@opensesame-labs/web-pwa 0.0.0-alpha.0

package/dist/assets/session-connections-WQ2L1zGG.js

@@ -0,0 +1,2 @@
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/main-BKK5N8Uh.css"])))=>i.map(i=>d[i]);
+import{s as e,g as t,l as n,v as r,d as i,e as a,c as o,f as s,i as c,o as l,a as d,b as u,j as p,k as h,m as f,n as m,p as g,r as w,G as v,q as y,t as b,w as k,x,y as I,C as j,z as _,A as S,B as A,h as C,D as E,E as T}from"./connections-CNmhCNAV.js";import{cN as N,bc as z,bb as $,c8 as P,X as O,a2 as R,a1 as L,S as U,be as D,K as q,ai as M,cz as K,z as F,Y as G,e as B,m as V,o as H,b9 as J,bd as W,v as Z,_ as X,bW as Y,d as Q,b3 as ee,b8 as te,y as ne,bo as re,e4 as ie,ej as ae,eM as oe,au as se,l as ce,bu as le,n as de,f as ue,b$ as pe,dX as he,dV as fe,dW as me,V as ge,M as we,O as ve,Q as ye,R as be,aF as ke,aX as xe,g as Ie,aE as je,a5 as _e,aA as Se,a as Ae}from"./main-BrkS-iow.js";import{r as Ce,j as Ee}from"./react-dom-BwC4eQlG.js";import{u as Te,c as Ne,L as ze,a as $e}from"./react-router-XsJY84ug.js";import{n as Pe,S as Oe,s as Re,C as Le}from"./InvokeScreen-C-kFFYVF.js";import{P as Ue,a as De}from"./PageTreeBranch-OgsaK684.js";import{L as qe,n as Me,T as Ke,a as Fe,u as Ge}from"./listing-page-B-c8QQVp.js";import{K as Be,a as Ve,c as He,h as Je,R as We,U as Ze,V as Xe,G as Ye,W as Qe,X as et,Y as tt,q as nt,J as rt,S as it,l as at,o as ot,Z as st,v as ct,s as lt,I as dt,g as ut,T as pt,t as ht,D as ft,_ as mt,$ as gt,n as wt,d as vt}from"./certs-CDCfMuEi.js";import{p as yt,b as bt,w as kt,d as xt,n as It,H as jt,S as _t,e as St,r as At,f as Ct}from"./connector-directory-gjDOqgWh.js";import{d as Et,b as Tt,F as Nt,C as zt,R as $t,c as Pt,u as Ot,a as Rt,G as Lt}from"./wake-lock-C_y0fQco.js";import{G as Ut,u as Dt,F as qt}from"./idp-presets-B1M-P0Ek.js";import{g as Mt}from"./local-vault-sessions-CGv9AsFj.js";import{s as Kt,d as Ft,u as Gt,cI as Bt,q as Vt,v as Ht,k as Jt,cH as Wt,j as Zt,cJ as Xt,x as Yt,f as Qt}from"./drop-open-BjgdLxWM.js";import{q as en,u as tn,t as nn,v as rn,l as an,r as on,w as sn,x as cn,y as ln,z as dn,g as un,A as pn,C as hn,D as fn,E as mn,F as gn,M as wn,G as vn,H as yn,I as bn,J as kn,K as xn,L as In,O as jn,P as _n,U as Sn,Q as An,R as Cn,S as En,T as Tn,V as Nn,W as zn,X as $n,Y as Pn,Z as On,f as Rn,k as Ln,_ as Un,s as Dn,$ as qn,c as Mn,a0 as Kn,a1 as Fn,a2 as Gn,a3 as Bn,a4 as Vn,a5 as Hn,a6 as Jn,p as Wn,a7 as Zn,a8 as Xn,a9 as Yn,aa as Qn,ab as er,ac as tr,ad as nr,ae as rr,af as ir}from"./binary-encoding-D9rJ9tvs.js";import{r as ar,n as or,e as sr,a as cr,b as lr}from"./native-google-capability-BVj1mBPb.js";import{ad as dr,d as ur,J as pr,x as hr,s as fr}from"./signals-DdOHdr--.js";import{j as mr,h as gr,s as wr,i as vr,o as yr,k as br,g as kr,n as xr,b as Ir,p as jr,N as _r,l as Sr,q as Ar,t as Cr,u as Er,a as Tr,w as Nr,r as zr,x as $r,c as Pr,y as Or,G as Rr,z as Lr}from"./native-oauth-http-BDqv664F.js";import{o as Ur,l as Dr,s as qr,_ as Mr,t as Kr,e as Fr,a as Gr,r as Br,n as Vr,q as Hr,u as Jr,ae as Wr,j as Zr,ab as Xr,d as Yr,b as Qr,x as ei,f as ti}from"./native-worker-zod-5c0ed887-B342B6ko.js";import{i as ni,a as ri,o as ii,c as ai,q as oi,b as si,B as ci,h as li,E as di,g as ui,at as pi,au as hi,av as fi,x as mi,U as gi,I as wi,l as vi,A as yi,v as bi,aw as ki,H as xi,R as Ii,y as ji,F as _i}from"./vault-ui-seam-BQGS7RR6.js";import{r as Si,u as Ai,d as Ci,s as Ei,a as Ti,D as Ni}from"./bucket-saved-vQCiVvN_.js";import{z as zi,$ as $i}from"./identity-BVf8yWa4.js";import{I as Pi,p as Oi,C as Ri,a as Li,g as Ui,o as Di,l as qi,i as Mi,d as Ki,B as Fi,P as Gi}from"./BackupEnableSwitch-DwKTWzBG.js";import{S as Bi,q as Vi,t as Hi,a4 as Ji}from"./identity-view-paths-Bi1yigZk.js";import{f as Wi,i as Zi,e as Xi,t as Yi,a as Qi,c as ea,w as ta,A as na,b as ra,d as ia,g as aa,h as oa,j as sa,G as ca,k as la,s as da,l as ua,m as pa,n as ha,o as fa,p as ma,I as ga}from"./IdentityConnectionSignIn-Bg53RjtJ.js";import{b as wa,i as va,C as ya,a as ba,c as ka,d as xa,e as Ia,u as ja,S as _a,s as Sa,f as Aa,V as Ca,g as Ea,h as Ta,p as Na,j as za,k as $a,l as Pa}from"./shared-Ck7e2FJN.js";import{c as Oa,i as Ra,h as La,d as Ua,f as Da,e as qa,p as Ma}from"./connect-plan-ClXbb_FT.js";import{E as Ka}from"./EmptyTip-DnxQjLsP.js";import{o as Fa}from"./vault-menu-CqO_AStq.js";import{o as Ga,l as Ba,m as Va,n as Ha,p as Ja,P as Wa,s as Za,r as Xa,q as Ya,t as Qa,u as eo,v as to,w as no,x as ro,y as io}from"./secret-backends-_-CBukTJ.js";import{z as ao}from"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import{G as oo,p as so,h as co,r as lo,o as uo,q as po,t as ho,u as fo,v as mo,w as go,x as wo,y as vo,z as yo,s as bo,A as ko,B as xo,d as Io,f as jo,b as _o,e as So,g as Ao,C as Co,D as Eo,n as To}from"./github-app-local-B-4pPsY4.js";import{b as No,g as zo,f as $o}from"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";import{s as Po,M as Oo,m as Ro,a as Lo,E as Uo,k as Do}from"./s3-CXe7JlAr.js";import{m as qo,_ as Mo}from"./hosted-model-authority-CcNPE44H.js";import{argon2id as Ko}from"./native-worker-hash-wasm-9cbb16de-Bp4uJJy_.js";import{k as Fo,K as Go,w as Bo,L as Vo,x as Ho,S as Jo,v as Wo,D as Zo,M as Xo,N as Yo,E as Qo}from"./entra-instances-NyEKYI5c.js";import{y as es,t as ts}from"./local-applications-rigvedS6.js";import{s as ns,n as rs}from"./native-oauth-resource-runtime-D9u6_l-d.js";import{I as is,m as as}from"./files-Bc2ZE3YH.js";import{g as os,k as ss}from"./native-catalog-status-INsDvLpU.js";import{r as cs,V as ls,w as ds,d as us,R as ps,j as hs,m as fs}from"./model-provider-B6oAnQX9.js";import{s as ms,o as gs}from"./runtime-2tzejM54.js";import{e as ws}from"./local-share-grants-approvals-C89RIn08.js";import{s as vs}from"./connector-marks-BsMcGRbV.js";import{A as ys,i as bs,b as ks,t as xs,c as Is}from"./types-Ctz6L20B.js";import{h as js,a as _s}from"./hosted-model-protocol-B8j_voAG.js";import{r as Ss,s as As,d as Cs,a as Es,i as Ts}from"./vault-credential-custody-DpnBb4qo.js";import{n as Ns,a as zs,s as $s,m as Ps}from"./model-key-state-NiiWojtT.js";import{x as Os,i as Rs,N as Ls,c as Us,y as Ds,r as qs,z as Ms}from"./federation-configured-restoration-DWAXgzcz.js";import{C as Ks}from"./MethodPicker-CqQTyAaT.js";import{y as Fs,h as Gs,s as Bs,z as Vs}from"./tailscale-artifacts-FyY85j_Y.js";const Hs=[/^pan$/,/^(?:card|credit ?card|debit ?card)(?:number|no|num)?$/,/^(?:primary)?accountnumber$/,/^cvv2?$/,/^cvc2?$/,/^cid$/,/^csc$/,/^cav2?$/,/^(?:card)?(?:security|verification)(?:code|value)$/,/^(?:card)?expiry(?:date|month|year)?$/,/^(?:card)?exp(?:date|month|year|iration)?$/,/^track[12]?data$/,/^magstripe$/,/^dpan$/,/^networktoken$/,/^cryptogram$/,/^emvdata$/],Js=/^(?:4|5[1-5]|2(?:2[2-9]|[3-6]\d|7[01]|720)|3[47]|3(?:0[0-5]|[689])|6(?:011|5|4[4-9]|22)|35(?:2[89]|[3-8])|62)/;function Ws(e){const t=e.replace(/[ -]/g,"");if(!/^\d{13,19}$/.test(t))return!1;if(!Js.test(t))return!1;let n=0,r=!1;for(let i=t.length-1;i>=0;i-=1){let e=t.charCodeAt(i)-48;r&&(e*=2,e>9&&(e-=9)),n+=e,r=!r}return n%10==0}function Zs(e){return e.toLowerCase().replace(/[_\-\s]/g,"")}class Xs extends N{constructor(e){super("INVARIANT_VIOLATION",`payment credential refused: ${e}`,{}),this.name="PaymentCredentialRefused"}}function Ys(e,t){if(e.length>=256)return e;const n=`${e}${t}`;return n.length<=256?n:`${n.slice(0,256)}…`}class Qs extends N{constructor(e,t){super("INVARIANT_VIOLATION",`${e}: ${t}`,{what:e,why:t}),this.name="PermissionRefused"}}function ec(e,t){throw new Qs(e,t)}const tc=[".*",".+","**","?","[^"];function nc(e){const t=`resource selector ${JSON.stringify(e)}`;0===e.length&&ec(t,"is empty"),e.length>512&&ec(t,"is longer than 512 characters"),e.trim()!==e&&ec(t,"has leading or trailing whitespace"),function(e){for(let t=0;t<e.length;t+=1){const n=e.charCodeAt(t);if(n<32||127===n)return!0}return!1}(e)&&ec(t,"contains a control character");const n=tc.find(t=>e.includes(t));if(void 0!==n&&ec(t,`contains ${JSON.stringify(n)}; a selector is an exact id or a \`prefix<sep>*\` subtree, never a pattern`),"*"===e)return{kind:"everything"};for(const r of["/",":"]){const n=`${r}*`;if(e.endsWith(n)){const i=e.slice(0,-n.length);return 0===i.length&&ec(t,"is a subtree with no prefix"),i.includes("*")&&ec(t,"carries more than one `*`"),{kind:"subtree",prefix:i,separator:r}}}return e.includes("*")&&ec(t,"is a bare prefix; write `prefix/*` or `prefix:*`"),{kind:"exact",id:e}}function rc(e,t){switch(e.kind){case"everything":return!0;case"exact":return e.id===t;case"subtree":{const n=`${e.prefix}${e.separator}`;return t.startsWith(n)&&t.length>n.length}}}function ic(e,t){return e.every(e=>t.some(t=>t===e))}function ac(e,t){return e.every(e=>{try{const n=nc(e);return t.some(e=>{try{return function(e,t){return"everything"===e.kind||"everything"!==t.kind&&("exact"===t.kind?rc(e,t.id):"exact"!==e.kind&&(e.prefix===t.prefix&&e.separator===t.separator||rc(e,t.prefix)))}(nc(e),n)}catch{return!1}})}catch{return!1}})}function oc(e,t={}){throw new N("INVARIANT_VIOLATION",`Grant attenuation: ${e}`,{invariant:"INV-GA-01",why:e,...t})}function sc(e){switch(e){case"phishing-resistant":return 3;case"mfa":return 2;case"pwd":case"password":return 1;default:return null}}function cc(e){switch(e){case"forbidden":return 0;case"read_only":return 1;case"pre_authorized":return 2}}async function lc(e,t){const n={...e,...t?.header};if(!Fo(n.jwk))throw new Go('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let r;try{r=Bo(n.jwk)}catch(o){throw new Go("Invalid Embedded JWK",{cause:o})}const i=Vo(n.alg);if(void 0!==r.use&&"sig"!==r.use)throw new Go('Invalid Embedded JWK, its "use" must be "sig" when present');if(void 0!==r.alg&&r.alg!==i.alg)throw new Go(`Invalid Embedded JWK, its "alg" must be "${i.alg}" when present`);const a=await Ho(i,r,!0);if("public"!==a.type)throw new Go('"jwk" (JSON Web Key) Header Parameter must be a public key');return a}async function dc(e=lo()){if(!e)throw new oo("configuration","Register a GitHub App on this device first.");const t=so(e);if(!t)throw new oo("configuration","Unlock the vault that holds this GitHub App key.");let n=null;try{n=co({binding:()=>lo()===e&&so(e)===t});const r={appId:e.id,privateKey:t},i=await uo(n.transport,r);if(n.transport.assertCurrent(),String(i.id)!==e.id)throw new oo("authorization","GitHub returned a different App.");const a=await po(n.transport,r);n.transport.assertCurrent();const o={...e,ownerLogin:i.owner?.login??e.ownerLogin,ownerType:i.owner?.type??e.ownerType,installations:a.map(e=>({id:String(e.id),accountLogin:e.account.login,accountType:e.account.type??""}))};return ho(o),o}finally{n?.close()}}async function uc(e=lo()){try{return await dc(e)}catch{return lo()}}const pc="config/vercel-connect-auth";let hc=null;function fc(e,t=512){return ni(e)?e.trim().slice(0,t):""}function mc(e){const t=e.token.trim(),n=e.manageKey?.trim()??"";if(!t&&!n)return null;const r={version:1,token:t};return e.teamId?.trim()&&(r.teamId=e.teamId.trim()),e.projectId?.trim()&&(r.projectId=e.projectId.trim()),n&&(r.manageKey=n),r}function gc(e){const t={token:e.token};return e.teamId&&(t.teamId=e.teamId),e.projectId&&(t.projectId=e.projectId),e.manageKey&&(t.manageKey=e.manageKey),t}function wc(){e(null)}async function vc(e,t){const n=mc(t);if(!n)throw new Error("A Vercel token or management key is required.");const r=(new TextEncoder).encode(JSON.stringify(n));if(r.length>4096)throw new Error("That Connect session is too large to keep here.");await ds(e,pc,r)}async function yc(t,n={}){if(n.signal?.aborted)return!1;if(hc&&!n.ephemeral)await vc(t,hc),hc=null;else if(hc&&n.ephemeral)return e(hc),!0;const r=await async function(e){try{const n=await cs(e,pc);if(n.length>4096)return null;const r=JSON.parse((new TextDecoder).decode(n)),i=ai(t=r)&&1===t.version?mc({token:fc(t.token,512),teamId:fc(t.teamId,128),projectId:fc(t.projectId,128),manageKey:fc(t.manageKey,512)}):null;return i?gc(i):null}catch(n){if(n instanceof ls&&"not-found"===n.code)return null;throw n}var t}(t);return!n.signal?.aborted&&(r?(e(r),!0):(hc||e(null),!1))}const bc=[{id:"connections.reload",description:"Re-reads the connection list. Use it after finishing an authorization somewhere else.",role:"action",routes:["/connections"],capabilityId:"connections.list"},{id:"connections.connected",description:"The Connected panel: every provider connection this device currently holds, with its state and a way into its settings.",role:"surface",routes:["/connections"],capabilityId:"connections.list"},{id:"connections.attention",description:"Panel listing connections that exist but cannot be used until a person finishes their authorization. Present only while at least one is unfinished.",role:"status",routes:["/connections"],capabilityId:"connections.list"},{id:"connections.catalog",description:"The Add a connection panel: the provider catalog, grouped by category. Choosing a provider opens its own page.",role:"surface",routes:["/connections"],capabilityId:"providers.list"},{id:"connections.provider-picker",description:"The / search command over the provider catalog. Matches a provider name, a category or a connector identifier.",role:"filter",routes:["/connections"],capabilityId:"providers.list"},{id:"connections.back",description:"Returns from one connector's page to the full Connections list.",role:"navigation",routes:["/connections"],capabilityId:null},{id:"connections.authorize",description:"The Authorization panel on a connector's page. This is where a connection is approved, or where an existing one reports what it is.",role:"ceremony",routes:["/connections"],capabilityId:"connections.create"},{id:"connections.revoke",description:"Revokes a connection, cutting off every project and agent bound to it and asking the provider to invalidate the credential.",role:"action",routes:["/connections"],capabilityId:"connections.remove"},{id:"nav.connections",description:"Rail entry that opens Connections, where provider connections are added, tested and revoked.",role:"navigation",routes:[],capabilityId:"app.navigate"}],kc=[{id:"/connections",title:"Connections — provider connections and their state"},{id:"/connections/git",title:"Connections — the generic git remote's own page"}],xc={name:"opensesame_connections_read",capabilityIds:["connections.list","connections.inspect"],scope:"session",readOnly:!0,description:"Read Vercel Connect connections: the list, or one connection. Read-only; never returns credentials.",inputSchema:{type:"object",properties:{view:{type:"string",enum:["connections","connection"]},connectionId:{type:"string",description:"Required for the connection view."}},required:["view"],additionalProperties:!1},execute:async e=>{const r=z(e,"view");switch(r){case"connections":return{connections:await n()};case"connection":{const n=z(e,"connectionId");return{connection:await t(n)}}default:throw new Error(`unknown_view:${r}`)}}},Ic={name:"opensesame_open_connect_ceremony",capabilityIds:["connections.create"],scope:"session",description:"Open the connect ceremony for a provider (and optionally an existing connection) so the human can grant consent. Never completes the ceremony.",inputSchema:{type:"object",properties:{providerId:{type:"string"},connectionId:{type:"string"}},additionalProperties:!1},execute:e=>{const t=$(e,"providerId"),n=$(e,"connectionId");let r="/connections";return t&&(r+=`/${encodeURIComponent(t)}`,n&&(r+=`/${encodeURIComponent(n)}`)),P(r)}},jc={providers:null,connections:null};let _c=jc;const Sc=new Set;function Ac(e){if(e.providers!==_c.providers||e.connections!==_c.connections){_c=e;for(const e of Sc)e()}}function Cc(e){return Sc.add(e),()=>{Sc.delete(e)}}function Ec(){return _c}function Tc(){Ac(jc)}const Nc=qe;function zc(e,t){const n=Object.fromEntries(Object.entries(t).map(([e,t])=>[e,t.trim()]).filter(([,e])=>""!==e));if("auth0"!==e.id||!ni(n.domain))return n;const r=n.domain.replace(/^https?:\/\//i,"").replace(/\/+$/,"");return n.domain=r,n.audience||=`https://${r}/api/v2/`,n}const $c=new Set(["linear","linq","microsoft","microsoft-teams","salesforce","slack","snowflake"]);function Pc(e){return $c.has(e)}const Oc=[{id:"microsoft",name:"Microsoft",members:["microsoft","m365","microsoft-teams"]},{id:"vercel",name:"Vercel",members:["vercel","vercel-ai-gateway"]},{id:"cloudflare",name:"Cloudflare",members:["cloudflare","cloudflare-origin-ca","cloudflare-ai-gateway","cloudflare-workers-ai"]},{id:"google",name:"Google",members:["google","google-drive","gemini","google-vertex","google-wallet"]},{id:"azure-sm",name:"Azure",members:["azure-sm","azure-ac","azure-openai"]},{id:"aws",name:"AWS",members:["aws","aws-kms","aws-ps","aws-sts","aws-bedrock","amazon-nova"]},{id:"gcp",name:"GCP",members:["gcp","gcp-kms","gcp-iam"]}],Rc=new Map(Oc.flatMap(e=>e.members.map(t=>[t,e])));function Lc(e){return Rc.get(Ve(e)??e)}function Uc(e){return Oc.some(t=>t.id===e)}const Dc=new Set([...$c].filter(e=>"linq"!==e)),qc=new Set(["assemblyai","cohere","deepgram","minimax","mistral","moonshotai","photon","replicate","stability","together","xiaomi","zai"]),Mc=new Set(["github","gitlab","bitbucket","codeberg","origin"]),Kc=new Set([...Mc,"vercel"]),Fc=new Set(["asana","calendly","canva","clickup","docusign","figma","google","google-drive","m365","obsidian","linear","make","microsoft-teams","monday","n8n","miro","notion","spotify","zapier"]),Gc=new Set(["discord","granola","intuit-mailchimp","linkedin","photon","reddit","resend","sendgrid","slack","twilio","x","zoom"]),Bc=new Set(["box","clickhouse","convex","dropbox","neon","pinecone","planetscale","snowflake"]),Vc=new Set(["attio","clay","hubspot","lemma","paypal","polar","salesforce","shopify","stripe","zomato"]),Hc=new Set([...Pi.map(e=>e.id),"fal-ai","higgsfield"]),Jc=new Set(Oc.map(e=>e.id)),Wc=new Set([...Jc,...Dc,...Kc,...Fc,...Gc,...Bc,...Vc,...Hc]);function Zc(e){const t=function(e){return new Set(e.flatMap(e=>[e.id,Ve(e.id)??e.id]))}(e),n=e[0];if(!n)return[];const r=(e,t,r,i)=>({...e??n,id:t,displayName:r,category:i,configured:!1,autoConfigurable:!1,missingConfig:[],callbackUrl:null}),i=e.find(e=>"google"===e.id),a=e.find(e=>"microsoft"===e.id),o=[r(i,"google-drive","Google Drive","storage"),r(a,"m365","M365","productivity")],s={microsoft:"productivity",vercel:"developer",cloudflare:"developer",google:"productivity","azure-sm":"encryption",aws:"cloud_secret_storage",gcp:"cloud_secret_storage"};for(const c of Oc)t.has(c.id)||o.push(r(n,c.id,c.name,Object.entries(s).find(([e])=>e===c.id)?.[1]??"custom"));return o.filter(e=>!t.has(e.id))}function Xc(e,t={}){const n=t.includeFeatured?[...e,...Zc(e)]:e;return wa(n.map(e=>function(e,t=!1){const n=Ve(e.id);return t&&n&&Uc(n)?{...e,id:n}:e}(e,t.includeFamilies)).filter(e=>va(e)||!0===t.includeFamilies&&Uc(e.id)).filter(e=>"ai_model_provider"!==e.category||Hc.has(e.id)).filter(e=>Wc.has(e.id)&&!qc.has(e.id)&&(!t.includeFamilies||Uc(e.id)||void 0===Lc(e.id))).map(e=>{const n=t.includeFamilies?Lc(e.id):void 0;return n&&n.id===e.id?{...e,displayName:n.name}:e}).sort((e,t)=>e.displayName.localeCompare(t.displayName,"en",{sensitivity:"base"})))}function Yc(e){const t=new Set;for(const n of Oa(e.id)?.methods??[])"oauth"===n.kind?t.add("OAuth"):"api-key"===n.kind?t.add("API key"):"mcp"===n.kind&&t.add("MCP");return"oauth2_authorization_code"===e.authKind&&t.add("OAuth"),"api_key"===e.authKind&&t.add("API key"),"configuration"===e.authKind&&t.add("Configuration"),Pc(e.id)&&t.add("Managed"),["OAuth","API key","MCP","OIDC","Local","Configuration","Managed"].filter(e=>t.has(e))}function Qc(e){const t=new Set;return Pc(e.id)&&t.add("Managed"),"ai_model_provider"===e.category?t.add("AI"):Kc.has(e.id)?(t.add("Developer tools"),Mc.has(e.id)&&t.add("Backup/recovery")):t.add(ya[e.category]),Dc.has(e.id)&&t.add(ya[e.category]),[...t]}function el(e,t){return!t||function(e){return[e.displayName,e.id,ya[e.category],...Qc(e),"ai_model_provider"===e.category?"model provider":""].join(" ").toLocaleLowerCase()}(e).includes(t)}function tl(e,t,n,r){const i={id:e,label:t,href:n};return r&&(i.selectTo=`/connections#${r}-${encodeURIComponent(e)}`),i}function nl(e,t=""){const n=t.trim().toLocaleLowerCase();return Xc(e,{includeFamilies:!0}).filter(e=>el(e,n)).map(e=>tl(e.id,e.displayName,ka(e.id),"catalog"))}function rl(e,t){return t.filter(xa).map(e=>tl(e.connectionId,e.displayName,ka(e.providerId,e.connectionId),"connected"))}function il(e,t,n=""){const r=e??[],i=t??[],a=ba(i);return[...a.length?[{id:"attention",label:"Needs attention",href:"/connections#attention",items:a.map(e=>tl(e.connectionId,e.displayName,ka(e.providerId,e.connectionId),"attention"))}]:[],{id:"connected",label:"Connected",href:"/connections#connected",keepEmpty:!0,items:rl(0,i)},{id:"catalog",label:"Add a connection",href:"/connections#catalog",keepEmpty:!0,items:nl(r,n)}]}function al({pathname:e}){const{hash:t}=Te(),i=e+(t||("/connections"===e?"#connected":"")),{providers:a,connections:o}=function(){const e=Ce.useSyncExternalStore(Cc,Ec,Ec),[t,i]=Ce.useState(jc);return Ce.useEffect(()=>{if(null!==e.providers)return;let t=!0;const a=r.providers(Mt());return i({providers:a,connections:null}),n().catch(()=>Be([])).then(e=>{t&&i({providers:a,connections:e})}),()=>{t=!1}},[e.providers]),null!==e.providers?e:t}(),s=il(a,o),c=s.find(e=>"catalog"===e.id),l=Pe(s.filter(e=>"catalog"!==e.id));return Ee.jsxs("div",{className:"railtree__kids",id:"connections-tree",children:[l.map(e=>Ee.jsx(Ue,{node:e,level:2,current:i,empty:"connected"===e.id?Ee.jsx("span",{className:"connections-tree__note",children:"No connected services"}):null},e.id)),c?Ee.jsx(Ue,{node:{id:c.id,label:c.label,href:c.href,children:[],branch:!0,count:c.items?.length??0},level:2,current:i,children:Ee.jsx(sl,{providers:a,current:i})}):null]})}let ol=Nc;function sl({providers:e,current:t}){const[n,r]=Ce.useState(ol),i=Ne(),a=nl(e??[]),o=a.slice(0,n),s=Me(a.length,n);return Ee.jsxs(Ee.Fragment,{children:[o.map(e=>Ee.jsx(De,{node:{...e,children:[],branch:!1},level:3,current:t},e.id)),s>0?Ee.jsx(Ke,{to:"/connections#catalog-more",child:!0,level:3,onToggle:()=>{const e=n+Nc;ol=e,r(e);const t=a[n];t&&i(`/connections#catalog-${encodeURIComponent(t.id)}`)},children:`Load ${s} more`}):null,0===a.length?Ee.jsx("output",{className:"connections-tree__note",children:null===e?"Loading connectors…":"No matching connectors"}):null]})}function cl(e){return Je(e)}function ll(e){return Je(e)}const dl={readDirectoryEndpoint:xt,writeDirectoryEndpoint:kt,syncConnectorDirectory:bt,pendingConnectorDirectory:yt,pageIsLoopback:zi};function ul(e,t){const n=e.connections.length,r=St(e.endpoint);return 0===n?`Nothing is authorized at ${r} yet. Authorize a connection there and sync again.`:`${n} ${1===n?"connector":"connectors"} found at ${r}.${t?"":" They are sealed into the vault the moment you sign in or continue as a guest."}`}function pl(e,t){const n=[];return e!==jt&&n.push({label:jt,onPick:()=>t(jt)}),dl.pageIsLoopback()&&e!==_t&&n.push({label:_t,onPick:()=>t(_t)}),n}function hl({tomb:e,initialKey:t="",onSynced:n}){const r=dl,[i,a]=Ce.useState(()=>r.pendingConnectorDirectory()?.endpoint||r.readDirectoryEndpoint()),[o,s]=Ce.useState(t),{busy:c,flash:l,clear:d,sync:u}=function(e,t){const[n,r]=Ce.useState(!1),[i,a]=Ce.useState(null);return{busy:n,flash:i,clear:()=>a(null),sync:function(n,i){r(!0),a(null),dl.syncConnectorDirectory({endpoint:n,key:i,tomb:e}).then(n=>{a({tone:"ok",text:ul(n,null!==e)}),t?.(n)}).catch(e=>{a({tone:"err",text:e instanceof Error?e.message:"The directory did not answer."})}).finally(()=>r(!1))}}}(e,n);function p(e){const t=e.trim(),n=It(t);if(a(n??t),null===n&&""!==t)return;const i=n??"";i!==r.readDirectoryEndpoint()&&r.writeDirectoryEndpoint(i).catch(()=>{})}return Ee.jsxs("div",{className:"setup__stack",children:[Ee.jsx(O,{id:"directory-endpoint",label:"Directory endpoint",type:"url",mono:!0,lead:Ee.jsx(R,{size:17}),placeholder:"https://…",value:i,disabled:c,onValueChange:e=>{a(e),d()},onCommit:p,fills:pl(i,p)}),Ee.jsx(O,{id:"directory-key",label:"Environment key",type:"password",mono:!0,autoComplete:"off",lead:Ee.jsx(L,{size:17}),placeholder:"Optional",value:o,disabled:c,onValueChange:e=>{s(e),d()}}),Ee.jsx("div",{className:"actions",children:Ee.jsx(U,{label:c?"Syncing…":"Sync connectors",disabled:c||!It(i),busy:c,onClick:()=>u(i,o),icon:Ee.jsx(D,{size:18})})}),Ee.jsx(Bi,{message:l})]})}function fl({connections:e}){return Ee.jsx("ul",{className:"xcards","aria-label":"Authorized connectors",children:e.map(e=>Ee.jsxs("li",{className:"xcard",children:[Ee.jsxs("span",{className:"xcard__pick",children:[Ee.jsxs("span",{className:"xcard__name",children:[e.displayName,e.endUser?` · ${e.endUser}`:""]}),Ee.jsxs("span",{className:"xcard__kind",children:[e.integrationId," · ",e.connectionId]})]}),Ee.jsx("span",{className:"xcard__side",children:Ee.jsx(Oe,e.errors>0?{tone:"warn",label:`${e.errors} ${1===e.errors?"error":"errors"}`}:{tone:"ok",label:"Authorized"})})]},`${e.integrationId}/${e.connectionId}`))})}function ml(){const e=Et(),t=e.isUnlocked()?e.activeTomb?.()??null:null,[n,r]=Ce.useState(yt);return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(Ut,{id:"setup.connectors",children:Ee.jsx(hl,{tomb:t,onSynced:r})}),n&&n.connections.length>0?Ee.jsx("section",{className:"setup__stack","aria-label":"Synced connectors",children:Ee.jsx(fl,{connections:n.connections})}):null]})}function gl({provider:e,name:t,apiKey:n,values:r,busy:i,online:a,failure:o,onName:s,onApiKey:c,onValue:l,onSubmit:d}){const u=Ce.useId(),p=Ce.useId();return Ee.jsxs("form",{className:"conn-tile__body",onSubmit:d,children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:p,children:"API key"}),Ee.jsx("input",{id:p,type:"password",autoComplete:"off",placeholder:"Paste API key once",title:"Paste once. It is not shown again.",value:n,onChange:e=>c(e.target.value)})]}),(e.configurationFields??[]).filter(e=>"api_key"!==e.name).map(e=>Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:`${p}-${e.name}`,children:e.label}),Ee.jsx("input",{id:`${p}-${e.name}`,name:e.name,type:e.secret?"password":"text",autoComplete:"off",required:e.required,value:r[e.name]??"",onChange:t=>l(e.name,t.target.value)})]},e.name)),Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Optional settings"}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:u,children:"Name it (optional)"}),Ee.jsx("input",{id:u,title:"Only changes the label in OpenSesame; the provider never sees it.",value:t,onChange:e=>s(e.target.value)})]})]}),Ee.jsx(U,{label:i?"Saving":`Connect ${e.displayName}`,busy:i,disabled:i||!a||""===n.trim(),children:o?Ee.jsx(Oe,{tone:"err",label:o}):null})]})}function wl(e){const t=new Map;for(const[n,r]of Object.entries(function(e){return"keychain"===e.id?{service:"opensesame"}:"plain"===e.id?{namespace:"opensesame"}:"better-auth"===e.id?{api_key_header:"x-api-key",config_id:"default"}:{}}(e)))void 0!==r&&t.set(n,r);return Object.fromEntries(t)}function vl({fields:e,idPrefix:t,defaults:n,values:r,onChange:i}){return e.map(e=>{const a=`${t}-${e.name}`,o=Wi(e);return Ee.jsxs("div",{className:"field",children:[Ee.jsxs("label",{className:"label conn-field-label",htmlFor:a,children:[e.label,n[e.name]?" (automatic)":e.required?" (required)":" (optional)"]}),Ee.jsx("input",{id:a,name:e.name,type:e.secret?"password":e.name.endsWith("_url")?"url":"text",autoComplete:"off",required:e.required,placeholder:o.placeholder,title:o.help,value:r[e.name]??"",onChange:t=>i(e.name,t.target.value)})]},e.name)})}function yl({provider:e,name:t,values:n,busy:r,online:i,failure:a,onName:o,onValue:s,onSubmit:c}){const l=Ce.useId(),d=wl(e),u=e.configurationFields??[],p=u.filter(e=>e.required&&void 0===d[e.name]),h=u.filter(e=>!p.includes(e)),f=e=>Ee.jsx(vl,{fields:e,idPrefix:l,defaults:d,values:n,onChange:s});return Ee.jsxs("form",{className:"conn-tile__body",onSubmit:c,children:[f(p),Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Optional settings"}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:l,children:"Name it (optional)"}),Ee.jsx("input",{id:l,title:"Only changes the label in OpenSesame; the provider never sees it.",value:t,onChange:e=>o(e.target.value)})]}),f(h)]}),Ee.jsx(U,{label:r?"Saving":"Save configuration",busy:r,disabled:r||!i,children:a?Ee.jsx(Oe,{tone:"err",label:a}):null})]})}function bl({authMode:e,onAuthMode:t}){return Ee.jsxs("fieldset",{className:"conn-git-auth",children:[Ee.jsx("legend",{className:"label",children:"Authentication"}),Ee.jsx("div",{className:"conn-git-auth__modes",role:"radiogroup",children:We.map(n=>Ee.jsxs("label",{className:"conn-git-auth__mode",children:[Ee.jsx("input",{type:"radio",name:"auth_mode",value:n.id,checked:e===n.id,onChange:e=>{Ze(e.target.value)&&t(e.target.value)}}),Ee.jsx("span",{children:n.label})]},n.id))})]})}function kl({nameId:e,authMode:t,username:n,token:r,password:i,onUsername:a,onToken:o,onPassword:s}){return Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"field",children:[Ee.jsxs("label",{className:"label",htmlFor:`${e}-user`,children:["Username","https_token"===t?" (optional)":""]}),Ee.jsx("input",{id:`${e}-user`,name:"username",autoComplete:"off",spellCheck:!1,required:"https_basic"===t,placeholder:"https_token"===t?"git / oauth2 / x-access-token":"",value:n,onChange:e=>a(e.target.value)})]}),Ee.jsxs("div","https_token"===t?{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:`${e}-token`,children:"Token"}),Ee.jsx("input",{id:`${e}-token`,name:"token",type:"password",autoComplete:"off",required:!0,value:r,onChange:e=>o(e.target.value)})]}:{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:`${e}-password`,children:"Password"}),Ee.jsx("input",{id:`${e}-password`,name:"password",type:"password",autoComplete:"off",required:!0,value:i,onChange:e=>s(e.target.value)})]})]})}function xl({nameId:e,sshKey:t,sshPassphrase:n,onSshKey:r,onSshPassphrase:i}){return Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:`${e}-ssh-key`,children:"SSH private key"}),Ee.jsx("textarea",{id:`${e}-ssh-key`,name:"ssh_private_key",required:!0,rows:4,spellCheck:!1,autoComplete:"off",placeholder:"-----BEGIN OPENSSH PRIVATE KEY-----",value:t,onChange:e=>r(e.target.value)})]}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:`${e}-ssh-pass`,children:"Passphrase (optional)"}),Ee.jsx("input",{id:`${e}-ssh-pass`,name:"ssh_passphrase",type:"password",autoComplete:"off",value:n,onChange:e=>i(e.target.value)})]})]})}function Il({model:e}){return Ee.jsxs("form",{className:"conn-tile__body",onSubmit:e.onSubmit,children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:`${e.nameId}-remote`,children:"Remote URL"}),Ee.jsx("input",{id:`${e.nameId}-remote`,name:"remote_url",type:"text",inputMode:"url",autoComplete:"off",spellCheck:!1,required:!0,placeholder:"https://…/repo.git or git@host:org/repo.git",value:e.remoteUrl,onChange:t=>e.onRemoteUrl(t.target.value)})]}),Ee.jsx(bl,{authMode:e.authMode,onAuthMode:e.onAuthMode}),"https_token"===e.authMode||"https_basic"===e.authMode?Ee.jsx(kl,{nameId:e.nameId,authMode:e.authMode,username:e.username,token:e.token,password:e.password,onUsername:e.onUsername,onToken:e.onToken,onPassword:e.onPassword}):null,"ssh_key"===e.authMode?Ee.jsx(xl,{nameId:e.nameId,sshKey:e.sshKey,sshPassphrase:e.sshPassphrase,onSshKey:e.onSshKey,onSshPassphrase:e.onSshPassphrase}):null,Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Optional settings"}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:e.nameId,children:"Name it"}),Ee.jsx("input",{id:e.nameId,value:e.name,onChange:t=>e.onName(t.target.value)})]})]}),Ee.jsx(U,{label:e.busy?"Saving":"Save Git remote",disabled:e.busy||!e.canSave})]})}function jl(e){try{const t=new URL(e);return(t.username||t.password)&&(t.username="",t.password=""),t.href}catch{return e}}function _l({provider:e,online:t,onFlash:n,onConnected:r,onRememberOffer:i}){const a=function({provider:e,onFlash:t,onConnected:n,onRememberOffer:r}){const i=Ce.useId(),[a,o]=Ce.useState(e.displayName),[s,c]=Ce.useState(""),[l,d]=Ce.useState("https_token"),[u,p]=Ce.useState(""),[h,f]=Ce.useState(""),[m,g]=Ce.useState(""),[w,v]=Ce.useState(""),[y,b]=Ce.useState(""),[k,x]=Ce.useState(!1),I=Xe(l,s,u,h,m,w);return{nameId:i,name:a,remoteUrl:s,authMode:l,username:u,token:h,password:m,sshKey:w,sshPassphrase:y,busy:k,canSave:I,onName:o,onRemoteUrl:c,onAuthMode:d,onUsername:p,onToken:f,onPassword:g,onSshKey:v,onSshPassphrase:b,onSubmit:i=>{!async function(i){if(i.preventDefault(),!I)return;x(!0);let o=!1;try{const{connection:i,bindError:c}=await async function(e){const t=Qe(e),n=e.name.trim()||e.provider.displayName,r=await et(e.provider,{displayName:n,configuration:t});try{return await async function(e,t,n){const r=tt(n);r&&await Oi({kind:"git_remote",providerId:e,connectionId:t,owner:r.owner,repo:r.repo,branch:"main",enabled:!0,config:{remoteUrl:jl(n)}})}(e.provider.id,r.connectionId,e.remoteUrl),{connection:r,bindError:null}}catch(c){return{connection:r,bindError:c}}}({provider:e,name:a,remoteUrl:s,authMode:l,username:u,token:h,password:m,sshKey:w,sshPassphrase:y});o=!0,f(""),g(""),v(""),b(""),t(null===c?