@open-everywhere/adapters 0.2.1 → 0.4.0

package/agent/register-defaults.ts

@@ -20,7 +20,6 @@
 // provider bundle: it drives the table it receives.
 
 import { registerOeOauth } from "./oe-oauth/register.js";
-import { oeOauthEnabled, loadOeOauthConfig } from "./oe-oauth/config.js";
 import { registerAgentBrowser } from "./browser/register.js";
 import { agentBrowserEnabled, loadAgentBrowserConfig } from "./browser/config.js";
 import { registerAwsAccess } from "./aws/register.js";
@@ -28,22 +27,23 @@ import { awsAccessEnabled } from "./aws/config.js";
 import { registerDirectoryAdapter } from "./directory/register.js";
 import { registerGatewayRouteProbe } from "./model/gateway-probe.js";
 import { registerNeon } from "./postgres/neon.js";
-import { vercelBlobPutter } from "./blob/hosting.js";
 import {
   registerDbCredentialBroker,
   CREDENTIAL_KEY_ENV,
   registerGitHubConfigPrProvider,
-  setBlobPutter,
   registerAuditDropCounter,
   emitTelemetry,
   getOperationalStore,
   bootVerifyAuditChainTail,
   bootBackfillLinkTenants,
   runBootNotices,
+  registerBootNotice,
+  announceJudgeWithoutRules,
   registerOperationalPgliteLazy,
   resolveOperationalSelection,
   resolveMemoryProviderId,
   onVercel,
+  getSettings,
   declareProviderSelection,
   assertConnectorMemoryGrants,
   applySubtreeSurfaceClaims,
@@ -94,6 +94,9 @@ export interface StoreWiring {
 /** What one `registerDefaultAdapters()` call wired. */
 export interface DefaultAdapterWiring {
   readonly providers: readonly string[];
+  /** The own-rolled OAuth flow registered. Always true since OPE-2411 deleted the master flag. A mint for an
+   *  OAuth home no connection declares fails closed unless the vault already holds a client record or an unexpired token for it;
+   *  the off switch is the bundle's `user-oauth` grant. */
   readonly oeOauth: boolean;
   readonly dbCredentialBroker: boolean;
   readonly agentBrowser: boolean;
@@ -110,17 +113,18 @@ export interface DefaultAdapterWiring {
  *
  * The PGlite floor (OPE-113) arms when the operational selection resolves to it (no provider named,
  * no `DATABASE_URL`). It stays off on Vercel, where the floor is per-instance and ephemeral, unless
- * `OE_ALLOW_EPHEMERAL_OPERATIONAL=1` names the single-instance escape. The Neon gate never opens on
- * the floor's branch, so the two never both register.
+ * the `storage.allowEphemeralOperational` setting names the single-instance escape (it was
+ * `OE_ALLOW_EPHEMERAL_OPERATIONAL=1` until OPE-2411). The Neon gate never opens on the floor's
+ * branch, so the two never both register.
  */
-export function decideStoreWiring(env: NodeJS.ProcessEnv, vercel: boolean): StoreWiring {
+export function decideStoreWiring(env: NodeJS.ProcessEnv, vercel: boolean, allowEphemeralOperational: boolean): StoreWiring {
   const operational = resolveOperationalSelection(env);
   const postgresSelected =
     resolveMemoryProviderId(env) === "postgres" || (operational.id === "postgres" && operational.floor === "none");
   return {
     operational,
     neon: postgresSelected && Boolean(env.DATABASE_URL),
-    pgliteFloor: operational.floor === "pglite" && (!vercel || env.OE_ALLOW_EPHEMERAL_OPERATIONAL === "1"),
+    pgliteFloor: operational.floor === "pglite" && (!vercel || allowEphemeralOperational),
   };
 }
 
@@ -156,11 +160,12 @@ async function wireDefaultAdapters(options: DefaultAdapterOptions): Promise<Defa
   // them. A row that lands ahead of the declaration cannot be retracted (core warns if one does).
   const providers = declareProviderSelection(options.providers.map((p) => p.id));
 
-  // Connector-plane user-auth flow (OPE-88): own-rolled OAuth, registered only when the master flag
-  // OE_OAUTH_ENABLED is armed AND a provider config block is present. Otherwise no flow registers and
-  // core's OAuth mint paths fail closed. There is no vendor fallback.
-  const oeOauthCfg = oeOauthEnabled() ? loadOeOauthConfig() : undefined;
-  if (oeOauthCfg) registerOeOauth({ providers: oeOauthCfg });
+  // Connector-plane user-auth flow (OPE-88): own-rolled OAuth. Since OPE-2411 it ALWAYS registers — the
+  // OE_OAUTH_ENABLED master flag and the OE_OAUTH_CONFIG env map are deleted. Each connector declares its
+  // own sign-in in its connection module, next to its URL, and the vault reads those declarations per
+  // call. A mint for an OAuth home nothing declares fails closed unless the vault already holds a client
+  // record or an unexpired token for it; the off switch is the bundle's `user-oauth` grant. There is no vendor fallback.
+  registerOeOauth();
 
   // The "db" credential broker (task #113): registered iff its AES key exists. Without the key the
   // broker fails closed on store and read, so registering it would falsely offer the "Set API key"
@@ -174,7 +179,7 @@ async function wireDefaultAdapters(options: DefaultAdapterOptions): Promise<Defa
   const browserCfg = agentBrowserEnabled() ? loadAgentBrowserConfig() : undefined;
   const agentBrowser = browserCfg ? registerAgentBrowser(browserCfg) : false;
 
-  // The AWS-access layer: only when OE_AWS_ENABLED is armed. Flag-off ⇒ core's AWS mint and exec
+  // The AWS-access layer: only when the `aws.enabled` setting is armed. Flag-off ⇒ core's AWS mint and exec
   // paths fail closed.
   const awsAccess = awsAccessEnabled();
   if (awsAccess) registerAwsAccess();
@@ -200,10 +205,6 @@ async function wireDefaultAdapters(options: DefaultAdapterOptions): Promise<Defa
   // cycle, and the one-chunk invariant), so this boot module injects the emitter.
   registerAuditDropCounter((action, platform) => emitTelemetry("oe.audit.dropped", { "oe.action": action, "oe.platform": platform }));
 
-  // The Vercel Blob putter for the HTML-artifact hosting seam. Harmless when unused: the hosting
-  // path runs only for an org that opted in, and the putter fails loud without its OIDC env.
-  setBlobPutter(vercelBlobPutter);
-
   // THE APP'S HOOK, after every default registration and before every check that reads them.
   const customAdapters = options.customAdapters !== undefined;
   if (options.customAdapters) await options.customAdapters();
@@ -217,7 +218,12 @@ async function wireDefaultAdapters(options: DefaultAdapterOptions): Promise<Defa
   // `subtree: true` declares so from its own bundle's register().
   applySubtreeSurfaceClaims();
 
