@open-everywhere/core 0.1.0

package/dist/agent/tools/connector.js

@@ -0,0 +1,212 @@
+// connector posts connect OPTIONS for a connector's credential; it never mints a capability or stores a key itself. On Slack it posts ONE card, and the CONSEQUENTIAL acts happen host-side at the CLICK, where standing is re-verified and any URL is delivered ephemerally to the clicker — the model is never in that loop. On other surfaces it mints the URL(s) into a HOST-POSTED message, and the api-key path degrades honestly.
+// 🔴 The MODEL never sees a URL: the tool's RESULT is a short factual summary, never anything capability-bearing. Tier `open` — posting UI is the same class as a reply and the gate is at the click — and ungated on every grain. Standing is read only to OMIT options a requester cannot use, never to refuse, and the omitted org-level options are re-gated at the click.
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { bindFrom } from "../identity/binding.js";
+import { resolveRole } from "../access/roles.js";
+import { resolvePartition } from "../memory/partition.js";
+import { getConfig } from "../access/config.js";
+import { appendAudit } from "../audit/audit.js";
+import { bridgeSlackForm } from "../channels/slack-bridge.js";
+import { resolveReplyTarget, postReply } from "../channels/reply-post.js";
+import { preRegisterDynamicEntry } from "../access/window-gated.js";
+import { resolveConnectorOptions, optionLabel, hostWriteHomeAvailable, offerableCredential } from "../connections/connector-offer.js";
+import { registeredCredentialHomes } from "../credentials/home.js";
+import { buildConnectCard, renderNonSlackConnect } from "../connections/connector-card.js";
+import { deriveCredentialRef } from "../credentials/ref.js";
+import { intakePageAvailable, issueIntakePageLink } from "../credentials/intake-page.js";
+/** DM ⇒ the personal universe; everything else (channel/mpim) ⇒ the shared universe. */
+function connectModeOf(mode) {
+    return mode === "dm" ? "dm" : "channel";
+}
+// FACTORED + PRE-REGISTERED (access/window-gated.ts REPLAY DOCTRINE): top-level defineTool const,
+// module-load registration under the deterministic slug-keyed step name.
+const connectorEntry = defineTool({
+    description: "Post connect options for a connector so a human can authorize it. Call with a connector name when " +
+        "someone wants to connect/authorize an integration (e.g. \"connect Notion\", \"set the API key\"), or " +
+        "with NO connector to list what can be connected here. This posts buttons/links — it does NOT store " +
+        "any secret or grant anything itself; a human completes the connect, and personal OAuth only works " +
+        "in a DM while org-level setup is admin-only (options a requester can't use are simply not shown). " +
+        "NEVER invite anyone to paste a secret/API key into chat — secrets travel only through the posted " +
+        "intake UI or an operator, and a pasted key is compromised. " +
+        "If the person says they have ALREADY completed a sign-in/authorization, do NOT call this — retry " +
+        "the actual operation instead (the connector's own tools / connection_search); grants land server-side, " +
+        "so only a fresh attempt can see them, and re-posting connect options reads as a runaround. " +
+        "The posted card/message IS the reply — do not add a URL, a summary, or confirmation text after this call.",
+    inputSchema: z.object({
+        connector: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("The connector to connect (as listed by calling with no connector). Omit to list connectable connectors here."),
+    }),
+    outputSchema: z.object({
+        action: z.enum(["posted", "listed", "none"]),
+        connector: z.string().optional(),
+        options: z.array(z.string()),
+        note: z.string(),
+    }),
+    // NO `approval:` — the tool only posts UI; the consequential act is the human click (gated host-side).
+    async execute(input, ctx) {
+        const binding = bindFrom(ctx);
+        const platform = binding.platform;
+        const mode = connectModeOf(binding.mode);
+        // 🔴 UNVERIFIED IS NOT "NOT AN ADMIN". The role resolver answers `unverified` when this turn cannot say whose ask it is serving — several people woke it at once, a relay message did, or a worker's parent named nobody. The NARROWING stays: org-level options are withheld, fail-closed, exactly as for a plain member.
+        // But the COPY must not tell the caller they lack standing, because the gate does not know who they are. The note below is appended to whichever answer this turn returns, so the caller learns the real reason and can ask again.
+        const role = resolveRole(ctx);
+        const isAdmin = role.unverified === undefined && role.isDomainAdmin; // folds in org-admin
+        // The narrower bit, gated the same way: the org-subject MINT option binds a deployment-wide row, so a
+        // domain admin is not offered it (connector-offer.ts omission gate 2b, OPE-1936). `unverified` withholds
+        // it for the same fail-closed reason it withholds the rest.
+        const isOrgAdmin = role.unverified === undefined && role.isOrgAdmin;
+        const unverifiedNote = role.unverified === undefined
+            ? ""
+            : " (Org-level options are withheld on this turn because the caller could not be verified, not because you lack standing —" +
+                " ask again on its own and they are offered normally.)";
+        // The "Set API key" offer is available iff a host-write-capable HOME is registered (R1): a pure
+        // query over the CredentialHome registry (the db home ⇔ its broker is registered, a future vendor's
+        // home ⇔ its own signal). Keyed off REGISTRATION, never selection or the target credential's stamp.
