@open-everywhere/core 0.1.0

package/dist/agent/connections/connector-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-auth.js","sourceRoot":"","sources":["../../../agent/connections/connector-auth.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,2GAA2G;AAE3G,OAAO,EACL,8BAA8B,GAM/B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,IAAI,EAAuB,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,qGAAqG;AACrG,qGAAqG;AACrG,oFAAoF;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAIrE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC9G,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAClG,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAC5H,mGAAmG;AACnG,oGAAoG;AACpG,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,EACrB,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9G,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,yGAAyG;AACzG,yGAAyG;AAEzG,SAAS,qBAAqB,CAAC,IAAqC;IAClE,MAAM,SAAS,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,SAAS,EAAE,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,WAAoB,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;IAC/G,IAAI,SAAS,EAAE,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC;IAC7E,IAAI,SAAS,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC;IACjE,OAAO,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAqC;IACtE,OAAO,8BAA8B,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;AAC1G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAO9B;IACC,OAAO,KAAK,EAAE,GAAmB,EAAmC,EAAE,CAAC,CAAC;QACtE,aAAa,EAAE,KAAK;QACpB,KAAK,CAAC,QAAQ;YACZ,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B;YAC3F,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAI/B;IACC,OAAO,KAAK,EAAE,GAAmB,EAAmC,EAAE,CAAC,CAAC;QACtE,aAAa,EAAE,KAAK;QACpB,KAAK,CAAC,QAAQ,CAAC,CAAC;YACd,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B;YAC3F,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAWhC;IACC,OAAO,KAAK,EAAE,GAAmB,EAAmC,EAAE,CAAC,CAAC;QACtE,aAAa,EAAE,KAAK;QACpB,KAAK,CAAC,QAAQ,CAAC,CAAC;YACd,4FAA4F;YAC5F,sFAAsF;YACtF,IAAI,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,MAAM,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpG,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B;YAC3F,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAwI,EACxI,IAAqF,EACrF,CAAU;IAEV,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,mEAAmE;YAC9F,uCAAuC,IAAI,CAAC,SAAS,8CAA8C;YACnG,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,8GAA8G;IAC9G,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjC,mCAAmC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,IAAI,CAAC,SAAS,iBAAiB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IACxI,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,wCAAwC,CAAC,CAAC;QAC5G,iGAAiG;QACjG,0GAA0G;QAC1G,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,wDAAwD,CAAC,CAAC;QACzG,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,uBAAuB,IAAI,CAAC,IAAI,sCAAsC;QACjG,iGAAiG;QACjG,mDAAmD,CACtD,CAAC;AACJ,CAAC;AA6BD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAyC;IAC1F,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACtE,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,aAAa,EAAE;QACpB,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,WAAW;QACtB,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE;KAC1C,CAAC,CAAC;AACL,CAAC;AAmBD;4GAC4G;AAC5G,MAAM,CAAC,MAAM,2BAA2B,GAAkC,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAC7G,mBAAmB,CAAC,eAAe,CAAC,CAAC,kBAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAE5F,6GAA6G;AAC7G,6FAA6F;AAE7F,SAAS,qBAAqB,CAAC,GAAW;IACxC,OAAO,yDAAyD,GAAG,2CAA2C,CAAC;AACjH,CAAC;AAED;;uGAEuG;AACvG,SAAS,gCAAgC,CAAC,SAAiB,EAAE,eAAuB;IAClF,OAAO,CACL,eAAe,SAAS,gDAAgD;QACxE,eAAe;QACf,oFAAoF;QACpF,qFAAqF;QACrF,8DAA8D,CAC/D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuC;IAEvC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5B,wGAAwG;QACxG,0GAA0G;QAC1G,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IAC/L,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,oDAAoD;IACjE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,GAAuB,EACvB,QAA4B,EAC5B,SAA6B,EAC7B,WAAmB;IAEnB,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,eAAe,SAAS,oEAAoE;YAC1F,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,+DAA+D,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACnE,IAAI,CAAC,4BAA4B,EAAE;QAAE,OAAO,GAAG,CAAC,CAAC,kDAAkD;IACnG,OAAO,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC;AAChG,CAAC;AAED;;2GAE2G;AAC3G,SAAS,wBAAwB,CAAC,CAAU;IAC1C,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,SAAiB,EACjB,IAAuC;IAEvC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,aAAa;QAAE,OAAO,KAAK,CAAC,CAAC,kDAAkD;IAC1F,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,kCAAkC;IAChG,IAAI,IAAI,EAAE,IAAI,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC,CAAC,oDAAoD;IACnG,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvF,4FAA4F;IAC5F,gGAAgG;IAChG,iGAAiG;IACjG,iEAAiE;IACjE,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrE,gGAAgG;IAChG,wGAAwG;IACxG,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1G,0BAA0B,CAAC,SAAS,CAAC,CAAC,CAAC,kEAAkE;IACzG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAkE,CAAC,CAAC;QACvG,OAAO;YACL,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,UAAU,EAAE,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,EAAE;YACvD,MAAM;YACN,WAAW,EAAE,OAAO;YACpB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,GAAmB,EACnB,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,MAAM,mBAAmB,CAAC;YAC/B,SAAS;YACT,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YACjB,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,UAAU,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAwI,EACxI,IAAI,GAAqG,EAAE;IAE3G,gGAAgG;IAChG,yGAAyG;IACzG,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACpH,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7H,OAAO,KAAK,EAAE,GAAmB,EAAmC,EAAE,CAAC,CAAC;QACtE,6IAA6I;QAC7I,6IAA6I;QAC7I,aAAa,EAAE,KAAK;QACpB,KAAK,CAAC,QAAQ,CAAC,CAAC;YACd,kGAAkG;YAClG,qGAAqG;YACrG,IAAI,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACpH,MAAM,0BAA0B,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7F,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,8CAA8C;YAC9G,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAE9E,6FAA6F;YAC7F,IAAI,IAAI,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChC,2FAA2F;gBAC3F,6FAA6F;gBAC7F,sEAAsE;gBACtE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBACjC,mCAAmC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,IAAI,CAAC,SAAS,iBAAiB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;gBACxI,CAAC;gBACD,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACzH,+FAA+F;gBAC/F,4FAA4F;gBAC5F,4FAA4F;gBAC5F,yFAAyF;gBACzF,8FAA8F;gBAC9F,8EAA8E;gBAC9E,EAAE;gBACF,yFAAyF;gBACzF,yFAAyF;gBACzF,uFAAuF;gBACvF,yFAAyF;gBACzF,wFAAwF;gBACxF,qFAAqF;gBACrF,2EAA2E;gBAC3E,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,wDAAwD;wBACnF,sDAAsD,CACzD,CAAC;gBACJ,CAAC;gBACD,0GAA0G;gBAC1G,gGAAgG;gBAChG,IAAI,eAAmC,CAAC;gBACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,wFAAwF;oBACxF,2FAA2F;oBAC3F,iCAAiC;oBACjC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;wBAC9B,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,wDAAwD;4BACnF,UAAU,IAAI,IAAI,YAAY,2DAA2D,CAC5F,CAAC;oBACJ,CAAC;oBACD,MAAM,OAAO,GAAG,kBAAkB,CAAC;wBACjC,KAAK,EAAE,2BAA2B,EAAE;wBACpC,sFAAsF;wBACtF,QAAQ,EAAE,yBAAyB,EAAE;wBACrC,sFAAsF;wBACtF,wFAAwF;wBACxF,4FAA4F;wBAC5F,OAAO,EAAE,IAAI;wBACb,SAAS,EAAE,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;wBAClD,aAAa,EAAE,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;wBAC1D,yGAAyG;wBACzG,4GAA4G;wBAC5G,mBAAmB,EAAE,uBAAuB,CAAC,aAAa,EAAE,KAAK,CAAC;wBAClE,wFAAwF;wBACxF,yFAAyF;wBACzF,oCAAoC;qBACrC,CAAC,CAAC;oBACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;wBACnB,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;wBACzH,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC7E,CAAC;oBACD,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;gBACjD,CAAC;gBACD,uGAAuG;gBACvG,6GAA6G;gBAC7G,MAAM,OAAO,GAAG,eAAe,IAAI,WAAW,CAAC;gBAC/C,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,CAAC,SAAS;oBACZ,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,qDAAqD,CAAC,CAAC;gBACtG,0FAA0F;gBAC1F,6FAA6F;gBAC7F,gGAAgG;gBAChG,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACrG,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,2FAA2F;oBAC3F,4FAA4F;oBAC5F,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE;wBACrC,OAAO,EAAE,MAAM;wBACf,OAAO,EAAE,IAAI;wBACb,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,2BAA2B,CAAC;wBACzD,0FAA0F;wBAC1F,wFAAwF;wBACxF,kFAAkF;wBAClF,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;qBAC1F,CAAC,CAAC;oBACH,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,2FAA2F;oBAC3F,6FAA6F;oBAC7F,MAAM,YAAY,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;oBACjD,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE;wBACrC,OAAO,EAAE,MAAM;wBACf,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO;wBACjD,IAAI,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;wBAC7C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;qBAC7G,CAAC,CAAC;oBACH,IAAI,YAAY,EAAE,CAAC;wBACjB,4FAA4F;wBAC5F,2FAA2F;wBAC3F,qEAAqE;wBACrE,IAAI,GAAuB,CAAC;wBAC5B,IAAI,CAAC;4BACH,2GAA2G;4BAC3G,6FAA6F;4BAC7F,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;4BACvE,oFAAoF;4BACpF,qFAAqF;4BACrF,0DAA0D;4BAC1D,GAAG,GAAG,CACJ,MAAM,SAAS,CACb,SAAS,EACT,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAC5C,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAClE,CACF,CAAC,GAAG,CAAC;wBACR,CAAC;wBAAC,MAAM,CAAC;4BACP,uEAAuE;wBACzE,CAAC;wBACD,yFAAyF;wBACzF,gGAAgG;wBAChG,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;wBAC/C,MAAM,eAAe,GAAG,GAAG;4BACzB,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC;4BAC5B,CAAC,CAAC,4CAA4C,SAAS,sBAAsB,CAAC;wBAChF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;oBACrF,CAAC;oBACD,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;YAED,2DAA2D;YAC3D,OAAO,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,2GAA2G;AAC3G,oGAAoG;AAEpG;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAI,GAA4B,EAAE;IACpE,OAAO,CAAC,GAAG,EAA4C,EAAE;QACvD,yFAAyF;QACzF,4FAA4F;QAC5F,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,gBAAgB,CAAC;QAC9D,0GAA0G;QAC1G,oGAAoG;QACpG,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,gBAAgB,CAAC,CAAC,qBAAqB;QACnE,OAAO,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,IAAI,wBAAwB,EAAE,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAC;IACnI,CAAC,CAAC;AACJ,CAAC;AAaD;;wCAEwC;AACxC,MAAM,UAAU,oCAAoC,CAAC,QAAgB;IACnE,OAAO,CACL,aAAa,QAAQ,uDAAuD;QAC5E,oGAAoG;QACpG,qBAAqB,CACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CACjC,GAA+H,EAC/H,IAAiD,EACjD,eAAgD,EAChD,WAAsC;IAEtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,IAAsD,CAAC;QAC3E,wGAAwG;QACxG,0GAA0G;QAC1G,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;QACpE,oGAAoG;QACpG,wGAAwG;QACxG,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,oCAAoC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvD,MAAM,kBAAkB,GAAG,KAAK,EAAE,SAAS,KAAK,MAAM,CAAC;QACvD,yGAAyG;QACzG,6EAA6E;QAC7E,MAAM,iBAAiB,GAAmD,EAAE,CAAC;QAC7E,MAAM,OAAO,GACX,kBAAkB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChI,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,kBAAkB;YAClB,kBAAkB;YAClB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YACpE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YACxF,SAAS,EAAE,qBAAqB,CAAC,IAA2B,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,2BAA2B,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,eAAe,CAAC,CAAC,sDAAsD;IAC1G,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,gBAAgB,CAAC,CAAC,2CAA2C;IAC7G,OAAO,eAAe,CAAC,CAAC,oCAAoC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,8GAA8G;IAC9G,iGAAiG;IACjG,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;IACvB,OAAO,0BAA0B,CAC/B,4BAA4B,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,8GAA8G;AAC9G,6GAA6G;AAC7G,gHAAgH;AAEhH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,mIAAmI,CAAC;AAEtI;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,+PAA+P,CAAC;AAElQ;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,sTAAsT,CAAC;AAEzT;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAAkB,EAClB,QAAgB,EAChB,IAAiD,EACjD,OAAgB;IAEhB,gGAAgG;IAChG,gGAAgG;IAChG,yEAAyE;IACzE,MAAM,WAAW,GAAG,CAAC,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,QAAQ,+CAA+C,CAAC,CAAC,CAAC,EAAE,CAAC;IACjI,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,+BAA+B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,CACL,eAAe,UAAU,UAAU,IAAI,aAAa,QAAQ,qDAAqD;QACjH,GAAG,OAAO,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,uBAAuB,IAAI,WAAW,GAAG,MAAM,EAAE;QAChG,qBAAqB,CACtB,CAAC;AACJ,CAAC;AAmBD;;iDAEiD;AACjD,KAAK,UAAU,uBAAuB,CAAC,GAAW,EAAE,QAAgB,EAAE,IAAY,EAAE,MAAc;IAChG,OAAO,CAAC,MAAM,mBAAmB,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;AAChG,CAAC;AAoBD,KAAK,UAAU,eAAe,CAC5B,IAAuC,EACvC,cAA6C;IAE7C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,4GAA4G;IAC5G,6GAA6G;IAC7G,MAAM,QAAQ,GAAG,2BAA2B,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3F,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO;YACL,6FAA6F;YAC7F,+FAA+F;YAC/F,4FAA4F;YAC5F,gDAAgD;YAChD,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;YACnC,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;YAC1E,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YAClF,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,mEAAmE;IAClF,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,KAAK,UAAU,SAAS,CAAI,EAAoB,EAAE,QAAW;IAC3D,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,2DAA2D;IAC1E,CAAC;AACH,CAAC;AAED;;;0BAG0B;AAC1B,SAAS,mBAAmB,CAAC,QAAwB;IACnD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,CAAC;AAChG,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,4BAA4B,CAC1C,MAAsB,EACtB,IAAI,GAAiC,EAAE;IAEvC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,sBAAsB,CAAC;IACrE,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,IAAI,uBAAuB,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,yBAAyB,CAAC;IAC1D,OAAO,KAAK,EAAE,GAAG,EAA2B,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QACtD,4GAA4G;QAC5G,4GAA4G;QAC5G,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;QACpE,8GAA8G;QAC9G,wGAAwG;QACxG,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC,CAAC,mDAAmD;QACzF,2GAA2G;QAC3G,sGAAsG;QACtG,MAAM,gBAAgB,GAAG,IAAI,KAAK,QAAQ,CAAC;QAC3C,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,QAAQ,CAAC;QACzE,4GAA4G;QAC5G,6GAA6G;QAC7G,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,cAAc,GAAG,GAAmB,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,iCAAiC,CAAC,UAAU,IAAI,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC;SAC1F,CAAC,CAAC;QACH,sGAAsG;QACtG,iGAAiG;QACjG,qGAAqG;QACrG,iGAAiG;QACjG,6FAA6F;QAC7F,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,gBAAgB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/G,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,gBAAgB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,iBAAiB;QACjH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAyC,EAAE,cAAc,CAAC,CAAC;QAC/F,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,gBAAgB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,wBAAwB;QACnG,6FAA6F;QAC7F,iGAAiG;QACjG,gEAAgE;QAChE,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,OAAO,QAAQ,CAAC;QACvC,+FAA+F;QAC/F,gGAAgG;QAChG,wFAAwF;QACxF,MAAM,IAAI,GAAG,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,qFAAqF;QACrF,wFAAwF;QACxF,MAAM,MAAM,GACV,CAAC,QAAQ;YACT,IAAI,KAAK,OAAO;YAChB,KAAK,CAAC,QAAQ,KAAK,SAAS;YAC5B,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACtG,MAAM,KAAK,GAAG;YACZ,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;SAC/E,CAAC;QACF,2GAA2G;QAC3G,2CAA2C;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,CACb,GAAG,EAAE,CACH,KAAK,CAAC;gBACJ,GAAG,KAAK;gBACR,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE;aACrF,CAAC,EACJ,SAAS,CACV,CAAC;YACF,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,MAAM,SAAS,CACb,GAAG,EAAE,CACH,KAAK,CAAC;YACJ,GAAG,KAAK;YACR,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE;gBACN,UAAU;gBACV,EAAE,EAAE,GAAG,CAAC,QAAQ;gBAChB,IAAI;gBACJ,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,gBAAgB;gBAC9D,KAAK,EAAE,IAAI;gBACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;aACpF;SACF,CAAC,EACJ,SAAS,CACV,CAAC;QACF,8GAA8G;QAC9G,4GAA4G;QAC5G,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC;QAClC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACtC,MAAM,IAAI,GACR,IAAI,KAAK,OAAO,IAAI,UAAU,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS;YACvE,CAAC,CAAC,MAAM,6BAA6B,CAAC;gBAClC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,WAAW,EAAE,QAAQ,GAAG,CAAC,QAAQ,EAAE;gBACnC,qFAAqF;gBACrF,kFAAkF;gBAClF,SAAS,EAAE,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACpD,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,KAAK,CAAC,UAAU;gBAC1B,WAAW;gBACX,OAAO,EAAE,QAAQ;gBACjB,8GAA8G;gBAC9G,8GAA8G;gBAC9G,YAAY,EAAE,CAAC;aAChB,CAAC;YACJ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,iCAAiC,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/H,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAuC,IAO1E;IACC,sFAAsF;IACtF,sCAAsC;IACtC,OAAO,KAAK,EAAE,GAAmB,EAAmC,EAAE,CACpE,8BAA8B,CAAS;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,CAAC,QAAQ,CAAC,CAAC;YACd,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B;YAC3F,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;AACP,CAAC"}

package/dist/agent/connections/connector-card.d.ts

@@ -0,0 +1,61 @@
+import type { Domain } from "../memory/domain.js";
+import type { ConnectorCredentials } from "../access/connector-credentials.js";
+import { type ConnectorAuthorizationStarter } from "./connector-auth.js";
+import { requestCredentialIntake, type CredentialIntakeDeps } from "../credentials/intake.js";
+import { type ConnectMode, type ConnectorOption } from "./connector-offer.js";
+/** Structural type of the Slack `chat.*` client — matches slackForm exactly (same as intake.ts). */
+type PostFn = (method: string, body: string) => Promise<Record<string, unknown> | undefined>;
+/** Button action_id prefix — `oe_connect:<connector>:<credentialType>`. The Slack front route classifies
+ *  a `block_actions` click as ours iff its action_id starts with this (like OE_SETKEY_ACTION_PREFIX). */
+export declare const OE_CONNECT_ACTION_PREFIX = "oe_connect:";
+/**
+ * Build the Block Kit card for a set of resolved options. PURE. An actionable option becomes a button
+ * carrying `oe_connect:<connector>:<type>`; NO URL is ever placed in the card — links mint at the click.
+ */
+export declare function buildConnectCard(connectorName: string, options: readonly ConnectorOption[], org: string): {
+    blocks: unknown[];
+    text: string;
+};
+/**
+ * Render the connect message for a NON-Slack surface. The URL lives only in the returned `text`, which the
+ * caller host-posts to the surface — never in the tool result.
+ */
+export declare function renderNonSlackConnect(connectorName: string, options: readonly ConnectorOption[], 
+/** The caller's binding facts. `org` + `platform` are here for ONE reason: the personal-OAuth URL
+ *  minted below binds a human's third-party account to a VAULT SUBJECT, and that subject must be
+ *  composed exactly as the later token read composes it (OPE-286) — so both come from the same
+ *  binding rather than being re-derived here. */
+ctx: {
+    readonly mode: ConnectMode;
+    readonly principalId?: string;
+    readonly org: string;
+    readonly platform: string;
+    readonly workspace?: string;
+}, startAuth?: ConnectorAuthorizationStarter, 
+/**
+ * Mint a one-shot intake-PAGE link for a `page`-route api-key option; absent ⇒ the option degrades to honest
+ * text. The URL is CAPABILITY-BEARING and lives ONLY in the returned `text`, so it is not added to `issued`.
+ */
+issuePageLink?: (o: ConnectorOption) => Promise<string | undefined>): Promise<{
+    text: string;
+    issued: ConnectorOption[];
+}>;
+export interface ConnectorCardDeps {
+    readonly post?: PostFn;
+    /** OAuth URL minter (subject-flexible) — injected in tests; live default hits the registered user-auth flow. */
+    readonly startAuth?: ConnectorAuthorizationStarter;
+    /** The api-key intake poster (defaults to the real credentials/intake.ts). */
+    readonly requestIntake?: (input: Parameters<typeof requestCredentialIntake>[0], deps?: CredentialIntakeDeps) => Promise<{
+        id: string;
+    }>;
+    readonly loadConnectorCredentials?: () => readonly ConnectorCredentials[];
+    readonly loadDomains?: () => readonly Domain[];
+    readonly now?: () => Date;
+}
+/**
+ * Handle one `oe_connect:` click: `false` when it is not ours, else it OWNS the click and NEVER throws.