-  const store = decideStoreWiring(process.env, onVercel());
+  // The judge-without-rules line (OPE-2400): `approvals.judgeMode: "enforce"` with no bound
+  // pre-approval rule behaves like `off`, so say so once. A boot notice, so it logs once per process,
+  // in the process that serves, and a failure costs one log line, never the boot.
+  registerBootNotice("approval-judge-no-rules", announceJudgeWithoutRules);
+
+  const store = decideStoreWiring(process.env, onVercel(), getSettings().storage.allowEphemeralOperational);
 
   // Neon (hosted Postgres) is LIVE-ONLY: registerNeon() builds the driver only when called here.
   if (store.neon) await registerNeon();
@@ -239,7 +245,7 @@ async function wireDefaultAdapters(options: DefaultAdapterOptions): Promise<Defa
   // credentials and the declared rooms differ from this checkout.
   await reconcileSurfaceCommands();
 
-  WIRED = { providers, oeOauth: oeOauthCfg !== undefined, dbCredentialBroker, agentBrowser, awsAccess, customAdapters, store };
+  WIRED = { providers, oeOauth: true, dbCredentialBroker, agentBrowser, awsAccess, customAdapters, store };
   return WIRED;
 }
 

package/agent/sandbox/backend-stop.ts

@@ -3,7 +3,7 @@
 
 import { Sandbox } from "@vercel/sandbox";
 import { execFile } from "node:child_process";
-import { onVercel, resolveSelfHostBackendKind } from "@open-everywhere/core/agent/adapter-api.js";
+import { resolveSandboxBackend } from "@open-everywhere/core/agent/adapter-api.js";
 import { getRecordedSandboxName } from "./created-sandbox-registry.js";
 
 /** One sandbox as its backend reports it — `createdAt` (epoch ms) is the one honestly-observable
@@ -22,7 +22,7 @@ export interface SandboxListing {
  * docker daemon, or a platform.
  */
 export interface SandboxStopper {
-  /** Backend id, matching `OE_SANDBOX_BACKEND` / eve's backend name. For logs and tests. */
+  /** Backend id, matching `sandbox.selfHostBackend` / eve's backend name. For logs and tests. */
   readonly backend: string;
   /** Does this backend bill sandbox runtime by wall clock? Only then is a stop priced. */
   readonly metered: boolean;
@@ -224,7 +224,7 @@ export const justBashStopper: SandboxStopper = {
   backend: "just-bash",
   metered: false,
   ownership:
-    "stop owner = NONE — the just-bash backend runs inside this app process. There is no VM or container to stop and no metered runtime, so the turn-end sweep is inert by design. Set OE_SANDBOX_BACKEND=docker for a backend whose compute is stopped at turn end",
+    "stop owner = NONE — the just-bash backend runs inside this app process. There is no VM or container to stop and no metered runtime, so the turn-end sweep is inert by design. Declare `sandbox.selfHostBackend: \"docker\"` for a backend whose compute is stopped at turn end",
   async list() {
     return [];
   },
@@ -239,16 +239,16 @@ export const justBashStopper: SandboxStopper = {
 // ── selection ─────────────────────────────────────────────────────────────────────────────────
 
 /**
- * The ONE "who stops the sandbox on this deployment" decision. It reads the SAME two switches the
- * app reads to BUILD the backend — `onVercel()` and `resolveSelfHostBackendKind()` — so the
- * backend that runs and the backend that stops can never disagree. An unknown
- * `OE_SANDBOX_BACKEND` throws here exactly as it throws at boot; the hook's fail-soft catch logs
- * it rather than failing the turn.
+ * The ONE "who stops the sandbox on this deployment" decision. It reads the SAME rule the app
+ * reads to BUILD the backend — `resolveSandboxBackend()` over the host fact and the `sandbox.*`
+ * settings — so the backend that runs and the backend that stops can never disagree. Settings load
+ * refuses an unknown backend, so no value reaching this read can be one.
  */
 export function resolveSandboxStopper(): SandboxStopper {
   if (forcedStopper !== undefined) return forcedStopper;
-  if (onVercel()) return vercelStopper;
-  return resolveSelfHostBackendKind() === "justbash" ? justBashStopper : createDockerStopper();
+  const backend = resolveSandboxBackend();
+  if (backend === "vercel") return vercelStopper;
+  return backend === "justbash" ? justBashStopper : createDockerStopper();
 }
 
 /** Test seam: force the resolved stopper so the hook's own branching can be driven without a

package/dist/agent/aws/config.d.ts

@@ -1,5 +1,6 @@
-/** Truthiness for the master flag — same off-spellings as the other connector-plane flags (default
- *  OFF: off is the inert posture; arming is a deliberate operator act). */
+/** The master flag: the `aws.enabled` setting (default OFF: off is the inert posture; arming is a
+ *  deliberate, reviewed commit). Read from the registered settings, so it is called at boot AFTER
+ *  `registerSettings` (register-defaults.ts runs from the app's register-adapters, after register-config). */
 export declare function awsAccessEnabled(): boolean;
 /** The AWS-access config block (env-sourced). Only a default region today; the identity/executor DI
  *  seams are passed by the caller (register.ts), not env. */
@@ -22,6 +23,7 @@ export interface AwsSsoConfig {
     /** OAuth scopes requested on the link (default applied by the minter). */
     readonly scopes?: readonly string[];
 }
-/** Load the Identity Center SSO link config from env. Region falls back to the general AWS default. */
+/** Load the Identity Center SSO link config: the region and client id from env, the scopes from the
+ *  `aws.ssoScopes` setting (empty ⇒ the minter's default). Region falls back to the general AWS default. */
 export declare function loadAwsSsoConfig(): AwsSsoConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/agent/aws/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../agent/aws/config.ts"],"names":[],"mappings":"AAmBA;2EAC2E;AAC3E,wBAAgB,gBAAgB,IAAI,OAAO,CAK1C;AAED;6DAC6D;AAC7D,MAAM,WAAW,eAAe;IAC9B;6FACyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;wFACwF;AACxF,wBAAgB,mBAAmB,IAAI,eAAe,CAGrD;AAED;;4FAE4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,uGAAuG;AACvG,wBAAgB,gBAAgB,IAAI,YAAY,CAc/C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../agent/aws/config.ts"],"names":[],"mappings":"AAmBA;;8GAE8G;AAC9G,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED;6DAC6D;AAC7D,MAAM,WAAW,eAAe;IAC9B;6FACyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;wFACwF;AACxF,wBAAgB,mBAAmB,IAAI,eAAe,CAGrD;AAED;;4FAE4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;4GAC4G;AAC5G,wBAAgB,gBAAgB,IAAI,YAAY,CAY/C"}