+        const hostWriteBroker = hostWriteHomeAvailable(registeredCredentialHomes());
+        // The one-shot intake PAGE is offerable as the non-Slack api-key path iff it's armed on this
+        // deployment (a signing key + a resolvable base URL — credentials/intake-page.ts). Keyed off
+        // deployment config, never a credential's stamp; false ⇒ api-key degrades to honest text.
+        const pageArmed = intakePageAvailable();
+        const catalogues = getConfig().loadConnectorCredentials?.() ?? [];
+        if (!input.connector) {
+            if (catalogues.length === 0) {
+                return { action: "none", options: [], note: "No connectors are configured on this deployment." };
+            }
+            const lines = catalogues.map((p) => {
+                const labels = resolveConnectorOptions({ catalogue: p, platform, mode, isAdmin, isOrgAdmin, hostWriteBroker, intakePageAvailable: pageArmed })
+                    .filter((o) => o.route.kind !== "unavailable")
+                    .map(optionLabel);
+                return `- ${p.connector}: ${labels.length ? labels.join(", ") : "nothing offerable here"}`;
+            });
+            return {
+                action: "listed",
+                options: catalogues.map((p) => p.connector),
+                note: `Connectable connectors here:\n${lines.join("\n")}\nCall connector with a connector name to post its options.${unverifiedNote}`,
+            };
+        }
+        const catalogue = catalogues.find((p) => p.connector === input.connector);
+        if (!catalogue) {
+            throw new Error(`no connector "${input.connector}" is configured — known connectors: ${catalogues.map((p) => p.connector).join(", ") || "none"}.`);
+        }
+        // `unavailable` options are OMITTED end-to-end (card, labels, audit): the honest-reason line is
+        // operator prose ("broker env … out of band") that reads as gibberish to an end user, and listing
+        // an unusable option invites the model to improvise around it (a live seat suggested a chat paste).
+        const options = resolveConnectorOptions({ catalogue, platform, mode, isAdmin, isOrgAdmin, hostWriteBroker, intakePageAvailable: pageArmed }).filter((o) => o.route.kind !== "unavailable");
+        const labels = options.map(optionLabel);
+        if (options.length === 0) {
+            return {
+                action: "none",
+                connector: catalogue.connector,
+                options: [],
+                note: `No connect options are offerable for ${catalogue.connector} here — personal OAuth is DM-only, and org-level setup (service OAuth / API key) is admin-only.${unverifiedNote}`,
+            };
+        }
+        const partition = resolvePartition(ctx);
+        const cardAudit = () => appendAudit({
+            org: partition.org,
+            platform: partition.platform,
+            workspace: partition.workspace,
+            surface: partition.surface,
+            ...(binding.principalId ? { principalId: binding.principalId } : {}),
+            action: "connector.card_posted",
+            detail: { connector: catalogue.connector, options: labels },
+        });
+        if (platform === "slack") {
+            const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+            if (!channelId) {
+                throw new Error("connector couldn't resolve this Slack channel's id — try again from a real channel or DM.");
+            }
+            const { blocks, text } = buildConnectCard(catalogue.connector, options, binding.org);
+            const body = new URLSearchParams();
+            body.set("channel", channelId);
+            if (binding.threadTs)
+                body.set("thread_ts", binding.threadTs);
+            body.set("text", text);
+            body.set("blocks", JSON.stringify(blocks));
+            const res = await bridgeSlackForm("chat.postMessage", body.toString());
+            if (res?.ok !== true) {
+                throw new Error("connector couldn't post the connect card to Slack (check the bot token / scopes).");
+            }
+            await cardAudit();
+            return {
+                action: "posted",
+                connector: catalogue.connector,
+                options: labels,
+                note: `posted connect options for ${catalogue.connector}: ${labels.join(", ")}`,
+            };
+        }
+        // Other surfaces: mint the URL(s) into a HOST-POSTED message; the model gets only the summary.
+        const target = resolveReplyTarget(ctx);
+        if (!target) {
+            throw new Error("connector couldn't resolve this conversation to post the connect links — ask me from a direct channel or DM.");
+        }
+        // Mints a one-shot intake-page link, deriving the SAME stored ref the Slack click would and binding the intake row to THIS requester.
+        // The URL lives only in the host-posted message text, never in the tool result. It returns undefined — an honest degrade — when there is no requester identity, no resolvable ref, or the page is not armed.
+        const issuePageLink = async (o) => {
+            if (!binding.principalId)
+                return undefined;
+            const cred = offerableCredential(catalogue, o.credentialType);
+            if (!cred)
+                return undefined;
+            const ref = deriveCredentialRef({ connector: catalogue.connector, credentialId: cred.id });
+            if (!ref)
+                return undefined;
+            const link = await issueIntakePageLink({
+                org: binding.org,
+                connector: catalogue.connector,
+                ...(partition.workspace ? { teamId: partition.workspace } : {}),
+                platform,
+                ref,
+                requestedBy: binding.principalId,
+                channelId: partition.surface,
+            });
+            return link?.url;
+        };
+        // org + platform ride from the SAME binding the principal does: the personal-OAuth URL this mints
+        // binds an account to a vault subject that connector-auth must later compose identically (OPE-286).
