadge() {\n  return <Badge variant=\"secondary\">OAuth</Badge>;\n}\n\nfunction CheckingCredentialsBadge() {\n  return (\n    <Badge\n      variant=\"outline\"\n      className=\"border-border bg-muted/50 text-[10px] text-muted-foreground\"\n    >\n      Checking credentials\n    </Badge>\n  );\n}\n\nconst effectiveClientSecretSlot = (oauth2: {\n  readonly securitySchemeName: string;\n  readonly clientSecretSlot: string | null;\n}): string => oauth2.clientSecretSlot ?? oauth2ClientSecretSlot(oauth2.securitySchemeName);\n\nconst sourceCredentialSlots = (source: StoredSourceSchemaType): readonly SourceCredentialSlot[] => {\n  const slots: SourceCredentialSlot[] = [];\n  for (const [name, value] of Object.entries(source.config.headers ?? {})) {\n    if (typeof value !== \"string\") slots.push({ kind: \"secret\", slot: value.slot, label: name });\n  }\n  for (const [name, value] of Object.entries(source.config.queryParams ?? {})) {\n    if (typeof value !== \"string\") slots.push({ kind: \"secret\", slot: value.slot, label: name });\n  }\n  const oauth2 = source.config.oauth2;\n  if (oauth2) {\n    slots.push({ kind: \"secret\", slot: oauth2.clientIdSlot, label: \"Client ID\" });\n    slots.push({\n      kind: \"secret\",\n      slot: effectiveClientSecretSlot(oauth2),\n      label: \"Client Secret\",\n    });\n    slots.push({\n      kind: \"connection\",\n      slot: oauth2.connectionSlot,\n      label: oauth2.flow === \"clientCredentials\" ? \"OAuth client connection\" : \"OAuth sign-in\",\n    });\n  }\n  return slots;\n};\n\n// The entry row already renders name + id + kind, so this summary\n// component only contributes extras — specifically, an OAuth status\n// badge when the source has OAuth2 configured. Non-OAuth sources\n// render nothing.\nexport default function OpenApiSourceSummary(props: {\n  sourceId: string;\n  variant?: \"badge\" | \"panel\";\n  onAction?: () => void;\n}) {\n  const displayScope = useScope();\n  const userScope = useUserScope();\n  const scopeStack = useScopeStack();\n  const summaryResult = useAtomValue(sourceAtom(props.sourceId, displayScope));\n  const sourceScopeId =\n    AsyncResult.isSuccess(summaryResult) && summaryResult.value?.scopeId\n      ? summaryResult.value.scopeId\n      : displayScope;\n  const sourceResult = useAtomValue(openApiSourceAtom(ScopeId.make(sourceScopeId), props.sourceId));\n  const bindingsResult = useAtomValue(\n    openApiSourceBindingsAtom(displayScope, props.sourceId, ScopeId.make(sourceScopeId)),\n  );\n  const connectionsResult = useAtomValue(connectionsAtom(displayScope));\n\n  const source =\n    AsyncResult.isSuccess(sourceResult) && sourceResult.value ? sourceResult.value : null;\n\n  if (!source) return null;\n  const oauth2 = source.config.oauth2;\n  const bindingsLoaded = AsyncResult.isSuccess(bindingsResult);\n  const connectionsLoaded = AsyncResult.isSuccess(connectionsResult);\n  if (!bindingsLoaded) {\n    return props.variant === \"panel\" ? null : <CheckingCredentialsBadge />;\n  }\n\n  const bindings = AsyncResult.isSuccess(bindingsResult) ? bindingsResult.value : [];\n  if (oauth2 && !connectionsLoaded) {\n    return props.variant === \"panel\" ? null : <CheckingCredentialsBadge />;\n  }\n  const connections = AsyncResult.isSuccess(connectionsResult) ? connectionsResult.value : [];\n  const liveConnectionIds = new Set(connections.map((connection) => connection.id));\n  const scopeRanks = new Map(scopeStack.map((scope, index) => [scope.id, index] as const));\n  const credentialTargetScope = userScope;\n  const missing = missingSourceCredentialLabels({\n    slots: sourceCredentialSlots(source),\n    bindings,\n    targetScope: credentialTargetScope,\n    scopeRanks,\n    liveConnectionIds,\n  });\n\n  if (props.variant === \"panel\") {\n    return <SourceCredentialNotice missing={missing} onAction={props.onAction} />;\n  }\n\n  if (missing.length > 0) return <SourceCredentialStatusBadge missing={missing} />;\n\n  if (!oauth2) return null;\n  const connectionBinding = effectiveBindingForScope(\n    bindings,\n    oauth2.connectionSlot,\n    credentialTargetScope,\n    scopeRanks,\n  );\n  const connectionId =\n    connectionBinding && connectionBinding.value.kind === \"connection\"\n      ? connectionBinding.value.connectionId\n      : null;\n\n  if (connectionId && connections.some((connection) => connection.id === connectionId)) {\n    return <SourceCredentialStatusBadge