package/dist/agent/aws/config.js

@@ -1,7 +1,9 @@
 // The `aws` access master arming flag and config block. Flag-off ⇒ NOTHING registers and core's AWS paths
-// fail closed, with no fallback. Config is env-sourced at the adapter boundary, like DATABASE_URL.
-/** The master arming flag env var — one string this module's readers share. */
-const OE_AWS_ENABLED_ENV = "OE_AWS_ENABLED";
+// fail closed, with no fallback. The two CHOICES are settings since OPE-2411 — `aws.enabled` (was
+// OE_AWS_ENABLED) and `aws.ssoScopes` (was OE_AWS_SSO_SCOPES) — because arming the plane and widening
+// what it asks for are policy. The WIRING (regions, the public OIDC client id) stays env-sourced at the
+// adapter boundary, like DATABASE_URL.
+import { getSettings } from "@open-everywhere/core/agent/adapter-api.js";
 /** Optional default region for STS + the CLI when a grant names none. */
 const OE_AWS_REGION_ENV = "OE_AWS_REGION";
 // The per-user Identity Center link config. These vars configure the LINK flow only — a mint needs the
@@ -11,16 +13,11 @@ const OE_AWS_REGION_ENV = "OE_AWS_REGION";
 const OE_AWS_SSO_REGION_ENV = "OE_AWS_SSO_REGION";
 /** The pre-registered PUBLIC OIDC client id for the Identity Center auth-code + PKCE link flow. */
 const OE_AWS_SSO_CLIENT_ID_ENV = "OE_AWS_SSO_CLIENT_ID";
-/** Optional space-separated OAuth scopes for the link (default "sso:account:access"). */
-const OE_AWS_SSO_SCOPES_ENV = "OE_AWS_SSO_SCOPES";
-/** Truthiness for the master flag — same off-spellings as the other connector-plane flags (default
- *  OFF: off is the inert posture; arming is a deliberate operator act). */
+/** The master flag: the `aws.enabled` setting (default OFF: off is the inert posture; arming is a
+ *  deliberate, reviewed commit). Read from the registered settings, so it is called at boot AFTER
+ *  `registerSettings` (register-defaults.ts runs from the app's register-adapters, after register-config). */
 export function awsAccessEnabled() {
-    const raw = process.env[OE_AWS_ENABLED_ENV];
-    if (raw === undefined)
-        return false;
-    const v = raw.trim().toLowerCase();
-    return v !== "" && v !== "0" && v !== "false" && v !== "off" && v !== "no";
+    return getSettings().aws.enabled;
 }
 /** Load the AWS-access config block from env. Always returns a (possibly empty) config — unlike the
  *  oe-oauth block there is no REQUIRED field, so the master flag alone gates arming. */
@@ -28,15 +25,14 @@ export function loadAwsAccessConfig() {
     const defaultRegion = process.env[OE_AWS_REGION_ENV]?.trim() || process.env.AWS_REGION?.trim();
     return { ...(defaultRegion ? { defaultRegion } : {}) };
 }
-/** Load the Identity Center SSO link config from env. Region falls back to the general AWS default. */
+/** Load the Identity Center SSO link config: the region and client id from env, the scopes from the
+ *  `aws.ssoScopes` setting (empty ⇒ the minter's default). Region falls back to the general AWS default. */
 export function loadAwsSsoConfig() {
     const region = process.env[OE_AWS_SSO_REGION_ENV]?.trim() ||
         process.env[OE_AWS_REGION_ENV]?.trim() ||
         process.env.AWS_REGION?.trim();
     const clientId = process.env[OE_AWS_SSO_CLIENT_ID_ENV]?.trim();
-    const scopes = process.env[OE_AWS_SSO_SCOPES_ENV]?.trim()
-        ? process.env[OE_AWS_SSO_SCOPES_ENV].trim().split(/\s+/u).filter(Boolean)
-        : undefined;
+    const scopes = getSettings().aws.ssoScopes;
     return {
         ...(region ? { region } : {}),
         ...(clientId ? { clientId } : {}),

package/dist/agent/aws/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../agent/aws/config.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,mGAAmG;AAEnG,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAC5C,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,uGAAuG;AACvG,yFAAyF;AAEzF;gGACgG;AAChG,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAClD,mGAAmG;AACnG,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AACxD,yFAAyF;AACzF,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAElD;2EAC2E;AAC3E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAC7E,CAAC;AAUD;wFACwF;AACxF,MAAM,UAAU,mBAAmB;IACjC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC/F,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC;AAcD,uGAAuG;AACvG,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE;QAC1C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE;QACvD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC1E,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../agent/aws/config.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,kGAAkG;AAClG,sGAAsG;AACtG,wGAAwG;AACxG,uCAAuC;AAEvC,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAEzE,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,uGAAuG;AACvG,yFAAyF;AAEzF;gGACgG;AAChG,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAClD,mGAAmG;AACnG,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AACxD;;8GAE8G;AAC9G,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;AACnC,CAAC;AAUD;wFACwF;AACxF,MAAM,UAAU,mBAAmB;IACjC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC/F,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC;AAcD;4GAC4G;AAC5G,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE;QAC1C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;QACtC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;IAC3C,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/dist/agent/aws/register.js

@@ -1,4 +1,4 @@
-// Register the AWS-access layer, called only when the OE_AWS_ENABLED master flag is armed. Flag-off ⇒
+// Register the AWS-access layer, called only when the `aws.enabled` master flag is armed. Flag-off ⇒
 // nothing registers and core's AWS mint, exec and link paths fail closed; rollback is not arming the flag.
 import { registerAwsIdentityProvider, registerAwsExecutor, registerAwsSsoLinkStore, registerAwsSsoCallbackCompleter, registerCredentialPurgeHook, } from "@open-everywhere/core/agent/adapter-api.js";
 import { makeAwsStsProvider } from "./sts.js";
@@ -27,7 +27,7 @@ export function registerAwsAccess(opts = {}) {
         ...opts.sso,
     });
     // Wire the `GET OE_AWS_SSO_CALLBACK_PATH` route to the SSO minter's code→token exchange, mirroring the
-    // own-rolled OAuth adapter's registerOeOauthCallbackCompleter. Fires under the OE_AWS_ENABLED boot
+    // own-rolled OAuth adapter's registerOeOauthCallbackCompleter. Fires under the `aws.enabled` boot
     // guard; flag-off ⇒ the completer is never registered and the route fails closed (generic error page).
     registerAwsSsoCallbackCompleter({ complete: ({ state, code }) => sso.completeLink(state, code) });
     const provider = makeAwsStsProvider({ defaultRegion, mintUserSso: (req) => sso.mint(req), ...opts.identity });