{tone:"ok",text:"Git remote saved."}:{tone:"warn",text:`Git remote saved, but its backup target could not be bound: ${Ia(c)}`}),Ye(i.connectionId)||r?.(i),n()}catch(c){t({tone:"err",text:Ia(c)}),o&&n()}finally{x(!1)}}(i)}}}({provider:e,online:t,onFlash:n,onConnected:r,onRememberOffer:i});return Ee.jsx(Il,{model:a})}const Sl=function(){const[e,t]=Ce.useState(null);return Ce.useEffect(()=>{(async function(e=oi()??null){if(!e)return"missing";try{return await(e.isUserVerifyingPlatformAuthenticatorAvailable?.())?"ok":"partial"}catch{return"partial"}})().then(t)},[]),Ee.jsx(q,{id:"connection:passkey-support",title:"Passkey",message:null===e||"ok"===e?null:"This browser is not your phone or YubiKey. If a site asks for a passkey, use TOTP, email, or approve on your phone instead of waiting on a prompt that cannot finish here.",tone:"warn"})};function Al(){return Ee.jsx(Sl,{})}const Cl={claimGithubAppCode:async function(e,t){if(""===e.trim()||!fo(t))return"ignored";let n=lo(),r=null;try{r=co({allowBeforeVault:!0,binding:()=>lo()===n});const t=await mo(r.transport,e);r.transport.assertCurrent();const{ownerLogin:i,ownerType:a}=go(t),o={id:String(t.id),key:"github-oauth",displayName:t.name,htmlUrl:t.html_url??null,ownerLogin:i,ownerType:a,installedByLogin:null,installations:[]};return n=o,ho(o),r.transport.assertCurrent(),wo(o,`${t.client_secret}\n${t.pem}`,r.tomb),await vo(),r.transport.assertCurrent(),"registered"}catch{return"failed"}finally{r?.close()}},readLocalGithubApp:lo,refreshGithubAppInstallations:uc,verifyGithubAppInstallations:dc,hasPendingGithubAppSecret:yo,captureGithubAuthority:co};function El({provider:e,online:t,onFlash:n}){const[r,o]=Ce.useState(null),s=function(e,t,n){const r=Ce.useRef(0),o=Ce.useRef(void 0);return Ce.useEffect(()=>{if("github"!==e.id)return;r.current+=1;const t=()=>{r.current+=1,window.clearTimeout(o.current)};return window.addEventListener("pagehide",t),()=>{r.current+=1,window.clearTimeout(o.current),window.removeEventListener("pagehide",t)}},[e.id]),async()=>{if("github"!==e.id)return;const s=++r.current;window.clearTimeout(o.current),n("app");try{const c=await i({returnTo:`${window.location.origin}${window.location.pathname}`,displayName:`OpenSesame ${e.displayName}`});if(s!==r.current)return;a(c),o.current=window.setTimeout(()=>{s===r.current&&(n(null),t({tone:"err",text:"GitHub did not open. Hard-refresh so CSP allows form posts to github.com, then try again."}))},2500)}catch(c){if(s!==r.current)return;t({tone:"err",text:Ia(c)}),n(null)}}}(e,n,o),c=Ce.useSyncExternalStore(bo,lo,()=>null);return function(e,t){const n=Ce.useRef(t);n.current=t;const r=Ce.useRef(null),i=Ce.useRef(null);Ce.useEffect(()=>{if("github"!==e)return;const t=window.location.href;let a=!0;const o=()=>a&&window.location.href===t,s=new URLSearchParams(window.location.search),c=()=>{o()&&window.history.replaceState({},"",function(e){for(const n of["code","state","github_app_code","github_app_state","github_app","reason","integration"])e.delete(n);const t=e.toString();return`${window.location.pathname}${t?`?${t}`:""}${window.location.hash}`}(s))},l={arrival:t,active:o,finish:c,flash:e=>n.current(e),failed(){o()&&(n.current({tone:"err",text:"GitHub App registration could not be verified. Unlock its vault and try again."}),c())}},d=s.get("github_app"),u=s.get("github_app_code")??s.get("code"),p=s.get("github_app_state")??s.get("state");let h=()=>{};return u&&p?h=function(e,t,n,r){let i;try{i=Cl.captureGithubAuthority({allowBeforeVault:!0})}catch{return e.failed(),()=>{}}return t.current?.arrival!==e.arrival&&(t.current={arrival:e.arrival,pending:Cl.claimGithubAppCode(n,r)}),t.current.pending.then(t=>{e.active()&&(i.transport.assertCurrent(),function(e,t){if("registered"===t){const t=Cl.readLocalGithubApp();if(!t)return;const n=Cl.hasPendingGithubAppSecret(t.id);e.flash({tone:"ok",text:n?"GitHub App registered. Unlock your vault to save its key.":"GitHub App registered."}),Cl.refreshGithubAppInstallations()}else"failed"===t&&e.flash({tone:"err",text:"GitHub App registration failed."});e.finish()}(e,t))}).catch(e.failed).finally(i.close),i.close}(l,r,u,p):"registered"===d||"installed"===d?h=function(e,t,n){let r;try{r=Cl.captureGithubAuthority()}catch{return e.failed(),()=>{}}return t.current?.arrival!==e.arrival&&(t.current={arrival:e.arrival,pending:Cl.verifyGithubAppInstallations()}),t.current.pending.then(t=>{e.active()&&(r.transport.assertCurrent(),Cl.readLocalGithubApp()===t&&(e.flash("installed"===n&&0===t.installations.length?{tone:"err",text:"GitHub has not confirmed an App installation."}:{tone:"ok",text:"installed"===n?"GitHub App installation verified.":"GitHub App registration verified."}),e.finish()))}).catch(e.failed).finally(r.close),r.close}(l,i,d):d&&("error"===d&&n.current({tone:"err",text:"GitHub App registration failed."}),c()),()=>{a=!1,h()}},[e])}(e.id,n),"github"!==e.id||null!==c?null:Ee.jsx("div",{className:"conn-client-setup",children:Ee.jsx(U,{label:"app"===r?"Opening GitHub":"Create GitHub App",disabled:!t||null!==r,icon:Ee.jsx(M,{size:18}),onClick:()=>{s()}})})}function Tl({provider:e,scopes:t,onToggleScope:n}){return 0===e.scopes.length?null:Ee.jsxs("fieldset",{className:"conn-scope-picker",children:[Ee.jsx("legend",{className:"label",children:"Ask for"}),e.scopes.map(e=>Ee.jsxs("label",{className:"check",children:[Ee.jsx("input",{type:"checkbox",checked:t.includes(e.name),onChange:()=>n(e.name)}),Ee.jsxs("span",{children:[Ee.jsx("code",{children:e.name}),e.sensitive?Ee.jsx(Oe,{tone:"warn",label:"Broad"}):null,Ee.jsx("span",{className:"hint",children:e.description})]})]},e.name))]})}function Nl({provider:e,online:t,busy:n,name:r,nameId:i,scopes:a,missingScope:o,oauthReady:s,onName:c,onToggleScope:l,onConnectOauth:d}){return Ee.jsxs("form",{onSubmit:e=>{d(e)},children:[Ee.jsx(Al,{}),s?null:Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Optional settings"}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{className:"label",htmlFor:i,children:"Name it (optional)"}),Ee.jsx("input",{id:i,value:r,onChange:e=>c(e.target.value)})]})]}),Ee.jsx(Tl,{provider:e,scopes:a,onToggleScope:l}),Ee.jsx(U,{label:n?"Waiting for consent":`Authorize with ${e.displayName}`,disabled:n||!t||o||!s,icon:Ee.jsx(M,{size:18})})]})}function zl({provider:e,online:t,busy:n,road:r,name:i,nameId:a,scopes:o,missingScope:s,onName:c,onToggleScope:l,onFlash:d,onConnectOauth:u}){const p=Ce.useSyncExternalStore(bo,lo,()=>null),h=e.configured||"github"===e.id&&null!==p;return Ee.jsxs("div",{className:"conn-tile__body",children:[Ee.jsx(El,{provider:e,online:t,onFlash:d}),null===r?null:Ee.jsx(Nl,{provider:e,online:t,busy:n,name:i,nameId:a,scopes:o,missingScope:s,oauthReady:h,onName:c,onToggleScope:l,onConnectOauth:u})]})}const $l=e=>`connector:${e}`;function Pl(e,t,n,r="err"){Kt({id:$l(e),tone:r,title:t,body:n})}function Ol(e){Ft($l(e))}function Rl({provider:e,online:t,onFlash:n,onConnected:r,onRememberOffer:i}){const[a,p]=Ce.useState(e.displayName),[h,f]=Ce.useState(()=>e.scopes.filter(e=>e.default).map(e=>e.name)),[m,g]=Ce.useState(""),[w,v]=Ce.useState(()=>wl(e)),[y,b]=Ce.useState(!1),k=Ce.useId(),x=function(e,t){const[n,r]=Ce.useState(!1),[i,a]=Ce.useState(""),s=Ce.useRef(null);return{busy:n,failure:i,save:async function(n,i,c){r(!0),a(""),Ol(e.id);try{s.current??=await o({providerId:e.id,displayName:n.name.trim()||e.displayName,scopes:n.scopes});const r=s.current;return await i(r),s.current=null,t.onFlash({tone:"ok",text:c}),t.onRememberOffer?.(r),t.onConnected(),!0}catch(l){const t=Ia(l);return a(t),Pl(e.id,e.displayName,t),!1}finally{r(!1)}}}}(e,{onFlash:n,onConnected:r,onRememberOffer:i}),I=ja().form(e),j=x.busy||y,_=function(e,t){return e.scopes.length>0&&0===t.length}(e,h);return nt(e.id)?Ee.jsx(_l,{provider:e,online:t,onFlash:n,onConnected:r,onRememberOffer:i}):"configuration"===e.authKind?null===I?null:Ee.jsx(yl,{provider:e,name:a,values:w,busy:j,online:t,failure:x.failure,onName:p,onValue:(e,t)=>v(n=>({...n,[e]:t})),onSubmit:t=>{!async function(t){t.preventDefault();const n=zc(e,w);await x.save({name:a},async e=>{await s(e.connectionId,n)},`${e.displayName} configuration saved.`)&&v(wl(e))}(t)}}):"api_key"===e.authKind?null===I?null:Ee.jsx(gl,{provider:e,name:a,apiKey:m,values:w,busy:j,online:t,failure:x.failure,onName:p,onApiKey:g,onValue:(e,t)=>v(n=>({...n,[e]:t})),onSubmit:t=>{!async function(t){t.preventDefault(),await x.save({name:a,scopes:h.length>0?h:void 0},async t=>{await c(t.connectionId,m.trim());const n=zc(e,w);Object.keys(n).length>0&&await s(t.connectionId,n)},"github"===e.id?"GitHub connected.":`${e.displayName} connected.`)&&g("")}(t)}}):Ee.jsx(zl,{provider:e,online:t,busy:j,road:I,name:a,nameId:k,scopes:h,missingScope:_,onName:p,onToggleScope:function(e){f(t=>t.includes(e)?t.filter(t=>t!==e):[...t,e])},onFlash:n,onConnectOauth:async function(t){t.preventDefault();const s=l("about:blank");b(!0);let c=!1;try{const t=await o({providerId:e.id,displayName:a.trim()||e.displayName,scopes:h});c=!0;const{authorizationUrl:l}=await d(t.connectionId,h);s?s.location.href=l:window.location.href=l;const p=await u(t.connectionId,s);"active"===p.result?(n({tone:"ok",text:`${e.displayName} is connected${p.connection.accountLabel?` as ${p.connection.accountLabel}`:""}. Bind it to a project or agent to let them use it.`}),i?.(p.connection),r()):"failed"===p.result?(n({tone:"err",text:p.connection.statusDetail??`${e.displayName} refused the authorization.`}),r()):(n({tone:"warn",text:`Consent for ${e.displayName} was not completed. The connection is waiting, and you can authorize it above.`}),r())}catch(p){s?.close(),n({tone:"err",text:Ia(p)}),c&&r()}finally{b(!1)}}})}const Ll={ok:"info",warn:"warn",err:"err"};function Ul(e){Kt({id:"setup:storage",tone:Ll[e.tone],title:"S3-compatible bucket",body:e.text})}function Dl(){const e=Mt().find(e=>"s3"===e.id);return void 0===e?null:Ee.jsx("section",{className:"setup__stack","aria-label":e.displayName,children:Ee.jsx(Rl,{provider:e,online:!0,onFlash:Ul,onConnected:()=>{}})})}function ql(e,t){if(!e||!t)return null;const n=e.find(e=>e.id===t);if(n)return n;const r=Ve(t);return r?e.find(e=>Ve(e.id)===r)??null:null}const Ml={openai_chat:"OpenAI-compatible",anthropic_messages:"Anthropic Messages",gemini_generate_content:"Gemini",rest_json:"Provider REST"};function Kl(e){return"ai_model_provider"===e.category}function Fl(e){return He(e)?.modelApi??null}function Gl(e){const t=Fl(e);return t?Ml[t.protocol]:null}function Bl({provider:e,connectionId:t,children:n,describedBy:r,layout:i="tile"}){const a=Ne(),o=ka(e.id,t);return Ee.jsxs("button",{type:"button",className:"tile"===i?"conn-tile__link":"icon-btn icon-btn--sm",tabIndex:"tile"===i?-1:0,"aria-label":`Actions for ${e.displayName}`,"aria-describedby":r,"aria-haspopup":"menu",onClick:t=>{const n=t.currentTarget,r=n.getBoundingClientRect();Fa({clientX:r.right,clientY:r.bottom,preventDefault:()=>t.preventDefault()},n,`${e.displayName} connection`,[[{id:"configure",label:"Configure connection",run:()=>a(`${o}#connector`)},{id:"access",label:"Check access",run:()=>a(`${o}#complete`)},{id:"remove",label:"Remove connection…",run:()=>a(`${o}#complete`)}]])},children:[n,Ee.jsx(K,{className:"tile"===i?"conn-tile__go":void 0,size:18})]})}const Vl=Ur({region:qr().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/),credential:Dr("sigv4")}).strict(),Hl=Ur({accessKeyId:qr().regex(/^[A-Z0-9]{16,128}$/),secretAccessKey:qr().min(20).max(256).regex(/^[A-Za-z0-9/+=]+$/),sessionToken:qr().min(16).max(8192).regex(/^[\x21-\x7e]+$/).optional()}).strict();function Jl(e){return`https://bedrock-runtime.${e.region}.amazonaws.com/`}function Wl(e){const t=Vl.parse(e.bedrock);if(!["aws-bedrock","byo-ai"].includes(e.providerId)||"bedrock_converse"!==e.family||"api-key"!==e.authentication||e.azure||e.vertex||!/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$/.test(e.model))throw new ys("configuration","Choose a valid Bedrock Converse target.");if("aws-bedrock"===e.providerId&&e.baseUrl.replace(/\/+$/,"")!==Jl(t).replace(/\/$/,""))throw new ys("configuration","Use the regional Bedrock runtime endpoint.");return t}function Zl(e,t){return Wl(e),new URL(`model/${encodeURIComponent(e.model)}/converse`,t)}function Xl(e){try{return Hl.parse(JSON.parse(e))}catch{throw new ys("authentication","Enter valid AWS credential JSON.")}}function Yl(e){let t;try{t=new URL(e.trim())}catch{throw new ys("configuration","Enter a complete AI API base URL.")}const n=["localhost","127.0.0.1","[::1]"].includes(t.hostname);if(!("https:"===t.protocol||"http:"===t.protocol&&n)||t.username||t.password||t.search||t.hash||/[\\\r\n]/.test(e)||/%2e|%2f|%5c/i.test(e))throw new ys("configuration","Use HTTPS, or loopback HTTP, without URL credentials, query or fragment.");return t.pathname=`${t.pathname.replace(/\/+$/,"")}/`,t}const Ql="https://api.stability.ai/v2beta/stable-image",ed=Ur({providerId:Mr(["stability","byo-ai"]),baseUrl:qr().min(1).max(2048),model:qr().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/),authentication:Dr("api-key"),apiKey:qr().min(0).max(16384).regex(/^[\x21-\x7e]*$/)}).strict();function td(e,t=!0){const n=ed.safeParse(e);if(!n.success||t&&!n.data.apiKey)throw new ys("configuration","Choose a Stability SD3 endpoint, saved model and API key.");const r=n.data,i=Yl(r.baseUrl);if("stability"===r.providerId&&(i.href!==Yl(Ql).href||!["sd3.5-medium","sd3.5-large","sd3.5-large-turbo"].includes(r.model)))throw new ys("configuration","Choose a documented Stability SD3 model and endpoint.");if(r.apiKey&&[r.baseUrl,r.model].some(e=>e.includes(r.apiKey)))throw new ys("configuration","Keep the image API key out of public fields.");return r}function nd(e,t=!0){if("stability_sd3"!==e.family||e.azure||e.vertex||e.bedrock)throw new ys("configuration","Choose one Stability SD3 image target without another protocol's credentials.");return td({providerId:e.providerId,baseUrl:e.baseUrl,model:e.model,authentication:e.authentication,apiKey:e.apiKey},t)}const rd=[{id:"bedrock_converse",label:"Amazon Bedrock Converse"},{id:"openai_chat",label:"OpenAI Chat Completions"},{id:"openai_responses",label:"OpenAI Responses"},{id:"anthropic_messages",label:"Anthropic Messages"},{id:"gemini_generate_content",label:"Gemini Generate Content"},{id:"replicate_predictions",label:"Replicate predictions"},{id:"elevenlabs_scribe",label:"ElevenLabs Scribe transcription"},{id:"deepgram_listen",label:"Deepgram transcription"},{id:"assemblyai_transcript",label:"AssemblyAI transcription"},{id:"stability_sd3",label:"Stability AI images"}];function id(e){return rd.some(t=>t.id===e)}function ad(e){const t=od(e);return rd.filter(n=>"byo-ai"===e||n.id===t?.family||["openai","azure-openai"].includes(e)&&"openai_responses"===n.id)}function od(e){if("stability"===e)return{providerId:e,name:"Stability AI",family:"stability_sd3",baseUrl:Ql,model:"sd3.5-medium"};if("ollama"===e)return{providerId:e,name:"Ollama",family:"openai_chat",baseUrl:"http://localhost:11434/v1"};if("assemblyai"===e)return{providerId:e,name:"AssemblyAI",family:"assemblyai_transcript",baseUrl:"https://api.assemblyai.com/v2",model:"universal-3-5-pro"};if("deepgram"===e)return{providerId:e,name:"Deepgram",family:"deepgram_listen",baseUrl:"https://api.deepgram.com/v1",model:"nova-3"};if("elevenlabs"===e)return{providerId:e,name:"ElevenLabs",family:"elevenlabs_scribe",baseUrl:"https://api.elevenlabs.io/v1",model:"scribe_v2"};if("replicate"===e)return{providerId:e,name:"Replicate",family:"replicate_predictions",baseUrl:"https://api.replicate.com/v1"};if("aws-bedrock"===e){const t={region:"us-east-1",credential:"sigv4"};return{providerId:e,name:"Amazon Bedrock",family:"bedrock_converse",baseUrl:Jl(t),bedrock:t}}return"google-vertex"===e?{providerId:e,name:"Google Vertex AI",family:"gemini_generate_content",baseUrl:"https://us-central1-aiplatform.googleapis.com/v1",vertex:{project:"",location:"us-central1",credential:"service-account"}}:"azure-openai"===e?{providerId:e,name:"Azure OpenAI",family:"openai_chat",baseUrl:"",azure:{api:"v1",credential:"api-key"}}:"byo-ai"===e?{providerId:e,name:"BYO AI",family:"openai_chat",baseUrl:""}:function(e){const t=Fl(e);return t&&id(t.protocol)?{providerId:e,name:He(e)?.displayName??e,family:t.protocol,baseUrl:t.baseUrl??""}:null}(e)}function sd(e){return null!==od(e)}function cd(e){const t=od(e);if(!t)throw new Error("This provider has no supported AI protocol.");return{...t,model:"elevenlabs_scribe"===t.family||"deepgram_listen"===t.family||"assemblyai_transcript"===t.family||"stability_sd3"===t.family?t.model:"",authentication:"ollama"===e?"none":"api-key",apiKey:"",tokenParameter:["openai","byo-ai","azure-openai"].includes(e)?"max_completion_tokens":"max_tokens"}}const ld=["oidc","oauth","mcp","api-key","native-local","specialized"];function dd(e,t){return t.unavailableKind?{...e,reason:t.unavailableKind}:e}const ud=Gr(qr()),pd=Br(qr(),qr()),hd=Ur({mode:Mr(["managed","byo"]),workspace:qr(),appScopes:ud,userScopes:ud,webhookResourceTypes:ud,webhookEnabled:Fr().optional(),webhookUrl:qr().optional(),icon:qr().refine(function(e){if(""===e)return!0;const t=/^data:image\/(png|jpeg);base64,([A-Za-z0-9+/]+={0,2})$/.exec(e);if(!t)return!1;const n=t[2];if(!n||n.length%4!=0)return!1;const r=n.endsWith("==")?2:n.endsWith("=")?1:0;return 3*n.length/4-r<=2097152&&n.startsWith("png"===t[1]?"iVBORw0KGgo":"/9j/")},"Use a PNG or JPEG icon under 2 MB")}),fd=Ur({method:Mr(["managed","oauth","mcp","api-key"]),name:qr(),uid:qr(),params:pd,oauth:Ur({serverUrl:qr(),authorizationEndpoint:qr(),tokenEndpoint:qr(),revocationEndpoint:qr(),userinfoEndpoint:qr(),tokenAuth:Mr(["client_secret_post","client_secret_basic","none"]),pkce:Mr(["S256","none","required"]),authorizationParams:pd,scopes:ud,refreshTokens:Fr(),clientId:qr(),clientSecret:qr(),registration:Mr(["manual","dcr","cimd"])}),mcpClientId:qr(),mcpClientSecret:qr(),mcpRegistration:Mr(["manual","dcr","cimd"]),keySubject:Mr(["user","app"]),key:qr(),serviceUrls:ud,instructions:qr()}),md=Ur({state:fd,options:hd}),gd=Ur({accountLabel:qr(),workspaceId:qr(),workspaceName:qr(),workspaceKey:qr(),grantedScopes:Gr(qr()),expiresAt:Vr().nullable(),kind:Mr(["oauth","api-key"]),needsReauth:Fr().optional()}),wd=Ur({app:gd.nullable(),user:gd.nullable(),webhook:Ur({id:qr(),url:qr(),resourceTypes:Gr(qr())}).nullable(),recovery:Ur({workspaceId:qr().min(1),phase:Mr(["cleanup","configure"])}).optional()}),vd=Ur({kind:Mr(["oauth","api-key"]),accessToken:qr().min(1).max(16384).regex(/^[!-~]+$/),refreshToken:qr().min(1).max(16384).regex(/^[!-~]+$/).optional(),expiresAt:Vr().finite().positive().nullable(),scopes:Gr(qr())}).refine(e=>"api-key"===e.kind||null!==e.expiresAt),yd=Ur({state:qr().min(32),verifier:qr().min(43),clientId:qr().min(1),redirectUri:qr(),actor:Mr(["app","user"]),scopes:Gr(qr()),createdAt:Vr(),fingerprint:qr()}),bd="linear_authorization",kd="linear_pending",xd=e=>`linear_${e}_grant`;function Id(e){try{return wd.parse(JSON.parse(e??""))}catch{return{app:null,user:null,webhook:null}}}function jd(e){const t=Si().find(t=>t.connectionId===e&&"linear"===t.providerId);return t?Id(t.fields[bd]):null}function _d(e){try{return vd.parse(JSON.parse(e??""))}catch{return null}}function Sd(e,t){return _d(Ci()[e]?.[xd(t)])}function Ad(e){const t=Si().find(t=>t.connectionId===e);if("linear"!==t?.providerId)throw new Error("Saved Linear connector not found");try{return md.parse(JSON.parse(t.fields.self_hosted_configuration??""))}catch{throw new Error("Saved Linear configuration is invalid")}}function Cd(e,t){return JSON.stringify({method:e.method,clientId:e.oauth.clientId,workspace:t.workspace.trim(),app:[...t.appScopes].sort(),user:[...t.userScopes].sort(),webhook:!0===t.webhookEnabled,url:t.webhookUrl??"",resources:[...t.webhookResourceTypes].sort()})}function Ed(e,t,n){if(e.recovery)return!1;const r=n=>{const r=e[n];return!(!r||r.needsReauth)&&("api-key"===r.kind||t["app"===n?"appScopes":"userScopes"].every(e=>r.grantedScopes.includes(e)))};return"api-key"===n?!(!e.app||e.app.needsReauth||t.webhookEnabled&&!e.webhook):(0===t.appScopes.length||!!e.app&&r("app"))&&(0===t.userScopes.length||!!e.user&&r("user"))&&(!t.webhookEnabled||!!e.webhook)}function Td(e,t,n){const r=e?.[n];if("app"===n&&e?.recovery&&(!r||r.needsReauth))return!0;const i=t["app"===n?"appScopes":"userScopes"];return i.length>0&&(!r||!!r.needsReauth||i.some(e=>!r.grantedScopes.includes(e)))}function Nd(e,t,n,r=!1){const i=[e.app,e.user].filter(e=>null!==e),a=i.flatMap(e=>null===e.expiresAt?[]:[e.expiresAt]);return{[bd]:JSON.stringify(e),linear_verified:!r&&Ed(e,t,n)?"1":"0",linear_granted_scopes:JSON.stringify([...new Set(i.flatMap(e=>e.grantedScopes))]),linear_account:i[0]?.workspaceName??"",linear_expires_at:a.length>0?new Date(Math.min(...a)).toISOString():"",linear_refreshable:i.some(e=>"oauth"===e.kind)?"1":"0"}}function zd(e,t){const n=Ad(e.row.connectionId);return{...e,row:{...e.row,fields:{...e.row.fields,...Nd(t,n.options,n.state.method,!(!e.secrets.linear_cleanup_app&&!e.secrets.linear_cleanup_user))},updatedAt:(new Date).toISOString()}}}function $d(e){const t=rt(e);if(!t)throw new Error("Saved Linear connector not found");return t}async function Pd(e,t,n){return await Ai(e,async e=>{if("linear"!==e.row.providerId)throw new Error("This is not a Linear connector");return t(e,Id(e.row.fields[bd]))},n),$d(e)}async function Od(e){const t=function(e){if(!e||e.validStatuses.length>0)return e;const{validStatuses:t,...n}=e;return n}(e.profile.verify),n=(new TextEncoder).encode(JSON.stringify({providerId:e.providerId,method:"api-key",parameters:Object.fromEntries(Object.entries(e.parameters).sort()),auth:e.profile.auth,verify:t,classification:e.classification}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",n))].map(e=>e.toString(16).padStart(2,"0")).join("")}function Rd(e,t){const n=Oa(e),r=n?.methods.find(e=>"api-key"===e.kind);if(!n||n.refused||"api-key"!==r?.kind||!r.preset)throw new Error("This provider has no supported API-key contract");const i=r.preset,{profile:a,variantId:o}=function(e,t){const n=t.credential_variant??e.credentialVariants[0]?.id,r=n?e.credentialVariants.find(e=>e.id===n):e;if(!r?.auth||!r.verify)throw new Error("Select a supported provider credential type");return{profile:r,variantId:n}}(i,t),s=a.templateParams.filter(e=>!e.secret).map(e=>e.name);i.credentialVariants.length&&s.push("credential_variant");const c=["api_key",...a.templateParams.filter(e=>e.secret).map(e=>e.name),...a.additionalCredentials.map(e=>e.name)];if(Object.keys(t).some(e=>!s.includes(e)))throw new Error("Enter only this provider's public configuration fields");const l=function(e,t,n){const r={};n&&(r.credential_variant=n);for(const i of e.templateParams.filter(e=>!e.secret))r[i.name]=Ld(i,t);return r}(a,t,o);return{providerId:e,providerName:n.name,profile:a,parameters:l,classification:{publicParameters:s,privateCredentials:c}}}function Ld(e,t){const n=t[e.name]?.trim()||e.choices?.[0]?.value||"";if(e.required&&!n)throw new Error(`Enter ${e.label}`);if(n&&e.choices&&!e.choices.some(e=>e.value===n))throw new Error(`Select a supported ${e.label}`);if(n.length>256||/[\r\n]/.test(n))throw new Error("Enter valid provider parameters");return n}function Ud(e,t,n={}){const r=e.classification.privateCredentials;if(Object.keys(t).some(e=>!r.includes(e)))throw new Error("Enter only this provider's private credential fields");const i=new Set(["api_key",...e.profile.additionalCredentials.filter(e=>e.required).map(e=>e.name),...e.profile.templateParams.filter(e=>e.secret&&e.required).map(e=>e.name)]),a={};for(const o of r){const e=t[o]?.trim()||n[o]||"";if(i.has(o)&&!e)throw new Error("Enter the required provider credentials");if(e.length>16384||e&&!/^[!-~]+$/.test(e))throw new Error("Enter valid provider credentials");e&&(a[o]=e)}return a}function Dd(e,t,n,r=!1){return e.replace(/\{([a-z_]+)\}/g,(e,i)=>{const a="key"===i?n.api_key:n[i]??t[i];if(void 0===a||""===a)throw new Error("Complete the provider's required configuration");return r?encodeURIComponent(a):a})}function qd(e){const t=e.replace(/^\[|\]$/g,"").toLowerCase();return"localhost"===t||t.endsWith(".localhost")||"::1"===t||/^127(?:\.[0-9]{1,3}){3}$/.test(t)}function Md(e,t,n){!function(e,t){const n=e.slice(8).split("/")[0]??"";for(const r of n.matchAll(/\{([a-z_]+)\}/g)){const e=r[1]??"",n=t.parameters[e]??"";if(!t.classification.publicParameters.includes(e)||!/^[A-Za-z0-9.-]+(?::[0-9]{1,5})?$/.test(n)||n.startsWith(".")||n.endsWith("."))throw new Error("Enter a valid provider tenant host");const i=n.indexOf(":");if(i>=0&&!qd(n.slice(0,i)))throw new Error("Enter a valid provider tenant host")}}(e,t);const[r=""]=e.slice(8).split("/"),i=e.replace(/\{([a-z_]+)\}/g,(e,n)=>r.includes(e)?t.parameters[n]??"":e),a=new URL(Dd(i,t.parameters,n,!0));if("https:"!==a.protocol||a.username||a.password||a.hash||a.port&&"443"!==a.port&&!qd(a.hostname))throw new Error("Provider requests require the compiled HTTPS target");return a}function Kd(e,t){const n={...t};for(const[r,i]of Object.entries(t)){const e=encodeURIComponent(i);e!==i&&(n[`url_${r}`]=e);const t=new URLSearchParams({value:i}).toString().slice(6);t!==i&&(n[`query_${r}`]=t)}if("basic"===e.profile.auth?.kind){const r=Fd(e,t).get("authorization");r&&(n.basic_authorization=r.slice(6))}return n}function Fd(e,t){const n=new Headers;for(const[i,a]of Object.entries(e.profile.verify?.headers??{}))[...a.matchAll(/\{([a-z_]+)\}/g)].some(n=>{const r=e.profile.templateParams.find(e=>e.name===n[1]);return r&&!r.required&&!e.parameters[r.name]&&!t[r.name]})||n.set(i,Dd(a,e.parameters,t));const r=e.profile.auth;if("header"===r?.kind){const i=t.api_key??"";n.set(r.header,r.valueTemplate?Dd(r.valueTemplate,e.parameters,t):`${r.scheme?`${r.scheme} `:""}${i}`)}if("basic"===r?.kind){const i=Dd(r.username,e.parameters,t),a=Dd(r.password,e.parameters,t);if(i.includes(":"))throw new Error("Enter a valid provider Basic username");n.set("Authorization",`Basic ${btoa(`${i}:${a}`)}`)}return n}function Gd(e,t){const n=e.profile.verify;if(!n)throw new Error("Provider verification is unavailable");const r=Md(n.url,e,t),i=Fd(e,t),a=e.profile.auth;if("query"===a?.kind&&r.searchParams.get(a.parameter)!==t.api_key)throw new Error("Provider verification does not match its query credential contract");if("path"===a?.kind){const n=Dd(a.template,e.parameters,t,!0);if(!r.pathname.startsWith(`${n}/`))throw new Error("Provider verification does not match its path credential contract")}const o=null===n.body?void 0:Dd(n.body,e.parameters,t),s={url:r,method:n.method,headers:i};return void 0!==o&&(s.body=o),n.validStatuses.length&&(s.validStatuses=n.validStatuses),s}function Bd(e,t,n){const r=new URL(n),i=e.profile.auth;if("query"===i?.kind){if(r.searchParams.has(i.parameter))throw new Error("Provider operation cannot override credential placement");r.searchParams.set(i.parameter,t.api_key??"")}if("path"===i?.kind){const n=Dd(i.template,e.parameters,t,!0),a=`${n}${r.pathname}`;if(!n.startsWith("/")||n.startsWith("//"))throw new Error("Provider operation has an invalid credential contract");if(r.pathname=a,r.pathname!==a)throw new Error("Provider operation changed its credential path")}if(r.origin!==n.origin||r.href.length>65536)throw new Error("Provider operation changed its target or exceeds its bound");return r}class Vd extends Error{constructor(e){super(e),this.name="NativeApiBrowserUnavailable"}}function Hd(e){const t=en(e.providerId,e.parameters);if(!t.available)throw new Vd(t.reason??"This provider does not allow direct browser API access")}async function Jd(e,t,n){try{Hd(t)}catch(r){throw r instanceof Vd&&e.privateState.verification&&await Wd(e,t,n),r}}async function Wd(e,t,n){await tn(e.connectionId,{revision:e.revision,fingerprint:e.configuration.fingerprint},t.classification,e=>(n.assertCurrent(),{...e,runtime:{...e.runtime,grants:e.runtime.grants.map(e=>({...e,needsReauth:!0}))},privateState:{...e.privateState,verification:null}}))}function Zd(e,t,n=0){if(n>10)throw new gr("response");if(ni(e)){if(e.length>65536)throw new gr("response");for(const n of Object.values(t))if(n&&e.includes(n))throw new gr("response")}else if(Array.isArray(e)){if(e.length>100)throw new gr("response");for(const r of e)Zd(r,t,n+1)}else if(ai(e)){if(Object.keys(e).length>100)throw new gr("response");for(const[r,i]of Object.entries(e))wr(r,t),Zd(i,t,n+1)}}function Xd(e,t=32){return[...e].some(e=>{const n=e.charCodeAt(0);return n<t||127===n})}async function Yd(e,t,n,r,i=Gt()){i.assertCurrent();const a=function(e,t){const n=an(e);if(!n||"api-key"!==n.configuration.method||n.configuration.providerId!==t.providerId)throw new Error("Use a verified saved API-key connection for this provider");return n}(e,t),o=Rd(t.providerId,a.configuration.parameters);if(await Jd(a,o,i),nn(a),await Od(o)!==a.configuration.fingerprint)throw new Error("Provider contract changed; configure this connection again");const{url:s,headers:c}=function(e,t,n){const r=t.profile.verify;if(!r)throw new Error("Provider verification is unavailable");const i=Md(r.url,t,e.privateState.credentials).origin,a=Oa(n.providerId)?.methods.find(e=>"api-key"===e.kind),o=n.origin??i,s=o!==i&&"api-key"===a?.kind?(a.preset?.serviceUrls??[]).map(e=>Md(e,t,{}).origin):[];if(o!==i&&!s.includes(o)||new URL(o).origin!==o)throw new Error("Provider operation does not match its compiled target");const c=e.privateState.credentials,l=Kd(t,c);Zd(n.path,l),function(e){if(e.length>2048||!e.startsWith("/")||/[?#\\]/.test(e)||Xd(e,33)||e.includes("//"))throw new Error("Provider operation does not match its compiled path");try{for(const t of e.split("/")){const e=decodeURIComponent(t);if("."===e||".."===e||/[/%\\?#]/.test(e)||Xd(e,33))throw new Error("Invalid path segment")}}catch{throw new Error("Provider operation does not match its compiled path")}}(n.path);const d=new URL(n.path,o);if(d.origin!==o||d.pathname!==n.path)throw new Error("Provider operation changed its target");!function(e,t,n){const r=Object.entries(t??{});if(r.length>16)throw new Error("Provider operation query exceeds its bound");for(const[i,a]of r){if(!/^[A-Za-z][A-Za-z0-9_-]{0,63}$/.test(i)&&"page[limit]"!==i||["constructor","prototype","__proto__"].includes(i)||!ni(a)&&!si(a)&&!ci(a)||si(a)&&!Number.isFinite(a))throw new Error("Provider operation has an invalid query field");const t=String(a);if(t.length>1024||Xd(t))throw new Error("Provider operation query exceeds its bound");Zd({[i]:t},n),e.searchParams.set(i,t)}if(e.search.length>4096)throw new Error("Provider operation query exceeds its bound")}(d,n.query,l);const u=function(e,t,n){const r=Fd(t,e.privateState.credentials),i=Kd(t,e.privateState.credentials);for(const[a,o]of Object.entries(n.headers??{})){const e=r.get(a);if(["authorization","cookie","host","x-api-key","x-goog-api-key"].includes(a.toLowerCase())||null!