missing={[]} />;\n  }\n\n  return <OAuthBadge />;\n}\n","import type { ConnectionId, CredentialBindingValue, ScopeId } from \"@executor-js/sdk/shared\";\n\nimport { oauth2ClientSecretSlot } from \"./source-contracts\";\nimport type { ConfiguredHeaderValue } from \"./types\";\n\nexport type BindingRowForCredentialStatus = {\n  readonly slot: string;\n  readonly scopeId: ScopeId;\n  readonly value: CredentialBindingValue;\n};\n\nexport type SourceForCredentialStatus = {\n  readonly config: {\n    readonly headers?: Record<string, ConfiguredHeaderValue>;\n    readonly oauth2?: {\n      readonly securitySchemeName: string;\n      readonly flow: \"authorizationCode\" | \"clientCredentials\";\n      readonly clientIdSlot: string;\n      readonly clientSecretSlot: string | null;\n      readonly connectionSlot: string;\n    };\n  };\n};\n\nconst scopeRank = (ranks: ReadonlyMap<string, number>, scopeId: ScopeId): number =>\n  ranks.get(scopeId) ?? Number.MAX_SAFE_INTEGER;\n\nexport const effectiveBindingForScope = (\n  rows: readonly BindingRowForCredentialStatus[],\n  slot: string,\n  targetScope: ScopeId,\n  ranks: ReadonlyMap<string, number>,\n): BindingRowForCredentialStatus | null =>\n  rows\n    .filter(\n      (row) => row.slot === slot && scopeRank(ranks, row.scopeId) >= scopeRank(ranks, targetScope),\n    )\n    .sort((a, b) => scopeRank(ranks, a.scopeId) - scopeRank(ranks, b.scopeId))[0] ?? null;\n\nconst hasSecretBinding = (\n  rows: readonly BindingRowForCredentialStatus[],\n  slot: string,\n  targetScope: ScopeId,\n  ranks: ReadonlyMap<string, number>,\n) => effectiveBindingForScope(rows, slot, targetScope, ranks)?.value.kind === \"secret\";\n\nconst hasConnectionBinding = (\n  rows: readonly BindingRowForCredentialStatus[],\n  slot: string,\n  targetScope: ScopeId,\n  ranks: ReadonlyMap<string, number>,\n  liveConnectionIds?: ReadonlySet<string>,\n) => {\n  const binding = effectiveBindingForScope(rows, slot, targetScope, ranks);\n  if (binding?.value.kind !== \"connection\") return false;\n  return liveConnectionIds ? liveConnectionIds.has(binding.value.connectionId) : true;\n};\n\nconst effectiveClientSecretSlot = (oauth2: {\n  readonly securitySchemeName: string;\n  readonly clientSecretSlot: string | null;\n}): string => oauth2.clientSecretSlot ?? oauth2ClientSecretSlot(oauth2.securitySchemeName);\n\nexport function missingCredentialLabels(\n  source: SourceForCredentialStatus,\n  bindings: readonly BindingRowForCredentialStatus[],\n  targetScope: ScopeId,\n  ranks: ReadonlyMap<string, number>,\n  options?: {\n    readonly liveConnectionIds?: ReadonlySet<string> | readonly ConnectionId[];\n  },\n): string[] {\n  const missing: string[] = [];\n  const rawLiveConnectionIds = options?.liveConnectionIds;\n  const liveConnectionIds = rawLiveConnectionIds\n    ? rawLiveConnectionIds instanceof Set\n      ? rawLiveConnectionIds\n      : new Set(rawLiveConnectionIds)\n    : undefined;\n\n  for (const [headerName, value] of Object.entries(source.config.headers ?? {})) {\n    if (typeof value === \"string\") continue;\n    if (!hasSecretBinding(bindings, value.slot, targetScope, ranks)) {\n      missing.push(headerName);\n    }\n  }\n\n  const oauth2 = source.config.oauth2;\n  if (!oauth2) return missing;\n\n  if (!hasSecretBinding(bindings, oauth2.clientIdSlot, targetScope, ranks)) {\n    missing.push(\"Client ID\");\n  }\n\n  const clientSecretSlot = effectiveClientSecretSlot(oauth2);\n  if (!hasSecretBinding(bindings, clientSecretSlot, targetScope, ranks)) {\n    missing.push(\"Client Secret\");\n  }\n\n  if (\n    !hasConnectionBinding(bindings, oauth2.connectionSlot, targetScope, ranks, liveConnectionIds)\n  ) {\n    missing.push(oauth2.flow === \"clientCredentials\" ? \"OAuth client connection\" : \"OAuth sign-in\");\n  }\n\n  return