package/dist/agent/aws/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../agent/aws/register.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,2GAA2G;AAE3G,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,EACvB,+BAA+B,EAC/B,2BAA2B,GAG5B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAA8B,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAA8B,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAA+C,MAAM,UAAU,CAAC;AACnI,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAYpE;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAA6B,EAAE;IAKnE,qGAAqG;IACrG,2FAA2F;IAC3F,MAAM,EAAE,aAAa,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,sGAAsG;IACtG,mFAAmF;IACnF,uBAAuB,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC/C,2GAA2G;IAC3G,wGAAwG;IACxG,2BAA2B,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,IAAI,CAAC,GAAG;KACZ,CAAC,CAAC;IAEH,uGAAuG;IACvG,mGAAmG;IACnG,uGAAuG;IACvG,+BAA+B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAElG,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../agent/aws/register.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,2GAA2G;AAE3G,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,EACvB,+BAA+B,EAC/B,2BAA2B,GAG5B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAA8B,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAA8B,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAA+C,MAAM,UAAU,CAAC;AACnI,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAYpE;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAA6B,EAAE;IAKnE,qGAAqG;IACrG,2FAA2F;IAC3F,MAAM,EAAE,aAAa,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,sGAAsG;IACtG,mFAAmF;IACnF,uBAAuB,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC/C,2GAA2G;IAC3G,wGAAwG;IACxG,2BAA2B,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,IAAI,CAAC,GAAG;KACZ,CAAC,CAAC;IAEH,uGAAuG;IACvG,kGAAkG;IAClG,uGAAuG;IACvG,+BAA+B,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAElG,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AACrC,CAAC"}

package/dist/agent/aws/sso.js

@@ -8,7 +8,7 @@ export { OE_AWS_SSO_CALLBACK_PATH };
  *  what makes the token response carry an id-token, and the id-token's `sub` is the only statement of
  *  WHO completed the sign-in the callback can observe. Without it {@link AwsSsoMinter.completeLink}
  *  refuses every completion, because it cannot name the signer (OPE-1955). An operator who overrides
- *  `OE_AWS_SSO_SCOPES` must keep `openid` in the list. */
+ *  the `aws.ssoScopes` setting must keep `openid` in the list. */
 const DEFAULT_SSO_SCOPES = ["sso:account:access", "openid"];
 /** Consent window for a pending link (15 min, matching the own-rolled OAuth pending TTL). */
 const DEFAULT_PENDING_TTL_MS = 15 * 60 * 1000;
@@ -166,7 +166,7 @@ export function makeAwsSsoMinter(opts = {}) {
     function requireOpenIdScope() {
         if (scopes.includes("openid"))
             return;
-        throw new Error("AWS SSO link: the configured scopes omit \"openid\" (OE_AWS_SSO_SCOPES). Without it the Identity " +
+        throw new Error("AWS SSO link: the configured scopes omit \"openid\" (the aws.ssoScopes setting). Without it the Identity " +
             "Center token response carries no id-token, so the account that signs in cannot be named and the " +
             "link can never complete. Fail-closed: no link was started.");
     }