+        const { text, issued } = await renderNonSlackConnect(catalogue.connector, options, { mode, principalId: binding.principalId, org: binding.org, platform: binding.platform }, undefined, issuePageLink);
+        const audit = {
+            org: partition.org,
+            platform: partition.platform,
+            workspace: partition.workspace,
+            surface: partition.surface,
+            ...(binding.principalId ? { principalId: binding.principalId } : {}),
+            route: "tool",
+        };
+        await postReply(target, text, audit);
+        await cardAudit();
+        // One connector.oauth_url_issued per URL actually minted — subject type + connector + who, NEVER the URL.
+        for (const o of issued) {
+            await appendAudit({
+                org: partition.org,
+                platform: partition.platform,
+                workspace: partition.workspace,
+                surface: partition.surface,
+                ...(binding.principalId ? { principalId: binding.principalId } : {}),
+                action: "connector.oauth_url_issued",
+                detail: { connector: catalogue.connector, subject: o.principal },
+            });
+        }
+        return {
+            action: "posted",
+            connector: catalogue.connector,
+            options: labels,
+            note: `posted connect options for ${catalogue.connector}: ${labels.join(", ")}`,
+        };
+        // NO toModelOutput: the output object carries only action/connector/options/note — all factual,
+        // NEVER a URL. The default structured rendering is safe; there is nothing capability-bearing to strip.
+    },
+});
+preRegisterDynamicEntry("connector", "_single", connectorEntry);
+export default defineDynamic({
+    events: {
+        // Mounts on every surface + grain (a connect affordance is a conversational verb). Unconditional
+        // resolve — no source/grain gate — so a standing seat can offer connect options too.
+        "session.started": (_event, _ctx) => connectorEntry,
+    },
+});
+//# sourceMappingURL=connector.js.map

package/dist/agent/tools/connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.js","sourceRoot":"","sources":["../../../agent/tools/connector.ts"],"names":[],"mappings":"AAAA,yaAAya;AACza,+WAA+W;AAE/W,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAwB,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAmB,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,sBAAsB,EAAE,mBAAmB,EAA0C,MAAM,mCAAmC,CAAC;AAC9K,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEzF,wFAAwF;AACxF,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED,kGAAkG;AAClG,yEAAyE;AACzE,MAAM,cAAc,GAAG,UAAU,CAAC;IAChC,WAAW,EACT,oGAAoG;QACpG,uGAAuG;QACvG,qGAAqG;QACrG,oGAAoG;QACpG,oGAAoG;QACpG,mGAAmG;QACnG,6DAA6D;QAC7D,mGAAmG;QACnG,yGAAyG;QACzG,6FAA6F;QAC7F,2GAA2G;IAC7G,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,8GAA8G,CAAC;KAC5H,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,uGAAuG;IACvG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAsB,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,2TAA2T;QAC3T,mOAAmO;QACnO,MAAM,IAAI,GAAG,WAAW,CAAC,GAAsB,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,qBAAqB;QAC1F,sGAAsG;QACtG,yGAAyG;QACzG,4DAA4D;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;QACpE,MAAM,cAAc,GAClB,IAAI,CAAC,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,yHAAyH;gBACzH,uDAAuD,CAAC;QAC9D,gGAAgG;QAChG,oGAAoG;QACpG,oGAAoG;QACpG,MAAM,eAAe,GAAG,sBAAsB,CAAC,yBAAyB,EAAE,CAAC,CAAC;QAC5E,6FAA6F;QAC7F,6FAA6F;QAC7F,0FAA0F;QAC1F,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,SAAS,EAAE,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC;QAElE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,MAAe,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,kDAAkD,EAAE,CAAC;YAC5G,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC;qBAC3I,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC;qBAC7C,GAAG,CAAC,WAAW,CAAC,CAAC;gBACpB,OAAO,KAAK,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC;YAC7F,CAAC,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,QAAiB;gBACzB,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3C,IAAI,EAAE,iCAAiC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8DAA8D,cAAc,EAAE;aACtI,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,iBAAiB,KAAK,CAAC,SAAS,uCAAuC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAClI,CAAC;QACJ,CAAC;QAED,gGAAgG;QAChG,kGAAkG;QAClG,oGAAoG;QACpG,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CACjJ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CACtC,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,MAAe;gBACvB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,wCAAwC,SAAS,CAAC,SAAS,kGAAkG,cAAc,EAAE;aACpL,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAsB,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,WAAW,CAAC;YACV,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE;SAC5D,CAAC,CAAC;QAEL,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACvG,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;YAC/G,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,kBAAkB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvE,IAAI,GAAG,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO;gBACL,MAAM,EAAE,QAAiB;gBACzB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,8BAA8B,SAAS,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAChF,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAsB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAC;QAClI,CAAC;QACD,sIAAsI;QACtI,6MAA6M;QAC7M,MAAM,aAAa,GAAG,KAAK,EAAE,CAAkB,EAA+B,EAAE;YAC9E,IAAI,CAAC,OAAO,CAAC,WAAW;gBAAE,OAAO,SAAS,CAAC;YAC3C,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,MAAM,GAAG,