+ * Every branch re-verifies standing host-side — a DM for personal, admin for org — and no URL is audited.
+ */
+export declare function handleConnectClick(payload: unknown, deps?: ConnectorCardDeps): Promise<boolean>;
+export {};
+//# sourceMappingURL=connector-card.d.ts.map

package/dist/agent/connections/connector-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-card.d.ts","sourceRoot":"","sources":["../../../agent/connections/connector-card.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAA2B,MAAM,oCAAoC,CAAC;AAExG,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE9F,OAAO,EAA+D,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE3I,oGAAoG;AACpG,KAAK,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;AAE7F;yGACyG;AACzG,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAStD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,GAAG,EAAE,MAAM,GACV;IAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA2BrC;AAcD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,SAAS,eAAe,EAAE;AACnC;;;iDAGiD;AACjD,GAAG,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAChJ,SAAS,GAAE,6BAA2D;AACtE;;;GAGG;AACH,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAClE,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAgFtD;AAUD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,gHAAgH;IAChH,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,CAAC;IACnD,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxI,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,SAAS,oBAAoB,EAAE,CAAC;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AA+CD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAqJzG"}

package/dist/agent/connections/connector-card.js

@@ -0,0 +1,361 @@
+// The connector CARD and its host-side click plane: the consequential acts run when a human clicks, never in the
+// model. An OAuth URL is CAPABILITY-BEARING — ephemeral to the clicker on Slack, host-posted into the room on a
+// surface with no buttons, and never in a log, an audit detail, an error, or the model's own tool result.
+import { bridgeSlackForm } from "../channels/slack-bridge.js";
+import { appendAudit } from "../audit/audit.js";
+import { getConfig } from "../access/config.js";
+import { roleForBinding } from "../access/roles.js";
+import { deploymentOrg } from "../identity/binding.js";
+import { rawVaultSubject } from "../identity/oauth-vault-share.js";
+import { vercelConnectorOf } from "../access/connector-credentials.js";
+import { AUTH_URL_TTL_MS, defaultConnectorAuthStarter, } from "./connector-auth.js";
+import { requestCredentialIntake } from "../credentials/intake.js";
+import { deriveCredentialRef } from "../credentials/ref.js";
+import { offerableCredential, optionLabel, unqualifiedAppRowMintHome } from "./connector-offer.js";
+/** Button action_id prefix — `oe_connect:<connector>:<credentialType>`. The Slack front route classifies
+ *  a `block_actions` click as ours iff its action_id starts with this (like OE_SETKEY_ACTION_PREFIX). */
+export const OE_CONNECT_ACTION_PREFIX = "oe_connect:";
+/** The button label per option kind — an action, not a description. */
+function buttonText(o) {
+    if (o.credentialType === "user-oauth")
+        return "Connect my account";
+    if (o.credentialType === "service-oauth")
+        return "Connect org account";
+    return "Set API key";
+}
+/**
+ * Build the Block Kit card for a set of resolved options. PURE. An actionable option becomes a button
+ * carrying `oe_connect:<connector>:<type>`; NO URL is ever placed in the card — links mint at the click.
+ */
+export function buildConnectCard(connectorName, options, org) {
+    const header = {
+        type: "section",
+        text: { type: "mrkdwn", text: `🔌 Connect *${connectorName}* — choose how to authorize:` },
+    };
+    const buttons = options
+        .filter((o) => o.route.kind === "modal" || o.route.kind === "url")
+        .map((o) => ({
+        type: "button",
+        action_id: `${OE_CONNECT_ACTION_PREFIX}${connectorName}:${o.credentialType}`,
+        value: org, // the org, so the click handler can resolve the catalogue/intake (mirrors intake.ts)
+        ...(o.credentialType === "user-oauth" ? { style: "primary" } : {}),
+        text: { type: "plain_text", text: buttonText(o) },
+    }));
+    // `unavailable` is NOT rendered (tools/connector.ts filters it out and this guards defence-in-depth):
+    // its reason is operator prose, not end-user copy. Only text-degrade (a working path, degraded
+    // presentation) earns a context line.
+    const degraded = options.filter((o) => o.route.kind === "text-degrade");
+    const blocks = [header];
+    if (buttons.length > 0)
+        blocks.push({ type: "actions", elements: buttons });
+    for (const o of degraded) {
+        blocks.push({
+            type: "context",
+            elements: [{ type: "mrkdwn", text: `*${optionLabel(o)}*: ${o.route.reason ?? "not available on this surface."}` }],
+        });
+    }
+    return { blocks, text: `Connect ${connectorName} — choose how to authorize.` };
+}
+// A surface with no interactive buttons gets the URL minted into a HOST-POSTED message: the model only ever
+// sees the factual summary, never the URL. A personal-oauth URL still only mints in a DM.
+/** Mint one OAuth authorization URL for a subject. Throws (LIVE-ONLY) if the vendor SDK is unbound. */
+async function mintOAuthUrl(startAuth, vercelConnector, subject) {
+    return (await startAuth(vercelConnector, { subject }, { expiresInMs: AUTH_URL_TTL_MS })).url;
+}
+/**
+ * Render the connect message for a NON-Slack surface. The URL lives only in the returned `text`, which the
+ * caller host-posts to the surface — never in the tool result.
+ */
+export async function renderNonSlackConnect(connectorName, options, 
+/** The caller's binding facts. `org` + `platform` are here for ONE reason: the personal-OAuth URL
+ *  minted below binds a human's third-party account to a VAULT SUBJECT, and that subject must be
+ *  composed exactly as the later token read composes it (OPE-286) — so both come from the same
+ *  binding rather than being re-derived here. */
+ctx, startAuth = defaultConnectorAuthStarter, 
+/**
+ * Mint a one-shot intake-PAGE link for a `page`-route api-key option; absent ⇒ the option degrades to honest
+ * text. The URL is CAPABILITY-BEARING and lives ONLY in the returned `text`, so it is not added to `issued`.
+ */
+issuePageLink) {
+    const lines = [`Connect *${connectorName}*:`];
+    const issued = [];
+    for (const o of options) {
+        // service-oauth takes ONE of two routes, and `dashboardUrl` is the selector (OPE-1914).
+        // A credential that declares one is completed on the Vercel dashboard by a team member — Connect's
+        // hosted flow rejects app subjects (live-proven 2026-07-20), so there is nothing to mint for it.
+        // A credential that declares NONE is homed at an authorization server this deployment drives
+        // itself (adapters/agent/oe-oauth), where `{type:"app"}` is an ordinary subject — so mint the org
+        // account's own authorization URL, exactly as the personal arm below mints the clicker's.
+        // 🔴 THE ADMIN GATE IS UPSTREAM. `resolveConnectorOptions` OMITS every app-principal option for a
+        // non-admin (connector-offer.ts omission gate 2), and every MINT-route option for a non-ORG-admin
+        // (gate 2b, OPE-1936), so an option of this type in `options` has already passed both. This function
+        // takes no standing of its own and must never be handed an unfiltered option list.
+        // 🔴 AND THE ADMIN GATE IS NOT ENOUGH ON ITS OWN HERE, WHICH IS WHY THE DM FENCE BELOW EXISTS.