package/dist/agent/aws/sso.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../agent/aws/sso.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,2GAA2G;AAE3G,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,GAMzB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAK1D,yGAAyG;AACzG,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC;;;;0DAI0D;AAC1D,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAU,CAAC;AACrE,6FAA6F;AAC7F,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,wGAAwG;AACxG,MAAM,wBAAwB,GAAG,IAAI,CAAC;AA+BtC;;;uEAGuE;AACvE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,uBAAuB,CAAC;IAC/B,gBAAgB,CAAS;IAClC,YAAY,gBAAwB,EAAE,GAAW;QAC/C,KAAK,CACH,uCAAuC,GAAG,0DAA0D;YAClG,GAAG,gBAAgB,+EAA+E;YAClG,+FAA+F;YAC/F,kGAAkG;YAClG,+FAA+F;YAC/F,6CAA6C,CAChD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF;AAED;uFACuF;AACvF,MAAM,UAAU,oBAAoB,CAAC,CAAU;IAC7C,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,GAAI,CAAwB,CAAC,IAAI,CAAC;IAC5C,OAAO,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,gBAAwB;IACrD,OAAO,eAAe,gBAAgB,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAK,GAAqB,gBAAgB,EAAE;IAC9E,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,gBAAwB;YACjC,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,gBAAwB,EAAE,KAAa;YACjD,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,gBAAwB;YAClC,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAK,GAAqB,gBAAgB,EAAE;IAC9E,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,SAAiB;YAClC,OAAO,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AA0DD,SAAS,kBAAkB;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;IAC1E,OAAO,GAAG,UAAU,GAAG,wBAAwB,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAuB;IAClD,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,gBAAgB,KAAK,EAAE,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;yGACyG;AACzG,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,CAAC,GAAG,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,qCAAqC;YAC5E,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,OAA2B;IACxD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,GAAG,GAAI,MAA4B,CAAC,GAAG,CAAC;IAC9C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAI,GAAwB,EAAE;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC;IACjD,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,0BAA0B,CAAC;IACrE,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,sBAAsB,EAAE,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAEzD,SAAS,aAAa;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,kGAAkG;gBAChG,sCAAsC,CACzC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,SAAS,eAAe;QACtB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,mGAAmG;gBACjG,oEAAoE,CACvE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD;;;+CAG2C;IAC3C,SAAS,kBAAkB;QACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO;QACtC,MAAM,IAAI,KAAK,CACb,mGAAmG;YACjG,kGAAkG;YAClG,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,gBAAgB,aAAa,EAAE,0BAA0B,CAAC;IAC1F,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,gBAAgB,aAAa,EAAE,sBAAsB,CAAC;IAClF,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,sBAAsB,aAAa,EAAE,uCAAuC,CAAC;IAE1G;8CAC0C;IAC1C,KAAK,UAAU,SAAS,CAAC,gBAAwB;QAC/C,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,kBAAkB,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,kGAAkG;gBAChG,wBAAwB,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAwB;YACnC,gBAAgB;YAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,GAAG,EAAE;YAChB,SAAS,EAAE,GAAG,EAAE,GAAG,UAAU;SAC9B,CAAC;QACF,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC/B,CAAC;IAED;;;0CAGsC;IACtC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,IAAY;QACrD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACzH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACvD,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACzF,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC;YAC9B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,GAAG;YACd,aAAa,EAAE,OAAO,CAAC,QAAQ;SAChC,CAAC,CAAC;QACH,sGAAsG;QACtG,kGAAkG;QAClG,2EAA2E;QAC3E,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,iGAAiG;QACjG,qFAAqF;QACrF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9G,oGAAoG;QACpG,kGAAkG;QAClG,2FAA2F;QAC3F,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,aAAa,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,OAAO,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,SAAS;gBACzB,CAAC,CAAC,8FAA8F;oBAC9F,iGAAiG;oBACjG,kFAAkF;gBACpF,CAAC,CAAC,2BAA2B,OAAO,CAAC,MAAM,oCAAoC,CAClF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAsB;YAChC,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,GAAG,EAAE;YACnB,qBAAqB,EAAE,OAAO,CAAC,WAAW;SAC3C,CAAC;QACF,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,4DAA4D;QAC5D,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACxD,CAAC;IAYD;+FAC2F;IAC3F,KAAK,UAAU,aAAa,CAAC,IAA4B;QACvD,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;QACjC,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;gBAC9B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;aAC3C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,8CAA8C,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAC5H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,yFAAyF;YACzF,IAAI,IAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;gBACvD,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAsB,CAAC;QACvE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;6FACyF;IACzF,KAAK,UAAU,gBAAgB,CAAC,gBAAwB;QACtD,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;YAC/B,4FAA4F;YAC5F,8FAA8F;YAC9F,sFAAsF;YACtF,2FAA2F;YAC3F,+FAA+F;YAC/F,0EAA0E;YAC1E,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,kEAAkE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,EAAE,IAAI,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;QACjF,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5H,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,uDAAuD,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,OAAO,GAAsB;YACjC,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,YAAY;YACnD,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,GAAG,EAAE;YACnB,iGAAiG;YACjG,+FAA+F;YAC/F,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;SACjD,CAAC;QACF,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,WAAW,CAAC;IAC7B,CAAC;IAWD;4GACwG;IACxG,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,gBAAwB,EACxB,SAAiB,EACjB,QAAgB;QAEhB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACzI,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,sDAAsD,CAAC,CAAC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CACpI,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,8FAA8F;YAC9F,MAAM,IAAI,KAAK,CACb,2CAA2C,GAAG,CAAC,MAAM,eAAe,QAAQ,gBAAgB,SAAS,KAAK;gBACxG,0GAA0G,CAC7G,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0B,CAAC;QAC3E,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QAChC,IAAI,CAAC,EAAE,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,gEAAgE,QAAQ,iBAAiB,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO;YACL,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,eAAe,EAAE,EAAE,CAAC,eAAe;YACnC,YAAY,EAAE,EAAE,CAAC,YAAY;YAC7B,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/G,CAAC;IACJ,CAAC;IAED,2GAA2G;IAC3G,0GAA0G;IAC1G,MAAM,IAAI,GAAG,cAAc,CAAwD;QACjF,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,SAAS;QAClB,kBAAkB,EAAE,wBAAwB;QAC5C,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,OAAO,IAAI,gBAAgB,EAAE;QACjF,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE;YACxC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC3F,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1H,CAAC;KACF,CAAC,CAAC;IAEH,KAAK,UAAU,IAAI,CAAC,GAAuB;QACzC,MAAM,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;QAC9C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,kGAAkG;YAClG,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;QAChH,CAAC;QACD,2FAA2F;QAC3F,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAmB,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../agent/aws/sso.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,2GAA2G;AAE3G,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,GAMzB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAK1D,yGAAyG;AACzG,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC;;;;kEAIkE;AAClE,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAU,CAAC;AACrE,6FAA6F;AAC7F,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,wGAAwG;AACxG,MAAM,wBAAwB,GAAG,IAAI,CAAC;AA+BtC;;;uEAGuE;AACvE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,uBAAuB,CAAC;IAC/B,gBAAgB,CAAS;IAClC,YAAY,gBAAwB,EAAE,GAAW;QAC/C,KAAK,CACH,uCAAuC,GAAG,0DAA0D;YAClG,GAAG,gBAAgB,+EAA+E;YAClG,+FAA+F;YAC/F,kGAAkG;YAClG,+FAA+F;YAC/F,6CAA6C,CAChD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF;AAED;uFACuF;AACvF,MAAM,UAAU,oBAAoB,CAAC,CAAU;IAC7C,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,GAAI,CAAwB,CAAC,IAAI,CAAC;IAC5C,OAAO,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,gBAAwB;IACrD,OAAO,eAAe,gBAAgB,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAK,GAAqB,gBAAgB,EAAE;IAC9E,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,gBAAwB;YACjC,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,gBAAwB,EAAE,KAAa;YACjD,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,gBAAwB;YAClC,MAAM,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAK,GAAqB,gBAAgB,EAAE;IAC9E,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,SAAiB;YAClC,OAAO,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AA0DD,SAAS,kBAAkB;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;IAC1E,OAAO,GAAG,UAAU,GAAG,wBAAwB,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAuB;IAClD,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,gBAAgB,KAAK,EAAE,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;yGACyG;AACzG,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,CAAC,GAAG,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,qCAAqC;YAC5E,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,OAA2B;IACxD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,GAAG,GAAI,MAA4B,CAAC,GAAG,CAAC;IAC9C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAI,GAAwB,EAAE;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC;IACjD,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,0BAA0B,CAAC;IACrE,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,sBAAsB,EAAE,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAEzD,SAAS,aAAa;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,kGAAkG;gBAChG,sCAAsC,CACzC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,SAAS,eAAe;QACtB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,mGAAmG;gBACjG,oEAAoE,CACvE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD;;;+CAG2C;IAC3C,SAAS,kBAAkB;QACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO;QACtC,MAAM,IAAI,KAAK,CACb,2GAA2G;YACzG,kGAAkG;YAClG,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,gBAAgB,aAAa,EAAE,0BAA0B,CAAC;IAC1F,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,gBAAgB,aAAa,EAAE,sBAAsB,CAAC;IAClF,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,sBAAsB,aAAa,EAAE,uCAAuC,CAAC;IAE1G;8CAC0C;IAC1C,KAAK,UAAU,SAAS,CAAC,gBAAwB;QAC/C,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,kBAAkB,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,kGAAkG;gBAChG,wBAAwB,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAwB;YACnC,gBAAgB;YAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,GAAG,EAAE;YAChB,SAAS,EAAE,GAAG,EAAE,GAAG,UAAU;SAC9B,CAAC;QACF,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC/B,CAAC;IAED;;;0CAGsC;IACtC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,IAAY;QACrD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACzH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACvD,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACzF,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC;YAC9B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,GAAG;YACd,aAAa,EAAE,OAAO,CAAC,QAAQ;SAChC,CAAC,CAAC;QACH,sGAAsG;QACtG,kGAAkG;QAClG,2EAA2E;QAC3E,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,iGAAiG;QACjG,qFAAqF;QACrF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9G,oGAAoG;QACpG,kGAAkG;QAClG,2FAA2F;QAC3F,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,aAAa,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,OAAO,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,SAAS;gBACzB,CAAC,CAAC,8FAA8F;oBAC9F,iGAAiG;oBACjG,kFAAkF;gBACpF,CAAC,CAAC,2BAA2B,OAAO,CAAC,MAAM,oCAAoC,CAClF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAsB;YAChC,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,GAAG,EAAE;YACnB,qBAAqB,EAAE,OAAO,CAAC,WAAW;SAC3C,CAAC;QACF,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,4DAA4D;QAC5D,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACxD,CAAC;IAYD;+FAC2F;IAC3F,KAAK,UAAU,aAAa,CAAC,IAA4B;QACvD,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;QACjC,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;gBAC9B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;aAC3C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,8CAA8C,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAC5H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,yFAAyF;YACzF,IAAI,IAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;gBACvD,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAsB,CAAC;QACvE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;6FACyF;IACzF,KAAK,UAAU,gBAAgB,CAAC,gBAAwB;QACtD,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;YAC/B,4FAA4F;YAC5F,8FAA8F;YAC9F,sFAAsF;YACtF,2FAA2F;YAC3F,+FAA+F;YAC/F,0EAA0E;YAC1E,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,kEAAkE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,EAAE,IAAI,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;QACjF,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5H,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,uDAAuD,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,OAAO,GAAsB;YACjC,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,YAAY;YACnD,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,GAAG,EAAE;YACnB,iGAAiG;YACjG,+FAA+F;YAC/F,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;SACjD,CAAC;QACF,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,WAAW,CAAC;IAC7B,CAAC;IAWD;4GACwG;IACxG,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,gBAAwB,EACxB,SAAiB,EACjB,QAAgB;QAEhB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACzI,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,sDAAsD,CAAC,CAAC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CACpI,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,8FAA8F;YAC9F,MAAM,IAAI,KAAK,CACb,2CAA2C,GAAG,CAAC,MAAM,eAAe,QAAQ,gBAAgB,SAAS,KAAK;gBACxG,0GAA0G,CAC7G,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0B,CAAC;QAC3E,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QAChC,IAAI,CAAC,EAAE,EAAE,WAAW,IAAI,CAAC,EAAE,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,gEAAgE,QAAQ,iBAAiB,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO;YACL,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,eAAe,EAAE,EAAE,CAAC,eAAe;YACnC,YAAY,EAAE,EAAE,CAAC,YAAY;YAC7B,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/G,CAAC;IACJ,CAAC;IAED,2GAA2G;IAC3G,0GAA0G;IAC1G,MAAM,IAAI,GAAG,cAAc,CAAwD;QACjF,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,SAAS;QAClB,kBAAkB,EAAE,wBAAwB;QAC5C,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,OAAO,IAAI,gBAAgB,EAAE;QACjF,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE;YACxC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC3F,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1H,CAAC;KACF,CAAC,CAAC;IAEH,KAAK,UAAU,IAAI,CAAC,GAAuB;QACzC,MAAM,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;QAC9C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,kGAAkG;YAClG,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;QAChH,CAAC;QACD,2FAA2F;QAC3F,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAClD,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAmB,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAC3C,CAAC"}