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;gBACrC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,QAAQ;gBACR,GAAG;gBACH,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,SAAS,CAAC,OAAO;aAC7B,CAAC,CAAC;YACH,OAAO,IAAI,EAAE,GAAG,CAAC;QACnB,CAAC,CAAC;QACF,kGAAkG;QAClG,oGAAoG;QACpG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAClD,SAAS,CAAC,SAAS,EACnB,OAAO,EACP,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EACxF,SAAS,EACT,aAAa,CACd,CAAC;QACF,MAAM,KAAK,GAAe;YACxB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,KAAK,EAAE,MAAM;SACd,CAAC;QACF,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,SAAS,EAAE,CAAC;QAClB,0GAA0G;QAC1G,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,WAAW,CAAC;gBAChB,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,EAAE,4BAA4B;gBACpC,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,MAAM,EAAE,QAAiB;YACzB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,8BAA8B,SAAS,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChF,CAAC;QACF,gGAAgG;QAChG,uGAAuG;IACzG,CAAC;CACF,CAAC,CAAC;AACH,uBAAuB,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AAEhE,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,iGAAiG;QACjG,qFAAqF;QACrF,iBAAiB,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc;KACpD;CACF,CAAC,CAAC"}

package/dist/agent/tools/create_agent.d.ts

@@ -0,0 +1,77 @@
+declare const _default: import("eve/tools").ToolDefinition<{
+    name: string;
+    title?: string | undefined;
+    memory: {
+        kind: "existing-silo";
+        silo: string;
+    } | {
+        kind: "new-readonly";
+        provider: "github" | "notion" | "postgres";
+        container?: string | undefined;
+        path?: string | undefined;
+        select?: {
+            default: "include" | "recurse";
+            rules?: {
+                path: string;
+                mode: "exclude" | "include" | "recurse";
+            }[] | undefined;
+        } | undefined;
+        skill?: string | undefined;
+    };
+    connectors?: {
+        name: string;
+        credential: string;
+    }[] | undefined;
+    instructions?: string | undefined;
+    exposed: boolean;
+    reason?: string | undefined;
+}, {
+    requested: boolean;
+    pendingId: string;
+    expiresAt?: string | undefined;
+    note: string;
+    autoApproved?: boolean | undefined;
+}> & {
+    execute(input: {
+        name: string;
+        title?: string | undefined;
+        memory: {
+            kind: "existing-silo";
+            silo: string;
+        } | {
+            kind: "new-readonly";
+            provider: "github" | "notion" | "postgres";
+            container?: string | undefined;
+            path?: string | undefined;
+            select?: {
+                default: "include" | "recurse";
+                rules?: {
+                    path: string;
+                    mode: "exclude" | "include" | "recurse";
+                }[] | undefined;
+            } | undefined;
+            skill?: string | undefined;
+        };
+        connectors?: {
+            name: string;
+            credential: string;
+        }[] | undefined;
+        instructions?: string | undefined;
+        exposed: boolean;
+        reason?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        requested: boolean;
+        autoApproved: boolean;
+        pendingId: string;
+        note: string;
+        expiresAt?: undefined;
+    } | {
+        autoApproved?: undefined;
+        requested: boolean;
+        pendingId: string;
+        expiresAt: string;
+        note: string;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=create_agent.d.ts.map

package/dist/agent/tools/create_agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create_agent.d.ts","sourceRoot":"","sources":["../../../agent/tools/create_agent.ts"],"names":[],"mappings":""}

package/dist/agent/tools/create_agent.js

@@ -0,0 +1,261 @@
+// create_agent PROPOSES a new channel-resident AGENT and has the agent open the ONE PR that provisions it. "An agent" is not a first-class object: it is the composition a single AgentSpec derives — a memory DOMAIN whose roster is this channel, a data SILO, and an access BUNDLE with a domain-scoped BINDING. This tool writes NOTHING at propose time: it validates, freezes the spec and posts a member card, and the ADMIN's merge is the privilege gate. A fire may not author one, because creating an agent is standing-behaviour authorship.
+// 🔴 The redirect leg is structurally INERT for this tool, unlike its siblings: the venue walk can only find a redirect venue by the asking channel being an EXPLICIT member of a domain, and the domain-collision gate below refuses whenever that is true. What the walk still buys is an accurate reason for each refusal. An EXPOSED agent is forced curated READ-ONLY, checked here before the card and again at config load.
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { randomUUID } from "node:crypto";
+import { bindFrom } from "../identity/binding.js";
+import { resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+import { actingPrincipalIdOf, buildResolveRequest, unattendedOf } from "../access/request.js";
+import { surfaceKeyOf } from "../access/resolver.js";
+import { getConfig } from "../access/config.js";
+import { definedConnectors, definedConnectorCredentials } from "../access/delta.js";
+import { assertExposedAgentSpec, } from "../memory/agents-codemod.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { requireSessionContinuation } from "../spend/checkpoint.js";
+const NAME_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+// The curated SELECTION schema (memory/selection.ts MemorySelection) — a `new-readonly` silo may
+// carve a subtree of its source.