missing;\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,oBAAoB;AAC7B,YAAY,iBAAiB;AAE7B,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,aAAa;AACtB,SAAS,UAAU,eAAe,oBAAoB;AACtD,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;;;ACYP,IAAM,YAAY,CAAC,OAAoC,YACrD,MAAM,IAAI,OAAO,KAAK,OAAO;AAExB,IAAM,2BAA2B,CACtC,MACA,MACA,aACA,UAEA,KACG;AAAA,EACC,CAAC,QAAQ,IAAI,SAAS,QAAQ,UAAU,OAAO,IAAI,OAAO,KAAK,UAAU,OAAO,WAAW;AAC7F,EACC,KAAK,CAAC,GAAG,MAAM,UAAU,OAAO,EAAE,OAAO,IAAI,UAAU,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK;;;ADlB5E;AADT,SAAS,aAAa;AACpB,SAAO,oBAAC,SAAM,SAAQ,aAAY,mBAAK;AACzC;AAEA,SAAS,2BAA2B;AAClC,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,WAAU;AAAA,MACX;AAAA;AAAA,EAED;AAEJ;AAEA,IAAM,4BAA4B,CAAC,WAGrB,OAAO,oBAAoB,uBAAuB,OAAO,kBAAkB;AAEzF,IAAM,wBAAwB,CAAC,WAAoE;AACjG,QAAM,QAAgC,CAAC;AACvC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,WAAW,CAAC,CAAC,GAAG;AACvE,QAAI,OAAO,UAAU,SAAU,OAAM,KAAK,EAAE,MAAM,UAAU,MAAM,MAAM,MAAM,OAAO,KAAK,CAAC;AAAA,EAC7F;AACA,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,eAAe,CAAC,CAAC,GAAG;AAC3E,QAAI,OAAO,UAAU,SAAU,OAAM,KAAK,EAAE,MAAM,UAAU,MAAM,MAAM,MAAM,OAAO,KAAK,CAAC;AAAA,EAC7F;AACA,QAAM,SAAS,OAAO,OAAO;AAC7B,MAAI,QAAQ;AACV,UAAM,KAAK,EAAE,MAAM,UAAU,MAAM,OAAO,cAAc,OAAO,YAAY,CAAC;AAC5E,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,MAAM,0BAA0B,MAAM;AAAA,MACtC,OAAO;AAAA,IACT,CAAC;AACD,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,MAAM,OAAO;AAAA,MACb,OAAO,OAAO,SAAS,sBAAsB,4BAA4B;AAAA,IAC3E,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAMe,SAAR,qBAAsC,OAI1C;AACD,QAAM,eAAe,SAAS;AAC9B,QAAM,YAAY,aAAa;AAC/B,QAAM,aAAa,cAAc;AACjC,QAAM,gBAAgB,aAAa,WAAW,MAAM,UAAU,YAAY,CAAC;AAC3E,QAAM,gBACQ,sBAAU,aAAa,KAAK,cAAc,OAAO,UACzD,cAAc,MAAM,UACpB;AACN,QAAM,eAAe,aAAa,kBAAkB,QAAQ,KAAK,aAAa,GAAG,MAAM,QAAQ,CAAC;AAChG,QAAM,iBAAiB;AAAA,IACrB,0BAA0B,cAAc,MAAM,UAAU,QAAQ,KAAK,aAAa,CAAC;AAAA,EACrF;AACA,QAAM,oBAAoB,aAAa,gBAAgB,YAAY,CAAC;AAEpE,QAAM,SACQ,sBAAU,YAAY,KAAK,aAAa,QAAQ,aAAa,QAAQ;AAEnF,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,SAAS,OAAO,OAAO;AAC7B,QAAM,iBAA6B,sBAAU,cAAc;AAC3D,QAAM,oBAAgC,sBAAU,iBAAiB;AACjE,MAAI,CAAC,gBAAgB;AACnB,WAAO,MAAM,YAAY,UAAU,OAAO,oBAAC,4BAAyB;AAAA,EACtE;AAEA,QAAM,WAAuB,sBAAU,cAAc,IAAI,eAAe,QAAQ,CAAC;AACjF,MAAI,UAAU,CAAC,mBAAmB;AAChC,WAAO,MAAM,YAAY,UAAU,OAAO,oBAAC,4BAAyB;AAAA,EACtE;AACA,QAAM,cAA0B,sBAAU,iBAAiB,IAAI,kBAAkB,QAAQ,CAAC;AAC1F,QAAM,oBAAoB,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC;AAChF,QAAM,aAAa,IAAI,IAAI,WAAW,IAAI,CAAC,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAU,CAAC;AACvF,QAAM,wBAAwB;AAC9B,QAAM,UAAU,8BAA8B;AAAA,IAC5C,OAAO,sBAAsB,MAAM;AAAA,IACnC;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,MAAM,YAAY,SAAS;AAC7B,WAAO,oBAAC,0BAAuB,SAAkB,UAAU,MAAM,UAAU;AAAA,EAC7E;AAEA,MAAI,QAAQ,SAAS,EAAG,QAAO,oBAAC,+BAA4B,SAAkB;AAE9E,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA;AAAA,EACF;AACA,QAAM,eACJ,qBAAqB,kBAAkB,MAAM,SAAS,eAClD,kBAAkB,MAAM,eACxB;AAEN,MAAI,gBAAgB,YAAY,KAAK,CAAC,eAAe,WAAW,OAAO,YAAY,GAAG;AACpF,WAAO,oBAAC,+BAA4B,SAAS,CAAC,GAAG;AAAA,EACnD;AAEA,SAAO,oBAAC,cAAW;AACrB;","names":[]}

package/dist/api/group.d.ts

@@ -1,6 +1,6 @@
 import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
 import { Schema } from "effect";
-import { InternalError } from "@executor-js/sdk/core";
+import { InternalError } from "@executor-js/sdk/shared";
 import { OpenApiParseError, OpenApiExtractionError, OpenApiOAuthError } from "../sdk/errors";
 export declare const OpenApiGroup: HttpApiGroup.HttpApiGroup<"openapi", HttpApiEndpoint.HttpApiEndpoint<"previewSpec", "POST", "/scopes/:scopeId/openapi/preview", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
@@ -81,54 +81,40 @@ export declare const OpenApiGroup: HttpApiGroup.HttpApiGroup<"openapi", HttpApiE
 }>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"addSpec", "POST", "/scopes/:scopeId/openapi/specs", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
-    readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
-    readonly credentialTargetScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
-    readonly spec: Schema.String;
+    readonly spec: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"url">;
+        readonly url: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"blob">;
+        readonly value: Schema.String;
+    }>]>;
     readonly specFetchCredentials: Schema.optional<Schema.Struct<{
         readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-            readonly secretId: Schema.String;
+            readonly kind: Schema.Literal<"secret">;
             readonly prefix: Schema.optional<Schema.String>;
         }>]>>>;
         readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-            readonly secretId: Schema.String;
+            readonly kind: Schema.Literal<"secret">;
             readonly prefix: Schema.optional<Schema.String>;
         }>]>>>;
     }>>;
-    readonly name: Schema.optional<Schema.String>;
-    readonly baseUrl: Schema.optional<Schema.String>;
-    readonly namespace: Schema.optional<Schema.String>;