package/dist/agent/browser/register.d.ts

@@ -1,4 +1,12 @@
 import { type AgentBrowserConfig } from "./config.js";
+/**
+ * The agent-browser session name every tool call passes as `--session`. 🔴 IT MUST BE BOUND. Without
+ * it the vendor derives the name from `sandbox.id`, and eve 0.69.0+ hands the tool a `SandboxSession`
+ * that has no `id`: `sanitizeSessionPart(undefined).trim()` then throws on EVERY browser call
+ * ("Cannot read properties of undefined (reading 'trim')", F-ART leg 4, 2026-10-09). One sandbox runs
+ * one agent-browser daemon, so a fixed name is per-sandbox — the same isolation the vendor default gave.
+ */
+export declare const BROWSER_SESSION_NAME = "oe-browser";
 /**
  * Arm the toolkit for a validated config. Returns false, LOUDLY, when the extension-config binding did not
  * take: unbound tools would run auto-install on and UNCONTAINED, so they are not registered at all.

package/dist/agent/browser/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../agent/browser/register.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAUtD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CA6CrE"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../agent/browser/register.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAWtD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CA8CrE"}

package/dist/agent/browser/register.js

@@ -3,6 +3,14 @@
 import browserExtension from "@agent-browser/eve";
 import * as vendorTools from "@agent-browser/eve/tools";
 import { registerBrowserToolkit, openBrowserEgressHosts, isLoopbackBrowseHost } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * The agent-browser session name every tool call passes as `--session`. 🔴 IT MUST BE BOUND. Without
+ * it the vendor derives the name from `sandbox.id`, and eve 0.69.0+ hands the tool a `SandboxSession`
+ * that has no `id`: `sanitizeSessionPart(undefined).trim()` then throws on EVERY browser call
+ * ("Cannot read properties of undefined (reading 'trim')", F-ART leg 4, 2026-10-09). One sandbox runs
+ * one agent-browser daemon, so a fixed name is per-sandbox — the same isolation the vendor default gave.
+ */
+export const BROWSER_SESSION_NAME = "oe-browser";
 /**
  * Arm the toolkit for a validated config. Returns false, LOUDLY, when the extension-config binding did not
  * take: unbound tools would run auto-install on and UNCONTAINED, so they are not registered at all.
@@ -13,12 +21,13 @@ export function registerAgentBrowser(cfg) {
         autoInstall: false,
         contentBoundaries: true,
         inlineScreenshots: false,
+        session: BROWSER_SESSION_NAME,
     });
     const bound = browserExtension.config;
     const domainsBound = Array.isArray(bound.allowedDomains) &&
         bound.allowedDomains.length === cfg.domains.length &&
         cfg.domains.every((d, i) => bound.allowedDomains[i] === d);
-    if (bound.autoInstall !== false || !domainsBound) {
+    if (bound.autoInstall !== false || !domainsBound || bound.session !== BROWSER_SESSION_NAME) {
         console.error("[open-everywhere:agent-browser] extension config binding FAILED (namespace patch missing? see patches/@agent-browser+eve+*.patch) — " +
             "REFUSING to arm the browser toolkit: unbound tools would run with vendor defaults (auto-install on, no domain containment).");
         return false;

package/dist/agent/browser/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../agent/browser/register.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,uGAAuG;AAEvG,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,WAAW,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,EAAyB,MAAM,4CAA4C,CAAC;AAWzJ;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,gBAAgB,CAAC;QACf,cAAc,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;QAChC,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;QACvB,iBAAiB,EAAE,KAAK;KACzB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAuC,CAAC;IACvE,MAAM,YAAY,GAChB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QACnC,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM;QAClD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,cAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QACjD,OAAO,CAAC,KAAK,CACX,sIAAsI;YACpI,6HAA6H,CAChI,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,OAAO,GAAqC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,IAA6C,CAAC;QACxD,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC9E,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,CAAqB,CAAC;QACrD,CAAC;IACH,CAAC;IACD,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAEhC,oGAAoG;IACpG,6GAA6G;IAC7G,wGAAwG;IACxG,mGAAmG;IACnG,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhI,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAChF,OAAO,CAAC,GAAG,CACT,0CAA0C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,kBAAkB;QACrF,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,YAAY,iCAAiC;QACnF,gEAAgE,CACnE,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../agent/browser/register.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,uGAAuG;AAEvG,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,WAAW,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,EAAyB,MAAM,4CAA4C,CAAC;AAYzJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,gBAAgB,CAAC;QACf,cAAc,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;QAChC,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;QACvB,iBAAiB,EAAE,KAAK;QACxB,OAAO,EAAE,oBAAoB;KAC9B,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAuC,CAAC;IACvE,MAAM,YAAY,GAChB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;QACnC,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM;QAClD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,cAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,KAAK,oBAAoB,EAAE,CAAC;QAC3F,OAAO,CAAC,KAAK,CACX,sIAAsI;YACpI,6HAA6H,CAChI,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,OAAO,GAAqC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,IAA6C,CAAC;QACxD,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC9E,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,CAAqB,CAAC;QACrD,CAAC;IACH,CAAC;IACD,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAEhC,oGAAoG;IACpG,6GAA6G;IAC7G,wGAAwG;IACxG,mGAAmG;IACnG,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhI,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAChF,OAAO,CAAC,GAAG,CACT,0CAA0C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,kBAAkB;QACrF,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,YAAY,iCAAiC;QACnF,gEAAgE,CACnE,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/agent/directory/config.d.ts