+const selectionSchema = z.object({
+    default: z.enum(["recurse", "include"]).describe('What UNLISTED nodes get: "recurse" = take all (prune with excludes); "include" = take only the root + ticked nodes.'),
+    rules: z
+        .array(z.object({
+        path: z.string().min(1).describe('Node path relative to the silo root ("Handbook/Deep Dive") or a raw node id.'),
+        mode: z.enum(["recurse", "include", "exclude"]),
+    }))
+        .optional(),
+});
+export default defineTool({
+    description: "PROPOSE a new AGENT for THIS channel — a self-contained teammate with its OWN memory brain and its own capabilities. This grants nothing itself: it opens a pull request adding the agent to this deployment's config, for a human to review and merge; nothing is provisioned until an admin merges it. An agent is three things derived from what you pass: a memory DOMAIN whose roster is this channel, a memory SILO (where its brain lives — either reuse an existing silo by name, or materialise a NEW read-only silo over notion/github/postgres), and a capability BUNDLE (its standing instructions + any connectors) bound to that channel. Use it when someone wants to stand up a dedicated assistant in a channel (\"make this channel a support agent backed by our Notion handbook\"). Refused from a DM, a group chat, an externally-shared channel, or a channel that ALREADY belongs to a domain. Set `exposed: true` ONLY for an agent a wider, less-trusted audience will reach — it is then forced curated READ-ONLY. The posted card IS the reply — do not add narration after this call. EXCEPT when this surface can't host a card: it then goes to a card-capable channel in the same domain, the `note` field names it, and you MUST relay that.",
+    inputSchema: z.object({
+        name: z
+            .string()
+            .min(1)
+            .max(64)
+            .describe('The agent\'s bare name — also its memory domain + bundle name. Letters, digits, "_" or "-", e.g. "support-desk". No "/".'),
+        title: z.string().optional().describe("A human-friendly display title, e.g. \"Support Desk Assistant\". Optional."),
+        memory: z
+            .discriminatedUnion("kind", [
+            z.object({
+                kind: z.literal("existing-silo"),
+                silo: z.string().min(1).describe("The name of an already-defined memory silo to reuse as this agent's brain."),
+            }),
+            z.object({
+                kind: z.literal("new-readonly"),
+                provider: z.enum(["notion", "github", "postgres"]).describe("The backing for a NEW read-only silo materialised for this agent."),
+                container: z.string().optional().describe('Provider container: a repo ("github"), a root page/teamspace id ("notion").'),
+                path: z.string().optional().describe("Subtree within the container this silo's memory lives under."),
+                select: selectionSchema.optional().describe("Curated subset of a tree backing (notion/github) — take only part of the source."),
+                skill: z.string().optional().describe("The skill that teaches how to USE/UPDATE this source (e.g. the Notion-update skill)."),
+            }),
+        ])
+            .describe('WHERE the agent\'s brain lives: reuse an existing silo ({ kind: "existing-silo", silo }) or materialise a new READ-ONLY one ({ kind: "new-readonly", provider, ... }).'),
+        connectors: z
+            .array(z.object({ name: z.string().min(1), credential: z.string().min(1) }))
+            .optional()
+            .describe("Connector grants this agent may use: { name, credential } each. `name` must already be defined in this deployment's config, and `credential` must be one that connector configures — every grant names the identity it is reached as."),
+        instructions: z.string().optional().describe("Standing instructions the agent follows on every turn — its persona / job. Kept as narrow as the job allows."),
+        exposed: z.boolean().optional().default(false).describe("True ONLY if a wider, less-trusted audience reaches this agent. It is then forced curated read-only (read-only silo, no org-brain inheritance)."),
+        reason: z.string().optional().describe("Why this agent is wanted — shown on the card and in the PR."),
+    }),
+    outputSchema: z.object({
+        requested: z.boolean(),
+        pendingId: z.string(),
+        expiresAt: z.string().optional().describe("Absent when the chain auto-approved: the row is already decided, so nothing expires."),
+        note: z.string(),
+        autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+    }),
+    // `never()` = no eve-level approval field; the gate:member card is posted MANUALLY inside execute()
+    // via the `agent.create` ActionKind. Same shape and reason as declare_webhook / create_routine.
+    approval: never(),
+    async execute(input, ctx) {
+        // SOFT session cost checkpoint (OPE-62) — pause consequential work past a configured per-session
+        // threshold until a member confirms; no-op when unconfigured.
+        await requireSessionContinuation(ctx, "create_agent");
+        const binding = bindFrom(ctx);
+        const p = resolvePartition(ctx);
+        // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `p` above is the TURN's
+        // partition, and a turn that merged queued deliveries carries only the LAST delivery's auth —
+        // so on a turn answering two rooms it names the wrong one. The GOVERNED scope follows the
+        // ADDRESSED wake instead, through the same road the reply path uses; it falls back to `p` on
+        // every unknown, so a single-wake turn is unchanged.
+        // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve batches
+        // adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+        // per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+        // unified window never compare equal; only the caller-less task COMPLETION COHORT still folds,
+        // and it carries no `auth` at all. But the TURN's ctx names the wrong room WITHOUT any merge
+        // too: a turn woken by an INTERNAL wake — an approval decision, a completion — answers a
+        // conversation whose envelope is in the seat's shared context, through the reply fence's
+        // same-conversation and pending arms (`channels/unified-window.ts` `resolveAnswerableReplyTarget`,
+        // arms 3 and 4). Measured in production on 2026-08-15 (`docs/glossary.md`). So this read is
+        // LOAD-BEARING, not defensive. `scripts/coalesced-delivery-merge-assumption-test.ts` pins only
+        // the merge road's impossibility.
+        // 🔴 WHAT MOVES IS THE GOVERNANCE KEY ONLY. Anything else this tool derives from `p` — the memory
+        // tier, the card's venue walk, and any surface key frozen into the proposal's own `args` — keeps
+        // reading the TURN's partition, deliberately: those name what the act DOES and where this seat
+        // lives, while the scope key names who may approve it and which halt covers it. Moving the act's
+        // own target is a design choice this task does not hold.