-    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
-        readonly secretId: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-        readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
-        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
-    }>, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly secretId: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>]>, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"binding">;
-        readonly slot: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>]>]>>>;
-    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
-        readonly secretId: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-        readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
-        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
-    }>, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly secretId: Schema.String;
+    readonly name: Schema.String;
+    readonly baseUrl: Schema.String;
+    readonly namespace: Schema.String;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
         readonly prefix: Schema.optional<Schema.String>;
-    }>]>, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"binding">;
-        readonly slot: Schema.String;
+    }>]>>>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
         readonly prefix: Schema.optional<Schema.String>;
-    }>]>]>>>;
+    }>]>>>;
     readonly oauth2: Schema.optional<Schema.Struct<{
         readonly kind: Schema.Literal<"oauth2">;
         readonly securitySchemeName: Schema.String;
         readonly flow: Schema.Literals<readonly ["authorizationCode", "clientCredentials"]>;
         readonly tokenUrl: Schema.String;
-        readonly authorizationUrl: Schema.NullOr<Schema.String>;
+        readonly authorizationUrl: Schema.withDecodingDefault<Schema.optional<Schema.NullOr<Schema.String>>>;
         readonly issuerUrl: Schema.optional<Schema.NullOr<Schema.String>>;
         readonly clientIdSlot: Schema.String;
         readonly clientSecretSlot: Schema.NullOr<Schema.String>;
@@ -146,7 +132,7 @@ export declare const OpenApiGroup: HttpApiGroup.HttpApiGroup<"openapi", HttpApiE
     readonly scope: Schema.String;
     readonly name: Schema.String;
     readonly config: Schema.Struct<{
-        readonly spec: Schema.String;
+        readonly spec: Schema.optional<Schema.String>;
         readonly sourceUrl: Schema.optional<Schema.String>;
         readonly baseUrl: Schema.optional<Schema.String>;
         readonly namespace: Schema.optional<Schema.String>;
@@ -177,7 +163,7 @@ export declare const OpenApiGroup: HttpApiGroup.HttpApiGroup<"openapi", HttpApiE
             readonly securitySchemeName: Schema.String;
             readonly flow: Schema.Literals<readonly ["authorizationCode", "clientCredentials"]>;
             readonly tokenUrl: Schema.String;
-            readonly authorizationUrl: Schema.NullOr<Schema.String>;
+            readonly authorizationUrl: Schema.withDecodingDefault<Schema.optional<Schema.NullOr<Schema.String>>>;
             readonly issuerUrl: Schema.optional<Schema.NullOr<Schema.String>>;
             readonly clientIdSlot: Schema.String;
             readonly clientSecretSlot: Schema.NullOr<Schema.String>;
@@ -185,119 +171,139 @@ export declare const OpenApiGroup: HttpApiGroup.HttpApiGroup<"openapi", HttpApiE
             readonly scopes: Schema.$Array<Schema.String>;
         }>>;
     }>;
-}>>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"updateSource", "PATCH", "/scopes/:scopeId/openapi/sources/:namespace", HttpApiEndpoint.StringTree<Schema.Struct<{
+}>>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"configure", "POST", "/scopes/:scopeId/openapi/configure", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
-    namespace: Schema.String;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
-    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
-    readonly name: Schema.optional<Schema.String>;
-    readonly baseUrl: Schema.optional<Schema.String>;
-    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
-        readonly secretId: Schema.String;
+    readonly source: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly scope: Schema.brand<Schema.String, "ScopeId">;
+    }>;
+    readonly scope: Schema.brand<Schema.String, "ScopeId">;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly kind: Schema.Literal<"text">;
+        readonly text: Schema.String;