@@ -1,3 +1,4 @@
+import { type OktaAppSetting } from "@open-everywhere/core/agent/adapter-api.js";
 /** Which app-assignment field carries the app-side identity for one mapped app. */
 export type OktaAppIdField = "externalId" | "userName";
 /** One configured Okta application → one of OUR platform tokens. */
@@ -27,13 +28,15 @@ export interface OktaDirectoryConfig {
  *  leaves the plane OFF rather than half-arming something. */
 export declare function oktaDirectoryEnabled(env?: NodeJS.ProcessEnv): boolean;
 /**
- * Parse the app map: `<platform>[/<tenant>]:<oktaAppId>[:<field>]`, comma-separated. The workspace rung uses
- * `/`, matching the principal-key grammar. FAIL-LOUD on a malformed entry — a dropped entry is a silent gap.
+ * Normalise the `directory.oktaApps` setting into the adapter's mappings: the default `field` is
+ * `externalId`. FAIL-LOUD on a malformed table — a dropped entry is a silent gap. The rules are the
+ * setting's own validator (`SETTINGS.directory.oktaApps.validate`), so settings load and this adapter
+ * refuse the same tables; it runs here too because a test can register an unvalidated value.
  */
-export declare function parseOktaAppMap(raw: string | undefined): readonly OktaAppMapping[];
+export declare function oktaAppMappings(entries: readonly OktaAppSetting[]): readonly OktaAppMapping[];
 /**
  * Load the Okta config block. FAIL-LOUD when the selector is armed but a required field is missing. An unset
  * SELECTOR stays silent — that is a deployment with no IdP, not a broken one.
  */
-export declare function loadOktaDirectoryConfig(env?: NodeJS.ProcessEnv): OktaDirectoryConfig;
+export declare function loadOktaDirectoryConfig(env?: NodeJS.ProcessEnv, apps?: readonly OktaAppSetting[]): OktaDirectoryConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/agent/directory/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../agent/directory/config.ts"],"names":[],"mappings":"AAgBA,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,UAAU,CAAC;AAEvD,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,sGAAsG;IACtG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;CAC1C;AAED;8DAC8D;AAC9D,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAElF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,cAAc,EAAE,CAwClF;AAsBD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,mBAAmB,CAiBjG"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../agent/directory/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAexG,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,UAAU,CAAC;AAEvD,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,sGAAsG;IACtG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;CAC1C;AAED;8DAC8D;AAC9D,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,cAAc,EAAE,CAS7F;AAsBD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE,SAAS,cAAc,EAAqC,GACjE,mBAAmB,CAgBrB"}