+        const proposeScopeKey = await proposalScopeKey(ctx, p);
+        // Where the card goes: this room when it can host one, otherwise a card-capable channel in the SAME domain. Placed exactly where the old card-path refusal was — the room-shaped question, answered before every requester- and config-shaped one below.
+        // What may move is only WHO READS the spec before the PR opens: the agent still binds to THIS channel, from the verified binding, and the requester's own outcome note still lands back here.
+        const venueResult = await checkApprovalVenue(binding, p, () => getConfig().loadDomains());
+        if ("refusal" in venueResult) {
+            throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "propose that agent"));
+        }
+        const venue = venueResult.venue;
+        // 🔴 THE ACTING principal, never the bound one. `principalIdOf` here would be answered by a routine
+        // fire's ATTESTED creator — a real person's id — so the refusal would be unreachable on a fire, and
+        // a fire could author a standing agent (a domain + silo + bundle bound to a channel) in that
+        // person's name. Creating an agent is standing-behaviour authorship, the same class as create_skill.
+        // principal-gate: presence — a new channel-resident agent is standing trusted behaviour (a domain +
+        // silo + bundle that run with the channel's access on every future turn), so this gate asks whether a
+        // human is here authoring it; the ACTING principal is undefined on a fire, the bound one is not.
+        const requestedBy = actingPrincipalIdOf(ctx);
+        if (!requestedBy) {
+            throw new Error("create_agent needs a verified sender on this turn — a triggered routine fire has no acting sender (only the creator it is attributed to), and a routine fire may not author standing behaviour (a new channel-resident agent) in that person's name. Ask a person in this conversation to propose it.");
+        }
+        // CHANNEL-ONLY / INTERNAL-ONLY (where request_access is): an agent binds to a channel's domain, so
+        // it must be proposed from that channel — never a DM/group — and never from a guest-bearing surface.
+        if (binding.mode !== "channel") {
+            throw new Error("create_agent binds an agent to the channel it's proposed from — ask again from that channel, not a DM or group chat.");
+        }
+        if (binding.trust === "external") {
+            throw new Error("this channel is externally shared — an agent can't be provisioned onto an external surface; an internal admin can add one by hand.");
+        }
+        // FAIL-CLOSED enablement gate: a deployment without an admin channel + config repo has no one to
+        // notify and nowhere to PR (reuse request_access's check).
+        const cfg = getConfig();
+        const ar = cfg.loadAccessRequests?.();
+        if (!ar?.adminChannel || !ar?.configRepo) {
+            throw new Error("creating agents from chat isn't enabled on this deployment (no admin channel / config repo configured — " +
+                "OE_ACCESS_ADMIN_CHANNEL + OE_ACCESS_CONFIG_REPO). An admin can add an agent by hand instead.");
+        }
+        const name = input.name.trim();
+        if (!NAME_RE.test(name)) {
+            throw new Error(`"${input.name}" isn't a valid agent name — use letters, digits, "_" or "-" (1–64 chars, no "/").`);
+        }
+        // The ASKING channel, frozen as the agent's OWN channel binding and as the requester's outcome-note destination.
+        // Independent of the card's venue: a redirect moves only who reads the spec before the PR opens, never which channel the agent binds to.
+        const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+        if (!channelId) {
+            throw new Error("create_agent couldn't resolve this channel's id — try again from a real channel, not a synthetic context.");
+        }
+        // The VERIFIED binding is the ONLY source of the agent's channel (never model input) — the same
+        // fully-qualified surface key the resolver matches bindings with, so the agent's domain roster is
+        // precisely the channel that asked (mirrors request_access's target-scope invariant).
+        const req = buildResolveRequest(ctx);
+        const surfaceKey = surfaceKeyOf(req);
+        // HARD-REFUSE at plan time: a name collision (the agent name is already a domain) and a channel
+        // that already belongs to a domain would both fail assertChannelExclusivity / assertDomainsValid at
+        // merge — refuse early with a clear message rather than let the merged-validation card path fail.
+        if (cfg.loadDomains().some((d) => d.name === name)) {
+            throw new Error(`"${name}" is already a memory domain in this deployment — an agent's name is its domain name, so pick a different name (or an admin renames the existing domain by hand).`);
+        }
+        const existingDomains = req.domains ?? [];
+        if (existingDomains.length > 0) {
+            throw new Error(`this channel already belongs to the "${existingDomains.join(", ")}" domain — a channel can be in at most one domain, so it can't also become agent "${name}". Propose the agent from a channel that isn't in a domain yet, or an admin moves this one by hand.`);
+        }
+        // Connectors are validated against the deployment's DEFINED connector universe and against each connector's own credential catalogue — the same two checks the access planner makes.
+        // A connector this deployment does not define, or a credential it does not configure, would grant nothing and cannot be requested this way.