         readonly prefix: Schema.optional<Schema.String>;
-        readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
-        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
-    }>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
         readonly secretId: Schema.String;
+        readonly secretScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
         readonly prefix: Schema.optional<Schema.String>;
-    }>]>, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"binding">;
-        readonly slot: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>]>]>>>;
-    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
-        readonly secretId: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"connection">;
+        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+    }>]>>>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly kind: Schema.Literal<"text">;
+        readonly text: Schema.String;
         readonly prefix: Schema.optional<Schema.String>;
-        readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
-        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
-    }>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
         readonly secretId: Schema.String;
+        readonly secretScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
         readonly prefix: Schema.optional<Schema.String>;
-    }>]>, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly kind: Schema.Literal<"binding">;
-        readonly slot: Schema.String;
-        readonly prefix: Schema.optional<Schema.String>;
-    }>]>]>>>;
-    readonly credentialTargetScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"connection">;
+        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+    }>]>>>;
+    readonly specFetchCredentials: Schema.optional<Schema.Struct<{
+        readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly kind: Schema.Literal<"text">;
+            readonly text: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"secret">;
+            readonly secretId: Schema.String;
+            readonly secretScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"connection">;
+            readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+        }>]>>>;
+        readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly kind: Schema.Literal<"text">;
+            readonly text: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"secret">;
+            readonly secretId: Schema.String;
+            readonly secretScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"connection">;
+            readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+        }>]>>>;
+    }>>;
     readonly oauth2: Schema.optional<Schema.Struct<{
+        readonly clientId: Schema.optional<Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly kind: Schema.Literal<"text">;
+            readonly text: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"secret">;
+            readonly secretId: Schema.String;
+            readonly secretScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"connection">;
+            readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+        }>]>>;
+        readonly clientSecret: Schema.optional<Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly kind: Schema.Literal<"text">;
+            readonly text: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"secret">;
+            readonly secretId: Schema.String;
+            readonly secretScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"connection">;
+            readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+        }>]>>;
+        readonly connection: Schema.optional<Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly kind: Schema.Literal<"text">;
+            readonly text: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"secret">;
+            readonly secretId: Schema.String;
+            readonly secretScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"connection">;
+            readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+        }>]>>;
+    }>>;
+    readonly oauth2Source: Schema.optional<Schema.Struct<{
         readonly kind: Schema.Literal<"oauth2">;
         readonly securitySchemeName: Schema.String;
         readonly flow: Schema.Literals<readonly ["authorizationCode", "clientCredentials"]>;
         readonly tokenUrl: Schema.String;