package/dist/agent/directory/config.js

@@ -1,5 +1,6 @@
 // The directory-adapter SELECTION and Okta config. Selector-off or config-absent ⇒ NOTHING registers, with no
 // partial arming. 🔴 The API token is a `secretRef` through a broker (default `db`), never a raw env read.
+import { SETTINGS, getSettings } from "@open-everywhere/core/agent/adapter-api.js";
 /** Which directory adapter to arm ("okta"). Unset ⇒ the directory plane stays off. */
 const OE_DIRECTORY_PROVIDER_ENV = "OE_DIRECTORY_PROVIDER";
 /** The Okta org URL, e.g. `https://acme.okta.com` (or an `*.oktapreview.com` sandbox). MUST be
@@ -10,51 +11,27 @@ const OE_DIRECTORY_OKTA_ORG_URL_ENV = "OE_DIRECTORY_OKTA_ORG_URL";
 const OE_DIRECTORY_OKTA_TOKEN_REF_ENV = "OE_DIRECTORY_OKTA_TOKEN_REF";
 /** Which broker holds that ref. Default "db" (the encrypted credential store — OPE-408 step 2). */
 const OE_DIRECTORY_OKTA_TOKEN_BROKER_ENV = "OE_DIRECTORY_OKTA_TOKEN_BROKER";
-/** App map: `"<platform>[/<tenant>]:<oktaAppId>[:<field>], …"` — see {@link parseOktaAppMap}. */
-const OE_DIRECTORY_OKTA_APPS_ENV = "OE_DIRECTORY_OKTA_APPS";
 /** True iff the selector names the Okta adapter. Exact match, trimmed, case-insensitive — a typo
  *  leaves the plane OFF rather than half-arming something. */
 export function oktaDirectoryEnabled(env = process.env) {
     return (env[OE_DIRECTORY_PROVIDER_ENV] ?? "").trim().toLowerCase() === "okta";
 }
 /**
- * Parse the app map: `<platform>[/<tenant>]:<oktaAppId>[:<field>]`, comma-separated. The workspace rung uses
- * `/`, matching the principal-key grammar. FAIL-LOUD on a malformed entry — a dropped entry is a silent gap.
+ * Normalise the `directory.oktaApps` setting into the adapter's mappings: the default `field` is
+ * `externalId`. FAIL-LOUD on a malformed table — a dropped entry is a silent gap. The rules are the
+ * setting's own validator (`SETTINGS.directory.oktaApps.validate`), so settings load and this adapter
+ * refuse the same tables; it runs here too because a test can register an unvalidated value.
  */
-export function parseOktaAppMap(raw) {
-    const out = [];
-    const seen = new Set();
-    for (const entry of (raw ?? "").split(",").map((s) => s.trim()).filter(Boolean)) {
-        const parts = entry.split(":").map((s) => s.trim());
-        const [head, appId, field] = parts;
-        if (parts.length < 2 || parts.length > 3 || !head || !appId) {
-            throw new Error(`${OE_DIRECTORY_OKTA_APPS_ENV} entry "${entry}" is malformed — expected "<platform>[/<tenant>]:<oktaAppId>" ` +
-                `with an optional ":externalId"/":userName" suffix, e.g. "slack:0oa1a2b3c4d5" or "slack/T0AB1CD2E:0oa1a2b3c4d5".`);
-        }
-        if (field !== undefined && field !== "externalId" && field !== "userName") {
-            throw new Error(`${OE_DIRECTORY_OKTA_APPS_ENV} entry "${entry}" names field "${field}" — only "externalId" (default) or "userName" are valid.`);
-        }
-        const slash = head.indexOf("/");
-        const platform = (slash < 0 ? head : head.slice(0, slash)).toLowerCase();
-        const tenant = slash < 0 ? undefined : head.slice(slash + 1).trim();
-        if (!platform || (tenant !== undefined && (tenant.length === 0 || tenant.includes("/")))) {
-            throw new Error(`${OE_DIRECTORY_OKTA_APPS_ENV} entry "${entry}" has an unusable platform/workspace half ("${head}") — write "<platform>" ` +
-                `or "<platform>/<workspace-id>" with exactly one slash, e.g. "slack/T0AB1CD2E".`);
-        }
-        // Two apps mapped to the SAME (platform, workspace) is a genuine misconfiguration rather than a
-        // widening: the two would write suggestions that are indistinguishable downstream, and whichever
-        // ran second would silently redefine the first's ids. Refused here, where the operator can see
-        // both entries, rather than as a mystery in a sync warning.
-        const key = `${platform}/${tenant ?? ""}`;
-        if (seen.has(key)) {
-            throw new Error(`${OE_DIRECTORY_OKTA_APPS_ENV} maps two apps to the same target "${key.replace(/\/$/u, "")}" — an app map entry names WHERE ` +
-                "the ids land, so two entries for one place cannot both be right. Give each workspace its own rung " +
-                '("slack/T0AB1CD2E:…,slack/T9ZYX8W7V:…"), or remove the duplicate.');
-        }
-        seen.add(key);
-        out.push({ platform, ...(tenant !== undefined ? { tenant } : {}), appId, field: field ?? "externalId" });
-    }
-    return out;
+export function oktaAppMappings(entries) {
+    const problem = SETTINGS.directory.oktaApps.validate(entries);
+    if (problem !== undefined)
+        throw new Error(`directory.oktaApps: ${problem}`);
+    return entries.map((a) => ({
+        platform: a.platform,
+        ...(a.tenant !== undefined ? { tenant: a.tenant } : {}),
+        appId: a.appId,
+        field: a.field ?? "externalId",
+    }));
 }
 /**
  * 🔴 The org URL MUST be `https://`: every request carries the SSWS API token in an `authorization` header.
@@ -78,7 +55,7 @@ function requireHttpsOrgUrl(raw) {
  * Load the Okta config block. FAIL-LOUD when the selector is armed but a required field is missing. An unset
  * SELECTOR stays silent — that is a deployment with no IdP, not a broken one.
  */
-export function loadOktaDirectoryConfig(env = process.env) {
+export function loadOktaDirectoryConfig(env = process.env, apps = getSettings().directory.oktaApps) {
     const orgUrl = env[OE_DIRECTORY_OKTA_ORG_URL_ENV]?.trim();
     const tokenRef = env[OE_DIRECTORY_OKTA_TOKEN_REF_ENV]?.trim();
     const missing = [];
@@ -90,12 +67,11 @@ export function loadOktaDirectoryConfig(env = process.env) {
         throw new Error(`${OE_DIRECTORY_PROVIDER_ENV}="okta" but ${missing.join(" and ")} ${missing.length > 1 ? "are" : "is"} not set — directory sync cannot be armed.`);
     }
     requireHttpsOrgUrl(orgUrl);
-    const apps = parseOktaAppMap(env[OE_DIRECTORY_OKTA_APPS_ENV]);
     return {
         orgUrl: orgUrl.replace(/\/+$/u, ""),
         tokenRef: tokenRef,
         tokenBroker: env[OE_DIRECTORY_OKTA_TOKEN_BROKER_ENV]?.trim() || "db",
-        apps,
+        apps: oktaAppMappings(apps),
     };
 }
 //# sourceMappingURL=config.js.map

package/dist/agent/directory/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../agent/directory/config.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,2GAA2G;AAE3G,sFAAsF;AACtF,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAC1D;;sCAEsC;AACtC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAClE,oGAAoG;AACpG,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AACtE,mGAAmG;AACnG,MAAM,kCAAkC,GAAG,gCAAgC,CAAC;AAC5E,iGAAiG;AACjG,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AA8B5D;8DAC8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,GAAG,0BAA0B,WAAW,KAAK,gEAAgE;gBAC3G,iHAAiH,CACpH,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,0BAA0B,WAAW,KAAK,kBAAkB,KAAK,0DAA0D,CAAC,CAAC;QAClJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CACb,GAAG,0BAA0B,WAAW,KAAK,+CAA+C,IAAI,0BAA0B;gBACxH,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,gGAAgG;QAChG,iGAAiG;QACjG,+FAA+F;QAC/F,4DAA4D;QAC5D,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,GAAG,0BAA0B,sCAAsC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC;gBAC3H,oGAAoG;gBACpG,mEAAmE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,YAAY,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,6BAA6B,KAAK,GAAG,4EAA4E,CAAC,CAAC;IACxI,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,6BAA6B,KAAK,GAAG,kFAAkF;YACxH,uHAAuH;YACvH,0CAA0C,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,6BAA6B,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,GAAG,yBAAyB,eAAe,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,4CAA4C,CAAC,CAAC;IACrK,CAAC;IACD,kBAAkB,CAAC,MAAO,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAC9D,OAAO;QACL,MAAM,EAAE,MAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACpC,QAAQ,EAAE,QAAS;QACnB,WAAW,EAAE,GAAG,CAAC,kCAAkC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI;QACpE,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../agent/directory/config.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,2GAA2G;AAE3G,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAuB,MAAM,4CAA4C,CAAC;AAExG,sFAAsF;AACtF,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAC1D;;sCAEsC;AACtC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAClE,oGAAoG;AACpG,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AACtE,mGAAmG;AACnG,MAAM,kCAAkC,GAAG,gCAAgC,CAAC;AAgC5E;8DAC8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAkC;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,YAAY;KAC/B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,6BAA6B,KAAK,GAAG,4EAA4E,CAAC,CAAC;IACxI,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,6BAA6B,KAAK,GAAG,kFAAkF;YACxH,uHAAuH;YACvH,0CAA0C,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,IAAI,GAA8B,WAAW,EAAE,CAAC,SAAS,CAAC,QAAQ;IAElE,MAAM,MAAM,GAAG,GAAG,CAAC,6BAA6B,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,GAAG,yBAAyB,eAAe,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,4CAA4C,CAAC,CAAC;IACrK,CAAC;IACD,kBAAkB,CAAC,MAAO,CAAC,CAAC;IAC5B,OAAO;QACL,MAAM,EAAE,MAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACpC,QAAQ,EAAE,QAAS;QACnB,WAAW,EAAE,GAAG,CAAC,kCAAkC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI;QACpE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;KAC5B,CAAC;AACJ,CAAC"}