+        const connectors = [
+            ...new Map((input.connectors ?? [])
+                .map((c) => ({ name: c.name.trim(), credential: c.credential.trim() }))
+                .filter((c) => c.name.length > 0 && c.credential.length > 0)
+                .map((c) => [c.name, c])).values(),
+        ];
+        if (connectors.length > 0) {
+            const defined = definedConnectors(cfg.loadBundles());
+            const unknown = connectors.filter((c) => !defined.includes(c.name));
+            if (unknown.length > 0) {
+                throw new Error(`connector(s) ${unknown.map((c) => `"${c.name}"`).join(", ")} aren't defined in this deployment's config (defined: ${defined.length ? defined.join(", ") : "none"}) — an agent can only be granted connectors this deployment already provides.`);
+            }
+            const catalogues = cfg.loadConnectorCredentials?.() ?? [];
+            for (const c of connectors) {
+                const configured = definedConnectorCredentials(catalogues, c.name);
+                if (!configured.includes(c.credential)) {
+                    throw new Error(`connector "${c.name}" has no credential "${c.credential}" configured (configured: ${configured.length ? configured.join(", ") : "none"}) — an agent names an identity this deployment already configures; it cannot mint one.`);
+                }
+            }
+        }
+        // THE FROZEN SPEC — everything the diff will contain, decided here, rendered on the card here, and
+        // never re-derived at click time.
+        const memory = input.memory.kind === "existing-silo"
+            ? { kind: "existing-silo", silo: input.memory.silo.trim() }
+            : {
+                kind: "new-readonly",
+                provider: input.memory.provider,
+                ...(input.memory.container?.trim() ? { container: input.memory.container.trim() } : {}),
+                ...(input.memory.path?.trim() ? { path: input.memory.path.trim() } : {}),
+                ...(input.memory.select ? { select: input.memory.select } : {}),
+                ...(input.memory.skill?.trim() ? { skill: input.memory.skill.trim() } : {}),
+            };
+        const spec = {
+            name,
+            ...(input.title?.trim() ? { title: input.title.trim() } : {}),
+            channels: [surfaceKey], // the AgentSpec's asking surface — becomes the derived domain's reach
+            memory,
+            ...(connectors.length > 0 ? { connectors } : {}),
+            ...(input.instructions?.trim() ? { instructions: input.instructions.trim() } : {}),
+            ...(input.exposed ? { exposed: true } : {}),
+        };
+        // EXPOSURE INVARIANT — an exposed agent must be curated read-only. Resolve `existing-silo`
+        // references over the MERGED silo set so a writable/unknown target is refused BEFORE the card.
+        const silos = cfg.loadSilos();
+        const resolveSilo = (n) => silos.find((s) => s.name === n);
+        assertExposedAgentSpec(spec, resolveSilo);
+        const args = {
+            org: p.org,
+            scopeKey: proposeScopeKey,
+            requestId: randomUUID(),
+            spec,
+            requestedBy,
+            ...(input.reason?.trim() ? { reason: input.reason.trim() } : {}),
+            channelId,
+            threadTs: binding.threadTs ?? null,
+            configRepo: ar.configRepo,
+            agentsPath: ar.agentsPath ?? "agent/memory/config/agents.generated.ts",
+        };
+        const posted = await requestApproval({
+            org: args.org,
+            kind: "agent.create",
+            args,
+            scopeKey: args.scopeKey,
+            domain: null,
+            requestedBy,
+            channelId: venue.channelId,
+            threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+            // Mint-frozen proposing-surface identity (task #105) — the TTL sweep's feedback target,
+            // and the VENUE's key because that is where the card actually is (OPE-338). `args.channelId`
+            // above stays the ASKING channel — it drives the agent's own binding and the requester's
+            // thread note, never the card.
+            postedTo: venue.surfaceKey,
+            chain: { unattended: unattendedOf(ctx) },
+        }, approvalPostDeps(venue.platform, ctx));
+        const memoryClause = spec.memory.kind === "new-readonly" ? `a new read-only ${spec.memory.provider} silo` : `existing silo "${spec.memory.silo}"`;
+        const subject = `PR against ${ar.configRepo} provisioning agent "${name}" (reading ${memoryClause}) for this channel`;
+        // Chain-lowered (OPE-296) ⇒ no card, and agent.create's execute has ALREADY opened the PR —
+        // its outcome carries the PR number/url plus the merge caveat, so this branch doesn't repeat
+        // it. See revoke_connector.ts for why this note stops being internal-only here.
+        if (posted.autoApproved) {
+            return {
+                requested: false,
+                autoApproved: true,
+                pendingId: posted.id,
+                note: autoApprovedNote(subject, posted.autoApproved),
+            };
+        }
+        return {
+            requested: true,
+            pendingId: posted.id,
+            expiresAt: posted.expiresAt,
+            // Internal-only bookkeeping WHEN THE CARD IS IN THIS ROOM. On a REDIRECT the card is by
+            // construction invisible from here, so this note is the only way the asker learns their
+            // proposal exists at all — cardPostedTail tells the model to relay it.