-        readonly authorizationUrl: Schema.NullOr<Schema.String>;
+        readonly authorizationUrl: Schema.withDecodingDefault<Schema.optional<Schema.NullOr<Schema.String>>>;
         readonly issuerUrl: Schema.optional<Schema.NullOr<Schema.String>>;
         readonly clientIdSlot: Schema.String;
         readonly clientSecretSlot: Schema.NullOr<Schema.String>;
         readonly connectionSlot: Schema.String;
         readonly scopes: Schema.$Array<Schema.String>;
     }>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
-    readonly updated: Schema.Boolean;
-}>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listSourceBindings", "GET", "/scopes/:scopeId/openapi/sources/:namespace/base/:sourceScopeId/bindings", HttpApiEndpoint.StringTree<Schema.Struct<{
-    scopeId: Schema.brand<Schema.String, "ScopeId">;
-    namespace: Schema.String;
-    sourceScopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.$Array<Schema.Struct<{
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.$Array<Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "CredentialBindingId">;
+    readonly scopeId: Schema.brand<Schema.String, "ScopeId">;
+    readonly pluginId: Schema.String;
     readonly sourceId: Schema.String;
     readonly sourceScopeId: Schema.brand<Schema.String, "ScopeId">;
-    readonly scopeId: Schema.brand<Schema.String, "ScopeId">;
-    readonly slot: Schema.String;
+    readonly slotKey: Schema.String;
     readonly value: Schema.Union<readonly [Schema.Struct<{
-        readonly kind: Schema.Literal<"secret">;
-        readonly secretId: Schema.brand<Schema.String, "SecretId">;
-        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
-    }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"connection">;
-        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
-    }>, Schema.Struct<{
         readonly kind: Schema.Literal<"text">;
         readonly text: Schema.String;
-    }>]>;
-    readonly createdAt: Schema.Date;
-    readonly updatedAt: Schema.Date;
-}>>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"setSourceBinding", "POST", "/scopes/:scopeId/openapi/source-bindings", HttpApiEndpoint.StringTree<Schema.Struct<{
-    scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
-    readonly sourceId: Schema.String;
-    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
-    readonly scope: Schema.brand<Schema.String, "ScopeId">;
-    readonly slot: Schema.String;
-    readonly value: Schema.Union<readonly [Schema.Struct<{
-        readonly kind: Schema.Literal<"secret">;
-        readonly secretId: Schema.brand<Schema.String, "SecretId">;
-        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
     }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"connection">;
-        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
-    }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"text">;
-        readonly text: Schema.String;
-    }>]>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
-    readonly sourceId: Schema.String;
-    readonly sourceScopeId: Schema.brand<Schema.String, "ScopeId">;
-    readonly scopeId: Schema.brand<Schema.String, "ScopeId">;
-    readonly slot: Schema.String;
-    readonly value: Schema.Union<readonly [Schema.Struct<{
         readonly kind: Schema.Literal<"secret">;
         readonly secretId: Schema.brand<Schema.String, "SecretId">;
         readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
     }>, Schema.Struct<{
         readonly kind: Schema.Literal<"connection">;
         readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
-    }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"text">;
-        readonly text: Schema.String;
     }>]>;
     readonly createdAt: Schema.Date;
     readonly updatedAt: Schema.Date;
-}>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"removeSourceBinding", "POST", "/scopes/:scopeId/openapi/source-bindings/remove", HttpApiEndpoint.StringTree<Schema.Struct<{
-    scopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
-    readonly sourceId: Schema.String;
-    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
-    readonly slot: Schema.String;
-    readonly scope: Schema.brand<Schema.String, "ScopeId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
-    readonly removed: Schema.Boolean;
-}>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never>, false>;
+}>>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never>, false>;