+        // This function's text is HOST-POSTED INTO THE ROOM (tools/connector.ts), not delivered to the
+        // asker — the module header says so. `completeAuthorization` checks no principal, so whoever
+        // opens an authorization URL owns the row it writes — and `storeToken` writes that row
+        // unconditionally (oe-oauth/token-vault.ts), so the binding is LAST-write-wins, not first. An org
+        // URL posted into a shared channel would therefore let any reader bind THEIR Notion workspace as
+        // the credential every routine then spends, over the top of an admin's earlier consent. The
+        // completion now audits `connector.credential_bound` with `rebound: true` (OPE-1937), so the swap
+        // is at least witnessed — the ledger row is a record after the fact, never a gate.
+        // The admin gate bounds who ASKS; only the DM bounds who COMPLETES.
+        // The personal arm below carries the identical fence for the identical reason.
+        if (o.credentialType === "service-oauth") {
+            if (o.dashboardUrl) {
+                lines.push(`• *${optionLabel(o)}* — a Vercel team member authorizes the org account on the dashboard: ${o.dashboardUrl}`);
+                continue;
+            }
+            if (o.route.kind === "url" && o.vercelConnector && ctx.mode === "dm") {
+                try {
+                    // The subject carries NO id: the token lands in the vault under the app row, which is keyed
+                    // to no principal. That is what a routine may later spend without touching a person's row.
+                    const url = await mintOAuthUrl(startAuth, o.vercelConnector, { type: "app" });
+                    lines.push(`• *${optionLabel(o)}* — connect the org account (expires soon): ${url}`);
+                    issued.push(o);
+                }
+                catch {
+                    lines.push(`• *${optionLabel(o)}* — couldn't start the org connect flow (the connector isn't fully provisioned; ask an operator).`);
+                }
+                continue;
+            }
+            if (o.route.kind === "url" && o.vercelConnector) {
+                lines.push(`• *${optionLabel(o)}* — message me directly and ask again: this surface has no buttons, so the link would be posted into the room, and whoever opened it first would bind the org account.`);
+                continue;
+            }
+            lines.push(`• *${optionLabel(o)}* — an operator authorizes the org account on the vendor's admin dashboard.`);
+            continue;
+        }
+        if (o.route.kind === "page") {
+            // api-key on a non-Slack surface: mint the one-shot secure page link (the requester opens it and
+            // enters the key on our own form — never in chat). Degrade honestly if the issuer/page is absent.
+            const url = issuePageLink ? await issuePageLink(o) : undefined;
+            lines.push(url
+                ? `• *${optionLabel(o)}* — open this one-time secure page to enter the key (expires soon; it works once): ${url}`
+                : `• *${optionLabel(o)}* — secure key entry isn't available on this deployment right now; ask an operator to set it via the Vercel dashboard/CLI.`);
+            continue;
+        }
+        if (o.route.kind === "url" && o.vercelConnector && o.credentialType === "user-oauth") {
+            if (!(ctx.mode === "dm" && ctx.principalId))
+                continue; // omitted off-DM by the resolver already; guard the principal id
+            try {
+                // 🔴 The QUALIFIED vault subject, through the ONE composer (OPE-286) — the same string
+                // connector-auth's mint will later read this token back under. A bare `ctx.principalId` here
+                // (the pre-OPE-286 spelling) would now bind the human's account to a row nothing reads.
+                const url = await mintOAuthUrl(startAuth, o.vercelConnector, {
+                    type: "user",
+                    id: rawVaultSubject(ctx.org, ctx.platform, ctx.workspace, ctx.principalId),
+                });
+                lines.push(`• *${optionLabel(o)}* — connect your personal account (expires soon): ${url}`);
+                issued.push(o);
+            }
+            catch {
+                lines.push(`• *${optionLabel(o)}* — couldn't start the connect flow (the connector isn't fully provisioned; ask an operator).`);
+            }
+        }
+        else {
+            lines.push(`• *${optionLabel(o)}* — ${o.route.reason ?? "not available on this surface."}`);
+        }
+    }
+    return { text: lines.join("\n"), issued };
+}
+/** Post an ephemeral (clicker-only) notice. Best-effort; the delivery channel for a capability URL. */
+async function ephemeral(post, channelId, userId, text) {
+    const body = new URLSearchParams();
+    body.set("channel", channelId);
+    body.set("user", userId);
+    body.set("text", text);
+    await post("chat.postEphemeral", body.toString());
+}
+function connectWhere(org, teamId, channelId) {
+    return { org, platform: "slack", workspace: teamId || "unknown", surface: channelId };
+}
+/**
+ * Session mode from a bare Slack channel id — the `D` prefix marks a DM. A click payload carries no
+ * channel_type, so the bundle's type-aware arms cannot apply here; this is its id-prefix arm, kept local.
+ */
+function slackIdPrefixMode(channelId) {
+    return channelId?.startsWith("D") ? "dm" : "channel";
+}
+/** Re-derive the clicker's admin standing host-side from the payload facts + the live domains config
+ *  (never from the card). A synthetic binding is enough — roleForBinding reads platform/workspace/
+ *  surface/principalId only. isDomainAdmin already folds in org-admin (org admins are admins everywhere). */
+function clickerRole(org, teamId, channelId, clickerId, domains) {
+    const binding = {
+        org,
+        platform: "slack",
+        workspace: teamId ?? "unknown",
+        surface: channelId,
+        mode: slackIdPrefixMode(channelId),
+        visibility: "private",
+        trust: "internal",
+        principalId: clickerId,
+    };
+    const role = roleForBinding(binding, domains);
+    return { isAdmin: role.isDomainAdmin, isOrgAdmin: role.isOrgAdmin, ...(role.domain ? { domain: role.domain } : {}) };
+}
+/**
+ * Handle one `oe_connect:` click: `false` when it is not ours, else it OWNS the click and NEVER throws.
+ * Every branch re-verifies standing host-side — a DM for personal, admin for org — and no URL is audited.
+ */
+export async function handleConnectClick(payload, deps = {}) {
+    const p = payload;
+    const action = p?.actions?.[0];
+    const actionId = typeof action?.action_id === "string" ? action.action_id : undefined;
+    if (actionId === undefined || !actionId.startsWith(OE_CONNECT_ACTION_PREFIX))
+        return false; // not ours
+    const post = deps.post ?? bridgeSlackForm;
+    try {
+        const rest = actionId.slice(OE_CONNECT_ACTION_PREFIX.length);
+        const sep = rest.lastIndexOf(":"); // connector names have no ':'; the type is the last segment
+        const connectorName = sep > 0 ? rest.slice(0, sep) : undefined;
+        const type = (sep > 0 ? rest.slice(sep + 1) : undefined);
+        const org = typeof action?.value === "string" ? action.value : undefined;
+        const clickerId = typeof p?.user?.id === "string" ? p.user.id : undefined;
+        const channelId = typeof p?.channel?.id === "string" ? p.channel.id : undefined;
+        const teamId = typeof p?.team?.id === "string" ? p.team.id : undefined;
+        if (!connectorName || !type || !org || !clickerId || !channelId) {
+            console.error(`[open-everywhere:connector] malformed oe_connect click "${actionId}" — missing connector/type/org/user/channel; ignoring`);
+            return true; // it WAS ours — fail soft, never forward a half-understood payload
+        }
+        const catalogues = deps.loadConnectorCredentials ? deps.loadConnectorCredentials() : (getConfig().loadConnectorCredentials?.() ?? []);
+        const catalogue = catalogues.find((c) => c.connector === connectorName);
+        // Select the OFFERABLE credential of this type via the SAME helper the offer resolver uses — so a
+        // forged click can never target an `intake: false` PLUMBING credential (e.g. notion `channel-key`);
+        // it resolves the intake-able one (team-key) or nothing. Never a bare first-of-type find.