+            note: `${cardPostedPrefix(venue)} — ${subject} (pending ${posted.id}). Nothing is provisioned until an admin merges the PR.${cardPostedTail(venue, "approve it", posted)}`,
+        };
+    },
+});
+//# sourceMappingURL=create_agent.js.map

package/dist/agent/tools/create_agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create_agent.js","sourceRoot":"","sources":["../../../agent/tools/create_agent.ts"],"names":[],"mappings":"AAAA,0hBAA0hB;AAC1hB,maAAma;AAEna,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAoB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAChH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAEL,sBAAsB,GAGvB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACxH,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE,MAAM,OAAO,GAAG,6BAA6B,CAAC;AAE9C,iGAAiG;AACjG,iCAAiC;AACjC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,qHAAqH,CAAC;IACvK,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8EAA8E,CAAC;QAChH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;KAChD,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,8sCAA8sC;IAChtC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,QAAQ,CAAC,0HAA0H,CAAC;QACvI,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;QACnH,MAAM,EAAE,CAAC;aACN,kBAAkB,CAAC,MAAM,EAAE;YAC1B,CAAC,CAAC,MAAM,CAAC;gBACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;gBAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4EAA4E,CAAC;aAC/G,CAAC;YACF,CAAC,CAAC,MAAM,CAAC;gBACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,mEAAmE,CAAC;gBAChI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6EAA6E,CAAC;gBACxH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;gBACpG,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;gBAC/H,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;aAC9H,CAAC;SACH,CAAC;aACD,QAAQ,CAAC,wKAAwK,CAAC;QACrL,UAAU,EAAE,CAAC;aACV,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC3E,QAAQ,EAAE;aACV,QAAQ,CACP,uOAAuO,CACxO;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;QAC5J,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,iJAAiJ,CAAC;QAC1M,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;KACtG,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;QACjI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;KAClI,CAAC;IACF,oGAAoG;IACpG,gGAAgG;IAChG,QAAQ,EAAE,KAAK,EAAE;IACjB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,iGAAiG;QACjG,8DAA8D;QAC9D,MAAM,0BAA0B,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChC,6FAA6F;QAC7F,8FAA8F;QAC9F,0FAA0F;QAC1F,6FAA6F;QAC7F,qDAAqD;QACrD,kGAAkG;QAClG,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,yFAAyF;QACzF,mGAAmG;QACnG,4FAA4F;QAC5F,+FAA+F;QAC/F,kCAAkC;QAClC,kGAAkG;QAClG,iGAAiG;QACjG,+FAA+F;QAC/F,iGAAiG;QACjG,yDAAyD;QACzD,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvD,yPAAyP;QACzP,8LAA8L;QAC9L,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAChC,oGAAoG;QACpG,oGAAoG;QACpG,6FAA6F;QAC7F,qGAAqG;QACrG,oGAAoG;QACpG,sGAAsG;QACtG,iGAAiG;QACjG,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,uSAAuS,CACxS,CAAC;QACJ,CAAC;QACD,mGAAmG;QACnG,qGAAqG;QACrG,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,sHAAsH,CAAC,CAAC;QAC1I,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,oIAAoI,CAAC,CAAC;QACxJ,CAAC;QAED,iGAAiG;QACjG,2DAA2D;QAC3D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,EAAE,EAAE,YAAY,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,0GAA0G;gBACxG,8FAA8F,CACjG,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,oFAAoF,CAAC,CAAC;QACtH,CAAC;QAED,iHAAiH;QACjH,yIAAyI;QACzI,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;QAC/H,CAAC;QAED,gGAAgG;QAChG,kGAAkG;QAClG,sFAAsF;QACtF,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAErC,gGAAgG;QAChG,oGAAoG;QACpG,kGAAkG;QAClG,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,mKAAmK,CAAC,CAAC;QAC/L,CAAC;QACD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAC1C,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,wCAAwC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,qFAAqF,IAAI,qGAAqG,CACjQ,CAAC;QACJ,CAAC;QAED,qLAAqL;QACrL,4IAA4I;QAC5I,MAAM,UAAU,GAAG;YACjB,GAAG,IAAI,GAAG,CACR,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;iBACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;iBACtE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;iBAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAU,CAAC,CACpC,CAAC,MAAM,EAAE;SACX,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,gBAAgB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,+EAA+E,CACjP,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAG,2BAA2B,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC,UAAU,6BAA6B,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,wFAAwF,CAChO,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mGAAmG;QACnG,kCAAkC;QAClC,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe;YACnC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE;YAC3D,CAAC,CAAC;gBACE,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;gBAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC;QAER,MAAM,IAAI,GAAc;YACtB,IAAI;YACJ,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,sEAAsE;YAC9F,MAAM;YACN,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;QAEF,2FAA2F;QAC3F,+FAA+F;QAC/F,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,CAAC,CAAS,EAA0B,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;QAC3F,sBAAsB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAE1C,MAAM,IAAI,GAAoB;YAC5B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,eAAe;YACzB,SAAS,EAAE,UAAU,EAAE;YACvB,IAAI;YACJ,WAAW;YACX,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YAClC,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,UAAU,EAAE,EAAE,CAAC,UAAU,IAAI,yCAAyC;SACvE,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,cAAc;YACpB,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI;YACZ,WAAW;YACX,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YAC1D,wFAAwF;YACxF,6FAA6F;YAC7F,yFAAyF;YACzF,+BAA+B;YAC/B,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;SACzC,EACD,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CACtC,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,QAAQ,OAAO,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;QAClJ,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC,UAAU,wBAAwB,IAAI,cAAc,YAAY,oBAAoB,CAAC;QACtH,4FAA4F;QAC5F,6FAA6F;QAC7F,gFAAgF;QAChF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,wFAAwF;YACxF,wFAAwF;YACxF,uEAAuE;YACvE,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,OAAO,aAAa,MAAM,CAAC,EAAE,0DAA0D,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE;SAC3K,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}