==e&&Object.values(i).some(t=>t&&e.includes(t))||a.toLowerCase()===("header"===t.profile.auth?.kind?t.profile.auth.header.toLowerCase():""))throw new Error("Provider operation cannot override credential placement");Zd({[a]:o},i),r.set(a,o)}return"POST"===n.method&&r.set("Content-Type","application/json"),r}(e,t,n);return{url:Bd(t,c,d),headers:u}}(a,o,t);try{const l={url:s,method:t.method,headers:c},d=[t.signal,i.signal].filter(e=>void 0!==e);if(d.length&&(l.signal=AbortSignal.any(d)),"POST"===t.method&&(Zd(n,Kd(o,a.privateState.credentials)),l.body=JSON.stringify(n),l.body.length>262144))throw new Error("Provider request is too large");await rn(e,{revision:a.revision,fingerprint:a.configuration.fingerprint});const u=await mr(l,function(e,t){return t?{...e,assertCurrent:()=>e.assertCurrent(),fetch:(n,r)=>(t(),e.fetch(n,r))}:e}(i,t.onDispatch)),p=function(e,t){try{return t(e)}catch{throw new gr("response")}}(u,r);return Zd(p,Kd(o,a.privateState.credentials)),i.assertCurrent(),await rn(e,{revision:a.revision,fingerprint:a.configuration.fingerprint}),i.assertCurrent(),p}catch(l){throw l instanceof gr&&"authorization"===l.code&&await Wd(a,o,i),l}}function Qd(e){return[...e].every(e=>{const t=e.charCodeAt(0);return t>=32&&127!==t})}const eu=qr().min(1).max(512).refine(Qd),tu=Ur({count:Vr().int().min(0).max(20),inboxes:Gr(Ur({inbox_id:eu,email:eu,display_name:qr().max(512).refine(Qd).optional()})).max(20),error:Hr().optional(),errors:Hr().optional()}),nu=Ur({label:qr(),items:Gr(Ur({id:qr(),label:qr()})).max(20)});function ru(e){const t=tu.parse(e);if(t.count!==t.inboxes.length||new Set(t.inboxes.map(e=>e.inbox_id)).size!==t.count)throw new gr("response");return{label:`${t.count} ${1===t.count?"inbox":"inboxes"}`,items:t.inboxes.map(e=>({id:e.inbox_id,label:e.display_name||e.email}))}}ao();const iu=Ur({label:qr(),items:Gr(Ur({id:qr(),label:qr()})).max(100)});function au(e,t,n,r={}){return{providerId:t.providerId,id:t.operationId,label:e,async read(i,a,o){if(o.assertCurrent(),Object.keys(a).length)throw new Error(`${e} does not accept request fields`);const s=await Yd(i,t,r,n,o);return o.assertCurrent(),iu.parse(s)}}}const ou=qr().min(1).max(4096).refine(e=>[...e].every(e=>{const t=e.charCodeAt(0);return t>=32&&127!==t})),su=ou.refine(e=>e.length<=256),cu=Ur({id:su,label:ou});function lu(e,t,n){const r=Gr(cu).parse(e);if(new Set(r.map(e=>e.id)).size!==r.length||"first-page"===n&&r.length>20)throw new gr("response");const i=r.slice(0,20);return{label:"first-page"===n?`Showing ${i.length} ${t} from first page`:`Showing ${i.length} of ${r.length} returned ${t}`,items:i}}ao();const du=Ur({object:Dr("api_v2"),organization_id:su.refine(e=>e.trim().length>0),test_mode:Fr(),mode:Mr(["sandbox","production"]).optional(),error:Hr().optional(),errors:Hr().optional()});function uu(e){const t=du.safeParse(e);if(!t.success||void 0!==t.data.mode&&t.data.mode!==(t.data.test_mode?"sandbox":"production"))throw new gr("response");return t.data}ao();const pu=Ur({id:su,name:ou}),hu=Gr(pu).max(20),fu=Gr(Ur({owner:pu.extend({type:Mr(["user","team"])})})).max(20),mu=Ur({status:Dr("ok"),sources:Gr(pu),code:Hr().optional(),message:Hr().optional(),error:Hr().optional(),errors:Hr().optional()}),gu=Gr(Ur({id:Vr().int().positive().max(Number.MAX_SAFE_INTEGER),name:ou})).max(20),wu=Ur({data:Gr(Ur({id:su,title:ou.or(Dr("")),type:Dr("project"),deleted:Fr()})).max(20),page:Ur({total_count:Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER),has_more:Fr(),next_cursor:ou.nullable()}),error:Hr().optional(),errors:Hr().optional()}),vu=Ur({data:Gr(Ur({id:su.refine(e=>/^entity_[A-Za-z0-9_-]+$/.test(e)),name:ou})).max(20),has_next:Fr(),cursor:ou.nullable(),error:Hr().optional(),errors:Hr().optional()}),yu=Ur({datasources:Gr(Ur({name:su})),error:Hr().optional(),errors:Hr().optional()}),bu=[au("List data sources",{providerId:"tinybird",operationId:"provider.datasources.read",method:"GET",path:"/v0/datasources",query:{attrs:"name"}},function(e){return lu(yu.parse(e).datasources.map(({name:e})=>({id:e,label:e})),"data sources","returned")}),au("List entities",{providerId:"lemma",operationId:"provider.entities.read",method:"GET",path:"/v0/entities"},function(e){const t=vu.parse(e);if(t.has_next!==(null!==t.cursor))throw new gr("response");return lu(t.data.map(e=>({id:e.id,label:e.name})),"entities","first-page")}),au("List projects",{providerId:"dovetail",operationId:"provider.projects.read",method:"GET",path:"/api/v1/projects",query:{"page[limit]":20}},function(e){const t=wu.parse(e);if(t.page.total_count<t.data.length||t.page.has_more!==(null!==t.page.next_cursor)||new Set(t.data.map(e=>e.id)).size!==t.data.length)throw new gr("response");return lu(t.data.filter(e=>!e.deleted).map(e=>({id:e.id,label:e.title||"(Untitled project)"})),"active projects","first-page")}),au("List sites",{providerId:"netlify",operationId:"provider.sites.read",method:"GET",path:"/api/v1/sites",query:{page:1,per_page:20}},function(e){return lu(hu.parse(e).map(e=>({id:e.id,label:e.name})),"sites","first-page")}),au("List workspaces",{providerId:"render",operationId:"provider.workspaces.read",method:"GET",path:"/v1/owners",query:{limit:20}},function(e){return lu(fu.parse(e).map(({owner:e})=>({id:e.id,label:e.name})),"workspaces","first-page")}),au("List news sources",{providerId:"newsapi",operationId:"provider.sources.read",method:"GET",path:"/v2/top-headlines/sources"},function(e){return lu(mu.parse(e).sources.map(e=>({id:e.id,label:e.name})),"news sources","returned")}),au("List membership projects",{providerId:"gitlab",operationId:"provider.projects.read",method:"GET",path:"/api/v4/projects",query:{membership:!0,simple:!0,per_page:20,page:1}},function(e){return lu(gu.parse(e).map(e=>({id:String(e.id),label:e.name})),"membership projects","first-page")})];ao();const ku=Ur({id:su,name:ou}),xu=Gr(ku).max(20),Iu=Ur({items:Gr(Ur({id:qr().uuid(),number:Vr().int().positive().max(Number.MAX_SAFE_INTEGER),project_slug:su,state:Mr(["created","errored","setup-pending","setup","pending"])})).max(1e3),next_page_token:qr().max(8192).nullable(),message:Hr().optional(),error:Hr().optional(),errors:Hr().optional()}),ju=Ur({droplets:Gr(ku.extend({id:Vr().int().positive().max(Number.MAX_SAFE_INTEGER)})).max(20),message:Hr().optional(),error:Hr().optional(),errors:Hr().optional()}),_u=Ur({projects:Gr(ku).max(20),page:Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),success:Dr(!0).optional(),error:Hr().optional(),errors:Hr().optional(),messages:Hr().optional()});function Su(e){return lu(xu.parse(e).map(({id:e,name:t})=>({id:e,label:t})),"pipelines","first-page")}function Au(e){if(!e||"."===e||".."===e||e.length>256||/[\s/%\\?#]/.test(e)||[...e].some(e=>e.charCodeAt(0)<32||127===e.charCodeAt(0)))throw new Error("Configure a canonical organization or project slug.");return encodeURIComponent(e)}function Cu(e){const t="buildkite"===e?"organization_slug":"project_slug",n="buildkite"===e?"List pipelines":"List project pipelines";return{providerId:e,id:"provider.pipelines.read",label:n,async read(r,i,a){if(a.assertCurrent(),Object.keys(i).length)throw new Error("Pipeline inventory does not accept request overrides.");const o=on(r);if(o?.providerId!==e||"api-key"!==o.configuration.method)throw new Error("Use this provider's verified saved API connection.");const s=o.revision,c=o.fingerprint,l=o.configuration.parameters[t]??"",d=function(e,t){if("buildkite"===e)return`/v2/organizations/${Au(t)}/pipelines`;const n=t.split("/");if(3!==n.length)throw new Error("Configure the CircleCI project slug as vcs/org/project.");return`/api/v2/project/${n.map(Au).join("/")}/pipeline`}(e,l),u=()=>{a.assertCurrent();const e=on(r);if(!e||e.revision!==s||e.fingerprint!==c)throw new Error("The saved inventory target changed. Reopen its configuration.")},p=await au(n,{providerId:e,operationId:"provider.pipelines.read",method:"GET",path:d,query:"buildkite"===e?{page:1,per_page:20}:void 0,onDispatch:u},"buildkite"===e?Su:e=>function(e,t){const n=Iu.parse(e);if(n.items.some(e=>e.project_slug!==t))throw new gr("response");return lu(n.items.map(e=>({id:e.id.toLowerCase(),label:`Pipeline ${e.number} — ${e.state}`})),"pipelines from first page","returned")}(e,l)).read(r,i,a);return u(),p}}}const Eu=Ur({meta:Ur({limit:Vr().int().positive().max(20),offset:Dr(0),total_count:Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER),next:ou.nullable(),previous:ou.nullable()}),objects:Gr(Ur({number:qr().regex(/^\+?[0-9]{1,32}$/),alias:ou.or(Dr("")).nullable()})).max(20),error:Hr().optional(),errors:Hr().optional()});function Tu(e){const t=Eu.parse(e),n=t.objects;if(n.length>t.meta.limit||n.length>t.meta.total_count)throw new gr("response");return lu(n.map(e=>({id:e.number.replace(/^\+/,""),label:e.alias?`${e.number} — ${e.alias}`:e.number})),"rented phone numbers","first-page")}const Nu=[{providerId:"plivo",id:"provider.numbers.read",label:"List rented phone numbers",async read(e,t,n){if(n.assertCurrent(),Object.keys(t).length)throw new Error("Number inventory does not accept request overrides.");const r=on(e);if("plivo"!==r?.providerId||"api-key"!==r.configuration.method)throw new Error("Use the verified saved Plivo API connection.");const i=`/v1/Account/${Au(r.configuration.parameters.auth_id??"")}/Number/`,a=()=>{n.assertCurrent();const t=on(e);if(t?.revision!==r.revision||t.fingerprint!==r.fingerprint)throw new Error("The saved Plivo account changed. Reopen its configuration.")},o=await au("List rented phone numbers",{providerId:"plivo",operationId:"provider.numbers.read",method:"GET",path:i,query:{limit:20,offset:0},onDispatch:a},Tu).read(e,t,n);return a(),o}},Cu("buildkite"),Cu("circleci"),au("List droplets",{providerId:"digitalocean",operationId:"provider.droplets.read",method:"GET",path:"/v2/droplets",query:{page:1,per_page:20}},function(e){return lu(ju.parse(e).droplets.map(({id:e,name:t})=>({id:String(e),label:t})),"non-GPU droplets","first-page")}),au("List accessible projects",{providerId:"doppler",operationId:"provider.projects.read",method:"GET",path:"/v3/projects",query:{page:1,per_page:20}},function(e){return lu(_u.parse(e).projects.map(({id:e,name:t})=>({id:e,label:t})),"projects","first-page")})];ao();const zu=Ur({id:su,name:ou}),$u={error:Hr().optional(),errors:Hr().optional(),message:Hr().optional(),success:Dr(!0).optional(),ok:Dr(!0).optional(),status:Hr().optional()},Pu=Ur({projects:Gr(zu.extend({org_id:su.optional()})).max(20),pagination:Ur({cursor:qr().max(8192).nullable().optional()}).optional(),unavailable:Gr(Hr()).optional(),...$u}),Ou=qr().min(1).max(45).regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/),Ru=Ur({indexes:Gr(Ur({name:Ou})).max(1e3),...$u}),Lu=Ur({data:Gr(zu).max(20),nextCursor:qr().max(8192).nullable().optional(),...$u}),Uu=Ur({items:Gr(zu).max(20),total_count:Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER),...$u}),Du=[{providerId:"neon",id:"provider.projects.read",label:"List projects",async read(e,t,n){if(n.assertCurrent(),Object.keys(t).length)throw new Error("Project inventory does not accept request overrides.");const r=on(e);if("neon"!==r?.providerId||"api-key"!==r.configuration.method)throw new Error("Use the verified saved Neon API connection.");const i=su.parse(r.configuration.parameters.org_id),a=()=>{n.assertCurrent();const t=on(e);if(t?.revision!==r.revision||t?.fingerprint!==r.fingerprint)throw new Error("The saved Neon organization changed. Reopen its configuration.")},o=await au("List projects",{providerId:"neon",operationId:"provider.projects.read",method:"GET",path:"/api/v2/projects",query:{limit:20,org_id:i},onDispatch:a},e=>function(e,t){const n=Pu.parse(e);if(n.projects.some(e=>void 0!==e.org_id&&e.org_id!==t))throw new gr("response");return lu(n.projects.map(({id:e,name:t})=>({id:e,label:t})),"projects","first-page")}(e,i)).read(e,t,n);return a(),o}},au("List indexes",{providerId:"pinecone",operationId:"provider.indexes.read",method:"GET",path:"/indexes",headers:{"X-Pinecone-API-Version":"2025-04"}},function(e){return lu(Ru.parse(e).indexes.map(({name:e})=>({id:e,label:e})),"indexes","returned")}),au("List workflows",{providerId:"n8n",operationId:"provider.workflows.read",method:"GET",path:"/api/v1/workflows",query:{limit:20,excludePinnedData:!0}},function(e){return lu(Lu.parse(e).data.map(({id:e,name:t})=>({id:e,label:t})),"workflows","first-page")}),au("List domains",{providerId:"mailgun",operationId:"provider.domains.read",method:"GET",path:"/v4/domains",query:{limit:20,skip:0}},function(e){const t=Uu.parse(e);if(t.total_count<t.items.length)throw new gr("response");return lu(t.items.map(({id:e,name:t})=>({id:e,label:t})),"domains","first-page")})];ao();const qu=Ur({data:Gr(Ur({token:qr().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i),state:Mr(["CLOSED","OPEN","PAUSED","PENDING_ACTIVATION","PENDING_FULFILLMENT"]),type:Mr(["MERCHANT_LOCKED","PHYSICAL","SINGLE_USE","VIRTUAL","UNLOCKED","DIGITAL_WALLET"])})).max(20),has_more:Fr(),error:Hr().optional(),errors:Hr().optional()});function Mu(e){const t=qu.safeParse(e);if(!t.success||new Set(t.data.data.map(e=>e.token.toLowerCase())).size!==t.data.data.length)throw new gr("response");return t.data}ao();const Ku=Ur({token:qr().min(1).max(36).refine(function(e){return e.trim().length>0&&[...e].every(e=>{const t=e.charCodeAt(0);return t>=32&&127!==t})}),active:Fr().optional()}),Fu=Ur({count:Vr().int().min(0).max(10).optional(),data:Gr(Ku).max(10).optional(),start_index:Dr(0).optional(),end_index:Vr().int().min(-1).max(9).optional(),is_more:Fr().optional(),error:Hr().optional(),errors:Hr().optional(),error_message:Hr().optional(),error_code:Hr().optional()});function Gu(e){if(ai(e)&&0===Object.keys(e).length)return{data:[],is_more:!1};const t=Fu.safeParse(e);if(!t.success)throw new gr("response");const n=t.data;if(function(e){return 0===e.data?.length&&(void 0===e.count||0===e.count)&&(void 0===e.end_index||e.end_index<=0)&&!0!==e.is_more}(n))return{data:[],is_more:!1};if(!n.data?.length||n.count!==n.data.length||0!==n.start_index||n.end_index!==n.data.length-1||void 0===n.is_more||new Set(n.data.map(e=>e.token)).size!==n.data.length)throw new gr("response");return{data:n.data,is_more:n.is_more}}ao();const Bu={error:Hr().optional(),errors:Hr().optional(),message:Hr().optional(),status:Hr().optional(),code:Hr().optional(),success:Dr(!0).optional()},Vu=Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER),Hu=Ur({items:Gr(Ur({id:su,direction:Mr(["mt","mo"])})).max(20),offset:Dr(0),limit:Dr(20),count:Vu.max(20),totalCount:Vu,ok:Dr(!0).optional(),...Bu}),Ju=Ur({ok:Dr(!0),result:Gr(Ur({command:qr().regex(/^[a-z0-9_]{1,32}$/),description:ou.refine(e=>[...e].length<=256)})).max(100),...Bu}),Wu=Ur({phone_numbers:Gr(Ur({id:qr().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i),phone_number:qr().regex(/^\+[1-9]\d{1,14}$/),line_type:Mr(["iMessage","RCS"]).optional(),forwarding_number:qr().regex(/^\+[1-9]\d{1,14}$/).nullable().optional(),reputation:Ur({status:Mr(["HEALTHY","AT_RISK","CRITICAL"]),doc_url:qr().url().max(4096).refine(e=>[...e].every(e=>e.charCodeAt(0)>=32&&127!==e.charCodeAt(0)))})})),...Bu});function Zu(e){return lu(Wu.parse(e).phone_numbers.map(e=>({id:e.id.toLowerCase(),label:`${e.phone_number}${e.line_type?` — ${e.line_type}`:""} — ${e.reputation.status}`})),"messaging lines","returned")}const Xu=[au("List messages",{providerId:"messagebird",operationId:"provider.messages.read",method:"GET",path:"/messages",query:{limit:20,offset:0},headers:{Accept:"application/json"}},function(e){const t=Hu.parse(e);if(t.count!==t.items.length||t.totalCount<t.count)throw new gr("response");return lu(t.items.map(({id:e,direction:t})=>({id:e,label:"mt"===t?"Outbound SMS":"Inbound SMS"})),"messages","first-page")}),au("List default bot commands",{providerId:"telegram",operationId:"provider.bot-commands.read",method:"GET",path:"/getMyCommands",headers:{Accept:"application/json"}},function(e){return lu(Ju.parse(e).result.map(({command:e,description:t})=>({id:e,label:`/${e} — ${t}`})),"default bot commands","returned")})];ao();const Yu=Jr([su,Vr().int().min(Number.MIN_SAFE_INTEGER).max(Number.MAX_SAFE_INTEGER)]),Qu=Gr(Ur({id:Yu,name:ou,type:ou})),ep=Ur({id:su,name:ou}),tp=Ur({data:Gr(ep).max(20),limit:Dr(20),page:Dr(1),error:Hr().optional(),errors:Hr().optional()}),np=Ur({teams:Gr(ep),error:Hr().optional(),errors:Hr().optional()}),rp=[au("List field definitions",{providerId:"bamboohr",operationId:"provider.fields.read",method:"GET",path:"/api/v1/meta/fields"},function(e){return lu(Qu.parse(e).map(e=>({id:String(e.id),label:e.name})),"field definitions","returned")}),au("List publications",{providerId:"beehiiv",operationId:"provider.publications.read",method:"GET",path:"/v2/publications",query:{limit:20,page:1}},function(e){return lu(tp.parse(e).data.map(e=>({id:e.id,label:e.name})),"publications","first-page")}),au("List workspaces",{providerId:"clickup",operationId:"provider.workspaces.read",method:"GET",path:"/api/v2/team"},function(e){return lu(np.parse(e).teams.map(e=>({id:e.id,label:e.name})),"workspaces","returned")})];ao();const ip=Ur({data:Gr(Ur({token:qr().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i),state:Mr(["CLOSED","OPEN","PAUSED"]),type:Mr(["DIGITAL_WALLET","MERCHANT_LOCKED","SINGLE_USE","UNLOCKED"])})).max(20),page:Dr(1),total_entries:Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER),total_pages:Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER),error:Hr().optional(),errors:Hr().optional()});function ap(e){const t=ip.safeParse(e);if(!t.success)throw new gr("response");const n=t.data;if(new Set(n.data.map(e=>e.token.toLowerCase())).size!==n.data.length||n.data.length>n.total_entries||n.total_entries>0&&(0===n.data.length||0===n.total_pages)||0===n.total_entries&&n.total_pages>1||n.total_entries>0&&n.total_pages>n.total_entries)throw new gr("response");return n}ao();const op=Ur({entity:Dr("collection"),count:Vr().int().min(0).max(20),items:Gr(Ur({entity:Dr("payment"),id:qr().regex(/^pay_[A-Za-z0-9]{1,128}$/),status:Mr(["created","authorized","captured","refunded","failed"]),currency:qr().regex(/^[A-Z]{3}$/),amount:Vr().int().min(0).max(Number.MAX_SAFE_INTEGER)})).max(20),error:Hr().optional(),errors:Hr().optional()});function sp(e){const t=op.safeParse(e);if(!t.success)throw new gr("response");const n=t.data;if(n.count!==n.items.length||new Set(n.items.map(e=>e.id)).size!==n.count)throw new gr("response");return n}ao();const cp=Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER),lp={error:Hr().optional(),errors:Hr().optional(),code:Hr().optional(),message:Hr().optional(),status:Hr().optional(),success:Dr(!0).optional(),ok:Dr(!0).optional()},dp=Ur({lists:Gr(Ur({id:cp,name:ou})).max(20),count:cp.optional(),...lp}),up=Ur({result:Gr(Ur({id:su.refine(e=>36===e.length),name:ou})).max(20),_metadata:Ur({count:cp.optional()}).optional(),...lp}),pp=Ur({items:Gr(Ur({key:su,name:ou})).max(20),totalCount:cp.optional(),...lp}),hp=[au("List contact lists",{providerId:"brevo",operationId:"provider.contact-lists.read",method:"GET",path:"/v3/contacts/lists",query:{limit:20,offset:0}},function(e){const t=dp.parse(e);if(void 0!==t.count&&t.count<t.lists.length)throw new gr("response");return lu(t.lists.map(({id:e,name:t})=>({id:String(e),label:t})),"contact lists","first-page")}),au("List marketing lists",{providerId:"sendgrid",operationId:"provider.marketing-lists.read",method:"GET",path:"/v3/marketing/lists",query:{page_size:20}},function(e){const t=up.parse(e);if(void 0!==t._metadata?.count&&t._metadata.count<t.result.length)throw new gr("response");return lu(t.result.map(({id:e,name:t})=>({id:e,label:t})),"marketing lists","first-page")}),au("List projects",{providerId:"launchdarkly",operationId:"provider.projects.read",method:"GET",path:"/api/v2/projects",query:{limit:20,offset:0}},function(e){const t=pp.parse(e);if(void 0!==t.totalCount&&t.totalCount<t.items.length)throw new gr("response");return lu(t.items.map(({key:e,name:t})=>({id:e,label:t})),"projects","first-page")})];function fp(e){return/^[\x20-\x7e]+$/.test(e)&&e.trim()===e}ao();const mp=qr().min(1).max(64).refine(fp),gp=Ur({object:Dr("list"),url:Dr("/v1/issuing/cards"),has_more:Fr(),data:Gr(Ur({object:Dr("issuing.card"),id:qr().regex(/^ic_[A-Za-z0-9]{1,128}$/).refine(fp),status:mp,type:mp,currency:qr().length(3).regex(/^[a-z]{3}$/)})).max(20),error:Hr().optional(),errors:Hr().optional()});function wp(e){const t=gp.safeParse(e);if(!t.success)throw new gr("response");if(new Set(t.data.data.map(e=>e.id)).size!==t.data.data.length)throw new gr("response");return t.data}ao();const vp=Ur({amount:Vr().int().min(Number.MIN_SAFE_INTEGER).max(Number.MAX_SAFE_INTEGER),currency:qr().regex(/^[a-z]{3}$/)}),yp=Ur({object:Dr("balance"),livemode:Fr(),available:Gr(vp).max(50),pending:Gr(vp).max(50),error:Hr().optional(),errors:Hr().optional()});function bp(e){const t=yp.safeParse(e);if(!t.success)throw new gr("response");for(const n of[t.data.available,t.data.pending])if(new Set(n.map(e=>e.currency)).size!==n.length)throw new gr("response");return t.data}function kp(e){return[...e].every(e=>{const t=e.charCodeAt(0);return t>=32&&127!==t})}ao();const xp=Ur({TotalCount:Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER),Messages:Gr(Ur({MessageID:qr().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i),Subject:qr().max(4096).refine(kp),Status:Mr(["Sent","Processed","Queued"]),MessageStream:Dr("outbound")})).max(20),ErrorCode:Hr().optional(),Message:Hr().optional(),error:Hr().optional(),errors:Hr().optional()}),Ip=Ur({items:Gr(Ur({name:qr().min(1).max(4096).refine(kp)})).max(20),nbPages:Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),message:Hr().optional(),status:Hr().optional(),error:Hr().optional(),errors:Hr().optional()}),jp=Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER),_p=Ur({success:Dr(!0),errors:Gr(Hr()).max(0),result:Gr(Ur({id:qr().min(1).max(32).refine(kp),name:qr().min(1).max(253).refine(kp)})).max(20),result_info:Ur({page:Dr(1).optional(),per_page:Dr(20).optional(),count:jp.optional(),total_count:jp.optional(),total_pages:jp.optional()}).optional(),error:Hr().optional()}),Sp=Ur({sys:Ur({type:Dr("Array")}),total:Vr().int().nonnegative().max(Number.MAX_SAFE_INTEGER),skip:Dr(0),limit:Dr(20),items:Gr(Ur({sys:Ur({type:Dr("Space"),id:qr().min(1).max(256).refine(kp)}),name:qr().min(1).max(4096).refine(kp)})).max(20),error:Hr().optional(),errors:Hr().optional()}),Ap=Gr(Ur({id:Vr().int().positive().max(Number.MAX_SAFE_INTEGER),name:qr().min(1).max(4096).refine(kp)})).max(20),Cp=[...Xu,au("List messaging lines",{providerId:"linq",operationId:"provider.phone-numbers.read",method:"GET",path:"/api/partner/v3/phone_numbers",headers:{Accept:"application/json"}},Zu),...hp,au("Read platform organization",{providerId:"agentcard",operationId:"provider.organization.read",method:"GET",path:"/api/v2"},function(e){const t=uu(e),n=t.test_mode?"test mode":"production";return{label:`Agentcard platform organization (${n})`,items:[{id:t.organization_id,label:`${t.organization_id} — ${n}`}]}}),au("List users",{providerId:"marqeta",operationId:"provider.users.read",method:"GET",path:"/v3/users",query:{count:10,start_index:0,fields:"token,active"}},function(e){const t=Gu(e);return{label:`Showing ${t.data.length} users from first page${t.is_more?"; more available":""}`,items:t.data.map(e=>({id:e.token,label:`${e.token} — ${void 0===e.active?"status not returned":e.active?"active":"inactive"}`}))}}),...Nu,...rp,...bu,...Du,au("List cards",{providerId:"privacy",operationId:"provider.cards.read",method:"GET",path:"/v1/cards",query:{page:1,page_size:20}},function(e){const t=ap(e);return{label:`Showing ${t.data.length} cards from first page${t.total_pages>1?"; more available":""}`,items:t.data.map(e=>({id:e.token,label:`${e.token} — ${e.state} (${e.type})`}))}}),au("List cards",{providerId:"lithic",operationId:"provider.cards.read",method:"GET",path:"/v1/cards",query:{page_size:20},headers:{"api-version":"2026-07-01"}},function(e){const t=Mu(e);return{label:`Showing ${t.data.length} cards from first page${t.has_more?"; more available":""}`,items:t.data.map(e=>({id:e.token,label:`${e.token} — ${e.state} (${e.type})`}))}}),au("List monitors",{providerId:"datadog",operationId:"provider.monitors.read",method:"GET",path:"/api/v1/monitor",query:{page:0,page_size:20}},function(e){const t=Ap.parse(e);if(new Set(t.map(e=>e.id)).size!==t.length)throw new gr("response");return{label:`Showing ${t.length} ${1===t.length?"monitor":"monitors"} from first page`,items:t.map(e=>({id:String(e.id),label:e.name}))}}),au("List payments",{providerId:"razorpay",operationId:"provider.payments.read",method:"GET",path:"/v1/payments",query:{count:20,skip:0}},function(e){const t=sp(e);return{label:`Showing ${t.count} payments from first page; amounts in minor units`,items:t.items.map(e=>({id:e.id,label:`${e.id} — ${e.status} (${e.currency} ${e.amount} minor units)`}))}}),au("List Issuing cards",{providerId:"stripe-issuing",operationId:"provider.issuing-cards.read",method:"GET",path:"/v1/issuing/cards",query:{limit:20},headers:{"Stripe-Version":"2026-09-30.endive"}},function(e){const t=wp(e);return{label:`Showing ${t.data.length} Issuing cards${t.has_more?" from first page; more available":""}`,items:t.data.map(e=>({id:e.id,label:`${e.id} — ${e.status} (${e.type})`}))}}),au("Read account balance",{providerId:"stripe",operationId:"provider.balance.read",method:"GET",path:"/v1/balance",headers:{"Stripe-Version":"2026-09-30.endive"}},function(e){const t=bp(e);return{label:`Stripe balance (${t.livemode?"live":"sandbox"}); amounts in minor units`,items:["available","pending"].flatMap(e=>t[e].map(t=>({id:`${e}:${t.currency}`,label:`${"available"===e?"Available":"Pending"} ${t.currency.toUpperCase()}: ${t.amount} minor units`})))}}),{providerId:"agentmail",id:"provider.inboxes.read",label:"List inboxes",read:async function(e,t,n=Gt()){if(n.assertCurrent(),Object.keys(t).length)throw new Error("List inboxes does not accept request fields");const r=await Yd(e,{providerId:"agentmail",operationId:"provider.inboxes.read",method:"GET",path:"/v0/inboxes",query:{limit:20}},{},ru,n);return nu.parse(r)}},au("List outbound messages",{providerId:"postmark",operationId:"provider.messages.read",method:"GET",path:"/messages/outbound",query:{count:20,offset:0,messagestream:"outbound"}},function(e){const t=xp.parse(e);if(t.Messages.length>t.TotalCount||new Set(t.Messages.map(e=>e.MessageID.toLowerCase())).size!==t.Messages.length)throw new gr("response");return{label:`Showing ${t.Messages.length} of ${t.TotalCount} messages in outbound stream`,items:t.Messages.map(e=>({id:e.MessageID,label:`${e.Subject||"(No subject)"} — ${e.Status}`}))}}),au("List spaces",{providerId:"contentful",operationId:"provider.spaces.read",method:"GET",path:"/spaces",query:{limit:20,skip:0}},function(e){const t=Sp.parse(e);if(t.total<t.items.length||new Set(t.items.map(e=>e.sys.id)).size!==t.items.length)throw new gr("response");return{label:`Showing ${t.items.length} of ${t.total} spaces from first page`,items:t.items.map(e=>({id:e.sys.id,label:e.name}))}}),au("List zones",{providerId:"cloudflare",operationId:"provider.zones.read",method:"GET",path:"/client/v4/zones",query:{page:1,per_page:20}},function(e){const t=_p.parse(e),n=t.result_info,r=t.result.length;if(new Set(t.result.map(e=>e.id)).size!==r||void 0!==n?.count&&n.count!==r||void 0!==n?.total_count&&n.total_count<r||0===n?.total_pages&&r>0)throw new gr("response");return{label:`Showing ${r} ${1===r?"zone":"zones"} from first page`,items:t.result.map(e=>({id:e.id,label:e.name}))}}),au("List indices",{providerId:"algolia",operationId:"provider.indices.read",method:"GET",path:"/1/indexes",query:{page:0,hitsPerPage:20}},function(e){const t=Ip.parse(e);if(new Set(t.items.map(e=>e.name)).size!==t.items.length||0===t.nbPages&&t.items.length>0)throw new gr("response");return{label:`Showing ${t.items.length} ${1===t.items.length?"index":"indices"} from first page`,items:t.items.map(e=>({id:e.name,label:e.name}))}})];function Ep(e,t,n,r,i){i.assertCurrent();const a=Cp.find(t=>t.providerId===e&&t.id===n);return a?a.read(t,r,i):null}const Tp=48,Np=[42,134,72,134,247,13,1,9,14],zp=[85,29,17],$p=[42,134,72,206,61,4,3,2];function Pp(e){const t=new Uint8Array(e.reduce((e,t)=>e+t.length,0));let n=0;for(const r of e)t.set(r,n),n+=r.length;return t}function Op(e){if(e<128)return Uint8Array.of(e);const t=[];for(let n=e;n>0;n=Math.floor(n/256))t.unshift(n%256);return Uint8Array.of(128|t.length,...t)}function Rp(e,...t){const n=Pp(t);return Pp([Uint8Array.of(e),Op(n.length),n])}function Lp(e){let t=0;for(;t<e.length-1&&0===e[t];)t+=1;const n=e.slice(t);return Rp(2,void 0!==n[0]&&n[0]>=128?Pp([Uint8Array.of(0),n]):n)}const Up=/^(?:\*\.)?(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;function Dp(e){return Up.test(e)||/^(?:\*\.)?(?:[a-z0-9-]+\.)+xn--[a-z0-9-]{1,59}$/.test(e)}async function qp(e,t=262144){const n=e.body?.getReader();if(!n)throw new gr("response");const r=[];let i=0;try{for(;;){const e=await n.read();if(e.done)break;if(i+=e.value.byteLength,i>t)throw new gr("response");r.push(e.value)}const e=new Uint8Array(i);let a=0;for(const t of r)e.set(t,a),a+=t.length;return new TextDecoder("utf-8",{fatal:!0}).decode(e)}finally{await n.cancel().catch(()=>{}),n.releaseLock()}}const Mp={production:"https://acme-v02.api.letsencrypt.org/directory",staging:"https://acme-staging-v02.api.letsencrypt.org/directory"},Kp=/^[A-Za-z0-9_-]{8,128}$/,Fp={name:"ECDSA",namedCurve:"P-256"};async function Gp(e){try{const t=JSON.parse(e),n=ai(t)?t:null;if(!(n&&"EC"===n.kty&&"P-256"===n.crv&&ni(n.x)&&ni(n.y)&&ni(n.d)))throw new Error("not an account key");const r=await crypto.subtle.importKey("jwk",n,Fp,!1,["sign"]),i={crv:"P-256",kty:"EC",x:n.x,y:n.y},a=new Uint8Array(await crypto.subtle.digest("SHA-256",(new TextEncoder).encode(JSON.stringify(i))));return{privateKey:r,jwk:i,thumbprint:ko(a)}}catch{throw new Error("The saved account key is not usable; connect again")}}async function Bp(e,t){const n=(new TextEncoder).encode(`${e}.${t.thumbprint}`);return ko(new Uint8Array(await crypto.subtle.digest("SHA-256",n)))}function Vp(e,t){let n="";try{const e=JSON.parse(t),r=ai(e)?e.type:void 0;ni(r)&&(n=r.replace("urn:ietf:params:acme:error:",""))}catch{}return"badNonce"===n?"badNonce":"rateLimited"===n||429===e?"rate-limit":["unauthorized","accountDoesNotExist","badSignatureAlgorithm"].includes(n)||401===e?"authorization":["userActionRequired","caa","rejectedIdentifier","externalAccountRequired"].includes(n)||403===e?"permission":"other"}const Hp={badNonce:"response",authorization:"authorization",permission:"permission","rate-limit":"rate-limit",other:"response"};function Jp(e){const t=Number(e.get("retry-after"));return Number.isFinite(t)&&t>0?1e3*Math.min(t,10):null}async function Wp(e,t,n,r){e.assertCurrent();const i=new AbortController,a=setTimeout(()=>i.abort(),2e4);try{const a=await e.fetch(t,{...n,signal:i.signal,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"});if(e.assertCurrent(),a.redirected)throw new gr("response");const o="HEAD"===n.method?"":await qp(a,r);if(i.signal.aborted)throw new gr("network");return{response:a,text:o}}catch(o){if(o instanceof gr)throw o;if(o instanceof di)throw new gr("deployment");throw new gr("network")}finally{clearTimeout(a)}}function Zp(e){const t=new URL(Mp[e]).host;return e=>{if(!ni(e)||e.length>512)return!1;try{const n=new URL(e);return"https:"===n.protocol&&n.host===t&&!n.username&&!n.password&&!n.search&&!n.hash&&n.pathname.startsWith("/acme/")}catch{return!1}}}async function Xp(e,t,n,r,i){const a=xo(JSON.stringify({alg:"ES256",nonce:t,url:n,..."kid"===i.kind?{kid:i.url}:{jwk:e.jwk}})),o=null===r?"":xo(JSON.stringify(r)),s=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e.privateKey,(new TextEncoder).encode(`${a}.