+        const cred = catalogue ? offerableCredential(catalogue, type) : undefined;
+        if (!catalogue || !cred) {
+            await ephemeral(post, channelId, clickerId, "This connect option is no longer available.");
+            return true;
+        }
+        const domains = deps.loadDomains ? deps.loadDomains() : getConfig().loadDomains();
+        const startAuth = deps.startAuth ?? defaultConnectorAuthStarter;
+        if (type === "user-oauth") {
+            if (slackIdPrefixMode(channelId) !== "dm") {
+                await ephemeral(post, channelId, clickerId, "Connecting your *personal* account only works in a DM with me — message me directly and try again.");
+                return true;
+            }
+            const userConnector = vercelConnectorOf(cred);
+            if (!userConnector) {
+                await ephemeral(post, channelId, clickerId, "This connector isn't configured for personal OAuth (no OAuth connector id). Ask an operator.");
+                return true;
+            }
+            // 🔴 The subject is the QUALIFIED vault subject through the ONE composer — connector-auth's mint reads that
+            // row back. The org is `deploymentOrg()`, never the click payload: a credential address never comes from input.
+            return await mintAndDeliverOAuth(post, startAuth, {
+                org, teamId, channelId, clickerId, connectorName, vercelConnector: userConnector,
+                subject: { type: "user", id: rawVaultSubject(deploymentOrg(), "slack", teamId, clickerId) }, subjectLabel: "user",
+            });
+        }
+        // service-oauth is ADMIN-ONLY — and the MINT route below is ORG-ADMIN-ONLY (OPE-1936). Both standings
+        // are re-derived host-side from the payload facts plus the live domains config — never read off the
+        // card, which an attacker would control.
+        // It then takes ONE of two routes, selected by `dashboardUrl` (OPE-1914), mirroring renderNonSlackConnect:
+        // a credential that declares one is completed on the VERCEL DASHBOARD, because Connect's hosted page
+        // REJECTS app subjects (live-proven 2026-07-20) and there is nothing to mint; a credential that declares
+        // NONE is homed at an authorization server this deployment drives itself (adapters/agent/oe-oauth), where
+        // `{type:"app"}` is an ordinary subject beside `{type:"user",id}` — so the org account gets a real
+        // authorization URL. The token then lands in the vault under the org's app row, keyed to no principal,
+        // which is what an unattended routine may spend without borrowing anyone's DM credential.
+        if (type === "service-oauth") {
+            const orgRole = clickerRole(org, teamId, channelId, clickerId, domains);
+            if (!orgRole.isAdmin) {
+                await ephemeral(post, channelId, clickerId, "Connecting the *org* account is admin-only — your id isn't listed as an admin for this workspace/domain.");
+                return true;
+            }
+            const dash = cred.dashboardUrl;
+            const mintHome = unqualifiedAppRowMintHome(type, cred);
+            if (mintHome) {
+                // 🔴 THE MINT ROUTE IS ORG-ADMIN-ONLY (OPE-1936), and this is the same predicate omission gate 2b
+                // reads — so a domain admin never sees the button and cannot reach the mint by forging a click.
+                // The row this bind writes carries no domain component, so domain standing is too narrow for it.
+                if (!orgRole.isOrgAdmin) {
+                    await ephemeral(post, channelId, clickerId, "Connecting the *org* account binds one credential for the whole deployment, so it takes an ORG admin — " +
+                        "your id is listed as an admin for this domain only. Ask an org admin to click it.");
+                    return true;
+                }
+                // No id in the subject — the app row is the org's, not a person's. The audit row this writes is
+                // `connector.oauth_url_issued` with subject `app`; the URL itself is ephemeral-only and never audited.
+                return await mintAndDeliverOAuth(post, startAuth, {
+                    org, teamId, channelId, clickerId, connectorName, vercelConnector: mintHome,
+                    subject: { type: "app" }, subjectLabel: "app",
+                });
+            }
+            await ephemeral(post, channelId, clickerId, dash
+                ? `Connecting the *org* ${connectorName} account is completed on the Vercel dashboard (needs a Vercel team member): ${dash} — authorize there, then ask me again.`
+                : `Connecting the *org* ${connectorName} account is done by an operator on the vendor's admin dashboard — no self-serve link is configured for it here.`);
+            await appendAudit({
+                ...connectWhere(org, teamId, channelId),
+                principalId: clickerId,
+                action: "connector.dashboard_link_issued",
+                detail: { connector: connectorName, configured: Boolean(dash) },
+            });
+            return true;
+        }
+        if (type === "api-key") {
+            const role = clickerRole(org, teamId, channelId, clickerId, domains);
+            if (!role.isAdmin) {
+                await ephemeral(post, channelId, clickerId, "Setting an *org* API key is admin-only — your id isn't listed as an admin for this workspace/domain.");
+                return true;
+            }
+            if (!cred.secretRef) {
+                await ephemeral(post, channelId, clickerId, "This connector's API-key credential has no configured storage ref. Ask an operator.");
+                return true;
+            }
+            const requestIntake = deps.requestIntake ?? requestCredentialIntake;
+            // The intake flow posts its OWN button and modal, and audits the request. The stored ref names the
+            // credential's HOME (credentials/ref.ts), so a pasted key lives in the db broker.
+            const ref = deriveCredentialRef({
+                connector: connectorName,
+                credentialId: cred.id,
+            });
+            if (!ref) {
+                await ephemeral(post, channelId, clickerId, "This connector's API-key credential has no resolvable storage home. Ask an operator.");
+                return true;
+            }
+            await requestIntake({
+                org,
+                connector: connectorName,
+                ...(role.domain ? { domain: role.domain } : {}),
+                ref,
+                requestedBy: clickerId,
+                channelId,
+                ...(teamId ? { teamId } : {}),
+            });
+            return true;
+        }
+        console.error(`[open-everywhere:connector] oe_connect click with unrecognised type "${String(type)}" — ignoring`);
+        return true;
+    }
+    catch (err) {
+        console.error(`[open-everywhere:connector] handleConnectClick failed softly for "${actionId}": ${String(err)}`);
+        return true;
+    }
+}
+/** Mint an OAuth authorization URL for `subject` and deliver it EPHEMERALLY to the clicker. Audits
+ *  `connector.oauth_url_issued` (subject type + connector + who — NEVER the URL). On a mint failure,
+ *  an honest ephemeral notice (no URL, no capability). Always returns true (the click was ours). */
+async function mintAndDeliverOAuth(post, startAuth, ctx) {
+    let url;
+    try {
+        url = (await startAuth(ctx.vercelConnector, { subject: ctx.subject }, { expiresInMs: AUTH_URL_TTL_MS })).url;
+    }
+    catch (err) {
+        // Never mask why with the URL; name the vendor requirement (LIVE-ONLY), never anything secret.