${o}`));return JSON.stringify({protected:a,payload:o,signature:ko(new Uint8Array(s))})}async function Yp(e,t,n){const r=Zp(e),i=await async function(e,t){const n=Zp(e),{response:r,text:i}=await Wp(t,Mp[e],{method:"GET",headers:{Accept:"application/json"}},65536);if(!r.ok)throw new gr("response",r.status);let a;try{a=JSON.parse(i)}catch{throw new gr("response")}const o=ai(a)?a:null,s=o?.newNonce,c=o?.newAccount,l=o?.newOrder;if(!n(s)||!n(c)||!n(l))throw new gr("response");return{newNonce:s,newAccount:c,newOrder:l}}(e,n),a=function(e,t){let n=null;return{remember(e){const t=e.get("replay-nonce");n=t&&Kp.test(t)?t:null},async next(){if(n){const e=n;return n=null,e}const r=(await Wp(e,t,{method:"HEAD"},1024)).response.headers.get("replay-nonce");if(!r||!Kp.test(r))throw new gr("response");return r}}}(n,i.newNonce);return{environment:e,directory:i,post:async function(e,i,o,s="application/json"){if(!r(e)||"kid"===o.kind&&!r(o.url))throw new gr("response");for(let r=0;;r+=1){const{response:c,text:l}=await Wp(n,e,{method:"POST",headers:{"Content-Type":"application/jose+json",Accept:s},body:await Xp(t,await a.next(),e,i,o)},131072);if(a.remember(c.headers),c.ok)return{status:c.status,text:l,location:c.headers.get("location"),retryAfterMs:Jp(c.headers)};const d=Vp(c.status,l);if("badNonce"!==d||0!==r)throw new gr(Hp[d],c.status)}},own:r}}function Qp(e){try{const t=JSON.parse(e.text);if(ai(t))return t}catch{}throw new gr("response")}const eh=/^[A-Za-z0-9_-]{16,128}$/,th=/^(?:-----BEGIN CERTIFICATE-----\r?\n[A-Za-z0-9+/=\r\n]+\r?\n-----END CERTIFICATE-----\r?\n?){1,8}$/,nh="Let's Encrypt rejected this order, usually because a DNS record was not found in time. Publish the TXT records, wait for them to appear, then start again with Issue.",rh=e=>new Promise(t=>setTimeout(t,e));function ih(e,t){return Zp(e)(t)&&/^\/acme\/order\/\d{1,20}\/\d{1,20}$/.test(new URL(t).pathname)}function ah(e,t,n){if(!Array.isArray(t)||!t.length||t.length>n)throw new gr("response");return t.map(t=>{if(!e.own(t))throw new gr("response");return t})}function oh(e){const t=Array.isArray(e.challenges)?e.challenges:[];for(const n of t)if(ai(n)&&"dns-01"===n.type)return n;throw new gr("response")}async function sh(e,t,n,r,i){for(let a=0;a<20;a+=1){const a=await e.post(n,null,{kind:"kid",url:t}),o=Qp(a);if("invalid"===o.status)throw new Error(nh);if(o.status===r)return o;await i(a.retryAfterMs??2e3)}throw new Error("Let's Encrypt has not finished checking yet. Try Finish again in a minute.")}async function ch(e,t,n,r=rh){const i={kind:"kid",url:t};let a=Qp(await e.post(n,null,i));if("invalid"===a.status)throw new Error(nh);if(["valid","processing"].includes(String(a.status)))throw new Error("That order has already been finished or was interrupted, and its private key is shown only once. Start a new order with Issue.");if("pending"===a.status)await async function(e,t,n){const r={kind:"kid",url:t};for(const i of ah(e,n.authorizations,20)){const t=Qp(await e.post(i,null,r));if("valid"===t.status)continue;if("pending"!==t.status)throw new Error(nh);const n=oh(t);if("pending"===n.status){if(!e.own(n.url))throw new gr("response");await e.post(n.url,{},r)}}}(e,t,a),a=await sh(e,t,n,"ready",r);else if("ready"!==a.status)throw new gr("response");const o=(Array.isArray(a.identifiers)?a.identifiers:[]).map(e=>ai(e)?e.value:void 0);if(!o.length||o.length>20||!o.every(e=>ni(e)&&Dp(e))||!e.own(a.finalize))throw new gr("response");const s=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),c=await async function(e,t){if(!e.length||e.some(e=>!Dp(e)))throw new Error("Enter valid DNS names");const n=Rp(Tp,...e.map(e=>Rp(130,(new TextEncoder).encode(e)))),r=Rp(Tp,Rp(Tp,Rp(6,Uint8Array.from(zp)),Rp(4,n))),i=Rp(Tp,Rp(2,Uint8Array.of(0)),Rp(Tp),new Uint8Array(await crypto.subtle.exportKey("spki",t.publicKey)),Rp(160,Rp(Tp,Rp(6,Uint8Array.from(Np)),Rp(49,r)))),a=new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},t.privateKey,li(i)));return Rp(Tp,i,Rp(Tp,Rp(6,Uint8Array.from($p))),Rp(3,Uint8Array.of(0),function(e){const t=e.length/2;return Rp(Tp,Lp(e.slice(0,t)),Lp(e.slice(t)))}(a)))}(o,s);await e.post(a.finalize,{csr:ko(c)},i);const l=await sh(e,t,n,"valid",r);if(!e.own(l.certificate))throw new gr("response");const d=await e.post(l.certificate,null,i,"application/pem-certificate-chain");if(!th.test(d.text))throw new gr("response");return{chain:d.text,privateKey:(u=new Uint8Array(await crypto.subtle.exportKey("pkcs8",s.privateKey)),p="PRIVATE KEY",`-----BEGIN ${p}-----\n${Io(u).match(/.{1,64}/g)?.join("\n")??""}\n-----END ${p}-----\n`)};var u,p}const lh="account_key",dh=["production","staging"];function uh(e){const t=e.parameters.environment,n=dh.find(e=>e===t);if(!n)throw new Error("Choose production or staging");return n}async function ph(e,t){const n=uh(e),r=e.parameters.account_url;if(!Zp(n)(r))throw new Error("Verify Let's Encrypt access before use");const i=await Gp(e.credentials[lh]??"");return{key:i,account:r,client:await Yp(n,i,t)}}const hh=sn({family:"Let's Encrypt",idPrefix:"conn_acme_",accepts:function(e){return"letsencrypt"===Ve(e)},classification:{publicParameters:["environment","accept_terms","account_url"],privateCredentials:[lh]},ui:function(){return{name:"Let's Encrypt",methodLabel:"ACME account",instructions:"Creates an ACME account with a key made in this browser and sealed on this device; no key is asked for. Open an order for your DNS names to get the TXT records to publish, then finish it once they resolve: the certificate chain and a new private key come back once and are not kept. Only DNS validation is offered, because a page cannot answer an HTTP request. Use staging while you test; it has far higher limits and issues untrusted certificates.",fields:[{id:"environment",label:"Environment",kind:"choice",secret:!1,required:!0,defaultValue:"production",choices:[{id:"production",label:"Production (trusted certificates)"},{id:"staging",label:"Staging (for testing)"}]},{id:"accept_terms",label:"Subscriber Agreement",kind:"choice",secret:!1,required:!0,choices:[{id:"yes",label:"I agree to the Let's Encrypt Subscriber Agreement"}]}],links:[{label:"Let's Encrypt Subscriber Agreement",url:"https://letsencrypt.org/repository/"},{label:"Challenge types",url:"https://letsencrypt.org/docs/challenge-types/"},{label:"ACME (RFC 8555)",url:"https://www.rfc-editor.org/rfc/rfc8555"}],disconnectExplanation:"Disconnect forgets this device's ACME account key. It deactivates nothing at Let's Encrypt, and certificates already issued stay valid until they expire.",actions:[{id:"certificate.issue",label:"Open an order and get the DNS records",fields:[{id:"domains",label:"DNS names",kind:"text",secret:!1,required:!0,placeholder:"example.com, *.example.com"}]},{id:"certificate.finish",label:"Finish an order and download the certificate",fields:[{id:"order_url",label:"Order address",kind:"text",secret:!1,required:!0,placeholder:"https://acme-v02.api.letsencrypt.org/acme/order/…"}]}]}},parse:async function(e,t){const n=function(e){if(Object.keys(e.requestedScopes??{}).length||Object.keys(e.targetIds??{}).length||Object.keys(e.credentials).length||Object.keys(e.parameters).some(e=>!["environment","accept_terms"].includes(e)))throw new Error("Choose an environment and agree to the terms");const t=dh.find(t=>t===e.parameters.environment);if(!t)throw new Error("Choose production or staging");if("yes"!==e.parameters.accept_terms)throw new Error("Agree to the Let's Encrypt Subscriber Agreement to create an account");return t}(e),r=t?.configuration.parameters.environment===n?t:null,i=r?.privateState.credentials[lh]??await async function(){const e=await crypto.subtle.generateKey(Fp,!0,["sign","verify"]);return JSON.stringify(await crypto.subtle.exportKey("jwk",e.privateKey))}(),a=r?.configuration.parameters.account_url,o={[lh]:i};wr(e.displayName,o),vr(e.icon??"",o);const s={environment:n,accept_terms:"yes"};return{providerId:e.providerId,parameters:a?{...s,account_url:a}:s,credentials:o}},fingerprint:e=>async function(e){const t=(new TextEncoder).encode(Bt({contract:"acme:rfc8555:dns-01:v1",parameters:{environment:e}}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",t))].map(e=>e.toString(16).padStart(2,"0")).join("")}(e.parameters.environment??""),prove:async function(e,t){const n=uh(e),r=await Gp(e.credentials[lh]??""),i=await async function(e){const t=await e.post(e.directory.newAccount,{termsOfServiceAgreed:!0},{kind:"jwk"}),n=t.location;if(!e.own(n)||!/^\/acme\/acct\/\d{1,20}$/.test(new URL(n).pathname))throw new gr("response");if("valid"!==Qp(t).status)throw new gr("authorization");return n}(await Yp(n,r,t));return{identity:{id:i,label:`${"staging"===n?"Staging":"Production"} account ${i.split("/").pop()}`,kind:"acme-account"},targets:[{id:n,label:`Let's Encrypt ${n}`,kind:"environment"}],grantLabel:"Let's Encrypt account key",target:{key:"environment",id:n},update:{parameters:{account_url:i}}}},refused:e=>"authorization"===e.code,targetOf:e=>({providerId:e.configuration.providerId,parameters:e.configuration.parameters,credentials:e.privateState.credentials}),operations:[{id:"certificate.issue",inputKeys:["domains"],run:async(e,t,n)=>{const r=function(e){const t=[...new Set(e.toLowerCase().split(/[\s,;]+/).filter(Boolean))];if(!t.length||t.length>20)throw new Error("Enter between 1 and 20 DNS names");if(t.find(e=>!Dp(e)))throw new Error("Enter DNS names such as example.com or *.example.com");return t}(n.domains??""),{key:i,account:a,client:o}=await ph(e,t),s=await async function(e,t,n,r){const i={kind:"kid",url:n},a=await e.post(e.directory.newOrder,{identifiers:r.map(e=>({type:"dns",value:e}))},i),o=a.location;if(!ih(e.environment,o))throw new gr("response");const s=Qp(a),c=[],l=[];for(const d of ah(e,s.authorizations,r.length)){const n=Qp(await e.post(d,null,i)),r=ai(n.identifier)?n.identifier.value:void 0;if(!ni(r)||!Dp(r))throw new gr("response");if("valid"===n.status){l.push(r);continue}if("pending"!==n.status)throw new gr("response");const a=oh(n).token;if(!ni(a)||!eh.test(a))throw new gr("response");c.push({name:`_acme-challenge.${r}`,value:await Bp(a,t)})}return{orderUrl:o,records:c,alreadyValid:l}}(o,i,a,r);return{label:s.records.length?`Publish ${s.records.length} TXT record${1===s.records.length?"":"s"}, wait for them to resolve, then finish the order`:"Every name is already validated; finish the order",items:[{id:"order",label:"Order address (paste into Finish)",secretValue:s.orderUrl},...s.records.map((e,t)=>({id:`txt-${t}`,label:`TXT ${e.name}`,secretValue:e.value})),...s.alreadyValid.map(e=>({id:`valid-${e}`,label:`${e} is already validated`}))]}}},{id:"certificate.finish",inputKeys:["order_url"],run:async(e,t,n)=>{const r=uh(e),i=(n.order_url??"").trim();if(!ih(r,i))throw new Error("Paste the order address that Issue gave you");const{account:a,client:o}=await ph(e,t),s=await ch(o,a,i);return{label:"Certificate issued; the private key is shown once",items:[{id:"certificate",label:"Certificate chain (PEM)",secretValue:s.chain},{id:"private_key",label:"Private key (PEM)",secretValue:s.privateKey}]}}}]}),fh={aws:{name:"AWS Secrets Manager",service:"secretsmanager",targetPrefix:"secretsmanager",allowedName:/^[A-Za-z0-9/_+=.@-]{1,512}$/},"aws-ps":{name:"AWS Parameter Store",service:"ssm",targetPrefix:"AmazonSSM",allowedName:/^[A-Za-z0-9_./-]{1,1011}$/}},mh=["aws","aws-ps"];function gh(e){const t=Ve(e);return mh.find(e=>e===t)??null}function wh(e){const t=gh(e);if(!t)throw new Error("This is not an AWS connection");return t}const vh={publicParameters:["region","access_key_id"],privateCredentials:["secret_access_key","session_token"]},yh=/^[a-z]{2}(?:-[a-z]+)+-\d{1,2}$/;function bh(e,t){if(!yh.test(t))throw new Error("Enter a valid AWS region");return new URL(`https://${e}.${t}.amazonaws.com/`)}function kh(e,t){return bh(fh[e].service,t)}function xh(e,t){if(!t||Object.keys(e.requestedScopes??{}).length||Object.keys(e.targetIds??{}).length)throw new Error("Configure only an AWS region and its access key");if(Object.keys(e.parameters).some(e=>!vh.publicParameters.includes(e))||Object.keys(e.credentials).some(e=>!vh.privateCredentials.includes(e)))throw new Error("Unsupported AWS configuration field")}function Ih(e){const t=Object.fromEntries(vh.publicParameters.map(t=>[t,(e.parameters[t]??"").trim()]));if(bh("sts",t.region??""),!/^[A-Z0-9]{16,128}$/.test(t.access_key_id??""))throw new Error("Enter a valid AWS access key ID");return t}function jh(e,t){const n=Object.fromEntries(vh.privateCredentials.map(n=>[n,e.credentials[n]||t?.privateState.credentials[n]||""]));if(e.credentials.secret_access_key&&!e.credentials.session_token&&(n.session_token=""),!n.secret_access_key||Object.values(n).some(e=>e.length>16384||e&&!/^[!-~]+$/.test(e)))throw new Error("Enter valid AWS signing credentials");return n}const _h=new Set(["UnrecognizedClientException","InvalidSignatureException","InvalidClientTokenId","SignatureDoesNotMatch","ExpiredTokenException","ExpiredToken","IncompleteSignature","MissingAuthenticationToken","MissingAuthenticationTokenException"]),Sh=new Set(["AccessDeniedException","AccessDenied","UnauthorizedOperation"]),Ah=new Set(["ThrottlingException","TooManyRequestsException","RequestLimitExceeded"]);function Ch(e,t){return 429===e||Ah.has(t)?new gr("rate-limit",e):_h.has(t)||401===e?new gr("authorization",e):Sh.has(t)||403===e?new gr("permission",e):new gr("response",e)}function Eh(e){return{accessKeyId:e.parameters.access_key_id??"",secretAccessKey:qo(e.credentials.secret_access_key??""),sessionToken:e.credentials.session_token?qo(e.credentials.session_token):void 0}}async function Th(e,t,n,r){t.assertCurrent();const i=fh[e.service],a=JSON.stringify(r),o=Po({method:"POST",url:kh(e.service,e.parameters.region??""),headers:new Headers({"content-type":"application/x-amz-json-1.1","x-amz-target":`${i.targetPrefix}.${n}`}),payloadHash:No(zo((new TextEncoder).encode(a))),region:e.parameters.region??"",credentials:Eh(e),service:i.service,payloadHashHeader:!1,pathEncoding:"twice"}),s=new AbortController,c=setTimeout(()=>s.abort(),15e3);try{const e=await t.fetch(o.url,{method:"POST",headers:o.headers,body:a,signal:s.signal,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"});if(t.assertCurrent(),e.redirected)throw new gr("response");const n=await qp(e);if(!e.ok)throw function(e,t){return Ch(e,function(e){try{const t=JSON.parse(e),n=ai(t)?t.__type:void 0;return ni(n)?n.split("#").pop()??"":""}catch{return""}}(t))}(e.status,n);if(t.assertCurrent(),s.signal.aborted)throw new gr("network");const r=JSON.parse(n);if(!ai(r))throw new gr("response");return r}catch(l){if(l instanceof gr)throw l;if(l instanceof di)throw new gr("deployment");if(l instanceof SyntaxError)throw new gr("response");throw new gr("network")}finally{clearTimeout(c)}}async function Nh(e,t){const n="aws"===e.service,r=await Th(e,t,n?"ListSecrets":"DescribeParameters",{MaxResults:n?20:10}),i=fh[e.service].allowedName,a=function(e,t){const n=ai(e)?e[t]:void 0;if(!Array.isArray(n))throw new gr("response");return n}(r,n?"SecretList":"Parameters");if(a.length>100)throw new gr("response");return a.map(t=>{const n=ai(t)?t.Name:void 0;if(!ni(n)||!i.test(n))throw new gr("response");return{id:n,label:wr(n,e.credentials)}})}const zh=[{id:"region",label:"Region",kind:"text",secret:!1,required:!0,defaultValue:"us-east-1",placeholder:"us-east-1"},{id:"access_key_id",label:"Access key ID",kind:"text",secret:!1,required:!0},{id:"secret_access_key",label:"Secret access key",kind:"text",secret:!0,required:!0},{id:"session_token",label:"Session token (optional)",kind:"text",secret:!0,required:!1}];function $h(e,t){return[{id:"provider.names.read",label:`List ${e} names`,fields:[]},{id:"provider.secret.read",label:`Read a ${e} value`,fields:[{id:"name",label:`${e[0]?.toUpperCase()}${e.slice(1)} name`,kind:"text",secret:!1,required:!0,placeholder:t}]}]}const Ph=sn({family:"AWS",idPrefix:"conn_aws_",accepts:function(e){return null!==gh(e)},classification:vh,ui:function(e){const t=gh(e)??"aws";return{name:fh[t].name,methodLabel:"AWS access key",instructions:"Use an IAM access key limited to listing names, and to reading values only if you want to read them here. The request is signed in this browser with Signature Version 4 and sent only to the endpoint AWS publishes for the region. Verification lists the first names, which proves permission to list and nothing about who owns the account.",fields:zh,links:[{label:"Create an IAM access key",url:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"}],disconnectExplanation:"Disconnect forgets this device's access key. It revokes nothing at AWS: delete or rotate the key in IAM to end its other uses.",actions:"aws"===t?$h("secret","prod/database"):$h("parameter","/prod/database/url")}},parse:function(e,t){const n=gh(e.providerId);if(xh(e,null!==n),!n)throw new Error("This is not an AWS connection");const r=Ih(e),i=jh(e,t);wr(e.displayName,i),vr(e.icon??"",i);for(const a of Object.values(r))wr(a,i);return{providerId:e.providerId,service:n,parameters:r,credentials:i}},fingerprint:e=>async function(e,t){const n=(new TextEncoder).encode(Bt({contract:`aws:sigv4:${e}:v1`,parameters:t}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",n))].map(e=>e.toString(16).padStart(2,"0")).join("")}(e.service,e.parameters),prove:async(e,t)=>(await Nh(e,t),function(e){const t=e.parameters.region??"";return{identity:{id:t,label:`${fh[e.service].name} in ${t}`,kind:"region"},targets:[{id:t,label:t,kind:"region"}],grantLabel:"AWS signing credentials",target:{key:"region",id:t}}}(e)),targetOf:e=>({providerId:e.configuration.providerId,service:wh(e.configuration.providerId),parameters:e.configuration.parameters,credentials:e.privateState.credentials}),operations:[{id:"provider.names.read",inputKeys:[],run:async(e,t)=>{const n=await Nh(e,t);return{label:`First ${n.length} names`,items:n}}},{id:"provider.secret.read",inputKeys:["name"],run:async(e,t,n)=>{const r=n.name??"",i=await async function(e,t,n){if(!fh[e.service].allowedName.test(n))throw new Error("Enter a valid name");const r="aws"===e.service,i=await Th(e,t,r?"GetSecretValue":"GetParameter",r?{SecretId:n}:{Name:n,WithDecryption:!0}),a=r?i:ai(i)?i.Parameter:void 0,o=ai(a)?a[r?"SecretString":"Value"]:void 0;if(!ni(o)||o.length>32768)throw new gr("response");return o}(e,t,r);return{label:"Value read once",items:[{id:r,label:r,secretValue:i}]}}}]}),Oh="api-version=2023-11-01",Rh=/^[A-Za-z0-9][A-Za-z0-9-]{3,48}[A-Za-z0-9]$/,Lh=/^[A-Za-z0-9+/=_:-]{4,128}$/,Uh=/^[A-Za-z0-9+/]{16,512}={0,2}$/,Dh=/^[\x20-\x7e\u00a0-\uffff]{1,256}$/,qh="47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=",Mh=["store","access_key_id"],Kh=["access_key_secret"];function Fh(e){return"azure-ac"===Ve(e)}function Gh(e,t){const n=e.credentials.access_key_secret||t?.privateState.credentials.access_key_secret||"";if(!Uh.test(n)||n.length%4!=0)throw new Error("Enter a valid access key secret");return n}async function Bh(e,t,n){t.assertCurrent();const r=`${e.parameters.store}.azconfig.io`,i=(new Date).toUTCString(),a=`GET\n${n}\n${i};${r};${qh}`,o=Io($o(zo,jo(e.credentials.access_key_secret??""),(new TextEncoder).encode(a))),s=new AbortController,c=setTimeout(()=>s.abort(),15e3);try{const a=await t.fetch(`https://${r}${n}`,{method:"GET",headers:{Accept:"application/json","x-ms-date":i,"x-ms-content-sha256":qh,Authorization:`HMAC-SHA256 Credential=${e.parameters.access_key_id}&SignedHeaders=x-ms-date;host;x-ms-content-sha256&Signature=${o}`},signal:s.signal,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"});if(t.assertCurrent(),a.redirected)throw new gr("response");const c=await qp(a);if(429===a.status)throw new gr("rate-limit",429);if(401===a.status)throw new gr("authorization",401);if(403===a.status)throw new gr("permission",403);if(!a.ok)throw new gr("response",a.status);if(t.assertCurrent(),s.signal.aborted)throw new gr("network");const l=JSON.parse(c);if(!ai(l))throw new gr("response");return l}catch(l){if(l instanceof gr)throw l;if(l instanceof di)throw new gr("deployment");if(l instanceof SyntaxError)throw new gr("response");throw new gr("network")}finally{clearTimeout(c)}}async function Vh(e,t){const n=await Bh(e,t,`/keys?${Oh}`),r=ai(n)?n.items:void 0;if(!Array.isArray(r)||r.length>500)throw new gr("response");return r.slice(0,20).map(t=>{const n=ai(t)?t.name:void 0;if(!ni(n)||!Dh.test(n))throw new gr("response");return{id:n,label:wr(n,e.credentials)}})}const Hh=sn({family:"Azure App Configuration",idPrefix:"conn_azac_",accepts:Fh,classification:{publicParameters:Mh,privateCredentials:Kh},ui:function(){return{name:"Azure App Configuration",methodLabel:"Store access key",instructions:"In the Azure portal open the store, then Settings, Access settings, and copy a read-only key's ID and secret. Every request is signed in this browser with HMAC-SHA256 and sent only to the store's own address. Verification lists key names, which proves the key may read the store.",fields:[{id:"store",label:"Store name",kind:"text",secret:!1,required:!0,placeholder:"my-store"},{id:"access_key_id",label:"Access key ID",kind:"text",secret:!1,required:!0},{id:"access_key_secret",label:"Access key secret",kind:"text",secret:!0,required:!0}],links:[{label:"Where to find the access keys",url:"https://learn.microsoft.com/en-us/azure/azure-app-configuration/howto-best-practices#security"}],disconnectExplanation:"Disconnect forgets this device's access key. It revokes nothing in Azure: regenerate the key in the portal to end its other uses.",actions:[{id:"provider.names.read",label:"List key names",fields:[]},{id:"provider.secret.read",label:"Read a key's value",fields:[{id:"name",label:"Key",kind:"text",secret:!1,required:!0,placeholder:"app:setting"}]}]}},parse:function(e,t){!function(e){if(!Fh(e.providerId)||Object.keys(e.requestedScopes??{}).length||Object.keys(e.targetIds??{}).length||Object.keys(e.parameters).some(e=>!Mh.includes(e))||Object.keys(e.credentials).some(e=>!Kh.includes(e)))throw new Error("Configure only an Azure store name and its access key")}(e);const n={store:(e.parameters.store??"").trim().toLowerCase(),access_key_id:(e.parameters.access_key_id??"").trim()};if(!Rh.test(n.store))throw new Error("Enter the store name, not its address");if(!Lh.test(n.access_key_id))throw new Error("Enter a valid access key ID");const r={access_key_secret:Gh(e,t)};wr(e.displayName,r),vr(e.icon??"",r);for(const i of Object.values(n))wr(i,r);return{providerId:e.providerId,parameters:n,credentials:r}},fingerprint:async e=>{const t=(new TextEncoder).encode(Bt({contract:"azure-appconfig:hmac:v1",parameters:e.parameters}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",t))].map(e=>e.toString(16).padStart(2,"0")).join("")},prove:async function(e,t){await Vh(e,t);const n=e.parameters.store??"";return{identity:{id:n,label:`${n}.azconfig.io`,kind:"store"},targets:[{id:n,label:n,kind:"store"}],grantLabel:"Azure App Configuration access key",target:{key:"store",id:n}}},targetOf:e=>({providerId:e.configuration.providerId,parameters:e.configuration.parameters,credentials:e.privateState.credentials}),operations:[{id:"provider.names.read",inputKeys:[],run:async(e,t)=>{const n=await Vh(e,t);return{label:`First ${n.length} key names`,items:n}}},{id:"provider.secret.read",inputKeys:["name"],run:async(e,t,n)=>{const r=n.name??"",i=await async function(e,t,n){if(!Dh.test(n)||"."===n||".."===n)throw new Error("Enter a valid key name");const r=await Bh(e,t,`/kv/${encodeURIComponent(n)}?${Oh}`),i=ai(r)?r.value:void 0;if(!ni(i)||i.length>32768)throw new gr("response");return i}(e,t,r);return{label:"Value read once",items:[{id:r,label:r,secretValue:i}]}}}]}),Jh=new TextEncoder;class Wh extends Error{constructor(){super("Bitwarden data could not be decrypted"),this.name="BitwardenCryptoError"}}const Zh=()=>{throw new Wh};function Xh(e){if(!/^[A-Za-z0-9+/_-]*={0,2}$/.test(e))return Zh();const t=e.replace(/-/g,"+").replace(/_/g,"/"),n=t+"=".repeat((4-t.length%4)%4);try{return Uint8Array.from(atob(n),e=>e.charCodeAt(0))}catch{return Zh()}}async function Yh(e,t){return crypto.subtle.importKey("raw",ui(e),{name:"HMAC",hash:"SHA-256"},!1,[t])}async function Qh(e,t){return new Uint8Array(await crypto.subtle.sign("HMAC",await Yh(e,"sign"),ui(t)))}async function ef(e,t,n){if(n<1||n>8160)return Zh();const r=new Uint8Array(32*Math.ceil(n/32));let i=new Uint8Array(0);for(let a=1;32*a<=r.length;a++){const n=new Uint8Array(i.length+t.length+1);n.set(i,0),n.set(t,i.length),n[n.length-1]=a,i=ui(await Qh(e,n)),r.set(i,32*(a-1))}return r.slice(0,n)}const tf=e=>64!==e.length?Zh():{enc:e.slice(0,32),mac:e.slice(32)};function nf(e){return tf(e)}const rf=[2,10],af=[16,1024],of=[1,16];async function sf(e,t){const{iv:n,data:r,mac:i}=function(e){const t=/^2\.([^|]+)\|([^|]+)\|([^|]+)$/.exec(e);if(!t)return Zh();const[,n,r,i]=t,a={iv:Xh(n??""),data:Xh(r??""),mac:Xh(i??"")};return 16!==a.iv.length||32!==a.mac.length||0===a.data.length||a.data.length%16!=0?Zh():a}(e),a=new Uint8Array(n.length+r.length);if(a.set(n,0),a.set(r,n.length),!(await crypto.subtle.verify("HMAC",await Yh(t.mac,"verify"),ui(i),ui(a))))return Zh();try{const e=await crypto.subtle.importKey("raw",ui(t.enc),"AES-CBC",!1,["decrypt"]);return new Uint8Array(await crypto.subtle.decrypt({name:"AES-CBC",iv:ui(n)},e,ui(r)))}catch{return Zh()}}async function cf(e,t){try{return new TextDecoder("utf-8",{fatal:!0}).decode(await sf(e,t))}catch{return Zh()}}const lf=e=>{if(void 0!==e)return"json"===e.kind?JSON.stringify(e.value):e.value.toString()};async function df(e,t,n,r,i,a={}){e.assertCurrent();const o=new Headers({Accept:"application/json"});r&&o.set("Authorization",`Bearer ${r}`);for(const[d,u]of Object.entries(a.headers??{}))o.set(d,u);i&&o.set("Content-Type",(e=>"json"===e.kind?"application/json":"application/x-www-form-urlencoded")(i));const s=new AbortController,c=setTimeout(()=>s.abort(),15e3);try{const r=await e.fetch(n,{method:t,headers:o,body:lf(i),signal:s.signal,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"});if(e.assertCurrent(),r.redirected)throw new gr("response");const c=await qp(r,a.limit);if(function(e){const{status:t}=e;if(401===t)throw new gr("authorization",401);if(403===t)throw new gr("permission",403);if(429===t)throw new gr("rate-limit",429);if(!e.ok)throw new gr("response",t)}(r),e.assertCurrent(),s.signal.aborted)throw new gr("network");return function(e){if(""===e.trim())return{};const t=JSON.parse(e);if(!ai(t))throw new gr("response");return t}(c)}catch(l){if(l instanceof gr)throw l;if(l instanceof di)throw new gr("deployment");if(l instanceof SyntaxError)throw new gr("response");throw new gr("network")}finally{clearTimeout(c)}}function uf(e,t,n,r){if(Object.keys(e.requestedScopes??{}).length>0||Object.keys(e.targetIds??{}).length>0||Object.keys(e.parameters).some(e=>!t.includes(e))||Object.keys(e.credentials).some(e=>!n.includes(e)))throw new Error(r)}const pf={us:{identity:"https://identity.bitwarden.com",api:"https://api.bitwarden.com"},eu:{identity:"https://identity.bitwarden.eu",api:"https://api.bitwarden.eu"}},hf="access_token",ff="[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",mf=new RegExp(`^0\\.(${ff})\\.([A-Za-z0-9]{16,64}):([A-Za-z0-9+/=_-]{22,44})$`,"i"),gf=new RegExp(`^${ff}$`,"i"),wf=e=>"eu"===e?"eu":"us";function vf(e){const t=e.split(".")[1];if(!t)throw new gr("response");try{const e=JSON.parse((new TextDecoder).decode(Xh(t))),n=ai(e)?e.organization:void 0;if(ni(n)&&gf.test(n))return n}catch{}throw new gr("response")}async function yf(e,t){const n=mf.exec(e.credentials[hf]??"");if(!n)throw new gr("response");const[,r,i,a]=n,o=pf[wf(e.parameters.site)],s=await df(t,"POST",`${o.identity}/connect/token`,void 0,{kind:"form",value:new URLSearchParams({grant_type:"client_credentials",scope:"api.secrets",client_id:r??"",client_secret:i??""})},{headers:{"Device-Type":"21"}}),c=s.access_token,l=s.encrypted_payload;if(!ni(c)||!/^[A-Za-z0-9._~+/=-]{20,8192}$/.test(c)||!ni(l))throw new gr("response");try{const e=JSON.parse(await cf(l,await async function(e){if(16!==e.length)return Zh();const t=await Qh(Jh.encode("bitwarden-accesstoken"),e);return tf(await ef(t,Jh.encode("sm-access-token"),64))}(Xh(a??"")))),t=ai(e)?e.encryptionKey:void 0;if(!ni(t))throw new gr("response");return{bearer:c,organization:vf(c),key:nf(Xh(t))}}catch(d){if(d instanceof gr)throw d;throw new gr("response")}}const bf=sn({family:"Bitwarden Secrets Manager",idPrefix:"conn_bwsm_",accepts:function(e){return"bitwarden-sm"===Ve(e)},classification:{publicParameters:["site"],privateCredentials:[hf]},ui:function(){return{name:"Bitwarden Secrets Manager",methodLabel:"Service account access token",instructions:"In Bitwarden open Secrets Manager → Machine accounts, choose a machine account and create an access token. Paste it here. Bitwarden's servers answer no web page, so the calls are carried by the OpenSesame connector bridge; the token proves the account by a login only it can read, secret names and values are decrypted in this browser with Web Crypto, and a value is shown once and never kept.",fields:[{id:"site",label:"Region",kind:"choice",secret:!1,required:!0,defaultValue:"us",choices:[{id:"us",label:"US (bitwarden.com)"},{id:"eu",label:"EU (bitwarden.eu)"}]},{id:hf,label:"Access token",kind:"text",secret:!0,required:!0,placeholder:"0.…"}],links:[{label:"Access tokens",url:"https://bitwarden.com/help/access-tokens/"}],disconnectExplanation:"Disconnect forgets this device's access token. It revokes nothing at Bitwarden: revoke the token on the machine account to end its other uses.",actions:[{id:"provider.names.read",label:"List secret names",fields:[]},{id:"provider.secret.read",label:"Read a secret's value",fields:[{id:"secret",label:"Secret ID",kind:"text",secret:!1,required:!0,placeholder:"from the list"}]}]}},parse:function(e,t){uf(e,["site"],[hf],"Configure only a region and a service account token");const n=e.parameters.site?.trim()||"us";if("us"!==n&&"eu"!==n)throw new Error("Choose a region");const r=(e.credentials[hf]||t?.privateState.credentials[hf]||"").trim();if(!mf.test(r))throw new Error("Enter the service account's access token (0.…:…)");const i={[hf]:r};return wr(e.displayName,i),vr(e.icon??"",i),{providerId:e.providerId,parameters:{site:n},credentials:i}},fingerprint:e=>async function(e){const t=(new TextEncoder).encode(Bt({contract:"bitwarden:secrets-manager:v1",parameters:e}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",t))].map(e=>e.toString(16).padStart(2,"0")).join("")}(e.parameters),prove:async function(e,t){const n=await yf(e,t),r=wf(e.parameters.site);return{identity:{id:`organization:${n.organization}`,label:"Secrets Manager machine account",kind:"machine-account"},targets:[{id:r,label:new URL(pf[r].api).hostname,kind:"region"}],grantLabel:"Bitwarden access token",target:{key:"site",id:r}}},targetOf:e=>({providerId:e.configuration.providerId,parameters:e.configuration.parameters,credentials:e.privateState.credentials}),operations:[{id:"provider.names.read",inputKeys:[],run:async(e,t)=>{const n=await async function(e,t){const n=await yf(e,t),r=pf[wf(e.parameters.site)],i=(await df(t,"GET",`${r.api}/organizations/${n.organization}/secrets`,n.bearer)).data;if(!Array.isArray(i)||i.length>1e3)throw new gr("response");const a=[];for(const s of i.slice(0,200)){const t=ai(s)?s.id:void 0,r=ai(s)?s.key:void 0;if(!ni(t)||!gf.test(t)||!ni(r))throw new gr("response");try{const i=await cf(r,n.key);a.push({id:t,label:wr(i.slice(0,256),e.credentials)})}catch(o){if(o instanceof gr)throw o;throw new gr("response")}}return a}(e,t);return{label:`${n.length} secret names`,items:n}}},{id:"provider.secret.read",inputKeys:["secret"],run:async(e,t,n)=>{const r=await async function(e,t,n){const r=(n.secret??"").trim();if(!gf.test(r))throw new Error("Enter a secret ID from the list");const i=await yf(e,t),a=pf[wf(e.parameters.site)],o=await df(t,"GET",`${a.api}/secrets/${r}`,i.bearer);if(o.id!==r||o.organizationId!==i.organization)throw new gr("response");const s=o.value,c=o.key;if(!ni(s)||!ni(c))throw new gr("response");try{const t=await cf(s,i.key);if(t.length>32768)throw new gr("response");return{id:r,label:wr((await cf(c,i.key)).slice(0,256),e.credentials),secret:t}}catch(l){if(l instanceof gr)throw l;throw new gr("response")}}(e,t,n);return{label:"Value read once",items:[{id:r.id,label:r.label,secretValue:r.secret}]}}}]}),kf={us:{identity:"https://identity.bitwarden.com",api:"https://api.bitwarden.com"},eu:{identity:"https://identity.bitwarden.eu",api:"https://api.bitwarden.eu"}},xf="email",If="master_password",jf="client_id",_f="client_secret",Sf="[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}",Af=new RegExp(`^${Sf}$`,"i"),Cf=new RegExp(`^user\\.${Sf}$`,"i");function Ef(e){const t=e.parameters.server;return t?{identity:`${t}/identity`,api:`${t}/api`}:"eu"===e.parameters.site?kf.eu:kf.us}function Tf(e){return Object.fromEntries(Object.entries(e).map(([e,t])=>[e.charAt(0).toUpperCase()+e.slice(1),ai(t)?Tf(t):t]))}const Nf=qr().max(1e6),zf=Ur({access_token:qr().regex(/^[A-Za-z0-9._~+/=-]{20,8192}$/),Key:Nf,Kdf:Jr([Dr(0),Dr(1)]),KdfIterations:Vr().int(),KdfMemory:Vr().int().nullish(),KdfParallelism:Vr().int().nullish()}),$f=Ur({Id:qr().regex(Af),Type:Vr().int(),Name:Nf,Key:Nf.nullish(),Notes:Nf.nullish(),Login:Ur({Password:Nf.nullish()}).passthrough().nullish(),OrganizationId:qr().nullish(),DeletedDate:qr().nullish()});async function Pf(e){const t=[...new Uint8Array(await crypto.subtle.digest("SHA-256",(new TextEncoder).encode(`opensesame:${e}`))).slice(0,16)].map(e=>e.toString(16).padStart(2,"0")).join("");return`${t.slice(0,8)}-${t.slice(8,12)}-4${t.slice(13,16)}-8${t.slice(17,20)}-${t.slice(20,32)}`}async function Of(e,t){const n=Ef(e),r=await df(t,"POST",`${n.identity}/connect/token`,void 0,{kind:"form",value:new URLSearchParams({grant_type:"client_credentials",scope:"api",client_id:e.credentials[jf]??"",client_secret:e.credentials[_f]??"",deviceType:"14",deviceIdentifier:await Pf(e.credentials[jf]??""),deviceName:"OpenSesame"})}),i=zf.safeParse({...Tf(r),access_token:r.access_token});if(!i.success)throw new gr("response");try{const t=await async function(e,t,n){const r=Jh.encode(t.trim().toLowerCase()),i=Jh.encode(e),a=function(e){const t=(e,[t,n])=>Number.isInteger(e)&&e>=t&&e<=n;return"pbkdf2"===e.kind?t(e.iterations,[5e3,2e6])?e:Zh():t(e.iterations,rf)&&t(e.memoryMiB,af)&&t(e.parallelism,of)?e:Zh()}(n);if("pbkdf2"===a.kind){const e=await crypto.subtle.importKey("raw",ui(i),"PBKDF2",!1,["deriveBits"]);return new Uint8Array(await crypto.subtle.deriveBits({name:"PBKDF2",hash:"SHA-256",salt:ui(r),iterations:a.iterations},e,256))}const o=new Uint8Array(await crypto.subtle.digest("SHA-256",ui(r)));return Ko({password:i,salt:o,iterations:a.iterations,memorySize:1024*a.memoryMiB,parallelism:a.parallelism,hashLength:32,outputType:"binary"})}(e.credentials[If]??"",e.credentials[xf]??"",function(e){if(0===e.Kdf)return{kind:"pbkdf2",iterations:e.KdfIterations};if(!e.KdfMemory||!e.KdfParallelism)throw new gr("response");return{kind:"argon2id",iterations:e.KdfIterations,memoryMiB:e.KdfMemory,parallelism:e.KdfParallelism}}(i.data)),r=nf(await sf(i.data.Key,await async function(e){return 32!==e.length?Zh():{enc:await ef(e,Jh.encode("enc"),32),mac:await ef(e,Jh.encode("mac"),32)}}(t)));return{bearer:i.data.access_token,key:r,api:n.api}}catch(a){if(a instanceof gr)throw a;if(a instanceof Wh)throw new gr("authorization");throw new gr("response")}}async function Rf(e,t){return e.Key?nf(await sf(e.Key,t)):t}const Lf=e=>!e.OrganizationId&&!e.DeletedDate;function Uf(e){switch(e){case 1:return"login";case 2:return"note";case 3:return"card";case 4:return"identity";default:return"item"}}const Df=e=>"vaultwarden"===Ve(e),qf=/^[A-Za-z0-9]{16,64}$/,Mf=/^[^\s@]{1,64}@[^\s@]{1,255}$/;function Kf(e){let t;try{t=new URL(e.trim())}catch{throw new Error("Enter your Vaultwarden address, such as https://vault.example.com")}if("https:"!==t.protocol||t.username||t.password||t.search||t.hash)throw new Error("Enter your Vaultwarden address, such as https://vault.example.com");return`${t.origin}${t.pathname.replace(/\/+$/,"")}`}const Ff=sn({family:"Bitwarden",idPrefix:"conn_bwvault_",accepts:function(e){const t=Ve(e);return"bitwarden"===t||"vaultwarden"===t},classification:{publicParameters:["site","server"],privateCredentials:[xf,If,jf,_f]},ui:function(e){const t=Df(e),n=t?"Vaultwarden":"Bitwarden";return{name:n,methodLabel:"Personal API key and master password",instructions:`In ${n} open Account settings → Security → Keys and view your API key. Paste its client ID and client secret, with your account email and master password. The master password never leaves this device: it derives the key that opens your vault here, with Web Crypto. ${t?"A self-hosted server is reached directly, so it must answer this site.":"Bitwarden's servers answer no web page, so the calls are carried by the OpenSesame connector bridge."} Only personal items are read, and the vault's encrypted data must fit in 1 MiB. A password or note is shown once and never kept.`,fields:[t?{id:"server",label:"Server address",kind:"url",secret:!1,required:!0,placeholder:"https://vault.example.com"}:{id:"site",label:"Region",kind:"choice",secret:!1,required:!0,defaultValue:"us",choices:[{id:"us",label:"US (bitwarden.com)"},{id:"eu",label:"EU (bitwarden.eu)"}]},{id:xf,label:"Account email",kind:"text",secret:!0,required:!0},{id:If,label:"Master password",kind:"text",secret:!0,required:!0},{id:jf,label:"API key client ID",kind:"text",secret:!0,required:!0,placeholder:"user.…"},{id:_f,label:"API key client secret",kind:"text",secret:!0,required:!0}],links:[{label:t?"Vaultwarden":"Bitwarden public API",url:t?"https://github.com/dani-garcia/vaultwarden/wiki":"https://bitwarden.com/help/personal-api-key/"}],disconnectExplanation:`Disconnect forgets this device's API key, email and master password. It revokes nothing at ${n}: rotate the API key in your account to end its other uses.`,actions:[{id:"provider.names.read",label:"List item names",fields:[]},{id:"provider.item.read",label:"Read a password or note",fields:[{id:"item",label:"Item ID",kind:"text",secret:!1,required:!0,placeholder:"from the list"}]}]}},parse:function(e,t){const n=Df(e.providerId);uf(e,[n?"server":"site"],[xf,If,jf,_f],"Configure only the server and the account's credentials");const r=function(e,t){if(t)return{server:Kf(e.parameters.server??"")};const n=e.parameters.site?.trim()||"us";if("us"!==n&&"eu"!==n)throw new Error("Choose a region");return{site:n}}(e,n),i=function(e,t){const n=t?.privateState.credentials??{},r=t=>(e.credentials[t]||n[t]||"").trim(),i=r(xf).toLowerCase(),a=e.credentials[If]||n[If]||"",o=r(jf),s=r(_f);if(!Mf.test(i))throw new Error("Enter the account's email address");if(a.length<1||a.length>1024)throw new Error("Enter the master password");if(!Cf.test(o))throw new Error("Enter the personal API key's client ID (user.…)");if(!qf.test(s))throw new Error("Enter the personal API key's client secret");return{[xf]:i,[If]:a,[jf]:o,[_f]:s}}(e,t);return wr(e.displayName,i),vr(e.icon??"",i),{providerId:e.providerId,parameters:r,credentials:i}},fingerprint:async function(e){const t=(new TextEncoder).encode(Bt({contract:"bitwarden:vault:v1",provider:Ve(e.providerId),parameters:e.parameters}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",t))].map(e=>e.toString(16).padStart(2,"0")).join("")},prove:async function(e,t){await Of(e,t);const n=e.parameters.server?"server":"site",r=e.parameters.server??e.parameters.site??"us";return{identity:{id:`${r}:${e.credentials[jf]}`,label:"Vault account",kind:"vault-account"},targets:[{id:r,label:new URL(Ef(e).api).hostname,kind:"server"}],grantLabel:"Bitwarden API key",target:{key:n,id:r}}},targetOf:e=>({providerId:e.configuration.providerId,parameters:e.configuration.parameters,credentials:e.privateState.credentials}),operations:[{id:"provider.names.read",inputKeys:[],run:async(e,t)=>{const n=await async function(e,t){const n=await Of(e,t),r=Tf(await df(t,"GET",`${n.api}/sync?excludeDomains=true`,n.bearer,void 0,{limit:1048576})).Ciphers;if(!Array.isArray(r))throw new gr("response");const i=[];for(const a of r){if(i.length>=200)break;if(!ai(a))throw new gr("response");const t=$f.safeParse(Tf(a));if(!t.success)throw new gr("response");if(Lf(t.data))try{const r=await cf(t.data.Name,await Rf(t.data,n.key));i.push({id:t.data.Id,label:wr(`${r.slice(0,200)} · ${Uf(t.data.Type)}`,e.credentials)})}catch{throw new gr("response")}}return i}(e,t);return{label:`${n.length} items`,items:n}}},{id:"provider.item.read",inputKeys:["item"],run:async(e,t,n)=>{const r=await async function(e,t,n){const r=(n.item??"").trim();if(!Af.test(r))throw new Error("Enter an item ID from the list");const i=await Of(e,t),a=await df(t,"GET",`${i.api}/ciphers/${r}`,i.bearer),o=$f.safeParse(Tf(a));if(!o.success||o.data.Id!==r||!Lf(o.data))throw new gr("response");const s=function(e){const t=1===e.Type?e.Login?.Password:2===e.Type?e.Notes:null;if(!t)throw new Error("Only a login's password or a secure note can be read");return t}(o.data);try{const t=await Rf(o.data,i.key),n=await cf(s,t);if(n.length>32768)throw new gr("response");return{id:r,label:wr((await cf(o.data.Name,t)).slice(0,200),e.credentials),value:n}}catch(c){if(c instanceof gr)throw c;throw new gr("response")}}(e,t,n);return{label:"Read once",items:[{id:r.id,label:r.label,secretValue:r.value}]}}}]}),Gf=new WeakMap;function Bf(e){return Gf.has(e)}function Vf(e,t,n){if(Gf.has(e))throw new Error("The transport reused a live response.");Gf.set(e,{signal:n,retire:t})}function Hf(e){return Gf.get(e)?.signal}function Jf(e){const t=Gf.get(e);Gf.delete(e),t?.retire?.()}function Wf(e,t,n,r){const i=e.clone(),a=e.body;if(!a)throw r();const o=a.getReader();let s,c=!1,l=!1,d=!1,u=()=>{};const p=new Promise(e=>{u=e}),h=()=>{t(),n?.throwIfAborted()};function f(){return s??=Promise.allSettled([Promise.resolve().then(()=>c?void 0:o.cancel()),Promise.resolve().then(()=>i.body?.cancel())]).then(()=>{}),s}const m=()=>{u(),f()};function g(){d||(o.releaseLock(),d=!0)}return n?.addEventListener("abort",m,{once:!0}),n?.aborted&&m(),{async read(){h();const e=await o.read();return c=e.done,h(),e},async finish(e){if(!c||!Number.isSafeInteger(e)||e<0||e>4194304)throw r();h(),g();const t=await Promise.race([i.arrayBuffer(),p.then(()=>{throw h(),r()})]);if(h(),t.byteLength!==e)throw r();l=!0},async close(){n?.removeEventListener("abort",m);try{l||await f()}finally{g()}}}}const Zf="https://oauth2.googleapis.com/token",Xf=/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}@[a-z][a-z0-9-]{3,61}\.(?:iam\.)?gserviceaccount\.com$/,Yf=/^[a-z][a-z0-9-]{4,28}[a-z0-9]$/,Qf=/^-----BEGIN PRIVATE KEY-----([A-Za-z0-9+/=\s]{200,8192})-----END PRIVATE KEY-----\s*$/,em=/^[A-Za-z0-9._~+/=-]{20,4096}$/;function tm(e){return Yf.test(e)}function nm(e){let t;try{t=JSON.parse(e)}catch{throw new Error("Paste the service account key file, a JSON document")}const n=ai(t)?t:null,r=n?.client_email,i=n?.private_key,a=n?.project_id;if(!(n&&"service_account"===n.type&&ni(r)&&Xf.test(r)&&ni(i)&&Qf.test(i)))throw new Error("That is not a service account key file");return{clientEmail:r,projectId:ni(a)&&Yf.test(a)?a:null,privateKey:i}}async function rm(e,t){let n;t.assertCurrent();try{n=await async function(e,t){const n=xo(JSON.stringify({alg:"RS256",typ:"JWT"})),r=xo(JSON.stringify({iss:e.clientEmail,scope:"https://www.googleapis.com/auth/cloud-platform",aud:Zf,iat:t,exp:t+3600})),i=await crypto.subtle.sign("RSASSA-PKCS1-v1_5",await async function(e){const t=Qf.exec(e)?.[1]?.replace(/\s+/g,"")??"";return crypto.subtle.importKey("pkcs8",li(jo(t)),{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["sign"])}(e.privateKey),(new TextEncoder).encode(`${n}.${r}`));return`${n}.${r}.${ko(new Uint8Array(i))}`}(e,Math.floor(Date.now()/1e3))}catch{throw new gr("authorization")}const r=new AbortController,i=setTimeout(()=>r.abort(),15e3);let a;try{if(a=await t.fetch(Zf,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:n}).toString(),signal:r.signal,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"}),t.assertCurrent(),a.redirected)throw new gr("response");const e=await async function(e,t){const n=Hf(e),r=n?AbortSignal.any([t.signal,n]):t.signal,i=()=>{t.assertCurrent(),r.throwIfAborted()};let a;const o=[];let s=0;try{if(i(),!Number.isSafeInteger(t.maxBytes)||t.maxBytes<1||t.maxBytes>4194304)throw t.invalid();for(a=Wf(e,i,r,t.invalid);;){const e=await a.read();if(e.done)break;if(s+=e.value.byteLength,s>t.maxBytes)throw t.invalid();o.push(e.value)}const n=new Uint8Array(s);let c,l=0;for(const e of o)n.set(e,l),l+=e.length;try{c=new TextDecoder("utf-8",{fatal:!0}).decode(n)}catch{throw t.invalid()}return await a.finish(s),i(),c}finally{try{a?await a.close():await(e.body?.cancel().catch(()=>{}))}finally{Jf(e)}}}(a,{maxBytes:16384,signal:r.signal,assertCurrent:()=>t.assertCurrent(),invalid:()=>new gr("response")});if([400,401].includes(a.status))throw new gr("authorization",a.status);if(403===a.status)throw new gr("permission",403);if(429===a.status)throw new gr("rate-limit",429);if(!a.ok)throw new gr("response",a.status);const i=JSON.parse(e),o=ai(i)?i.access_token:void 0;if(!ni(o)||!em.test(o))throw new gr("response");return t.assertCurrent(),o}catch(o){if(o instanceof gr)throw o;if(o instanceof di)throw new gr("deployment");if(o instanceof SyntaxError)throw new gr("response");throw new gr("network")}finally{try{await async function(e){if(e)try{e.bodyUsed||await(e.body?.cancel().catch(()=>{}))}finally{Jf(e)}}(a)}finally{clearTimeout(i)}}}async function im(e,t,n,r,i){e.assertCurrent();const a=new Headers({Authorization:`Bearer ${t}`,Accept:"application/json"});void 0!==i&&a.set("Content-Type","application/json");const o=new AbortController,s=setTimeout(()=>o.abort(),15e3);try{const t=await e.fetch(r,{method:n,headers:a,body:i,signal:o.signal,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"});if(e.assertCurrent(),t.redirected)throw new gr("response");const s=await qp(t);if(401===t.status)throw new gr("authorization",401);if(403===t.status)throw new gr("permission",403);if(429===t.status)throw new gr("rate-limit",429);if(!t.ok)throw new gr("response",t.status);if(e.assertCurrent(),o.signal.aborted)throw new gr("network");const c=JSON.parse(s);if(!ai(c))throw new gr("response");return c}catch(c){if(c instanceof gr)throw c;if(c instanceof di)throw new gr("deployment");if(c instanceof SyntaxError)throw new gr("response");throw new gr("network")}finally{clearTimeout(s)}}const am="service_account_json",om=/^[A-Za-z0-9_-]{1,255}$/;async function sm(e,t){const n=(new TextEncoder).encode(Bt({contract:e,parameters:t}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",n))].map(e=>e.toString(16).padStart(2,"0")).join("")}function cm(e,t){return e.credentials[am]||t?.privateState.credentials[am]||""}function lm(e,t,n){!function(e,t){const n=t?["project"]:[];if(Object.keys(e.requestedScopes??{}).length||Object.keys(e.targetIds??{}).length||Object.keys(e.parameters).some(e=>!n.includes(e))||Object.keys(e.credentials).some(e=>e!==am))throw new Error("Configure only a service account key and its project")}(e,n);const r=nm(cm(e,t)),i=(e.parameters.project??"").trim()||r.projectId||"";if(n&&!tm(i))throw new Error("Enter the project ID");const a=[["client_email",r.clientEmail]];n&&a.push(["project",i]);const o=Object.fromEntries(a),s={[am]:cm(e,t)};wr(e.displayName,s),vr(e.icon??"",s);for(const c of Object.values(o))wr(c,s);return{providerId:e.providerId,parameters:o,credentials:s}}function dm(e,t){return rm(nm(e.credentials[am]??""),t)}async function um(e,t){const n=await dm(e,t),r=e.parameters.project??"",i=(await im(t,n,"GET",`https://secretmanager.googleapis.com/v1/projects/${r}/secrets?pageSize=20`)).secrets??[];if(!Array.isArray(i)||i.length>100)throw new gr("response");return i.map(t=>{const n=ai(t)?t.name:void 0,r=ni(n)?n.split("/").pop():void 0;if(!r||!om.test(r))throw new gr("response");return{id:r,label:wr(r,e.credentials)}})}async function pm(e,t,n){if(!om.test(n))throw new Error("Enter a valid secret name");const r=await dm(e,t),i=e.parameters.project??"",a=await im(t,r,"GET",`https://secretmanager.googleapis.com/v1/projects/${i}/secrets/${n}/versions/latest:access`),o=ai(a.payload)?a.payload.data:void 0;if(!ni(o)||o.length>65536)throw new gr("response");try{const e=new TextDecoder("utf-8",{fatal:!0}).decode(jo(o));if(e.length>32768)throw new gr("response");return e}catch(s){if(s instanceof gr)throw s;throw new gr("response")}}const hm={id:am,label:"Service account key (JSON)",kind:"text",secret:!0,required:!0,placeholder:'{"type":"service_account", …}'},fm={label:"Create a service account key",url:"https://cloud.google.com/iam/docs/keys-create-delete"},mm="Disconnect forgets this device's service account key. It revokes nothing at Google: delete the key in the console to end its other uses.",gm=e=>({providerId:e.configuration.providerId,parameters:e.configuration.parameters,credentials:e.privateState.credentials}),wm=sn({family:"Google Cloud Secret Manager",idPrefix:"conn_gcp_",accepts:function(e){return"gcp"===Ve(e)},classification:{publicParameters:["project","client_email"],privateCredentials:[am]},ui:function(){return{name:"Google Cloud Secret Manager",methodLabel:"Service account key",instructions:"Create a service account with the Secret Manager Secret Accessor role (and Viewer to list names), add a JSON key and paste it. The key signs a short-lived token in this browser and is sent only to Google's own token and API addresses. Verification lists the first secret names.",fields:[{id:"project",label:"Project ID (optional)",kind:"text",secret:!1,required:!1,placeholder:"defaults to the key's own project"},hm],links:[fm],disconnectExplanation:mm,actions:[{id:"provider.names.read",label:"List secret names",fields:[]},{id:"provider.secret.read",label:"Read a secret's latest value",fields:[{id:"name",label:"Secret name",kind:"text",secret:!1,required:!0,placeholder:"database-password"}]}]}},parse:(e,t)=>lm(e,t,!0),fingerprint:e=>sm("gcp:jwt-bearer:secretmanager:v1",e.parameters),prove:async function(e,t){await um(e,t);const n=e.parameters.project??"";return{identity:{id:e.parameters.client_email??"",label:e.parameters.client_email??"",kind:"service-account"},targets:[{id:n,label:n,kind:"project"}],grantLabel:"Google service account key",target:{key:"project",id:n}}},targetOf:gm,operations:[{id:"provider.names.read",inputKeys:[],run:async(e,t)=>{const n=await um(e,t);return{label:`First ${n.length} names`,items:n}}},{id:"provider.secret.read",inputKeys:["name"],run:async(e,t,n)=>{const r=n.name??"";return{label:"Value read once",items:[{id:r,label:r,secretValue:await pm(e,t,r)}]}}}]}),vm=sn({family:"Google Cloud IAM Credentials",idPrefix:"conn_gcpiam_",accepts:function(e){return"gcp-iam"===Ve(e)},classification:{publicParameters:["client_email"],privateCredentials:[am]},ui:function(){return{name:"Google Cloud IAM Credentials",methodLabel:"Service account key",instructions:"Paste a service account JSON key. It signs a short-lived token in this browser, and Google's IAM Credentials API can then issue an access token for a service account the key may impersonate (the Service Account Token Creator role). Verification checks that Google accepts the key.",fields:[hm],links:[fm,{label:"Create short-lived credentials",url:"https://cloud.google.com/iam/docs/create-short-lived-credentials-direct"}],disconnectExplanation:mm,actions:[{id:"gcp.access-token.generate",label:"Get an access token for a service account",fields:[{id:"service_account",label:"Service account email",kind:"text",secret:!1,required:!0,placeholder:"target@project.iam.gserviceaccount.com"}]}]}},parse:(e,t)=>lm(e,t,!1),fingerprint:e=>sm("gcp:jwt-bearer:iamcredentials:v1",e.parameters),prove:async(e,t)=>{await dm(e,t);const n=e.parameters.client_email??"";return{identity:{id:n,label:n,kind:"service-account"},targets:[{id:n,label:n,kind:"service-account"}],grantLabel:"Google service account key",target:{key:"service_account",id:n}}},targetOf:gm,operations:[{id:"gcp.access-token.generate",inputKeys:["service_account"],run:(e,t,n)=>async function(e,t,n){if(!Xf.test(n))throw new Error("Enter a service account email");const r=await dm(e,t),i=await im(t,r,"POST",`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(n)}:generateAccessToken`,JSON.stringify({scope:["https://www.googleapis.com/auth/cloud-platform"],lifetime:"3600s"})),a=i.accessToken,o=i.expireTime;if(!(ni(a)&&/^[A-Za-z0-9._~+/=-]{20,4096}$/.test(a)&&ni(o)&&/^\d{4}-\d\d-\d\dT[\d:.]+Z$/.test(o)))throw new gr("response");return{label:"Access token, shown once",items:[{id:"accessToken",label:"Access token",secretValue:a},{id:"expireTime",label:`Expires ${o}`}]}}(e,t,n.service_account??"")}]}),ym=Object.freeze({issuer:Object.freeze({pattern:"^\\d{6,32}$"}),walletClass:Object.freeze({qualification:"unqualified-or-this-issuer",suffixPattern:"^[A-Za-z0-9._-]+$",issuerSeparator:"."}),email:Object.freeze({pattern:"^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$",maxLength:320}),nativeServiceAccount:Object.freeze({type:"service_account",emailPattern:"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}@[a-z][a-z0-9-]{3,61}\\.(?:iam\\.)?gserviceaccount\\.com$",keyPemPattern:"^-----BEGIN PRIVATE KEY-----([A-Za-z0-9+/=\\s]{200,8192})-----END PRIVATE KEY-----\\s*$",jsonMaxLength:32768}),key:Object.freeze({format:"pkcs8",algorithm:"RSASSA-PKCS1-v1_5",hash:"SHA-256",usage:"sign",maxRawLength:32768,pemPattern:"^-----BEGIN PRIVATE KEY-----\\s*([A-Za-z0-9+/=\\s]{200,32768})-----END PRIVATE KEY-----\\s*$",escapedNewlines:!0})});function bm(e,t,n){if(!new RegExp(ym.issuer.pattern).test(e))return"issuer_id";if("unqualified-or-this-issuer"!==ym.walletClass.qualification)throw new Error("Unsupported Google Wallet class qualification");const r=`${e}${ym.walletClass.issuerSeparator}`,i=t.startsWith(r),a=i?t.slice(r.length):t;return t.includes(ym.walletClass.issuerSeparator)&&!i||!new RegExp(ym.walletClass.suffixPattern).test(a)?"class_id":n.length>ym.email.maxLength||!new RegExp(ym.email.pattern).test(n)?"service_account_email":null}function km(e){return ym.key.escapedNewlines&&e.includes("-----BEGIN")?e.replace(/\\n/g,"\n"):e}function xm(e){if(e.length>ym.key.maxRawLength)return null;const t=km(e).trim(),n=new RegExp(ym.key.pemPattern).exec(t)?.[1]?.replace(/\s+/g,"");if(!n)return null;try{atob(n)}catch{return null}return{pem:t,body:n}}const Im={issuerId:"OPENSESAME_WALLET_GOOGLE_ISSUER_ID",classId:"OPENSESAME_WALLET_GOOGLE_CLASS_ID",serviceAccountEmail:"OPENSESAME_WALLET_GOOGLE_SERVICE_ACCOUNT_EMAIL",serviceAccountKeyPem:"OPENSESAME_WALLET_GOOGLE_SERVICE_ACCOUNT_KEY",publicBaseUrl:"OPENSESAME_WALLET_GOOGLE_PUBLIC_BASE_URL",origins:"OPENSESAME_WALLET_GOOGLE_ORIGINS"};class jm extends Error{variables;constructor(e,t){super(e),this.name="WalletConfigError",this.variables=t}}function _m(e,t){return(e[t]??"").trim()}class Sm extends Error{constructor(e){super(e),this.name="WalletInputError"}}class Am extends Error{status;constructor(e,t,n){super(t,{cause:n}),this.name="WalletRequestError",this.status=e}}class Cm extends Error{rule;path;constructor(e,t,n){super(`wallet payload rejected [${e}] at ${t}: ${n}`),this.name="WalletPayloadRejected",this.rule=e,this.path=t}}const Em="<elided>",Tm=/^[A-Za-z0-9 ._:+-]+$/u,Nm=/[A-Za-z0-9]+/gu;function zm(e){return 0===e.length||e.length>40?Em:Tm.test(e)?function(e){for(const t of e.match(Nm)??[])if(!(t.length<16)&&/[A-Za-z]/u.test(t)&&/[0-9]/u.test(t))return!0;return!1}(e)?Em:e:Em}function $m(e){return e.toLowerCase().replace(/[^a-z0-9]/gu,"")}function Pm(e){return e.replace(/([a-z0-9])([A-Z])/gu,"$1 $2").split(/[^A-Za-z0-9]+/u).filter(e=>e.length>0).map(e=>e.toLowerCase())}const Om=new Set([...dr.map($m),"cvc","cvv2","cvc2","cardverificationvalue","cardverificationcode","cardsecuritycode","securitycode"]),Rm=new Set(["cvv","cvc","cvv2","cvc2","cardverificationvalue","cardverificationcode","cardsecuritycode","securitycode"]),Lm=new Set(["id","device","client","claim","card","number","ref","vp","api"]),Um=new Set(dr.flatMap(Pm).filter(e=>!Lm.has(e))),Dm=new Set(["javascript:","data:","vbscript:","file:","blob:"]),qm=[{pattern:/osc_clm_/u,detail:"value contains an OpenSesame claim-token prefix"},{pattern:/eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/u,detail:"value contains a JWT"},{pattern:/eyJ[A-Za-z0-9_+/=-]{20,}/u,detail:"value contains base64-encoded JSON"},{pattern:/\bbearer\s+[\w.~+/=-]{8,}/iu,detail:"value contains a Bearer credential"},{pattern:/-----BEGIN [A-Z0-9 ]+-----/u,detail:"value contains a PEM block"}],Mm=/[A-Za-z0-9_-]{16,}/u,Km=new RegExp("\\p{Nd}(?:[ -]?\\p{Nd}){11,}","gu"),Fm=new RegExp("\\p{Nd}{3,6}(?:\\.\\p{Nd}{3,6}){2,5}","gu"),Gm=new RegExp("^\\p{Nd}$","u"),Bm=/[A-Za-z0-9_.-]/u,Vm=/^\.[A-Za-z0-9_-]*[A-Za-z_-]/u;function Hm(e){const t=e.codePointAt(0)??0;let n=0;for(;n<9&&Gm.test(String.fromCodePoint(t-n-1));)n+=1;return n}function Jm(e){let t="";for(const n of e)" "!==n&&"-"!==n&&"."!==n&&(t+=String(Hm(n)));return t}function Wm(e,t,n){const r=e[t-1];return(void 0===r||!Bm.test(r))&&Vm.test(e.slice(n))}const Zm=[{network:"Visa",prefix:/^4/u,lengths:[13,16,19]},{network:"Mastercard",prefix:/^(?:5[1-5]|2(?:2[2-9]|[3-6]\d|7[01]|720))/u,lengths:[16,19]},{network:"American Express",prefix:/^3[47]/u,lengths:[15]},{network:"Diners Club",prefix:/^3(?:0[0-5]|095|[68])/u,lengths:[14,16,19]},{network:"Discover",prefix:/^6(?:011|5|4[4-9])/u,lengths:[16,19]},{network:"JCB",prefix:/^35(?:2[89]|[3-8]\d)/u,lengths:[16,19]},{network:"JCB (legacy)",prefix:/^(?:2131|1800)/u,lengths:[15]},{network:"UnionPay",prefix:/^62/u,lengths:[16,17,18,19]},{network:"Maestro",prefix:/^(?:5018|5020|5038|5893|6304|6759|676[1-3])/u,lengths:[12,13,14,15,16,17,18,19]},{network:"Dankort",prefix:/^5019/u,lengths:[16]},{network:"Elo",prefix:/^(?:50(?:41|6[67])|509\d|6277|636[23])/u,lengths:[16]},{network:"Hipercard",prefix:/^6062/u,lengths:[16]},{network:"Mir",prefix:/^220[0-4]/u,lengths:[16,17,18,19]},{network:"UATP",prefix:/^1/u,lengths:[15]}];function Xm(e){return!!Zm.some(t=>t.lengths.includes(e.length)&&t.prefix.test(e))&&function(e){let t=0,n=!1;for(let r=e.length-1;r>=0;r-=1){const i=e.charCodeAt(r)-48,a=n?2*i:i;t+=a>9?a-9:a,n=!n}return t%10==0}(e)}function Ym(e,t){const n=$m(e);if(Rm.has(n))throw new Cm("card_verification_value",t,`field "${zm(e)}" names a card verification value`);if(Om.has(n))throw new Cm("forbidden_key",t,`field "${zm(e)}" names credential material`)}function Qm(e,t,n){for(const r of qm)if(r.pattern.test(e))throw new Cm("bearer_shape",n,r.detail);for(const r of function(e){const t=[];for(const n of e.matchAll(Km)){const r=n[0]??"",i=n.index??0;Wm(e,i,i+r.length)||t.push(Jm(r))}for(const n of e.matchAll(Fm))t.push(Jm(n[0]??""));return t}(e))if(Xm(r))throw new Cm("primary_account_number",n,"value contains a primary account number");if(function(e,t){let n;try{n=new URL(e)}catch{return}if(Dm.has(n.protocol))throw new Cm("unsafe_url_scheme",t,`URL scheme "${zm(n.protocol)}" is not renderable safely in a wallet`);const r=n.hash.startsWith("#")?n.hash.slice(1):n.hash,i=[{where:"query",params:n.searchParams},{where:"fragment",params:new URLSearchParams(r)}];for(const a of i)for(const[e]of a.params)if(Om.has($m(e)))throw new Cm("forbidden_url_param",t,`URL ${a.where} carries the forbidden parameter "${zm(e)}"`)}(e,n),null!==t&&Pm(t).some(e=>Um.has(e))&&Mm.test(e))throw new Cm("labelled_high_entropy",n,`field "${zm(t)}" is named for credential material and holds an opaque run`)}function eg(e){return zm(Object.prototype.toString.call(e).slice(8,-1))}function tg(e){const t=Object.getPrototypeOf(e);return null===t||t===Object.prototype}function ng(e){!function(e){const t=new WeakSet,n=[{node:e,path:"$"}];for(;n.length>0;){const e=n.pop();if(void 0===e)break;const r=e.node;if(null===r)continue;if(ni(r)||si(r)||ci(r))continue;if(pi(r))continue;if(hi(r))throw new Cm("non_json_value",e.path,"a bigint is not JSON data; JSON.stringify refuses to serialize one");if(fi(r)||mi(r))throw new Cm("non_json_value",e.path,`a ${eg(r)} is not JSON data and would be dropped silently`);if(!ri(r))throw new Cm("non_json_value",e.path,`a ${eg(r)} is not JSON data`);if(Array.isArray(r)){if(t.has(r))continue;t.add(r),r.forEach((t,r)=>{n.push({node:t,path:`${e.path}[${r}]`})});continue}if(t.has(r))continue;if(t.add(r),!tg(r))throw new Cm("non_json_value",e.path,`a ${eg(r)} is not JSON data; a pass carries strings, numbers, booleans, arrays, and plain objects`);if("toJSON"in r)throw new Cm("non_json_value",e.path,"a value defining toJSON chooses its own serialized form, which is not the form this check inspected");const i=Object.getOwnPropertyDescriptors(r);for(const t of Object.keys(r)){const r=i[t];if(void 0!==r){if(void 0!==r.get||void 0!==r.set)throw new Cm("non_json_value",`${e.path}.${zm(t)}`,"an accessor property is not JSON data; it can answer one thing to this check and another to the signer");n.push({node:r.value,path:`${e.path}.${zm(t)}`})}}}}(e);const t=function(e){try{return JSON.stringify(e)}catch{throw new Cm("cyclic_payload","$","the payload cannot be serialized to JSON; it refers back to itself or nests too deeply")}}(e);void 0!==t&&function(e){const t=[{node:e,key:null,label:null,path:"$"}];for(;t.length>0;){const e=t.pop();if(void 0===e)break;if(null!==e.key&&Ym(e.key,e.path),Array.isArray(e.node))e.node.forEach((n,r)=>{t.push({node:n,key:null,label:e.label,path:`${e.path}[${r}]`})});else if(ai(e.node))for(const[n,r]of Object.entries(e.node))t.push({node:r,key:n,label:n,path:`${e.path}.${zm(n)}`});else Qm(String(e.node),e.label,e.path)}}(JSON.parse(t))}const rg="https://walletobjects.googleapis.com/walletobjects/v1",ig="https://oauth2.googleapis.com/token";function ag(e){const t=e.fetch,n=e.assertCurrent,r=e.signal,i=e.supportsNativeOrigin,a=e.capture;let o=!1;const s=()=>{if(o||e.fetch!==t||e.assertCurrent!==n||e.signal!==r||e.supportsNativeOrigin!==i||e.capture!==a||r?.aborted)throw o=!0,new gr("deployment")},c=()=>{s();try{n.call(e),s()}catch(t){throw o=!0,t}s()},l={assertCurrent:c,fetch:async(n,r)=>{c();const i=await t.call(e,n,r);try{return c(),i}catch(a){throw await(i.body?.cancel().catch(()=>{})),a}}};return i&&(l.supportsNativeOrigin=t=>{c();const n=i.call(e,t);return c(),n}),c(),r?{...l,signal:r}:l}const og={name:"Google Wallet",methodLabel:"Issuer service account",instructions:"Add your service account as a Developer on the Google Wallet issuer, then supply its JSON key and an existing Generic pass class. The approved browser connection reaches Google directly; configured native networking is optional. Verification checks that exact class. Prepare a public pass, then choose Save to Google Wallet to open Google's save flow. A prepared link does not mean a pass has been saved.",fields:[{id:"issuer_id",label:"Issuer ID",kind:"text",secret:!1,required:!0},{id:"class_id",label:"Generic class ID",kind:"text",secret:!1,required:!0},{id:"origin",label:"Presenting HTTPS origin",kind:"url",secret:!1,required:!0},{id:"service_account_json",label:"Service account JSON key",kind:"text",secret:!0,required:!0}],links:[{label:"Google Wallet web passes",url:"https://developers.google.com/wallet/generic/web"}],disconnectExplanation:"Disconnect forgets this device's issuer key. It does not revoke the service-account key or remove passes saved to Google Wallet.",actions:[{id:"provider.pass.prepare",label:"Prepare a Google Wallet pass",resultOrigins:["https://pay.google.com"],fields:[{id:"title",label:"Public pass title",kind:"text",secret:!1,required:!0},{id:"header",label:"Public pass header",kind:"text",secret:!1,required:!0}]}]};ao();const sg=["issuer_id","class_id","origin","client_email"],cg=["service_account_json"],lg=Ur({access_token:qr().regex(/^[A-Za-z0-9._~+/=-]{20,4096}$/),expires_in:Vr().int().positive().max(86400),token_type:Dr("Bearer").optional()}),dg=e=>"google-wallet"===Ve(e);function ug(e){const t=function(e){let t;try{t=JSON.parse(e)}catch{throw new Error("Paste the service account key file, a JSON document")}if(!