+        console.error(`[open-everywhere:connector] oauth mint failed for ${ctx.connectorName} (${ctx.subjectLabel}): ${String(err)}`);
+        await ephemeral(post, ctx.channelId, ctx.clickerId, "Couldn't start the connect flow just now — the connector isn't fully provisioned on this deployment. Ask an operator.");
+        return true;
+    }
+    const who = ctx.subjectLabel === "user" ? "your personal" : "the org service";
+    // CAPABILITY-BEARING: ephemeral-only, to the clicker alone. NEVER logged/audited below.
+    await ephemeral(post, ctx.channelId, ctx.clickerId, `Open this link to connect ${who} *${ctx.connectorName}* account (expires soon): ${url}`);
+    // Audit THAT a URL was issued — subject type + connector + who. NEVER the URL.
+    await appendAudit({
+        ...connectWhere(ctx.org, ctx.teamId, ctx.channelId),
+        principalId: ctx.clickerId,
+        action: "connector.oauth_url_issued",
+        detail: { connector: ctx.connectorName, subject: ctx.subjectLabel },
+    });
+    return true;
+}
+//# sourceMappingURL=connector-card.js.map

package/dist/agent/connections/connector-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-card.js","sourceRoot":"","sources":["../../../agent/connections/connector-card.ts"],"names":[],"mappings":"AAAA,iHAAiH;AACjH,gHAAgH;AAChH,0GAA0G;AAE1G,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAuB,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAGnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EACL,eAAe,EACf,2BAA2B,GAE5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAA6B,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,yBAAyB,EAA0C,MAAM,sBAAsB,CAAC;AAK3I;yGACyG;AACzG,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAEtD,uEAAuE;AACvE,SAAS,UAAU,CAAC,CAAkB;IACpC,IAAI,CAAC,CAAC,cAAc,KAAK,YAAY;QAAE,OAAO,oBAAoB,CAAC;IACnE,IAAI,CAAC,CAAC,cAAc,KAAK,eAAe;QAAE,OAAO,qBAAqB,CAAC;IACvE,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,aAAqB,EACrB,OAAmC,EACnC,GAAW;IAEX,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,aAAa,8BAA8B,EAAE;KAC3F,CAAC;IACF,MAAM,OAAO,GAAG,OAAO;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;SACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,GAAG,wBAAwB,GAAG,aAAa,IAAI,CAAC,CAAC,cAAc,EAAE;QAC5E,KAAK,EAAE,GAAG,EAAE,qFAAqF;QACjG,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE;KAClD,CAAC,CAAC,CAAC;IACN,sGAAsG;IACtG,+FAA+F;IAC/F,sCAAsC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACxE,MAAM,MAAM,GAAc,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,gCAAgC,EAAE,EAAE,CAAC;SACnH,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,aAAa,6BAA6B,EAAE,CAAC;AACjF,CAAC;AAED,4GAA4G;AAC5G,0FAA0F;AAE1F,uGAAuG;AACvG,KAAK,UAAU,YAAY,CACzB,SAAwC,EACxC,eAAuB,EACvB,OAAkF;IAElF,OAAO,CAAC,MAAM,SAAS,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,OAAmC;AACnC;;;iDAGiD;AACjD,GAAgJ,EAChJ,SAAS,GAAkC,2BAA2B;AACtE;;;GAGG;AACH,aAAmE;IAEnE,MAAM,KAAK,GAAa,CAAC,YAAY,aAAa,IAAI,CAAC,CAAC;IACxD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,wFAAwF;QACxF,mGAAmG;QACnG,iGAAiG;QACjG,6FAA6F;QAC7F,kGAAkG;QAClG,0FAA0F;QAC1F,kGAAkG;QAClG,kGAAkG;QAClG,qGAAqG;QACrG,mFAAmF;QACnF,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,uFAAuF;QACvF,kGAAkG;QAClG,iGAAiG;QACjG,4FAA4F;QAC5F,kGAAkG;QAClG,mFAAmF;QACnF,oEAAoE;QACpE,+EAA+E;QAC/E,IAAI,CAAC,CAAC,cAAc,KAAK,eAAe,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,yEAAyE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBAC1H,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACrE,IAAI,CAAC;oBACH,4FAA4F;oBAC5F,2FAA2F;oBAC3F,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC9E,KAAK,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;oBACrF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,mGAAmG,CAAC,CAAC;gBACtI,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,wKAAwK,CAAC,CAAC;gBACzM,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,6EAA6E,CAAC,CAAC;YAC9G,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,iGAAiG;YACjG,kGAAkG;YAClG,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/D,KAAK,CAAC,IAAI,CACR,GAAG;gBACD,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,sFAAsF,GAAG,EAAE;gBACjH,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,4HAA4H,CACrJ,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;YACrF,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS,CAAC,iEAAiE;YACxH,IAAI,CAAC;gBACH,uFAAuF;gBACvF,6FAA6F;gBAC7F,wFAAwF;gBACxF,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,eAAe,EAAE;oBAC3D,IAAI,EAAE,MAAM;oBACZ,EAAE,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;iBAC3E,CAAC,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,qDAAqD,GAAG,EAAE,CAAC,CAAC;gBAC3F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,+FAA+F,CAAC,CAAC;YAClI,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAqBD,uGAAuG;AACvG,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB,EAAE,MAAc,EAAE,IAAY;IACpF,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvB,MAAM,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,MAA0B,EAAE,SAAiB;IAC9E,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,SAA6B;IACtD,OAAO,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;6GAE6G;AAC7G,SAAS,WAAW,CAClB,GAAW,EACX,MAA0B,EAC1B,SAAiB,EACjB,SAAiB,EACjB,OAA0B;IAE1B,MAAM,OAAO,GAAmB;QAC9B,GAAG;QACH,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,MAAM,IAAI,SAAS;QAC9B,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC;QAClC,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,UAAU;QACjB,WAAW,EAAE,SAAS;KACvB,CAAC;IACF,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB,EAAE,IAAI,GAAsB,EAAE;IACrF,MAAM,CAAC,GAAG,OAAiD,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,wBAAwB,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,WAAW;IAEvG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,4DAA4D;QAC/F,MAAM,aAAa,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAwC,CAAC;QAChG,MAAM,GAAG,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvE,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;YAChE,OAAO,CAAC,KAAK,CAAC,2DAA2D,QAAQ,uDAAuD,CAAC,CAAC;YAC1I,OAAO,IAAI,CAAC,CAAC,mEAAmE;QAClF,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtI,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC;QACxE,kGAAkG;QAClG,oGAAoG;QACpG,0FAA0F;QAC1F,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,6CAA6C,CAAC,CAAC;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,2BAA2B,CAAC;QAEhE,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1B,IAAI,iBAAiB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC1C,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,oGAAoG,CAAC,CAAC;gBAClJ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,8FAA8F,CAAC,CAAC;gBAC5I,OAAO,IAAI,CAAC;YACd,CAAC;YACD,4GAA4G;YAC5G,gHAAgH;YAChH,OAAO,MAAM,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE;gBAChD,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa;gBAChF,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM;aAClH,CAAC,CAAC;QACL,CAAC;QAED,sGAAsG;QACtG,oGAAoG;QACpG,yCAAyC;QACzC,2GAA2G;QAC3G,qGAAqG;QACrG,yGAAyG;QACzG,0GAA0G;QAC1G,mGAAmG;QACnG,uGAAuG;QACvG,0FAA0F;QAC1F,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACxE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,0GAA0G,CAAC,CAAC;gBACxJ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC;YAC/B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,kGAAkG;gBAClG,gGAAgG;gBAChG,iGAAiG;gBACjG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;oBACxB,MAAM,SAAS,CACb,IAAI,EACJ,SAAS,EACT,SAAS,EACT,yGAAyG;wBACvG,mFAAmF,CACtF,CAAC;oBACF,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,gGAAgG;gBAChG,uGAAuG;gBACvG,OAAO,MAAM,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE;oBAChD,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ;oBAC3E,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,KAAK;iBAC9C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,SAAS,CACb,IAAI,EACJ,SAAS,EACT,SAAS,EACT,IAAI;gBACF,CAAC,CAAC,wBAAwB,aAAa,+EAA+E,IAAI,wCAAwC;gBAClK,CAAC,CAAC,wBAAwB,aAAa,iHAAiH,CAC3J,CAAC;YACF,MAAM,WAAW,CAAC;gBAChB,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC;gBACvC,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,iCAAiC;gBACzC,MAAM,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;aAChE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,sGAAsG,CAAC,CAAC;gBACpJ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,qFAAqF,CAAC,CAAC;gBACnI,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC;YACpE,mGAAmG;YACnG,kFAAkF;YAClF,MAAM,GAAG,GAAG,mBAAmB,CAAC;gBAC9B,SAAS,EAAE,aAAa;gBACxB,YAAY,EAAE,IAAI,CAAC,EAAE;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,sFAAsF,CAAC,CAAC;gBACpI,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,aAAa,CAAC;gBAClB,GAAG;gBACH,SAAS,EAAE,aAAa;gBACxB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG;gBACH,WAAW,EAAE,SAAS;gBACtB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,wEAAwE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,qEAAqE,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;oGAEoG;AACpG,KAAK,UAAU,mBAAmB,CAChC,IAAY,EACZ,SAAwC,EACxC,GASC;IAED,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+FAA+F;QAC/F,OAAO,CAAC,KAAK,CAAC,qDAAqD,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC,YAAY,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9H,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,uHAAuH,CAAC,CAAC;QAC7K,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC9E,wFAAwF;IACxF,MAAM,SAAS,CACb,IAAI,EACJ,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,SAAS,EACb,6BAA6B,GAAG,KAAK,GAAG,CAAC,aAAa,6BAA6B,GAAG,EAAE,CACzF,CAAC;IACF,+EAA+E;IAC/E,MAAM,WAAW,CAAC;QAChB,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC;QACnD,WAAW,EAAE,GAAG,CAAC,SAAS;QAC1B,MAAM,EAAE,4BAA4B;QACpC,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE;KACpE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/agent/connections/connector-flags.d.ts

@@ -0,0 +1,22 @@
+/** True iff the per-user (Connect user-subject) credential path is armed. Off (default) ⇒
+ *  connections stay on the app-principal path and flag-off is byte-identical. */
+export declare function connectorUserPrincipalEnabled(): boolean;
+/**
+ * True iff the C.3 shared user-OAuth vault is armed — a confirmed link-set member then keys the vault by the
+ * set's subject. Arming makes a confirmed membership credential-bearing, which the directory-sync guard reads.
+ */
+export declare function connectorLinkSetVaultEnabled(): boolean;
+/**
+ * {@link connectorLinkSetVaultEnabled}, read FAIL-CLOSED: any throw resolves ARMED, because a false negative
+ * is a silent cross-person credential grant. Keyed on the VAULT flag alone, never on a conjunction.
+ */
+export declare function directoryLinkSetVaultArmed(): boolean;
+/** True iff the per-op read/write approval gate is armed. Off (default) ⇒ connections keep
+ *  the blanket `once()` approval and flag-off is byte-identical. */
+export declare function connectorOpTieringEnabled(): boolean;
+/**
+ * True iff the MEMBER PLANE is armed — a member's own connector credential resolving in a shared room their
+ * domain declared it for, reads only. Off ⇒ inert. This flag is the deployment's half of the answer only.
+ */
+export declare function connectorMemberPlaneEnabled(): boolean;
+//# sourceMappingURL=connector-flags.d.ts.map

package/dist/agent/connections/connector-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-flags.d.ts","sourceRoot":"","sources":["../../../agent/connections/connector-flags.ts"],"names":[],"mappings":"AAKA;iFACiF;AACjF,wBAAgB,6BAA6B,IAAI,OAAO,CAEvD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CAEtD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAMpD;AAED;oEACoE;AACpE,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,OAAO,CAErD"}

package/dist/agent/connections/connector-flags.js

@@ -0,0 +1,40 @@
+// Arming flags for the connector plane. All default OFF, so an unarmed deployment behaves exactly as it did
+// before the flag; arming one is a reviewed diff in the deployment's own `agent/settings.ts`.
+import { getSettings } from "../settings/settings.js";
+/** True iff the per-user (Connect user-subject) credential path is armed. Off (default) ⇒
+ *  connections stay on the app-principal path and flag-off is byte-identical. */
+export function connectorUserPrincipalEnabled() {
+    return getSettings().connectors.userPrincipal;
+}
+/**
+ * True iff the C.3 shared user-OAuth vault is armed — a confirmed link-set member then keys the vault by the
+ * set's subject. Arming makes a confirmed membership credential-bearing, which the directory-sync guard reads.
+ */
+export function connectorLinkSetVaultEnabled() {
+    return getSettings().connectors.linkSetVault;
+}
+/**
+ * {@link connectorLinkSetVaultEnabled}, read FAIL-CLOSED: any throw resolves ARMED, because a false negative
+ * is a silent cross-person credential grant. Keyed on the VAULT flag alone, never on a conjunction.
+ */
+export function directoryLinkSetVaultArmed() {
+    try {
+        return connectorLinkSetVaultEnabled();
+    }
+    catch {
+        return true;
+    }
+}
+/** True iff the per-op read/write approval gate is armed. Off (default) ⇒ connections keep
+ *  the blanket `once()` approval and flag-off is byte-identical. */
+export function connectorOpTieringEnabled() {
+    return getSettings().connectors.opTiering;
+}
+/**
+ * True iff the MEMBER PLANE is armed — a member's own connector credential resolving in a shared room their
+ * domain declared it for, reads only. Off ⇒ inert. This flag is the deployment's half of the answer only.
+ */
+export function connectorMemberPlaneEnabled() {
+    return getSettings().connectors.memberPlane;
+}
+//# sourceMappingURL=connector-flags.js.map

package/dist/agent/connections/connector-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-flags.js","sourceRoot":"","sources":["../../../agent/connections/connector-flags.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,8FAA8F;AAE9F,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD;iFACiF;AACjF,MAAM,UAAU,6BAA6B;IAC3C,OAAO,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,CAAC;QACH,OAAO,4BAA4B,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,yBAAyB;IACvC,OAAO,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,WAAW,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;AAC9C,CAAC"}