(ai(t)&&t.type===ym.nativeServiceAccount.type&&ni(t.client_email)&&new RegExp(ym.nativeServiceAccount.emailPattern).test(t.client_email)&&ni(t.private_key)&&new RegExp(ym.nativeServiceAccount.keyPemPattern).test(t.private_key)))throw new Error("That is not a service account key file");return{clientEmail:t.client_email,privateKey:t.private_key}}(e.credentials.service_account_json??""),n=function(e){const t=Object.values(Im),n=t.filter(t=>_m(e,t).length>0);if(0===n.length)return{enabled:!1};const r=t.filter(t=>0===_m(e,t).length);if(r.length>0)throw new jm(`Google Wallet is partially configured: ${n.join(", ")} set, ${r.join(", ")} missing. Set all of them or none of them.`,r);const i=_m(e,Im.issuerId);if("issuer_id"===bm(i,"placeholder","x@example.test"))throw new jm(`${Im.issuerId} must be the numeric Google-assigned issuer id.`,[Im.issuerId]);const a=function(e,t){const n=t.indexOf(ym.walletClass.issuerSeparator);if(n<0)return`${e}${ym.walletClass.issuerSeparator}${t}`;const r=t.slice(0,n);if(r!==e)throw new jm(`${Im.classId} names issuer "${r}" but ${Im.issuerId} is "${e}"; a class must belong to its own issuer.`,[Im.classId,Im.issuerId]);return t}(i,_m(e,Im.classId));if("class_id"===bm(i,a,"x@example.test"))throw new jm(`${Im.classId} suffix may only contain letters, digits, ".", "_" and "-".`,[Im.classId]);const o=_m(e,Im.serviceAccountEmail).toLowerCase();if("service_account_email"===bm(i,a,o))throw new jm(`${Im.serviceAccountEmail} must be the service account's client email address.`,[Im.serviceAccountEmail]);const s=_m(e,Im.serviceAccountKeyPem),c=xm(s),l=km(s);if(/-----BEGIN RSA PRIVATE KEY-----/u.test(l))throw new jm(`${Im.serviceAccountKeyPem} is a PKCS#1 key; supply the PKCS#8 "BEGIN PRIVATE KEY" form from the service account JSON.`,[Im.serviceAccountKeyPem]);if(!c)throw new jm(`${Im.serviceAccountKeyPem} must be a PKCS#8 PEM private key.`,[Im.serviceAccountKeyPem]);return{enabled:!0,issuerId:i,classId:a,serviceAccountEmail:o,serviceAccountKeyPem:l,publicBaseUrl:function(e,t){let n;try{n=new URL(t)}catch{throw new jm(`${e} is not a URL.`,[e])}if("https:"!==n.protocol)throw new jm(`${e} must use https.`,[e]);if(n.username.length>0||n.password.length>0)throw new jm(`${e} must not carry credentials.`,[e]);if(n.search.length>0||n.hash.length>0)throw new jm(`${e} must be a bare origin and path, with no query or fragment.`,[e]);return`${n.origin}${n.pathname.replace(/\/+$/u,"")}`}(Im.publicBaseUrl,_m(e,Im.publicBaseUrl)),origins:function(e){const t=e.split(",").map(e=>e.trim()).filter(e=>e.length>0);if(0===t.length)throw new jm(`${Im.origins} is set but lists no origins.`,[Im.origins]);return t.map(e=>{let t;try{t=new URL(e)}catch{throw new jm(`${Im.origins} entry "${e}" is not a URL.`,[Im.origins])}if("https:"!==t.protocol)throw new jm(`${Im.origins} entry "${e}" must use https.`,[Im.origins]);if("/"!==t.pathname||t.search.length>0||t.hash.length>0)throw new jm(`${Im.origins} entry "${e}" must be a bare origin.`,[Im.origins]);return t.origin})}(_m(e,Im.origins))}}({OPENSESAME_WALLET_GOOGLE_ISSUER_ID:e.parameters.issuer_id,OPENSESAME_WALLET_GOOGLE_CLASS_ID:e.parameters.class_id,OPENSESAME_WALLET_GOOGLE_SERVICE_ACCOUNT_EMAIL:t.clientEmail,OPENSESAME_WALLET_GOOGLE_SERVICE_ACCOUNT_KEY:t.privateKey,OPENSESAME_WALLET_GOOGLE_PUBLIC_BASE_URL:e.parameters.origin,OPENSESAME_WALLET_GOOGLE_ORIGINS:e.parameters.origin});if(!n.enabled)throw new Error("Configure the Google Wallet issuer");return n}function pg(e,t){!function(e){if(!dg(e.providerId)||Object.keys(e.requestedScopes??{}).length||Object.keys(e.targetIds??{}).length||Object.keys(e.parameters).some(e=>!sg.includes(e))||Object.keys(e.credentials).some(e=>!cg.includes(e)))throw new Error("Configure only the Google Wallet issuer, class, origin and service-account key")}(e);const n={service_account_json:e.credentials.service_account_json||t?.privateState.credentials.service_account_json||""};if(n.service_account_json.length>ym.nativeServiceAccount.jsonMaxLength)throw new Error("Supply a bounded service-account JSON key");const r={providerId:e.providerId,parameters:{...e.parameters},credentials:n};try{const t=ug(r);if(new URL(r.parameters.origin??"").origin!==r.parameters.origin)throw new Error("Use an HTTPS origin without a path");r.parameters={issuer_id:t.issuerId,class_id:t.classId,origin:t.origins[0]??"",client_email:t.serviceAccountEmail};for(const i of[...Object.values(r.parameters),e.displayName])wr(i,n);vr(e.icon??"",n)}catch{throw new Error("Enter a valid issuer, class, HTTPS presenting origin and service-account JSON key")}return t&&(r.saved={id:t.connectionId,guard:cn(t)}),r}async function hg(e,t,n){const r=ug(e),i=`https://walletobjects.googleapis.com/walletobjects/v1/genericClass/${encodeURIComponent(r.classId)}`;let a=null;const o=async()=>{t.assertCurrent(),e.saved&&await rn(e.saved.id,e.saved.guard),t.assertCurrent()},s=new WeakMap,c=async(e,n)=>{await o();const r=new Request(e,n),c="https://oauth2.googleapis.com/token"===r.url&&"POST"===r.method;if(!c&&(r.url!==i||"GET"!==r.method))throw new gr("deployment");const l=[r.signal,AbortSignal.timeout(15e3)];t.signal&&l.push(t.signal);const d=AbortSignal.any(l),u=await async function(e,t,n){const r={method:e.method,headers:e.headers,signal:t,credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"};return n&&(r.body=await e.text()),r}(r,d,c);let p;await o();try{if(p=await t.fetch(r.url,u),await o(),!p.ok||p.redirected)throw[400,401].includes(h=p.status)?new gr("authorization",h):new gr(403===h?"permission":429===h?"rate-limit":"response",h);return s.set(p,{signal:d,token:c}),p}catch(f){throw await(p?.body?.cancel().catch(()=>{})),await o(),a=f instanceof gr?f:new gr("network"),a}var h},l=async(e,t)=>{const n=s.get(e);if(!n||t!==(n.token?16384:65536))throw new gr("deployment");try{await o();const r=await yr(e,{maxBytes:t,signal:n.signal});return await o(),n.token?lg.parse(r):r}catch(r){throw await o(),a=r instanceof gr?r:new gr("response"),a}finally{s.delete(e)}};await o();try{const e=await n(function(e){const{config:t}=e,n=e.fetchImpl??globalThis.fetch,r=e.now??(()=>new Date),i=e.readResponseJson??(e=>e.json());let a=null;const o=()=>(a??=es(t.serviceAccountKeyPem,"RS256"),a);let s=null;const c=async()=>{const e=r().getTime();if(null!==s&&s.expiresAtMs>e)return s.value;const a=Math.floor(e/1e3),c=await new Jo({iss:t.serviceAccountEmail,scope:"https://www.googleapis.com/auth/wallet_object.issuer",aud:ig,iat:a,exp:a+3600}).setProtectedHeader({alg:"RS256",typ:"JWT"}).sign(await o());let l;try{l=await n(ig,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:c}).toString()})}catch(p){throw new Am(0,"Google's token endpoint was unreachable; no change was made.",p)}if(!l.ok)throw new Am(l.status,`Google refused the service-account assertion (HTTP ${l.status}).`);const{value:d,lifetime:u}=function(e,t){if(!ai(e)||!ni(e.access_token)||0===e.access_token.length)throw new Am(t,"Google's token response carried no access token.");const n=void 0===e.expires_in?3600:e.expires_in;if(!si(n)||!Number.isFinite(n)||n<=0)throw new Am(t,"Google's token response carried an invalid expiry.");return{value:e.access_token,lifetime:n}}(await i(l,16384),l.status);return s={value:d,expiresAtMs:e+1e3*Math.max(u-60,0)},d},l=async(e,t)=>{const r=await c(),i=`${rg}/genericObject/${encodeURIComponent(e)}`;let a;try{a=await n(i,{method:"PATCH",headers:{authorization:`Bearer ${r}`,"content-type":"application/json"},body:JSON.stringify(t)})}catch(o){throw new Am(0,"Google Wallet was unreachable; the pass was not changed.",o)}if(!a.ok){if(404===a.status)throw new Am(404,`Google holds no pass with id ${e}.`);if(a.status>=500)throw new Am(a.status,`Google Wallet failed the update (HTTP ${a.status}); the pass may or may not have changed.`);throw new Am(a.status,`Google Wallet refused the update (HTTP ${a.status}).`)}},d=async(e,t,r)=>{ng(t);const i=await c(),a=`${rg}/${e}`;let o;try{o=await n(a,{method:"POST",headers:{authorization:`Bearer ${i}`,"content-type":"application/json"},body:JSON.stringify(t)})}catch(s){throw new Am(0,r,s)}if(!o.ok&&409!==o.status){if(o.status>=500)throw new Am(o.status,`Google Wallet failed the ${e} insert (HTTP ${o.status}); it may or may not have been created.`);throw new Am(o.status,`Google Wallet refused the ${e} insert (HTTP ${o.status}).`)}};return{config:t,hasFetch:void 0!==n,now:r,signSaveUrl:async e=>{const n=r(),i={iss:t.serviceAccountEmail,aud:"google",typ:"savetowallet",iat:Math.floor(n.getTime()/1e3),origins:[...t.origins],payload:{genericObjects:[...e]}};ng(ii(i));const a=`https://pay.google.com/gp/v/save/${await new Jo(i).setProtectedHeader({alg:"RS256",typ:"JWT"}).sign(await o())}`;if(a.length>4096)throw new Sm(`The save link is ${a.length} characters; Google rejects links over 4096. Shorten the title or drop display rows.`);return a},verifyGenericClass:async()=>async function(e,t,n,r){let i,a=!1;try{if(i=await e(`https://walletobjects.googleapis.com/walletobjects/v1/genericClass/${encodeURIComponent(n)}`,{method:"GET",headers:{Authorization:`Bearer ${t}`,Accept:"application/json"},credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"}),!i.ok||i.redirected)throw new Error("Class proof refused");const o=await r(i,65536);if(!ai(o)||o.id!==n)throw new Error("Class proof changed");a=!0}catch{throw new Am(i?.status??0,"Google Wallet could not verify the configured pass class.")}finally{a||await(i?.body?.cancel().catch(()=>{}))}}(n,await c(),t.classId,i),patchGenericObject:async(e,t)=>{ng(t),await l(e,t)},patchGenericObjectUnscreened:(e,t)=>l(e,t),insertGenericObject:e=>d("genericObject",e,"Google Wallet was unreachable; the pass was not provisioned."),insertGenericClass:e=>d("genericClass",e,"Google Wallet was unreachable; the class was not provisioned.")}}({config:r,fetchImpl:c,readResponseJson:l}));return await o(),e}catch{throw await o(),a??new gr("response")}}const fg=(mg=sn({family:"Google Wallet",idPrefix:"conn_google_wallet_",accepts:dg,classification:{publicParameters:sg,privateCredentials:cg},ui:()=>og,parse:pg,fingerprint:async e=>{const t=(new TextEncoder).encode(Bt({contract:"google-wallet:issuer-class:v1",parameters:e.parameters,credentials:e.credentials}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",t))].map(e=>e.toString(16).padStart(2,"0")).join("")},prove:async(e,t)=>{await hg(e,t,e=>e.verifyGenericClass());const n=e.parameters.class_id??"";return{identity:{id:e.parameters.client_email??"",label:e.parameters.client_email??"",kind:"service-account"},targets:[{id:n,label:n,kind:"pass-class"}],grantLabel:"Google Wallet configured class access",target:{key:"class",id:n}}},targetOf:e=>pg({providerId:e.configuration.providerId,displayName:e.configuration.displayName,icon:e.configuration.icon,parameters:e.configuration.parameters,credentials:e.privateState.credentials},e),operations:[{id:"provider.pass.prepare",inputKeys:["title","header"],run:async(e,t,n)=>{const r=n.title??"",i=n.header??"";for(const a of[r,i])if(!a.trim()||a.length>120||[...a].some(e=>e.charCodeAt(0)<32||127===e.charCodeAt(0)))throw new Error("Supply bounded public pass title and header text");return hg(e,t,async e=>{await e.verifyGenericClass();const t={id:`${e.config.issuerId}.os_${crypto.randomUUID().replaceAll("-","")}`,classId:e.config.classId,state:"ACTIVE",cardTitle:{defaultValue:{language:"en-US",value:r}},header:{defaultValue:{language:"en-US",value:i}}},n=await e.signSaveUrl([t]);return{label:"Save link prepared",items:[{id:t.id,label:"Save to Google Wallet",url:n}]}})}}]}),{...mg,configure:async(e,t=Vt().capture())=>mg.configure(function(e){return{...e,parameters:{...e.parameters},credentials:{...e.credentials},targetIds:{...e.targetIds},requestedScopes:Object.fromEntries(Object.entries(e.requestedScopes??{}).map(([e,t])=>[e,[...t]]))}}(e),ag(t)),verify:async(e,t=Vt().capture())=>mg.verify(e,ag(t)),invoke:(e,t,n={},r=Vt().capture())=>mg.invoke(e,t,{...n},ag(r))});var mg;async function gg(e,t,n,r,i){e.assertCurrent();const a=new Headers({Accept:"application/json"});r&&a.set("Authorization",`Bearer ${r}`),void 0!==i&&a.set("Content-Type","application/json");const o=new AbortController,s=setTimeout(()=>o.abort(),15e3);try{const r=await e.fetch(n,{method:t,headers:a,body:i,signal:o.signal,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"});if(e.assertCurrent(),r.redirected)throw new gr("response");const s=await qp(r);if(401===r.status)throw new gr("authorization",401);if(403===r.status)throw new gr("permission",403);if(429===r.status)throw new gr("rate-limit",429);if(!r.ok)throw new gr("response",r.status);if(e.assertCurrent(),o.signal.aborted)throw new gr("network");const c=JSON.parse(s);if(!ai(c))throw new gr("response");return c}catch(c){if(c instanceof gr)throw c;if(c instanceof di)throw new gr("deployment");if(c instanceof SyntaxError)throw new gr("response");throw new gr("network")}finally{clearTimeout(s)}}const wg={us:"https://app.infisical.com",eu:"https://eu.infisical.com"},vg="client_id",yg="client_secret",bg=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,kg=/^[!-~]{8,512}$/,xg=/^[A-Za-z0-9-]{1,64}$/,Ig=/^[A-Za-z0-9_-]{1,64}$/,jg=/^\/(?:[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*)?$/,_g=/^[A-Za-z0-9_.-]{1,255}$/,Sg=e=>"eu"===e?"eu":"us";async function Ag(e,t){const n=wg[Sg(e.parameters.site)],r=(await gg(t,"POST",`${n}/api/v1/auth/universal-auth/login`,void 0,JSON.stringify({clientId:e.credentials[vg]??"",clientSecret:e.credentials[yg]??""}))).accessToken;if(!ni(r)||!/^[A-Za-z0-9._~+/=-]{20,8192}$/.test(r))throw new gr("response");return r}function Cg(e){const t=(e.project??"").trim(),n=(e.environment??"").trim()||"prod",r=(e.path??"").trim()||"/";if(!xg.test(t))throw new Error("Enter the project ID");if(!Ig.test(n))throw new Error("Enter an environment slug");if(!jg.test(r)||r.includes(".."))throw new Error("Enter a folder path such as /");return new URLSearchParams({workspaceId:t,environment:n,secretPath:r})}async function Eg(e,t,n){const r=(n.name??"").trim();if(!_g.test(r))throw new Error("Enter a valid secret name");const i=Cg(n),a=await Ag(e,t),o=wg[Sg(e.parameters.site)],s=await gg(t,"GET",`${o}/api/v3/secrets/raw/${encodeURIComponent(r)}?${i}`,a),c=ai(s.secret)?s.secret.secretValue:void 0;if(!ni(c)||c.length>32768)throw new gr("response");return c}const Tg=[{id:"project",label:"Project ID",kind:"text",secret:!1,required:!0,placeholder:"00000000-0000-0000-0000-000000000000"},{id:"environment",label:"Environment",kind:"text",secret:!1,required:!1,placeholder:"prod"},{id:"path",label:"Folder",kind:"text",secret:!1,required:!1,placeholder:"/"}],Ng=sn({family:"Infisical",idPrefix:"conn_infisical_",accepts:function(e){return"infisical"===Ve(e)},classification:{publicParameters:["site"],privateCredentials:[vg,yg]},ui:function(){return{name:"Infisical",methodLabel:"Machine identity",instructions:"In Infisical open Organization Settings → Access Control → Machine Identities, create an identity with Universal Auth, and add a client secret. Paste its client ID and client secret. Infisical's servers answer only its own web app, so the call is carried by the OpenSesame connector bridge; the login proves the identity and the token it returns is used once and not kept.",fields:[{id:"site",label:"Region",kind:"choice",secret:!1,required:!0,defaultValue:"us",choices:[{id:"us",label:"US (app.infisical.com)"},{id:"eu",label:"EU (eu.infisical.com)"}]},{id:vg,label:"Client ID",kind:"text",secret:!0,required:!0,placeholder:"00000000-0000-0000-0000-000000000000"},{id:yg,label:"Client secret",kind:"text",secret:!0,required:!0}],links:[{label:"Universal Auth",url:"https://infisical.com/docs/documentation/platform/identities/universal-auth"}],disconnectExplanation:"Disconnect forgets this device's client ID and secret. It revokes nothing at Infisical: delete the client secret on the identity to end its other uses.",actions:[{id:"provider.names.read",label:"List secret names",fields:Tg},{id:"provider.secret.read",label:"Read a secret's value",fields:[...Tg,{id:"name",label:"Secret name",kind:"text",secret:!1,required:!0,placeholder:"DATABASE_URL"}]}]}},parse:function(e,t){!function(e){if(Object.keys(e.requestedScopes??{}).length||Object.keys(e.targetIds??{}).length||Object.keys(e.parameters).some(e=>"site"!==e)||Object.keys(e.credentials).some(e=>e!==vg&&e!==yg))throw new Error("Configure only a region and a machine identity")}(e);const n=e.parameters.site?.trim()||"us";if("us"!==n&&"eu"!==n)throw new Error("Choose a region");const r=t?.privateState.credentials??{},i=(e.credentials[vg]||r[vg]||"").trim(),a=(e.credentials[yg]||r[yg]||"").trim();if(!bg.test(i))throw new Error("Enter the machine identity's client ID");if(!kg.test(a))throw new Error("Enter the client secret");const o={[vg]:i,[yg]:a};return wr(e.displayName,o),vr(e.icon??"",o),{providerId:e.providerId,parameters:{site:n},credentials:o}},fingerprint:e=>async function(e){const t=(new TextEncoder).encode(Bt({contract:"infisical:universal-auth:v1",parameters:e}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",t))].map(e=>e.toString(16).padStart(2,"0")).join("")}(e.parameters),prove:async function(e,t){await Ag(e,t);const n=Sg(e.parameters.site),r=new URL(wg[n]).hostname;return{identity:{id:r,label:"Machine identity",kind:"machine-identity"},targets:[{id:n,label:r,kind:"region"}],grantLabel:"Infisical machine identity",target:{key:"site",id:n}}},targetOf:e=>({providerId:e.configuration.providerId,parameters:e.configuration.parameters,credentials:e.privateState.credentials}),operations:[{id:"provider.names.read",inputKeys:["project","environment","path"],run:async(e,t,n)=>{const r=await async function(e,t,n){const r=Cg(n),i=await Ag(e,t),a=wg[Sg(e.parameters.site)],o=(await gg(t,"GET",`${a}/api/v3/secrets/raw?${r}`,i)).secrets;if(!Array.isArray(o)||o.length>1e3)throw new gr("response");return o.slice(0,200).map(t=>{const n=ai(t)?t.secretKey:void 0;if(!ni(n)||!_g.test(n))throw new gr("response");return{id:n,label:wr(n,e.credentials)}})}(e,t,n);return{label:`First ${r.length} names`,items:r}}},{id:"provider.secret.read",inputKeys:["project","environment","path","name"],run:async(e,t,n)=>{const r=(n.name??"").trim();return{label:"Value read once",items:[{id:r,label:r,secretValue:await Eg(e,t,n)}]}}}]});ao();const zg=qr().regex(/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i),$g=Vr().int().nonnegative().max(20),Pg={error:Hr().optional(),errors:Hr().optional(),statementHandles:Hr().optional()},Og=Ur({code:Dr("333334"),statementHandle:zg,...Pg}),Rg=Ur({numRows:$g,format:Dr("jsonv2"),rowType:Gr(Ur({name:qr().min(1).max(64),type:qr().min(1).max(64)})).length(5),partitionInfo:Gr(Ur({rowCount:$g,uncompressedSize:Vr().int().nonnegative().max(262144).optional()})).max(20)}),Lg=Ur({code:Dr("090001"),sqlState:Dr("00000"),statementHandle:zg,resultSetMetaData:Rg.optional(),data:Gr(Gr(qr().max(4096).nullable()).length(5)).max(20),...Pg}),Ug=["created_on","name","kind","database_name","schema_name"];function Dg(e){const t=new URL(e);if("https:"!==t.protocol||t.username||t.password||t.port||"/"!==t.pathname||t.search||t.hash||!t.hostname.endsWith(".snowflakecomputing.com")||!t.hostname.split(".").every(e=>/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(e)))throw new Error("Enter the HTTPS account URL from Snowflake Account Details.");return t.origin}function qg(e){return e.throwIfAborted(),new Promise((t,n)=>{const r=()=>{clearTimeout(i),n(new gr("network"))},i=setTimeout(()=>{e.removeEventListener("abort",r),t()},250);e.addEventListener("abort",r,{once:!0}),e.aborted&&r()})}function Mg(e){if(!e.binding)return;const t=on(e.binding.id);if(!t||t.revision!==e.binding.revision||t.fingerprint!==e.binding.fingerprint)throw new Error("The saved Snowflake connection changed. Reopen its configuration.")}function Kg(e){const t=e.rowType.map(e=>e.name.toLowerCase());if(5!==new Set(t).size||Ug.some(e=>!t.includes(e))||"text"!==e.rowType[t.indexOf("name")]?.type.toLowerCase()||e.partitionInfo.reduce((e,t)=>e+t.rowCount,0)!==e.numRows)throw new gr("response");return t}async function Fg(e,t){let n;try{n=function(e,t){t.assertCurrent();const n=Dg(e.parameters.account_url??""),r=Mr(["PROGRAMMATIC_ACCESS_TOKEN","OAUTH"]).parse(e.parameters.token_type),i=e.credentials.token??"",a=new Headers({Authorization:`Bearer ${i}`,Accept:"application/json","Content-Type":"application/json","User-Agent":"OpenSesame/1.0","X-Snowflake-Authorization-Token-Type":r}),o=new AbortController,s=AbortSignal.any([o.signal,...t.signal?[t.signal]:[]]),c=()=>{t.assertCurrent(),s.throwIfAborted(),Mg(e)};c();const l=e.binding?Ei(()=>{try{Mg(e)}catch{o.abort()}}):()=>{},d=setTimeout(()=>o.abort(),15e3);let u=0;return{request:async(e,r)=>{c();const i={url:n+e,method:void 0===r?"GET":"POST",headers:a,signal:s};void 0!==r&&(i.body=r);const o=await mr(i,t);if(c(),u+=(new TextEncoder).encode(JSON.stringify(o)).length,u>524288)throw new gr("response");return o},check:c,signal:s,token:i,close(){clearTimeout(d),l(),o.abort()}}}(e,t);const r=await async function(e,t){const n={statement:"SHOW TERSE DATABASES LIMIT 20",timeout:15};e.parameters.role&&(n.role=e.parameters.role);let r,i=await t.request(`/api/v2/statements?requestId=${crypto.randomUUID()}`,JSON.stringify(n));for(let o=0;;o++){const e=Og.safeParse(i);if(!e.success)break;if(o>=64||r&&r!==e.data.statementHandle)throw new gr("response");r=e.data.statementHandle,await qg(t.signal),t.check(),i=await t.request(`/api/v2/statements/${r}`)}const a=Lg.parse(i);if(r&&a.statementHandle!==r)throw new gr("response");return a}(e,n),{rows:i,names:a}=await async function(e,t){const n=Rg.parse(e.resultSetMetaData);if(Kg(n),e.data.length!==(n.partitionInfo[0]?.rowCount??0))throw new gr("response");const r=[...e.data];for(let i=1;i<n.partitionInfo.length;i++){const a=Lg.parse(await t.request(`/api/v2/statements/${e.statementHandle}?partition=${i}`));if(a.statementHandle!==e.statementHandle||a.data.length!==n.partitionInfo[i]?.rowCount||a.resultSetMetaData&&JSON.stringify(a.resultSetMetaData)!==JSON.stringify(n))throw new gr("response");r.push(...a.data)}if(r.length!==n.numRows)throw new gr("response");return{rows:r,names:Kg(n)}}(r,n),o=function(e,t,n){return lu(e.map(e=>{if(["kind","database_name","schema_name"].some(n=>null!==e[t.indexOf(n)]))throw new gr("response");const r=qr().min(1).max(256).parse(e[t.indexOf("name")]);if([...r].some(e=>e.charCodeAt(0)<32||127===e.charCodeAt(0)))throw new gr("response");return wr(r,{token:n,encoded:encodeURIComponent(n)}),{id:r,label:r}}),"databases","first-page")}(i,a,n.token);return n.check(),o}catch(r){if(n?.signal.aborted)throw new gr("network");if(r instanceof gr)throw r;if(r instanceof Wr||r instanceof SyntaxError)throw new gr("response");throw new gr("network")}finally{n?.close()}}ao();const Gg=["account_url","token_type","role"],Bg=["token"],Vg=Mr(["PROGRAMMATIC_ACCESS_TOKEN","OAUTH"]),Hg=qr().min(1).max(16384).regex(/^[\x21-\x7e]+$/),Jg=qr().max(256).refine(e=>[...e].every(e=>e.charCodeAt(0)>=32&&127!==e.charCodeAt(0)));function Wg(e,t){!function(e){if("snowflake"!==e.providerId||Object.keys(e.parameters).some(e=>!Gg.includes(e))||Object.keys(e.credentials).some(e=>!Bg.includes(e))||Object.keys(e.requestedScopes??{}).length||Object.keys(e.targetIds??{}).length)throw new Error("Configure only the Snowflake account URL, token type, role and token.")}(e);const n=function(e){try{return{account_url:Dg((e.parameters.account_url??"").trim()),token_type:Vg.parse(e.parameters.token_type??"PROGRAMMATIC_ACCESS_TOKEN"),role:Jg.parse(e.parameters.role??"")}}catch{throw new Error("Enter the Snowflake HTTPS account URL, supported token type and optional role.")}}(e),r=t?.configuration.providerId===e.providerId&&Bt(t.configuration.parameters)===Bt(n),i=e.credentials.token||(r?t.privateState.credentials.token:"")||"";if(!Hg.safeParse(i).success)throw new Error("Enter a token for this exact Snowflake account, token type and role.");const a={token:i},o={token:i,encoded:encodeURIComponent(i)};wr(e.displayName,o),vr(e.icon??"",o);for(const c of Object.values(n))wr(c,o);const s={providerId:"snowflake",parameters:n,credentials:a};return t&&(s.binding={id:t.connectionId,revision:t.revision,fingerprint:t.configuration.fingerprint}),s}const Zg=sn({family:"Snowflake",idPrefix:"conn_snowflake_",accepts:e=>"snowflake"===e,classification:{publicParameters:Gg,privateCredentials:Bg},ui:function(){return{name:"Snowflake",methodLabel:"Snowflake token",instructions:"Copy the HTTPS Server URL from Snowsight Account Details. Supply a restricted programmatic access token or an already-issued OAuth access token. Verification runs SHOW TERSE DATABASES LIMIT 20 without a warehouse. Requests use this account only, through the approved browser or configured native HTTP route. Polling is bounded; authority loss stops local requests. Snowflake's 15-second statement timeout bounds the read-only job; this connection does not remotely cancel it.",fields:[{id:"account_url",label:"Snowflake account URL",kind:"url",secret:!1,required:!0,placeholder:"https://organization-account.snowflakecomputing.com"},{id:"token_type",label:"Token type",kind:"choice",secret:!1,required:!0,defaultValue:"PROGRAMMATIC_ACCESS_TOKEN",choices:[{id:"PROGRAMMATIC_ACCESS_TOKEN",label:"Programmatic access token"},{id:"OAUTH",label:"Already-issued OAuth access token"}]},{id:"role",label:"Role (optional)",kind:"text",secret:!1,required:!1,help:"Sent as structured request context, never inserted into SQL. Changing this role requires a token to be supplied and proved again."},{id:"token",label:"Access token",kind:"text",secret:!0,required:!0}],links:[{label:"Snowflake SQL API authentication",url:"https://docs.snowflake.com/en/developer-guide/sql-api/authenticating"},{label:"Programmatic access tokens",url:"https://docs.snowflake.com/en/user-guide/programmatic-access-tokens"}],disconnectExplanation:"Disconnect forgets this device's token and verified account. Revoke the token in Snowflake to end its other uses.",actions:[{id:"provider.databases.read",label:"List databases",fields:[]}]}},parse:Wg,fingerprint:async e=>{const t=(new TextEncoder).encode(Bt({contract:"snowflake-sql:databases:v1",providerId:e.providerId,parameters:e.parameters,credentials:e.credentials}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",t))].map(e=>e.toString(16).padStart(2,"0")).join("")},prove:async(e,t)=>{await Fg(e,t);const n=e.parameters.account_url??"";return{identity:{id:n,label:new URL(n).hostname,kind:"account"},targets:[{id:n,label:n,kind:"account"}],grantLabel:"Snowflake database metadata access",target:{key:"account",id:n}}},targetOf:e=>Wg({providerId:e.configuration.providerId,displayName:e.configuration.displayName,icon:e.configuration.icon,parameters:e.configuration.parameters,credentials:e.privateState.credentials},e),operations:[{id:"provider.databases.read",inputKeys:[],run:(e,t)=>Fg(e,t)}]}),Xg=new Map([["&amp;","&"],["&lt;","<"],["&gt;",">"],["&quot;",'"'],["&apos;","'"]]);function Yg(e,t){if(/<!(?:DOCTYPE|ENTITY)/i.test(e))throw new gr("response");let n=e;for(const r of t){if(!/^[A-Za-z][A-Za-z0-9]*$/.test(r))throw new gr("response");const e=new RegExp(`<${r}(?:\\s[^>]*)?>([\\s\\S]*?)</${r}>`).exec(n);if(!e)return null;n=e[1]??""}return n.trim().replace(/&(?:amp|lt|gt|quot|apos);/g,e=>Xg.get(e)??e)}function Qg(e,t,n){const r=Yg(e,t);if(null===r||r.length>4096||!n.test(r))throw new gr("response");return r}const ew=/^arn:aws[a-z-]*:iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/,tw="3600";function nw(e){return"aws-sts"===Ve(e)}async function rw(e,t,n,r){t.assertCurrent();const i=e.parameters.region??"",a=new URLSearchParams([["Action",n],["Version","2011-06-15"],...Object.entries(r??{})]).toString(),o=Po({method:"POST",url:bh("sts",i),headers:new Headers({"content-type":"application/x-www-form-urlencoded; charset=utf-8"}),payloadHash:No(zo((new TextEncoder).encode(a))),region:i,credentials:Eh(e),service:"sts",payloadHashHeader:!1,pathEncoding:"twice"}),s=new AbortController,c=setTimeout(()=>s.abort(),15e3);try{const e=await t.fetch(o.url,{method:"POST",headers:o.headers,body:a,signal:s.signal,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"});if(t.assertCurrent(),e.redirected)throw new gr("response");const n=await qp(e);if(!e.ok)throw Ch(e.status,Yg(n,["Error","Code"])??"");if(t.assertCurrent(),s.signal.aborted)throw new gr("network");return n}catch(l){if(l instanceof gr)throw l;if(l instanceof di)throw new gr("deployment");throw new gr("network")}finally{clearTimeout(c)}}async function iw(e,t){const n=await rw(e,t,"GetCallerIdentity"),r=["GetCallerIdentityResult"];return{account:Qg(n,[...r,"Account"],/^\d{12}$/),arn:Qg(n,[...r,"Arn"],/^arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:\d{0,12}:[\x21-\x7e]+$/),userId:Qg(n,[...r,"UserId"],/^[A-Za-z0-9:_@.=,+/-]{1,256}$/)}}function aw(e,t){const n=[t,"Credentials"],r=/^[A-Za-z0-9+/=_-]{16,16384}$/,i=Qg(e,[...n,"Expiration"],/^\d{4}-\d\d-\d\dT[\d:.]+Z$/);return{label:"Temporary credentials, shown once",items:[{id:"AccessKeyId",label:"Access key ID",secretValue:Qg(e,[...n,"AccessKeyId"],/^[A-Z0-9]{16,128}$/)},{id:"SecretAccessKey",label:"Secret access key",secretValue:Qg(e,[...n,"SecretAccessKey"],r)},{id:"SessionToken",label:"Session token",secretValue:Qg(e,[...n,"SessionToken"],r)},{id:"Expiration",label:`Expires ${i}`}]}}const ow=[{id:"region",label:"Region",kind:"text",secret:!1,required:!0,defaultValue:"us-east-1",placeholder:"us-east-1"},{id:"access_key_id",label:"Access key ID",kind:"text",secret:!1,required:!0},{id:"secret_access_key",label:"Secret access key",kind:"text",secret:!0,required:!0},{id:"session_token",label:"Session token (optional)",kind:"text",secret:!0,required:!1}],sw=sn({family:"AWS STS",idPrefix:"conn_sts_",accepts:nw,classification:vh,ui:function(){return{name:"AWS Security Token Service",methodLabel:"AWS access key",instructions:"Use an IAM access key. The request is signed in this browser with Signature Version 4 and sent only to the STS endpoint AWS publishes for the region. Verification calls GetCallerIdentity, which needs no permission and shows which account and identity the key belongs to.",fields:ow,links:[{label:"Create an IAM access key",url:"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"}],disconnectExplanation:"Disconnect forgets this device's access key. It revokes nothing at AWS: delete or rotate the key in IAM to end its other uses.",actions:[{id:"sts.identity.read",label:"Show who this key is",fields:[]},{id:"sts.role.assume",label:"Assume a role",fields:[{id:"role_arn",label:"Role ARN",kind:"text",secret:!1,required:!0,placeholder:"arn:aws:iam::123456789012:role/Deploy"}]},{id:"sts.session-token.get",label:"Get a session token",fields:[]}]}},parse:function(e,t){xh(e,nw(e.providerId));const n=Ih(e),r=jh(e,t);wr(e.displayName,r),vr(e.icon??"",r);for(const i of Object.values(n))wr(i,r);return{providerId:e.providerId,parameters:n,credentials:r}},fingerprint:async e=>{const t=(new TextEncoder).encode(Bt({contract:"aws:sigv4:sts:v1",parameters:e.parameters}));return No(new Uint8Array(await crypto.subtle.digest("SHA-256",t)))},prove:async function(e,t){const n=await iw(e,t),r=e.parameters.region??"";return{identity:{id:n.account,label:wr(n.arn,e.credentials),kind:"account"},targets:[{id:r,label:r,kind:"region"}],grantLabel:"AWS signing credentials",target:{key:"region",id:r}}},targetOf:e=>({providerId:e.configuration.providerId,parameters:e.configuration.parameters,credentials:e.privateState.credentials}),operations:[{id:"sts.identity.read",inputKeys:[],run:async(e,t)=>{const n=await iw(e,t);return{label:"Caller identity",items:[{id:"account",label:`Account ${n.account}`},{id:"arn",label:wr(n.arn,e.credentials)},{id:"user",label:`User ID ${n.userId}`}]}}},{id:"sts.role.assume",inputKeys:["role_arn"],run:async(e,t,n)=>{const r=n.role_arn??"";if(!ew.test(r))throw new Error("Enter a valid IAM role ARN");return aw(await rw(e,t,"AssumeRole",{RoleArn:r,RoleSessionName:"OpenSesame",DurationSeconds:tw}),"AssumeRoleResult")}},{id:"sts.session-token.get",inputKeys:[],run:async(e,t)=>aw(await rw(e,t,"GetSessionToken",{DurationSeconds:tw}),"GetSessionTokenResult")}]}),cw="api_token",lw="client_id",dw="client_secret",uw=[{id:"no",label:"No"},{id:"yes",label:"Yes"}],pw={id:"device",label:"Device ID",kind:"text",secret:!1,required:!0,placeholder:"from the device list"},hw={name:"Tailscale",methodLabel:"API access token or OAuth client",instructions:"In the Tailscale admin console open Settings → Keys, and either generate an API access token, or create an OAuth client with the scopes you need and paste its ID and secret. Tailscale's cloud API answers no web page, so the call is carried by the OpenSesame connector bridge; the credential is proved by reading your tailnet's devices, an OAuth token is used once and not kept, and nothing Tailscale says back in an error is repeated.",fields:[{id:"tailnet",label:"Tailnet",kind:"text",secret:!1,required:!1,placeholder:"-",help:"Leave as - for the credential's own tailnet."},{id:cw,label:"API access token",kind:"text",secret:!0,required:!1,placeholder:"tskey-api-…",help:"Use this, or the OAuth client below."},{id:lw,label:"OAuth client ID",kind:"text",secret:!0,required:!1},{id:dw,label:"OAuth client secret",kind:"text",secret:!0,required:!1,placeholder:"tskey-client-…"}],links:[{label:"Tailscale API",url:"https://tailscale.com/api"},{label:"OAuth clients",url:"https://tailscale.com/kb/1215/oauth-clients"}],disconnectExplanation:"Disconnect forgets this device's token or client secret. It revokes nothing at Tailscale: revoke the key or client in the admin console to end its other uses.",actions:[{id:"provider.devices.read",label:"List devices",fields:[]},{id:"provider.device.authorize",label:"Approve a device",fields:[pw]},{id:"provider.device.rename",label:"Rename a device",fields:[pw,{id:"name",label:"New name",kind:"text",secret:!1,required:!0,placeholder:"laptop"}]},{id:"provider.keys.read",label:"List auth keys",fields:[]},{id:"provider.key.create",label:"Create an auth key",fields:[{id:"tags",label:"Tags",kind:"text",secret:!1,required:!1,placeholder:"tag:server"},{id:"reusable",label:"Reusable",kind:"choice",secret:!1,required:!1,defaultValue:"no",choices:uw},{id:"ephemeral",label:"Ephemeral",kind:"choice",secret:!1,required:!1,defaultValue:"no",choices:uw},{id:"expiry_days",label:"Expires in (days)",kind:"text",secret:!1,required:!1,placeholder:"1"}]}]},fw="https://api.tailscale.com/api/v2",mw=/^tskey-[A-Za-z0-9_-]{8,300}$/,gw=/^[A-Za-z0-9_-]{1,64}$/,ww=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/,vw=/^tag:[a-z][a-z0-9-]{0,62}$/,yw=e=>encodeURIComponent(e.parameters.tailnet||"-");async function bw(e,t,n,r,i){const a=await async function(e,t){const n=e.credentials[cw];if(n)return n;const r=(await df(t,"POST",`${fw}/oauth/token`,void 0,{kind:"form",value:new URLSearchParams({grant_type:"client_credentials",client_id:e.credentials[lw]??"",client_secret:e.credentials[dw]??""})})).access_token;if(!ni(r)||!/^[A-Za-z0-9._~+/=-]{16,8192}$/.test(r))throw new gr("response");return r}(e,t);return df(t,n,`${fw}${r}`,a,i)}function kw(e,t,n,r){const i=e[t];if(!Array.isArray(i)||i.length>1e3)throw new gr("response");return i.slice(0,200).map(e=>{if(!ai(e))throw new gr("response");const t=r(e);return{id:t.id,label:wr(t.label,n)}})}const xw=(e,t="")=>ni(e)?e:t;async function Iw(e,t){return kw(await bw(e,t,"GET",`/tailnet/${yw(e)}/devices?fields=default`),"devices",e.credentials,e=>{const t=xw(e.id);if(!gw.test(t))throw new gr("response");const n=Array.isArray(e.addresses)?e.addresses.find(ni):void 0,r=ni(n)?n:"";return{id:t,label:`${xw(e.hostname)||xw(e.name)||t}${r?` · ${r}`:""}${!1===e.authorized?" · waiting for approval":""}`}})}function jw(e){const t=(e.device??"").trim();if(!gw.test(t))throw new Error("Enter a device ID from the list");return encodeURIComponent(t)}const _w=/^[A-Za-z0-9]{6,64}$/,Sw=/^[!-~]{8,512}$/,Aw=/^(?:-|[A-Za-z0-9][A-Za-z0-9.-]{0,254})$/,Cw=[Ph,sw,Hh,ln,wm,vm,hh,Ng,Zg,fg,sn({family:"Tailscale",idPrefix:"conn_tailscale_",accepts:function(e){return"tailscale"===Ve(e)},classification:{publicParameters:["tailnet"],privateCredentials:[cw,lw,dw]},ui:function(){return hw},parse:function(e,t){uf(e,["tailnet"],[cw,lw,dw],"Configure only a tailnet and one Tailscale credential");const n=e.parameters.tailnet?.trim()||"-";if(!Aw.test(n))throw new Error("Enter a tailnet name, or -");const r=t?.privateState.credentials??{},i=Boolean(e.credentials[cw]),a=Boolean(e.credentials[lw]||e.credentials[dw]),o=!i,s=(t,n)=>(e.credentials[t]||(n?r[t]:"")||"").trim(),c=function(e,t,n){if(e&&!t&&!n){if(!mw.test(e))throw new Error("Enter a Tailscale API access token (tskey-api-…)");return{[cw]:e}}if(!e&&t&&n){if(!_w.test(t))throw new Error("Enter the OAuth client's ID");if(!Sw.test(n))throw new Error("Enter the OAuth client's secret");return{[lw]:t,[dw]:n}}throw new Error("Enter either an API access token or an OAuth client's ID and secret")}(s(cw,!a),s(lw,o),s(dw,o));return wr(e.displayName,c),vr(e.icon??"",c),{providerId:e.providerId,parameters:{tailnet:n},credentials:c}},fingerprint:async function(e){const t=e.credentials[cw]?"token":"oauth",n=(new TextEncoder).encode(Bt({contract:"tailscale:api:v1",flavor:t,parameters:e.parameters}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",n))].map(e=>e.toString(16).padStart(2,"0")).join("")},prove:async function(e,t){const n=await Iw(e,t),r=e.parameters.tailnet||"-";return{identity:{id:`tailnet:${r}`,label:"-"===r?"Your tailnet":r,kind:"tailnet"},targets:[{id:r,label:`${"-"===r?"Your tailnet":r} · ${n.length} device${1===n.length?"":"s"}`,kind:"tailnet"}],grantLabel:"Tailscale credential",target:{key:"tailnet",id:r}}},targetOf:e=>({providerId:e.configuration.providerId,parameters:e.configuration.parameters,credentials:e.privateState.credentials}),operations:[{id:"provider.devices.read",inputKeys:[],run:async(e,t)=>{const n=await Iw(e,t);return{label:`${n.length} devices`,items:n}}},{id:"provider.device.authorize",inputKeys:["device"],run:async(e,t,n)=>{const r=jw(n);return await bw(e,t,"POST",`/device/${r}/authorized`,{kind:"json",value:{authorized:!0}}),{label:"Approved",items:[{id:decodeURIComponent(r),label:"Device approved"}]}}},{id:"provider.device.rename",inputKeys:["device","name"],run:async(e,t,n)=>{const r=jw(n),i=(n.name??"").trim();if(!ww.test(i))throw new Error("Enter a name of letters, digits and hyphens");return await bw(e,t,"POST",`/device/${r}/name`,{kind:"json",value:{name:i}}),{label:"Renamed",items:[{id:decodeURIComponent(r),label:i}]}}},{id:"provider.keys.read",inputKeys:[],run:async(e,t)=>{const n=await async function(e,t){return kw(await bw(e,t,"GET",`/tailnet/${yw(e)}/keys`),"keys",e.credentials,e=>{const t=xw(e.id);if(!gw.test(t))throw new Error("Unexpected key identifier");const n=xw(e.description);return{id:t,label:n?`${t} · ${n}`:t}})}(e,t);return{label:`${n.length} auth keys`,items:n}}},{id:"provider.key.create",inputKeys:["tags","reusable","ephemeral","expiry_days"],run:async(e,t,n)=>{const r=await async function(e,t,n){const r=(n.tags??"").split(",").map(e=>e.trim()).filter(Boolean);if(r.length>20||r.some(e=>!vw.test(e)))throw new Error("Enter tags such as tag:server, separated by commas");const i=Number((n.expiry_days??"").trim()||"1");if(!Number.isInteger(i)||i<1||i>90)throw new Error("Choose an expiry of 1 to 90 days");const a=(e,t)=>"yes"===(n[e]??"no"),o=await bw(e,t,"POST",`/tailnet/${yw(e)}/keys`,{kind:"json",value:{capabilities:{devices:{create:{reusable:a("reusable"),ephemeral:a("ephemeral"),preauthorized:!0,tags:r}}},expirySeconds:86400*i}}),s=o.key,c=xw(o.id);if(!ni(s)||!mw.test(s)||!gw.test(c))throw new gr("response");return{id:c,key:s}}(e,t,n);return{label:"Key shown once",items:[{id:r.id,label:`Auth key ${r.id}`,secretValue:r.key}]}}}]}),bf,Ff];function Ew(e){return Cw.find(t=>t.accepts(e))??null}const Tw=new Set(["github","s3","vault","openbao"]);function Nw(e){return Tw.has(e)||null!==Ew(e)||function(e){const t=Oa(e);return!!t&&!t.refused&&t.methods.some(e=>"api-key"===e.kind&&!!e.preset&&(!!e.preset.auth&&!!e.preset.verify||e.preset.credentialVariants.some(e=>!!e.auth&&!!e.verify)))}(e)}const zw=new Map,$w=new Set;function Pw(e,t){if(zw.has(e))throw new Error("Native provider driver is already active");return zw.set(e,t),$w.delete(e),()=>{zw.get(e)===t&&(zw.delete(e),$w.add(e))}}function Ow(e){return $w.has(e)}function Rw(e,t){return!0===zw.get(e)?.supports(t)}function Lw(e,t){const n=zw.get(e);if(!n?.supports(t))throw new Error("This provider route is unavailable in the active browser runtime");return n}const Uw=Ur({mcp_authentication:Mr(["bearer","header","anonymous"]),mcp_url:qr().max(4096),mcp_resource:qr().max(4096),mcp_transport:Mr(["streamable-http","sse"]),mcp_post_endpoint:qr().max(4096).optional(),mcp_header:qr().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/).optional()}).strict(),Dw=qr().min(1).max(32768).refine(e=>!/[\r\n\0]/.test(e)),qw=/^(?:host|cookie|set-cookie|origin|referer|content-.*|connection|upgrade|transfer-encoding|te|trailer|keep-alive|proxy-.*|sec-.*|mcp-.*)$/i,Mw=/^(?:access_token|token|api[_-]?key|key|secret|authorization)$/i,Kw=()=>({publicParameters:Uw.keyof().options,privateCredentials:["mcp_configured_reference","mcp_configured_vault"]});function Fw(e){const t=Oa(e);return!!t&&!t.refused&&t.methods.some(e=>"mcp"===e.kind)}function Gw(e){const t=Uw.parse(e);for(const n of[t.mcp_url,t.mcp_resource,t.mcp_post_endpoint])if(n&&[...dn(n).searchParams.keys()].some(e=>Mw.test(e)))throw new un("target");if("header"===t.mcp_authentication){if(!t.mcp_header||qw.test(t.mcp_header))throw new un("target")}else if(t.mcp_header)throw new un("target");if("sse"===t.mcp_transport&&!t.mcp_post_endpoint)throw new un("target");return pn({providerId:"configured-mcp",fingerprint:"validated",endpoint:t.mcp_url,resource:t.mcp_resource,issuer:null,transport:t.mcp_transport,ssePostEndpoint:t.mcp_post_endpoint}),t}function Bw(e){return"mcp"===e.method&&"mcp_authentication"in e.parameters&&(Gw(e.parameters),!0)}function Vw(e){if(e.transport.assertCurrent(),!e.transport.signal)throw new un("disposed");e.transport.signal.throwIfAborted()}function Hw(e,t,n){if(Vw(n),t.mcp_configured_vault!==n.tomb)throw new un("disposed");return Ss(t.mcp_configured_reference??"",e.fingerprint,["mcpToken"],n.tomb)}async function Jw(e){const t={providerId:e.providerId,method:e.method,target:Gw(e.parameters)},n=await crypto.subtle.digest("SHA-256",(new TextEncoder).encode(Bt(t)));return Array.from(new Uint8Array(n),e=>e.toString(16).padStart(2,"0")).join("")}function Ww(e,t){const n=gn(e),r=n.privateState.recovery.find(e=>e.id===t),i=Oa(n.configuration.providerId);if(!r||!i||!["registration","configure","revoke"].includes(r.kind))throw new mn("pending");const a=xn(n.configuration.providerId,n.configuration.parameters.mcp_url),o="ok"===a.status&&"dcr"===a.registration,s=vn(e,t)||n.privateState.recovery.some(e=>["registration","exchange","refresh"].includes(e.credentials?.phase??""));return{url:i.docsUrl??a.url,message:`${i.docsUrl?`Open ${i.name}'s official documentation and authorization settings`:`Open the MCP server address this connection used (no documentation link is known for ${i.name}) and find its authorization settings in your ${i.name} account`}. Revoke application access for this connection${o?" and remove its OpenSesame public client registration":""}. Confirm only after completing that provider action. Uncertain issuance remains in recovery because the provider could still finish a submitted request. Confirmation clears local authorization only for settled obligations; it does not verify provider revocation or a working connection.`,canConfirm:!s,revision:n.revision}}const Zw="opensesame.connector-bridge",Xw=["bad_request","host_not_allowed","not_granted","denied_header","too_large","not_enabled","redirect_refused","timeout","network"],Yw=/^[A-Za-z0-9_-]{8,64}$/,Qw=/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;function ev(e,t){return Object.keys(e).length===t.length&&t.every(t=>t in e)}function tv(e){return ni(e)&&e.length<=253&&Qw.test(e)}function nv(e,t){if(!ai(e)||e.channel!==Zw||1!==e.version||"response"!==e.direction||!ni(e.id)||!Yw.test(e.id))return null;const{id:n}=e;if(!1===e.ok){const t=Xw.find(t=>t===e.error);return t?{id:n,error:t}:null}if(!0!==e.ok)return null;const r="hello"===t?function(e){if(!ai(e)||!ev(e,["bridge","version","granted"]))return null;const{granted:t,version:n}=e;return"opensesame-connector-bridge"!==e.bridge||!ni(n)||n.length>32||!Array.isArray(t)||t.length>512||!t.every(tv)?null:{bridge:"opensesame-connector-bridge",version:n,granted:t.filter(tv)}}(e.result):"fetch"===t?function(e){if(!ai(e)||!ev(e,["status","headers","body"]))return null;const t=function(e){if(!Array.isArray(e)||e.length>64)return null;const t=[];for(const n of e){if(!Array.isArray(n)||2!==n.length)return null;const[e,r]=n;if(!ni(e)||!ni(r))return null;t.push([e,r])}return t}(e.headers),{status:n,body:r}=e;return!si(n)||!Number.isInteger(n)||n<200||n>599||!ni(r)||!t?null:{status:n,headers:t,body:r}}(e.result):function(e){if(!ai(e)||!ev(e,["pending"]))return null;const{pending:t}=e;return Array.isArray(t)&&t.every(tv)?{pending:t.filter(tv)}:null}(e.result);return r?{id:n,result:r}:null}function rv(e,t){return e.find(e=>e.providerId===t)?.authorities??[]}function iv(e,t){return e.find(e=>e.providerId===t)?.oauth??[]}const av=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;function ov(e,t){return e.find(e=>function(e,t){return e.authorities.includes(t)||(e.oauth?.includes(t)??!1)||(e.tenants?.some(e=>function(e,t){if(!t.startsWith("*."))return!1;const n=t.slice(1);return!(!e.endsWith(n)||e.length<=n.length)&&e.slice(0,e.length-n.length).split(".").every(e=>av.test(e))}(t,e))??!1)}(e,t))?.providerId??null}const sv=[{providerId:"agentmail",authorities:["api.agentmail.to"]},{providerId:"amazon-nova",authorities:["api.nova.amazon.com"]},{providerId:"arcee",authorities:["api.arcee.ai"]},{providerId:"auth0",authorities:[],tenants:["*.auth0.com"]},{providerId:"bamboohr",authorities:[],tenants:["*.bamboohr.com"]},{providerId:"beehiiv",authorities:["api.beehiiv.com"],oauth:["api.beehiiv.com","app.beehiiv.com"]},{providerId:"bitwarden",authorities:["api.bitwarden.com","api.bitwarden.eu","identity.bitwarden.com","identity.bitwarden.eu"]},{providerId:"bitwarden-sm",authorities:["api.bitwarden.com","api.bitwarden.eu","identity.bitwarden.com","identity.bitwarden.eu"]},{providerId:"box",authorities:[],oauth:["api.box.com"]},{providerId:"circleci",authorities:["circleci.com"]},{providerId:"clerk",authorities:["api.clerk.com"]},{providerId:"clickup",authorities:[],oauth:["api.clickup.com"]},{providerId:"cloudflare",authorities:["api.cloudflare.com"]},{providerId:"cloudflare-origin-ca",authorities:["api.cloudflare.com"]},{providerId:"codeberg",authorities:[],oauth:["codeberg.org"]},{providerId:"convex",authorities:[],oauth:["api.convex.dev"]},{providerId:"crusoe",authorities:["api.inference.crusoecloud.com"]},{providerId:"databricks",authorities:[],tenants:["*.azuredatabricks.net","*.cloud.databricks.com","*.gcp.databricks.com"]},{providerId:"datadog",authorities:["api.ap1.datadoghq.com","api.ap2.datadoghq.com","api.datadoghq.com","api.datadoghq.eu","api.ddog-gov.com","api.uk1.datadoghq.com","api.us2.ddog-gov.com","api.us3.datadoghq.com","api.us5.datadoghq.com"]},{providerId:"deepgram",authorities:["api.deepgram.com"]},{providerId:"docusign",authorities:[],oauth:["account.docusign.com"]},{providerId:"doppler",authorities:["api.doppler.com"]},{providerId:"dovetail",authorities:["dovetail.com"]},{providerId:"edenai",authorities:["api.edenai.run"]},{providerId:"exa",authorities:["api.exa.ai"]},{providerId:"fathom",authorities:["api.fathom.ai"]},{providerId:"friendli",authorities:["api.friendli.ai"]},{providerId:"helicone",authorities:["ai-gateway.helicone.ai","api.helicone.ai"]},{providerId:"hetzner",authorities:["inference.hetzner.com"]},{providerId:"higgsfield",authorities:["api.higgsfield.ai"]},{providerId:"hubspot",authorities:[],oauth:["api.hubapi.com"]},{providerId:"infisical",authorities:["app.infisical.com","eu.infisical.com"]},{providerId:"intercom",authorities:[],oauth:["api.intercom.io"]},{providerId:"io-net",authorities:["api.intelligence.io.solutions"]},{providerId:"jev",authorities:["api.typesafe.ai"]},{providerId:"kernel",authorities:["api.onkernel.com"]},{providerId:"kilo",authorities:["api.kilo.ai"]},{providerId:"lemma",authorities:["api.getlemma.com"]},{providerId:"linkedin",authorities:[],oauth:["api.linkedin.com","www.linkedin.com"]},{providerId:"llmgateway",authorities:["api.llmgateway.io"]},{providerId:"modal",authorities:["inference.us-west.modal.direct"]},{providerId:"monday",authorities:[],oauth:["api.monday.com","auth.monday.com"]},{providerId:"neon",authorities:["console.neon.tech"]},{providerId:"notion",authorities:[],oauth:["api.notion.com"]},{providerId:"npm",authorities:["registry.npmjs.org"]},{providerId:"nvidia",authorities:["integrate.api.nvidia.com"]},{providerId:"okta",authorities:[],tenants:["*.okta-emea.com","*.okta.com","*.oktapreview.com"]},{providerId:"ollama-cloud",authorities:["ollama.com"]},{providerId:"photon",authorities:[],oauth:["app.photon.codes"]},{providerId:"plivo",authorities:["api.plivo.com"]},{providerId:"postmark",authorities:["api.postmarkapp.com"]},{providerId:"railway",authorities:["backboard.railway.com"]},{providerId:"reddit",authorities:[],oauth:["oauth.reddit.com","www.reddit.com"]},{providerId:"render",authorities:["api.render.com"]},{providerId:"replicate",authorities:["api.replicate.com"]},{providerId:"resend",authorities:["api.resend.com"]},{providerId:"salesforce",authorities:[],oauth:["login.salesforce.com"]},{providerId:"sanity",authorities:["api.sanity.io"],oauth:["api.sanity.io"]},{providerId:"segment",authorities:["api.segmentapis.com"]},{providerId:"sendgrid",authorities:["api.sendgrid.com"]},{providerId:"sentry",authorities:[],oauth:["sentry.io"]},{providerId:"shopify",authorities:[],tenants:["*.myshopify.com"]},{providerId:"slack",authorities:[],oauth:["slack.com"]},{providerId:"stepfun",authorities:["api.stepfun.ai"]},{providerId:"tailscale",authorities:["api.tailscale.com"]},{providerId:"thinking-machines",authorities:["tinker.thinkingmachines.dev"]},{providerId:"typeform",authorities:["api.eu.typeform.com","api.typeform.com"],oauth:["api.typeform.com"]},{providerId:"volcengine",authorities:["ark.cn-beijing.volces.com"]},{providerId:"webflow",authorities:["api.webflow.com"],oauth:["api.webflow.com"]},{providerId:"whoop",authorities:[],oauth:["api.prod.whoop.com"]},{providerId:"workday",authorities:[],tenants:["*.myworkday.com"]},{providerId:"x",authorities:[],oauth:["api.x.com"]},{providerId:"zoom",authorities:[],oauth:["api.zoom.us","zoom.us"]}];class cv extends Error{constructor(e){super(`The connector bridge answered: ${e}`),this.code=e,this.name="BridgeCallError"}code}function lv(e,t={}){const n=t.helloMs??800,r=t.fetchMs??25e3,i=function(e,t){const n=new Map;let r=null,i=!1;function a(){!i||n.size>0||(r?.(),r=null)}function o(e){for(const[t,r]of n){const i=nv(e,r.operation);if(i?.id===t)return n.delete(t),r.settle(i),void a()}}return{ask:function(s,c,l){if(i)return Promise.resolve(null);r??=e.listen(o);const d=t();return new Promise(t=>{const r=setTimeout(()=>{n.delete(d),t(null),a()},l);var i;n.set(d,{operation:c,settle:e=>{clearTimeout(r),t(e)}}),e.post((i=s(d),{channel:Zw,version:1,direction:"request",...i}))})},drain(){i=!0,a()},close(){r?.(),r=null;for(const e of n.values())e.settle(null);n.clear()}}}(e,t.newId??(()=>crypto.randomUUID())),a=i.ask;return{hello:async function(){const e=await a(e=>({id:e,op:"hello"}),"hello",n);return e&&"result"in e&&"bridge"in e.result?e.result:null},need:async function(e){const t=await a(t=>({id:t,op:"need",hosts:[...e]}),"need",n);if(!t)throw new cv("unanswered");if("error"in t)throw new cv(t.error);return"pending"in t.result?[...t.result.pending]:[]},fetch:async function(e){const t=await a(t=>({id:t,op:"fetch",request:e}),"fetch",r);if(!t)throw new cv("unanswered");if("error"in t)throw new cv(t.error);if(!("status"in t.result))throw new cv("unanswered");return t.result},drain:i.drain,close:i.close}}const dv={present:!1,version:null,granted:[]},uv=new Set;let pv=null,hv=dv,fv=0;function mv(e){if(e.present!==hv.present||e.version!==hv.version||e.granted.length!==hv.granted.length||!e.granted.every((e,t)=>e===hv.granted[t])){hv=e;for(const e of[...uv])e()}}function gv(e){return pv=e,()=>{pv===e&&(pv=null,mv(dv))}}const wv=()=>hv,vv=e=>(uv.add(e),()=>{uv.delete(e)});async function yv(){const e=pv;if(!e)return hv;const t=++fv,n=await e.hello();return pv!==e||t!==fv||mv(n?{present:!0,version:n.version,granted:[...n.granted].sort()}:dv),hv}function bv(e){const t=Ve(e)??e;return[...new Set([...rv(sv,t),...iv(sv,t)])]}function kv(e){return hv.present&&hv.granted.includes(e.hostname)?ov(sv,e.hostname):null}const xv="https://github.com/OpenSesame-Labs/OpenSesame/tree/main/apps/browser-extension-bridge";async function Iv(e,t=[]){const n=pv,r=Ve(e)??e,i=t.filter(e=>function(e,t){return null!==ov(sv,t)}(0,e)&&ov(sv,e)===r),a=[...new Set([...bv(e),...i])].filter(tv);if(n&&hv.present&&0!==a.length)try{await n.need(a)}catch(o){if(!(o instanceof cv))throw o}}function jv(e){const t=[];return e.forEach((e,n)=>t.push([n,e])),t}function _v(e){if(null==e)return null;if(e instanceof URLSearchParams)return e.toString();if(e instanceof ArrayBuffer||ArrayBuffer.isView(e))try{return new TextDecoder("utf-8",{fatal:!0}).decode(e)}catch{throw new gr("bridge")}if(Object(e)!==e)return String(e);throw new gr("bridge")}const Sv=new Set([204,205,304]);function Av(e){if(e?.aborted)throw e.reason??new DOMException("aborted","AbortError")}async function Cv(e,t){const n=e instanceof URL?e:new URL(e),r=kv(n),i=pv;if(!i||!r)throw new gr("bridge");Av(t?.signal);const a=function(e,t,n){return{providerId:e,url:t.href,method:Ev(n?.method),headers:jv(new Headers(n?.headers)),body:_v(n?.body)}}(r,n,t);try{const e=await i.fetch(a);return Av(t?.signal),new Response(Sv.has(e.status)?null:e.body,{status:e.status,headers:new Headers(e.headers)})}catch(o){if(o instanceof cv)throw function(e){return new gr("network"===e.code||"timeout"===e.code||"unanswered"===e.code?"network":"bridge")}(o);throw o}}function Ev(e){const t=(e??"GET").toUpperCase(),n=["GET","HEAD","POST","PUT","PATCH","DELETE"].find(e=>e===t);if(!n)throw new gr("bridge");return n}const Tv=["token_endpoint","resource","revocation_endpoint","domain","shop","ui_host","api_host"];function Nv({id:e="connector",label:t="Connector",step:n,title:r,actions:i,focus:a=!1,children:o}){return Ee.jsxs("section",{className:"panel",id:e,"aria-label":t,tabIndex:a?-1:void 0,children:[Ee.jsxs("div",{className:"panel__head",children:[Ee.jsxs("h2",{children:[Ee.jsx("span",{className:"cx-step",children:n})," ",r]}),i]}),o]})}const zv=qr().regex(/^data:image\/(png|jpeg);base64,[A-Za-z0-9+/]+={0,2}$/);function $v({value:e,onChange:t,onError:n,onBusyChange:r}){const i=Ce.useId(),[a,o]=Ce.useState(!1);return Ee.jsxs("div",{className:"cx-icon-field","aria-busy":a,children:[Ee.jsx("label",{className:"f__label",htmlFor:i,children:"Icon"}),Ee.jsxs("div",{className:"cx-icon-field__row",children:[e?Ee.jsx("img",{src:e,alt:"Connector icon",width:44,height:44}):null,Ee.jsx("input",{id:i,type:"file",disabled:a,accept:"image/png,image/jpeg","aria-label":"Icon",title:"PNG or JPG, at least 640 × 640 pixels, at most 2 MB",onChange:e=>{!async function(e){const i=e.currentTarget,a=i.files?.[0];if(a){o(!0),r?.(!0);try{t(await async function(e){if(!["image/png","image/jpeg"].includes(e.type))throw new Error("Choose a PNG or JPG icon.");if(e.size>2097152)throw new Error("The icon must be at most 2 MB.");const t=await function(e){return new Promise((t,n)=>{const r=new FileReader;r.onload=()=>{const e=zv.safeParse(r.result);e.success?t(e.data):n(new Error("The icon could not be read."))},r.onerror=()=>n(new Error("The icon could not be read.")),r.readAsDataURL(e)})}(e);return await new Promise((e,n)=>{const r=new Image;r.onload=()=>r.naturalWidth>=640&&r.naturalHeight>=640?e():n(new Error("The icon must be at least 640 × 640 pixels.")),r.onerror=()=>n(new Error("Choose a valid PNG or JPG icon.")),r.src=t}),t}(a))}catch(s){n(s instanceof Error?s.message:"The icon could not be read.")}finally{i.value="",o(!1),r?.(!1)}}}(e)}}),e?Ee.jsx("button",{type:"button",disabled:a,className:"icon-btn","aria-label":"Remove icon",title:"Remove icon",onClick:()=>t(""),children:Ee.jsx(F,{size:16})}):null]})]})}function Pv({label:e,value:t,options:n,onChange:r,disabled:i=!1,legendHidden:a=!1}){const o=Ce.useId();return Ee.jsxs("fieldset",{className:"cx-block",children:[Ee.jsx("legend",{className:a?"visually-hidden":void 0,children:e}),Ee.jsx("div",{className:"cx-modes",role:"radiogroup","aria-label":e,children:n.map(e=>Ee.jsxs("label",{className:"cx-mode",children:[Ee.jsx("input",{type:"radio",name:o,checked:t===e.id,disabled:i||e.disabled,onChange:()=>r(e.id)}),Ee.jsx("span",{children:e.label})]},e.id))})]})}function Ov({label:e,value:t,options:n,onChange:r}){const i=Ce.useId();return Ee.jsxs("div",{className:"cx-select",children:[Ee.jsx("label",{className:"f__label",htmlFor:i,children:e}),Ee.jsx("select",{id:i,value:t,onChange:e=>{const t=n.find(t=>t.id===e.target.value);t&&r(t.id)},children:n.map(e=>Ee.jsx("option",{value:e.id,children:e.label},e.id))})]})}function Rv({rows:e}){return Ee.jsx("dl",{className:"cx-facts",children:e.map(([e,t])=>Ee.jsxs("div",{className:"cx-fact",children:[Ee.jsx("dt",{children:e}),Ee.jsx("dd",{children:t})]},e))})}function Lv({value:e,label:t}){return Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":t,title:t,onClick:()=>{navigator.clipboard?.writeText(e)},children:Ee.jsx(G,{size:14})})}function Uv({href:e,children:t}){return Ee.jsxs("a",{className:"conn-doc-link",href:e,target:"_blank",rel:"noreferrer noopener",children:[t," ",Ee.jsx(M,{size:12})]})}const Dv=new Map([["gitlab","https://gitlab.com/api/v4/user"],["dropbox","https://api.dropboxapi.com/2/users/get_current_account"],["spotify","https://api.spotify.com/v1/me"],["google","https://openidconnect.googleapis.com/v1/userinfo"],["workos","https://signin.workos.com/oauth2/userinfo"],["resend","https://api.resend.com/domains"]]);function qv(e){return Dv.get(e)??null}function Mv(e,t,n={},r){const i=In(e,t,n);if(i.available)return i;try{const a=function(e,t,n){if("oauth"===t){if("token_endpoint"in n||"resource"in n)return n.token_endpoint&&n.resource?{tokenEndpoint:n.token_endpoint,resourceEndpoint:n.resource}:null;const t=xr(e),r=qv(e);return t&&r?{tokenEndpoint:Ir(t,{parameters:{...n}}).token,resourceEndpoint:r}:null}if("mcp"===t){if("mcp_authentication"in n&&"oauth"!==n.mcp_authentication)return{resourceEndpoint:Gw(n).mcp_url};const t=xn(e,n.mcp_url);return"ok"===t.status?{tokenEndpoint:t.tokenEndpoint,resourceEndpoint:t.url}:null}return null}(e,t,n);if(!a)return i;const o=r??Gt();return In(e,t,n,{...a,transport:o})}catch{return i}}function Kv(e,t){const n=Mv(e.providerId,e.method,e.parameters,t);if(!n.available)throw new Error((n.reason?`${n.reason} `:"")+"Configure the Tailscale browser node's integration HTTP transport for this connection's token and resource origins, or use an endpoint that permits this browser origin.");t.assertCurrent(),t.signal?.throwIfAborted()}function Fv(e){const t=Object.fromEntries(e.filter(e=>!e.when&&!e.secret).map(e=>[e.id,e.defaultValue??""]));return Object.fromEntries(Gv(e,t).map(e=>[e.id,e.secret?"":e.defaultValue??""]))}function Gv(e,t){return e.filter(e=>!e.when||t[e.when.fieldId]===e.when.value)}function Bv(e,t,n,r){let i={...t,[n]:r};if(!e.some(e=>e.when?.fieldId===n))return i;const a=new Set(Gv(e,t));for(let o=0;o<e.length;o++){const t=Object.fromEntries(Gv(e,i).map(e=>[e.id,e.secret?"":a.has(e)?i[e.id]??"":e.defaultValue??""]));if(JSON.stringify(t)===JSON.stringify(i))return t;i=t}return i}function Vv(e,t){return Object.fromEntries(e.scopeGroups.map(e=>{const n=e.choices.filter(e=>e.default).map(e=>e.name),r=[...new Set([...t?.[e.actor]??n,...e.requiredScopes??[]])].filter(t=>e.choices.some(e=>e.name===t));return[e.actor,r]}))}function Hv(e,t,n){return Object.fromEntries(Gv(e,t).filter(e=>e.secret===n&&!e.displayOnly).map(e=>[e.id,t[e.id]??""]))}function Jv(e,t){return Gv(e,t).find(e=>e.required&&!t[e.id]?.trim())}function Wv(e,t){let n=e;for(const r of Object.values(t))r&&(n=n.replaceAll(r,"[credential removed]"));return n}function Zv(e){return"connected"===e.status&&null!==e.verifiedAt&&Mv(e.providerId,e.configuration.method,e.configuration.parameters).available}function Xv(e,t){try{const n=new URL(e);return"https:"!==n.protocol||n.username||n.password||t&&!t.includes(n.origin)?null:n.href}catch{return null}}function Yv(e){return"policy"!==e.unavailableKind&&(e.available||!0===e.configurable)}function Qv(e,t){return(e.authorizeFirst??["oauth","mcp","oidc"].includes(e.id))&&!(t&&Zv(t))}function ey({descriptor:e,method:t,locked:n,onMethod:r}){const i=e.methods.filter(Yv).sort((e,t)=>(e.preferredRank??Number.MAX_SAFE_INTEGER)-(t.preferredRank??Number.MAX_SAFE_INTEGER)),a=e.methods.filter(e=>!Yv(e));return Ee.jsxs(Ee.Fragment,{children:[i.length>1?Ee.jsx(Pv,{label:"Sign-in method",value:t,options:i.map(e=>({id:e.id,label:e.label})),disabled:n,onChange:e=>{const t=i.find(t=>t.id===e);t&&r(t)}}):null,a.length?Ee.jsxs("details",{className:"cx-application",open:0===i.length,children:[Ee.jsx("summary",{children:i.length?"Other sign-in methods":"Why not"}),a.map(e=>Ee.jsxs("div",{children:[Ee.jsxs("p",{className:"hint",children:[e.label,":"," ",e.unavailableReason??"Unavailable on this device."]}),e.links?.length?Ee.jsx("div",{className:"cx-links",children:e.links.map(e=>{const t=Xv(e.url);return t?Ee.jsx(Uv,{href:t,children:e.label},e.url):null})}):null]},e.id))]}):null]})}function ty({name:e,onName:t,icon:n,onIcon:r,onError:i,onBusy:a}){return Ee.jsxs("details",{className:"cx-application",children:[Ee.jsx("summary",{children:"Appearance"}),Ee.jsx(O,{label:"Connector name",value:e,onValueChange:t}),Ee.jsx($v,{value:n,onChange:r,onError:i,onBusyChange:a})]})}function ny(e){return Object.freeze({signal:e.signal,assertCurrent:()=>{if(!e.current())throw new DOMException("This configuration ended.","AbortError")}})}function ry({descriptor:e,controller:t,view:n}){const r=e.methods.map(e=>`${e.id}:${e.available}`).join("/"),i=e.providerId,a=n?.connectionId,o=n?.revision,s=n?.fingerprint,c=Ce.useMemo(()=>({controllerIdentity:t,providerId:i,connectionId:a,revision:o,fingerprint:s,roads:r}),[t,i,a,o,s,r]),l=Ce.useRef(c);l.current=c;const d=function(e,t){const n=Ce.useRef(null),r=Ce.useRef(null);return Ce.useEffect(()=>{const e={};n.current=e;const t=Ht.onLock(()=>{r.current?.controller.abort(),r.current=null});return()=>{t(),n.current===e&&(n.current=null,r.current?.controller.abort(),r.current=null)}},[]),Ce.useEffect(()=>()=>{const t=r.current;t?.owner===e&&(t.controller.abort(),r.current=null)},[e]),()=>{const i=n.current;r.current?.controller.abort();const a={controller:new AbortController,owner:e};return r.current=a,{signal:a.controller.signal,current:()=>!a.controller.signal.aborted&&null!==i&&n.current===i&&t.current===e&&r.current===a,finish:()=>{r.current===a&&(r.current=null)}}}}(c,l);return{owner:c,begin:d}}function iy({busy:e,method:t,view:n,onCancel:r,authorization:i}){if(void 0!==i){if(!i?.current())return null}else if(!e||!t||!Qv(t,n))return null;return Ee.jsx(B,{label:"Cancel sign-in",onClick:i?.cancel??r,children:Ee.jsx(H,{size:16})})}function ay({descriptor:e,controller:t,view:n,busy:r,perform:i,authorization:a}){const o=e.methods.find(e=>e.id===n.configuration.method&&e.available),s=!!o&&Qv(o),c=o?.scopeGroups??[],l=ry({descriptor:e,controller:t,view:n}),[d,u]=Ce.useState(null),p=d===l.owner;async function h(e){if(r)return;const n=l.begin();if(n.current()){u(l.owner);try{await i(()=>t.authorize(e))}finally{n.current()&&u(null),n.finish()}}}return Ee.jsxs("div",{className:"cx-form",children:[s&&"connected"!==n.status&&"cleanup"!==n.status?Ee.jsx("div",{className:"cx-links",children:c.length>0?c.map(e=>Ee.jsx(B,{label:`Authorize ${e.label}`,disabled:r,onClick:()=>{h(e.actor)},children:Ee.jsx(M,{size:16})},e.actor)):Ee.jsx(B,{label:`Authorize ${e.name}`,disabled:r,onClick:()=>{h()},children:Ee.jsx(M,{size:16})})}):null,Ee.jsx(iy,{busy:p,method:o,onCancel:t.cancelAuthorization,authorization:void 0===a?void 0:null}),Ee.jsx(B,{label:"native-local"===o?.id?`Verify ${e.name} configuration`:`Verify ${e.name} access`,disabled:r||!o||"cleanup"===n.status,onClick:()=>{i(async()=>{await t.verify()})},children:Ee.jsx(V,{size:16})})]})}function oy({label:e,choices:t,selected:n,onChange:r,requiredChoices:i=[]}){const a=Ce.useId();return 0===t.length?null:Ee.jsxs("details",{className:"cx-selection",children:[Ee.jsxs("summary",{"aria-label":e,children:[Ee.jsx("span",{children:e}),Ee.jsxs("span",{className:"cx-selection__count",children:[n.length," selected"]})]}),Ee.jsxs("fieldset",{className:"cx-selection__choices",children:[Ee.jsx("legend",{className:"visually-hidden",children:e}),t.map(e=>Ee.jsxs("label",{className:"check",title:e.description,children:[Ee.jsx("input",{id:`${a}-${e.name}`,type:"checkbox",checked:n.includes(e.name),disabled:i.includes(e.name),onChange:()=>r(n.includes(e.name)?n.filter(t=>t!==e.name):[...n,e.name])}),Ee.jsxs("span",{children:[e.name,i.includes(e.name)?" (required)":""]})]},e.name))]})]})}const sy=/\[([^\]\n]+)\]\(([^)\s]+)\)|\*\*([^*\n]+)\*\*|`([^`\n]+)`/g;function cy(e){let t="",n=0;for(const r of e.matchAll(sy))t+=e.slice(n,r.index),t+=r[1]??r[3]??r[4]??"",n=r.index+r[0].length;return t+e.slice(n)}function ly(e,t){const n=[];let r=0;for(const i of e.matchAll(sy)){if(n.push(e.slice(r,i.index)),void 0!==i[1]){const e=i[2]?Xv(i[2],t):null;n.push(e?Ee.jsx("a",{href:e,target:"_blank",rel:"noreferrer noopener",children:i[1]},i.index):i[1])}else n.push(void 0!==i[3]?Ee.jsx("strong",{children:i[3]},i.index):Ee.jsx("code",{children:i[4]},i.index));r=i.index+i[0].length}return n.push(e.slice(r)),n}function dy({text:e,origins:t=[]}){return Ee.jsx("p",{children:ly(e,t)})}function uy({field:e,value:t,onChange:n}){const r=Ce.useId();return"choice"!==e.kind||e.secret?"textarea"!==e.kind||e.secret?Ee.jsx(O,{label:e.label,value:t,type:e.secret?"password":"url"===e.kind?"url":"text",placeholder:e.placeholder,autoComplete:e.secret?"new-password":"off",readOnly:e.readOnly,mono:e.secret||"url"===e.kind,onValueChange:n}):Ee.jsxs("div",{className:"cx-select",children:[Ee.jsx("label",{className:"f__label",htmlFor:r,children:e.label}),Ee.jsx("textarea",{id:r,className:"cx-textarea",value:t,maxLength:e.maxLength??1e5,readOnly:e.readOnly,onChange:e=>n(e.target.value)})]}):Ee.jsx(Ov,{label:e.label,value:t,options:[{id:"",label:"Select…"},...e.choices??[]],onChange:n})}function py({fields:e,values:t,onChange:n}){return Gv(e,t).map(e=>Ee.jsxs("div",{className:"cx-form",children:[Ee.jsx(uy,{field:e,value:t[e.id]??"",onChange:t=>n(e.id,t)}),e.help?Ee.jsx(Oe,{tone:"idle",label:cy(e.help)}):null]},e.id))}function hy({method:e,values:t,scopes:n,onValue:r,onScopes:i}){const a=function(e){const t=new Map;for(const n of e??[]){const e=Xv(n.url);e&&t.set(JSON.stringify([n.label,e]),{label:n.label,url:e})}return[...t].map(([e,t])=>({id:e,...t}))}(e.links),o=a.map(e=>new URL(e.url).origin),s=e.fields.filter(e=>(e.required||e.secret)&&!e.displayOnly),c=e.fields.filter(e=>!e.required&&!e.secret||e.displayOnly);return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(py,{fields:s,values:t,onChange:r}),c.length||e.scopeGroups.length?Ee.jsxs("details",{className:"cx-application",children:[Ee.jsx("summary",{children:"Sign-in options"}),Ee.jsx(py,{fields:c,values:t,onChange:r}),e.scopeGroups.map(e=>Ee.jsx("div",{className:"cx-form",title:e.help,children:Ee.jsx(oy,{label:e.label,choices:e.choices,selected:n[e.actor]??[],requiredChoices:e.requiredScopes,onChange:t=>i(e.actor,t)})},e.actor))]}):null,e.instructions?Ee.jsxs("details",{className:"cx-application",children:[Ee.jsx("summary",{children:"Sign-in help"}),Ee.jsx(dy,{text:e.instructions,origins:o})]}):null,Ee.jsx("div",{className:"cx-links",children:a.map(e=>Ee.jsx(Uv,{href:e.url,children:e.label},e.id))})]})}function fy(e,t){return["api-key","mcp"].includes(e.id)?{}:t?.configuration.targetIds??{}}function my(e,t){const n=Fv(e.fields);if(t?.configuration.method!==e.id)return n;for(const r of e.fields)r.secret||r.readOnly||void 0===t.configuration.parameters[r.id]||(n[r.id]=t.configuration.parameters[r.id]),"resource_parameter"===r.id&&void 0===t.configuration.parameters.resource_parameter&&(n[r.id]="send"),!r.secret&&"client_id"===r.id&&t.configuration.clientId&&(n[r.id]=t.configuration.clientId);return Object.fromEntries(Gv(e.fields,n).map(e=>[e.id,n[e.id]??""]))}function gy(e,t,n={}){return function(e,t){if("oauth"!==t.id)return t;const n=function(e){const t=Ve(e)??e,n=iv(sv,t),r=sv.find(e=>e.providerId===t)?.tenants??[];if(0===n.length&&0===r.length)return null;const i=[...n,...r];return{hosts:i,text:`This provider's OAuth servers refuse web pages ${r.length?n.length?"at its own hosts and at your tenant":"at your own tenant":"at its own hosts"}, so a page cannot read the token exchange or the account check there. With the optional connector bridge installed, switched on for this site and allowed for ${i.join(", ")}${r.length?" (type your tenant host first and it appears in the bridge)":""}, those requests go through it. Your client secret stays sealed in your vault and is sent only to those hosts, and the bridge keeps nothing.`}}(e);return!n||t.instructions?.includes(n.text)?t:{...t,instructions:t.instructions?`${t.instructions}\n\n${n.text}`:n.text,links:(t.links??[]).some(e=>e.url===xv)?t.links:[...t.links??[],{label:"Connector bridge",url:xv}]}}(e,function(e,t,n){if("policy"===t.unavailableKind)return t;const r=t.runtimeAvailable??t.available,i=Mv(e,t.id,n);if(i.available)return function(e,t){if(!t.advice)return e;const n=[...e.links??[]];for(const r of t.evidenceUrls)n.some(e=>e.url===r)||n.push({label:"Browser access evidence",url:r});return{...e,instructions:e.instructions?.includes(t.advice)?e.instructions:e.instructions?`${e.instructions}\n\n${t.advice}`:t.advice,links:n}}(r?{...t,runtimeAvailable:r,available:!0,unavailableKind:void 0,unavailableReason:void 0}:{...t,runtimeAvailable:r,available:!1},i);const a=i.reason??"This provider route is unavailable in this browser.";return{...t,runtimeAvailable:r,available:!1,configurable:r||!0===t.configurable,unavailableKind:"refuses-browser",unavailableReason:a}}(e,t,n))}function wy(e,t){return"native-local"===t?`${e} configuration validated locally and saved on this device. Provider access was not checked.`:`${e} access verified and saved on this device.`}function vy({descriptor:e}){const t=e.docsUrl?Xv(e.docsUrl):null,n=jn(e.name,t);return Ee.jsxs(Ee.Fragment,{children:[n?Ee.jsx(Uv,{href:n.url,children:n.label}):null,e.externalLinks?.map(e=>Ee.jsx(Uv,{href:e.url,children:e.label},e.url)),e.configurationLinks?.map(e=>Ee.jsx(ze,{to:e.to,children:e.label},e.to))]})}function yy({method:e,missing:t,failure:n}){return Ee.jsxs(Ee.Fragment,{children:[t?Ee.jsx(Oe,{tone:"warn",label:`${t.label} is required.`}):null,n?Ee.jsx(Oe,{tone:"err",label:n}):null,e.available?null:Ee.jsx(Oe,{tone:"warn",label:e.unavailableReason??"This provider route is unavailable in this browser."})]})}function by({descriptor:e}){const t=e.methods.map(e=>e.unavailableKind),n=_n(t);return t.some(e=>void 0!==e)?Ee.jsx(Oe,{tone:"built-in"===n?"ok":"warn",label:`${e.name}: ${Sn[n]}`}):Ee.jsx(Oe,{tone:"warn",label:`${e.name} has no supported browser connection method.`})}function ky({props:e,model:t,missing:n}){const{descriptor:r}=e;return t.method||e.authorization?.current()?Ee.jsxs(U,{label:t.method?(i=t.method,a=e.view,o=r.name,Qv(i,a)?`Sign in to ${o}`:`Verify and connect ${o}`):`Sign in to ${r.name}`,busy:t.busy,disabled:t.busy||t.iconBusy||!t.method?.available||!!n||!t.name.trim(),children:[t.method?Ee.jsx(yy,{method:t.method,missing:n,failure:t.failure}):Ee.jsx(by,{descriptor:r}),Ee.jsx(iy,{busy:t.busy,method:t.method,view:e.view,onCancel:e.controller.cancelAuthorization,authorization:e.authorization})]}):Ee.jsx(by,{descriptor:r});var i,a,o}function xy(e){const t=function(e){const{descriptor:t,controller:n,view:r,onChanged:i,onFlash:a}=e,{lifetime:o,busy:s,setBusyOwner:c,failure:l,setFailure:d}=function(e){const{authorization:t}=e,n=ry(e),[r,i]=Ce.useState(null),a=r===n.owner||!!t?.current(),[o,s]=Ce.useState(null);return{lifetime:n,busy:a,setBusyOwner:i,failure:o?.owner===n.owner?o.text:"",setFailure:e=>s({owner:n.owner,text:e})}}(e),u=t.methods.filter(Yv),p=function(e,t){if(t)return e.methods.find(e=>Yv(e)&&e.id===t.configuration.method);const n=e.methods.filter(Yv),r=n.filter(e=>e.available),i=r.length?r:n,a=i.filter(e=>void 0!==e.preferredRank).sort((e,t)=>(e.preferredRank??Number.MAX_SAFE_INTEGER)-(t.preferredRank??Number.MAX_SAFE_INTEGER));if(a[0])return a[0];for(const o of["oidc","oauth","mcp","api-key","native-local"]){const e=i.find(e=>e.id===o);if(e)return e}}(t,r),[h,f]=Ce.useState(p?.id),[m,g]=Ce.useState(()=>p?my(p,r):{}),[w,v]=Ce.useState(()=>p?Vv(p,r?.configuration.requestedScopes):{}),y=function(e,t){const[n,r]=Ce.useState(t?.configuration.displayName??e),[i,a]=Ce.useState(t?.configuration.icon??""),[o,s]=Ce.useState(!1);return{name:n,setName:r,icon:i,setIcon:a,iconBusy:o,setIconBusy:s}}(t.name,r),{name:b}=y,k=u.find(e=>e.id===h),x=k?function(e,t,n,r,i){return gy(e,function(e,t,n,r){const i=function(e,t){const n=Gv(e.fields,t).find(e=>e.secret&&e.when&&e.help);return n?.help?{...e,instructions:n.help}:e}(e,n);if(!t||!Zv(t)||t.configuration.method!==i.id)return i;if("oauth"===i.id&&r&&JSON.stringify(r)!==JSON.stringify(t.configuration.requestedScopes))return i;const a=Hv(i.fields,my(i,t),!1),o=Hv(i.fields,n,!1);return Object.keys(a).length!==Object.keys(o).length||Object.entries(a).some(([e,t])=>t.trim()!==o[e]?.trim())?i:{...i,fields:i.fields.map(e=>e.secret?{...e,required:!1,help:(e.help?`${e.help} `:"")+"Leave blank to keep the saved credential."}:e)}}("mcp"===t.id&&["bearer","header","anonymous"].includes(r.mcp_authentication??"")?{...t,authorizeFirst:!1,scopeGroups:[]}:t,n,r,i),Hv(t.fields,r,!1))}(t.providerId,k,r,m,w):void 0,I=function(e,t,n,r,i){return!n&&!r&&e?.available&&!Jv(e.fields,t)&&!!i.trim()}(x,m,s,y.iconBusy,b);return{method:x,values:m,setValues:g,scopes:w,setScopes:v,busy:s,...y,setFailure:d,failure:l,choose:function(e){r||!Yv(e)||s||y.iconBusy||(f(e.id),g(my(e,r)),v(Vv(e)),d(""))},submit:async function(e){if(e.preventDefault(),!x||!I)return;const s=o.begin();if(!s.current())return;c(o.owner),d("");const l=Hv(x.fields,m,!0);try{const e=Qv(x,r),i=await(e?n.connect:n.configure)({method:x.id,owner:ny(s),displayName:b.trim(),icon:y.icon,parameters:Hv(x.fields,m,!1),credentials:l,requestedScopes:Vv(x,w),targetIds:fy(x,r)});if(!s.current())return;if(i.providerId!==t.providerId)throw new Error("Provider returned a different connection.");Zv(i)?(g(Hv(x.fields,m,!1)),a({tone:"ok",text:wy(t.name,x.id)})):a({tone:"warn",text:`Complete ${t.name} sign-in to connect.`})}catch(u){if(s.current()){const e=Wv(Ia(u),l);d(e),a({tone:"err",text:e})}}finally{try{if(s.current()){c(null);const e=n.load();s.current()&&i(e)}}finally{s.finish()}}}}}(e);!function(e,t){const n=Ce.useSyncExternalStore(vv,wv,wv),r=function(e){const t=new Set;for(const n of Tv){const r=e[n]?.trim().toLowerCase();if(r)try{const e=new URL(r.includes("://")?r:`https://${r}`).hostname;e.includes(".")&&t.add(e)}catch{}}return[...t].sort()}(t).join(" ");Ce.useEffect(()=>{n.present&&r&&Iv(e,r.split(" "))},[n.present,e,r])}(e.descriptor.providerId,t.values);const{descriptor:n}=e,r=t.method?Jv(t.method.fields,t.values):void 0;return Ee.jsxs("form",{className:"cx-form panel__body",onSubmit:e=>{t.submit(e)},children:[Ee.jsxs("fieldset",{className:"cx-block cx-form",disabled:t.busy||t.iconBusy,children:[Ee.jsxs("legend",{className:"visually-hidden",children:[n.name," configuration"]}),Ee.jsx(ey,{descriptor:n,method:e.view?.configuration.method??t.method?.id??"",locked:!!e.view,onMethod:t.choose}),t.method?Ee.jsxs(Ee.Fragment,{children:[e.view&&Zv(e.view)?Ee.jsx(ty,{name:t.name,onName:t.setName,icon:t.icon,onIcon:t.setIcon,onError:t.setFailure,onBusy:t.setIconBusy}):null,Ee.jsx(hy,{method:t.method,values:t.values,scopes:t.scopes,onValue:(e,n)=>t.setValues(r=>Bv(t.method?.fields??[],r,e,n)),onScopes:(e,n)=>t.setScopes(t=>({...t,[e]:n}))})]}):null]}),Ee.jsx(ky,{props:e,model:t,missing:r}),Ee.jsx(vy,{descriptor:n})]})}function Iy(e,t){return Ce.useMemo(()=>{const n=[e,t].filter(e=>void 0!==e);return n.length?AbortSignal.any(n):void 0},[e,t])}function jy(e,t){const n=Ce.useRef(null),r=Ce.useRef(null),i=Ce.useRef({onFlash:e,ownerSignal:t}),[a,o]=Ce.useState(!1),[s,c]=Ce.useState(""),[l,d]=Ce.useState(""),u=Ce.useCallback((e,t=!1)=>{r.current===e&&(r.current=null,n.current===e.epoch&&(o(!1),t&&(c(""),d(""))),e.detach(),e.cancel(),e.controller.abort())},[]),p=Ce.useCallback(()=>{const e=r.current;e?u(e,!0):n.current&&(o(!1),c(""),d(""))},[u]);Ce.useLayoutEffect(()=>{const e=Symbol("secret backend action mount");return n.current=e,o(!1),c(""),d(""),()=>{if(n.current!==e)return;n.current=null;const t=r.current;t&&u(t)}},[u]),Ce.useLayoutEffect(()=>{i.current={onFlash:e,ownerSignal:t};const n=r.current;n&&n.ownerSignal!==t&&u(n,!0)},[e,t,u]);const h=Ce.useCallback(async e=>{const t=n.current,a=i.current.ownerSignal;if(!t||r.current||a?.aborted)return!1;const{token:s,cancelled:l,subscribe:p}=function(e,t,n){let r=()=>{};const i=new Promise(e=>{r=()=>e(void 0)}),a={epoch:e,controller:new AbortController,ownerSignal:t,cancel:r,detach:()=>t?.removeEventListener("abort",o)},o=()=>n(a,!0);return{token:a,cancelled:i,subscribe:()=>t?.addEventListener("abort",o,{once:!0})}}(t,a,u),{controller:h}=s,f=()=>n.current===t&&r.current===s&&i.current.ownerSignal===a&&!h.signal.aborted&&!a?.aborted,m=function(e,t){return{signal:e,current:t,check:()=>{if(!t())throw new DOMException("This action ended.","AbortError")}}}(h.signal,f);if(r.current=s,p(),!f())return u(s,!0),!1;o(!0),c(""),d("");try{const t=await Promise.race([e(m),l]);return!!f()&&(t&&d(t),!0)}catch(g){if(!f())return!1;const e=Ia(g);return c(e),i.current.onFlash({tone:"err",text:e}),!1}finally{u(s)}},[u]);return{busy:a,failure:s,result:l,clear:p,run:h}}const _y=Ur({type:Dr("object"),required:Gr(qr().min(1)).optional()});function Sy(e){if(!e||(new TextEncoder).encode(e).length>32768)return null;try{const t=_y.safeParse(JSON.parse(e));return t.success?{schema:e,required:t.data.required??[]}:null}catch{return null}}function Ay({schema:e}){const t=Sy(e);return t?Ee.jsxs("div",{className:"cx-form",children:[Ee.jsxs("p",{className:"hint",children:["Required fields:"," ",Ee.jsx("code",{children:t.required.join(", ")||"None advertised"})]}),Ee.jsxs("details",{className:"cx-application",children:[Ee.jsx("summary",{children:"Advertised argument schema"}),Ee.jsx("pre",{className:"cx-argument-schema","aria-label":"Advertised argument schema",children:t.schema})]})]}):null}function Cy({label:e,value:t}){const[n,r]=Ce.useState(!1),i=Tt();return Ee.jsx(Nt,{label:e,actions:Ee.jsxs(Ee.Fragment,{children:[Ee.jsx($t,{label:e,revealed:n,onToggle:()=>r(e=>!e)}),Ee.jsx(Pt,{value:t,label:e,fieldKey:e,copied:i.copied,failed:i.failed,onCopy:i.copy})]}),children:Ee.jsx(zt,{label:e,value:t,revealed:n})})}function Ey(){const e=Ht.getSnapshot();return JSON.stringify([e.status,e.tomb,e.guest,e.awaitingSecondStep,e.decoy])}function Ty(e,t,n,r,i){const{busy:a,clear:o}=n,s=i?.scope,c=!0===i?.preserveDisabledResult,l=Ce.useMemo(()=>({controller:e,scope:s,end:o}),[e,s,o]);Ce.useLayoutEffect(()=>{t||(c&&!a||r(null),a&&o())},[t,a,o,r,c]),Ce.useLayoutEffect(()=>{r(null);let e=Ey();const t=()=>{l.end(),r(null)},n=Ht.onLock(t),i=Ht.subscribe(()=>{const n=Ey();e!==n&&(e=n,t())});return()=>{n(),i(),l.end()}},[l,r])}function Ny({result:e,origins:t}){return Ee.jsxs("section",{"aria-label":e.label,children:[Ee.jsx("output",{children:e.label}),e.items.length?Ee.jsx("ul",{children:e.items.map(e=>{const n=e.url?Xv(e.url,t):null;return Ee.jsx("li",{children:void 0!==e.secretValue?Ee.jsx(Cy,{label:e.label,value:e.secretValue}):n?Ee.jsx("a",{href:n,target:"_blank",rel:"noreferrer noopener",children:e.label}):e.label},e.id)})}):null]})}function zy(e){const{action:t}=e,{values:n,setValues:r,busy:i,failure:a,result:o,readRevision:s,enabled:c,missing:l,run:d}=function({action:e,controller:t,connected:n,disabled:r,onChanged:i,onFlash:a}){const[o,s]=Ce.useState(()=>Fv(e.fields)),c=jy(a),{busy:l,failure:d}=c,[u,p]=Ce.useState(null),[h,f]=Ce.useState(0),m=n&&e.available&&!r,g=Jv(e.fields,o);return Ty(t,m,c,p),{values:o,setValues:s,busy:l,failure:d,result:u,readRevision:h,enabled:m,missing:g,run:async function(n){n.preventDefault(),!m||l||g||(p(null),f(e=>e+1),await c.run(async n=>{try{const r=await t.invoke(e.id,Object.fromEntries(Gv(e.fields,o).map(e=>[e.id,o[e.id]??""])),n.signal);n.check(),p(r),s(t=>function(e,t){return{...t,...Object.fromEntries(e.fields.filter(e=>e.secret).map(e=>[e.id,""]))}}(e,t))}catch(r){if(n.signal.aborted||r instanceof ur)return void c.clear();throw n.check(),new Error(Wv(Ia(r),Hv(e.fields,o,!0)))}finally{if(n.current()){const e=t.load();n.check(),i(e)}}}))}}}(e);return Ee.jsxs("details",{className:"cx-application",children:[Ee.jsx("summary",{children:t.label}),Ee.jsxs("form",{className:"cx-form",onSubmit:e=>{d(e)},children:[Ee.jsxs("fieldset",{className:"cx-block cx-form",disabled:i||!c,children:[Ee.jsx("legend",{className:"visually-hidden",children:t.label}),t.inputSchema?Ee.jsx(Ay,{schema:t.inputSchema}):null,Ee.jsx(py,{fields:t.fields,values:n,onChange:(e,n)=>r(r=>Bv(t.fields,r,e,n))}),Ee.jsxs(U,{label:t.label,busy:i,disabled:i||!c||!!l,children:[t.available?null:Ee.jsx(Oe,{tone:"warn",label:t.reason??"This action is unavailable for this connection."}),a?Ee.jsx(Oe,{tone:"err",label:a}):null]})]}),c&&o?Ee.jsx(Ny,{result:o,origins:t.resultOrigins},s):null]})]})}function $y({descriptor:e,controller:t,view:n,disabled:r=!1,onChanged:i,onFlash:a}){return 0===e.actions.length?null:Ee.jsxs("section",{className:"cx-block cx-form","aria-label":`Use ${e.name}`,children:[Ee.jsxs("h3",{children:["Use ",e.name]}),e.actions.map(e=>Ee.jsx(zy,{action:e,controller:t,connected:Zv(n),disabled:r,onChanged:i,onFlash:a},`${n.providerId}/${n.connectionId}/${n.revision}/${n.fingerprint}/${e.id}`))]})}function Py({entry:e,controller:t,disabled:n,onConfirm:r,revision:i,attempt:a}){const{acknowledged:o,setAcknowledged:s,instructions:c,loadError:l,retryGuide:d}=function(e,t,n,r){const[i,a]=Ce.useState(!1),o=e.revocationInstructions?.(t),s=!!o,[c,l]=Ce.useState(null),[d,u]=Ce.useState(!1),[p,h]=Ce.useState(0);return Ce.useEffect(()=>{if(a(!1),l(null),u(!1),s||!e.loadRevocationInstructions)return;let i=!0;return Promise.resolve().then(()=>i?e.loadRevocationInstructions?.(t)??null:null).then(e=>{i&&l({revision:n,attempt:r,retry:p,guide:e})}).catch(()=>{i&&u(!0)}),()=>{i=!1}},[e,t,n,r,p,s]),{acknowledged:i,setAcknowledged:a,instructions:o??(c?.revision===n&&c.attempt===r&&c.retry===p?c.guide:null),loadError:d,retryGuide:()=>h(e=>e+1)}}(t,e.id,i,a);if(!c&&l)return Ee.jsxs("div",{children:[Ee.jsx(Oe,{tone:"warn",label:"Provider revocation guide is unavailable. Try again after the authorization operation finishes."}),Ee.jsx("button",{type:"button",disabled:n,onClick:d,children:"Retry provider revocation guide"})]});if(!c)return null;const u=Xv(c.url);return u?Ee.jsxs("fieldset",{className:"cx-block cx-form",disabled:n,children:[Ee.jsx("legend",{children:"Provider revocation"}),Ee.jsxs("details",{className:"cx-application",children:[Ee.jsx("summary",{children:"Provider revocation guide"}),Ee.jsx("p",{children:c.message})]}),Ee.jsx("a",{href:u,target:"_blank",rel:"noopener noreferrer",children:"Open provider revocation instructions"}),Ee.jsxs("label",{className:"check",children:[Ee.jsx("input",{type:"checkbox",checked:o,disabled:!c.canConfirm||!t.confirmRevocation,onChange:e=>s(e.target.checked)}),Ee.jsx("span",{children:c.acknowledgementLabel??"I revoked this application at the provider"})]}),Ee.jsx(U,{label:"Confirm provider revocation",disabled:!o||!c.canConfirm||!t.confirmRevocation,onClick:()=>r(e.id,c.revision)}),c.canConfirm?null:Ee.jsx(Oe,{tone:"warn",label:"This provider authorization requires recovery before confirmation. Review the guide and retry cleanup."})]}):null}function Oy({view:e,controller:t,disabled:n=!1,onChanged:r,onFlash:i}){const[a,o]=Ce.useState(!1),[s,c]=Ce.useState(""),[l,d]=Ce.useState(0);async function u(e,s=!1,l){if(!a&&!n){o(!0),c("");try{if(s){if(!t.confirmRevocation)return;const n=t.revocationInstructions?.(e);if(n&&!n.canConfirm)return;if(void 0===l&&!n?.canConfirm)return;void 0===l?await t.confirmRevocation(e):await t.confirmRevocation(e,l)}else await t.retry(e)}catch(u){s&&d(e=>e+1);const e=Wv(Ia(u),{});c(e),i({tone:"err",text:e})}finally{o(!1),r(t.load())}}}return 0===e.recovery.length?null:Ee.jsxs("section",{className:"cx-block cx-form","aria-label":"Provider recovery",children:[Ee.jsx("h3",{children:"Provider cleanup"}),e.recovery.map(r=>Ee.jsxs("div",{className:"cx-form",children:[Ee.jsx("p",{children:r.label}),Ee.jsx(B,{label:`Retry ${r.label.toLowerCase()}`,disabled:a||n,"aria-busy":a||void 0,onClick:()=>{u(r.id)},children:Ee.jsx(V,{size:16})}),Ee.jsx(Oe,{tone:"warn",label:r.detail}),Ee.jsx(Py,{entry:r,controller:t,disabled:a||n,revision:e.revision,attempt:l,onConfirm:(e,t)=>{u(e,!0,t)}},`${e.revision}/${r.id}`)]},r.id)),s?Ee.jsx(Oe,{tone:"err",label:s}):null]})}const Ry={configuration:"Provider verification pending",authorizing:"Provider authorization in progress",connected:"Provider verification pending",reauthorize:"Provider authorization needs renewal",cleanup:"Provider cleanup required"},Ly={configuration:"Local configuration validation pending",authorizing:"Local configuration validation in progress",connected:"Local configuration validation pending",reauthorize:"Local configuration needs validation",cleanup:"Local configuration cleanup required"};function Uy(e,t){const n=In(e.providerId,e.configuration.method,e.configuration.parameters);return"cleanup"===e.status||n.available?Zv(e)?"native-local"===e.configuration.method?`${t} configuration verified`:e.identity&&"credential-valid"!==e.identity.assurance?`${t} connected`:`${t} access verified`:"native-local"===e.configuration.method?Ly[e.status]:Ry[e.status]:n.reason??"This provider route is unavailable in this browser."}function Dy({view:e}){return e.grants.map(t=>Ee.jsxs("section",{className:"cx-block cx-form",children:[Ee.jsx("h3",{children:t.label}),Ee.jsx(Rv,{rows:qy(t,Zv(e))})]},t.actor))}function qy(e,t){const n=[["Permissions","known"===e.permissionState?e.grantedScopes.join(", ")||"No scopes returned":"provider-managed"===e.permissionState?"Managed by the provider":"Provider did not report granted permissions"],["Authorization",e.needsReauth||null!==e.expiresAt&&e.expiresAt<=Date.now()?"Authorize again":t?"Verified":"Verification pending"]];return n.push(["Expires",null===e.expiresAt?"Not reported by the provider":new Date(e.expiresAt).toISOString()]),n}function My({descriptor:e,view:t}){const n=e.methods.find(e=>e.id===t.configuration.method),r=Object.entries(t.configuration.parameters).map(([e,t])=>[n?.fields.find(t=>t.id===e&&!t.secret)?.label??e,t]);return t.configuration.clientId&&r.push(["Public client ID",t.configuration.clientId]),r.length?Ee.jsx(Rv,{rows:r}):null}function Ky({view:e,verified:t}){return Ee.jsxs(Ee.Fragment,{children:[e.identity?Ee.jsx(Rv,{rows:[[t?"native-local"===e.configuration.method?"Configuration":"credential-valid"===e.identity.assurance?"Verified access":e.identity.kind:"native-local"===e.configuration.method?"Previously validated configuration":`Previously verified ${e.identity.kind}`,e.identity.label]]}):null,t||null===e.verifiedAt?null:Ee.jsx(Rv,{rows:[["native-local"===e.configuration.method?"Last local validation":"Last provider verification",new Date(e.verifiedAt).toISOString()]]}),e.targets.length>0?Ee.jsx(Rv,{rows:(n=e.targets,n.map(e=>[e.id===e.label?"api"===e.kind?"API endpoint":e.kind:`${e.kind} · ${e.id}`,e.label]))}):null]});var n}function Fy(e){const{descriptor:t,controller:n,view:r,onChanged:i,onFlash:a}=e,o=function(e){const{descriptor:t,controller:n,onChanged:r,onFlash:i,onRemoved:a,authorization:o}=e,s=ry(e),c={owner:s.owner,busy:!1,confirming:!1,failure:""},[l,d]=Ce.useState(c),u=l.owner===s.owner?l:c,p=u.busy||!!o?.current(),h=e=>d(t=>({...t.owner===s.owner?t:c,...e}));async function f(e){if(p)return;const t=s.begin();if(t.current()){h({busy:!0,failure:""});try{await e(t.current)}catch(a){if(t.current()){const e=Wv(Ia(a),{});h({failure:e}),i({tone:"err",text:e})}}finally{try{if(t.current()){h({busy:!1});const e=n.load();t.current()&&r(e)}}finally{t.finish()}}}}return{...u,busy:p,perform:f,remove:async function(){p||(u.confirming?(h({confirming:!1}),await f(async e=>{await n.remove(),e()&&(a(),e()&&i({tone:"ok",text:`${t.name} connection removed from this device.`}))})):h({confirming:!0}))},cancel:()=>h({confirming:!1})}}(e),s=Zv(r);return Ee.jsx(Nv,{id:"complete",step:3,title:s?"Complete":"Authorization",label:`${t.name} connection status`,focus:!0,actions:Ee.jsx(Oe,{tone:s?"ok":"warn",label:Uy(r,t.name)}),children:Ee.jsxs("div",{className:"panel__body cx-form",children:[Ee.jsx("p",{children:r.configuration.displayName}),Ee.jsx(My,{descriptor:t,view:r}),Ee.jsx(Ky,{view:r,verified:s}),Ee.jsx(Dy,{view:r}),Ee.jsx(ay,{descriptor:t,controller:n,view:r,busy:o.busy,perform:o.perform,authorization:e.authorization}),Ee.jsx(Oy,{view:r,controller:n,disabled:o.busy,onChanged:i,onFlash:a}),Ee.jsx($y,{descriptor:t,controller:n,view:r,disabled:o.busy,onChanged:i,onFlash:a}),o.failure?Ee.jsx(Oe,{tone:"err",label:o.failure}):null,t.disconnectExplanation?Ee.jsxs("details",{className:"cx-application",children:[Ee.jsx("summary",{children:"Provider disconnection guide"}),Ee.jsx("p",{children:t.disconnectExplanation})]}):null,Ee.jsxs("div",{className:"cx-links",children:[Ee.jsx(B,{label:o.confirming?"Confirm remove connector":"Remove connector",armed:o.confirming,disabled:o.busy,onClick:()=>{o.remove()},children:Ee.jsx(F,{size:16})}),o.confirming?Ee.jsx(B,{label:"Cancel removal",disabled:o.busy,onClick:o.cancel,children:Ee.jsx(H,{size:16})}):null]})]})})}function Gy(e){const t=Sy(e.inputSchema);return{id:`mcp.tool:${e.id}`,label:`${e.id}: ${e.label}`,available:null!==t,reason:"This server did not advertise a displayable argument schema.",inputSchema:t?.schema,fields:[{id:"arguments",label:"Tool arguments (JSON object)",kind:"textarea",secret:!1,required:!0,defaultValue:"{}",help:"Use the required fields and types in the advertised argument schema. The schema is checked before sending this request."}],resultOrigins:[]}}function By({view:e,controller:t,onChanged:n,onFlash:r,disabled:i=!1}){const[a,o]=Ce.useState(null),s=jy(r),{busy:c,failure:l}=s,d=!i&&"connected"===e.status,u=JSON.stringify([e.providerId,e.connectionId,e.revision,e.fingerprint]);return Ty(t,d,s,o,{scope:u,preserveDisabledResult:!0}),Ee.jsxs("section",{className:"panel","aria-label":"MCP tools",children:[Ee.jsxs("div",{className:"panel__head",children:[Ee.jsx("h2",{children:"Provider tools"}),Ee.jsx(Oe,{tone:"warn",label:"Tools may change provider data. Review the advertised tool description before running it."})]}),Ee.jsxs("div",{className:"panel__body cx-form",children:[Ee.jsx(B,{label:"Discover MCP tools",disabled:i||c||"connected"!==e.status,onClick:()=>{!async function(){d&&!c&&(o(null),await s.run(async e=>{try{const n=await t.invoke("mcp.tools.list",{},e.signal);return e.check(),void o(n)}finally{e.current()&&n(t.load())}}))}()},children:Ee.jsx(J,{size:16})}),l?Ee.jsx(Oe,{tone:"err",label:l}):null,a?Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("p",{children:[a.label," · ",a.items.length," tools"]}),Ee.jsx($y,{controller:t,view:e,disabled:i||c,onChanged:n,onFlash:r,descriptor:{providerId:e.providerId,name:a.label,docsUrl:null,methods:[],actions:a.items.map(Gy)}})]}):null]})]})}function Vy(e){if(!/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,99}$/.test(e.owner)||!/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,99}$/.test(e.repo)||"@"===e.branch||e.branch.startsWith("-")||!e.branch||e.branch.length>255||/[\s~^:?*\[\\]/.test(e.branch)||Array.from(e.branch).some(e=>e.charCodeAt(0)<33||127===e.charCodeAt(0))||e.branch.includes("..")||e.branch.includes("@{")||e.branch.split("/").some(e=>!e||e.startsWith(".")||e.endsWith(".")||e.endsWith(".lock")))throw new it("configuration","Use a repository owner, name and existing branch for the Bitbucket backup.");return`/2.0/repositories/${encodeURIComponent(e.owner)}/${encodeURIComponent(e.repo)}`}function Hy(e){if(Object.keys(e).some(e=>!["backup_owner","backup_repo","backup_branch"].includes(e)))throw new it("configuration","Unknown Bitbucket backup parameter.");const t={owner:(e.backup_owner??"").trim(),repo:(e.backup_repo??"").trim(),branch:(e.backup_branch??"").trim()};return t.owner||t.repo||t.branch?(Vy(t),Object.freeze(t)):null}ao();const Jy=Ur({full_name:qr(),uuid:qr().min(1),scm:Dr("git")}),Wy=Ur({name:qr(),target:Ur({hash:qr().regex(/^[a-f0-9]{40}$/)})});async function Zy(e,t,n){if("bitbucket"!==e.providerId)return;const r=Hy(e.parameters);if(!r)return;const i=Vy(r),a=Fd(e,t),o=e=>mr({url:`https://api.bitbucket.org${e}`,method:"GET",headers:a,signal:n.signal},n),s=Jy.safeParse(await o(i)),c=Wy.safeParse(await o(`${i}/refs/branches/${encodeURIComponent(r.branch)}`));if(!s.success||s.data.full_name!==`${r.owner}/${r.repo}`||!c.success||c.data.name!==r.branch)throw new it("response","Bitbucket did not prove the selected repository and branch.")}function Xy(){throw new it("stale","The saved Bitbucket backup authority changed.")}function Yy(e,t){const n=an(e);return n&&"bitbucket"===n.configuration.providerId&&"api-key"===n.configuration.method&&Bt(Hy(n.configuration.parameters))===Bt(t)||Xy(),An(n),nn(n),n}ao();const Qy=524288,eb=qr().regex(/^[a-f0-9]{40}$/),tb=Ur({name:qr(),target:Ur({hash:eb})}),nb=Ur({hash:eb,parents:Gr(Ur({hash:eb})).length(1)}),rb=Ur({type:Dr("commit_file"),path:qr(),size:Vr().int().min(1).max(Qy),attributes:Gr(qr()).length(0)});function ib(e="response"){throw new it(e,"The encrypted Bitbucket backup operation did not complete.")}function ab(e){return/^backups\/[a-f0-9-]{36}\.json$/.test(e)||"opensesame-vault.backup.json"===e||ib("configuration"),e.split("/").map(encodeURIComponent).join("/")}function ob(e){(new TextEncoder).encode(e).length>Qy&&ib("unsupported");try{return Jt(Wt(e))}catch{return ib()}}async function sb(e,t,n){await e.current();const r=AbortSignal.any([e.signal,AbortSignal.timeout(2e4)]);try{const i=new Headers(e.headers);i.set("Accept","application/json"),n&&i.set("Content-Type","application/x-www-form-urlencoded");const a={method:n?"POST":"GET",headers:i,signal:r,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"};n&&(a.body=n.toString());const o=await e.transport.fetch(`https://api.bitbucket.org${t}`,a);e.check(),await async function(e,t){if(!t.ok||t.redirected){if(await(t.body?.cancel()),401===t.status){try{await e.invalidate()}finally{e.close()}ib("authentication")}404===t.status&&ib("not-found"),[400,409,422].includes(t.status)&&ib("configuration"),ib()}}(e,o),o.status===(n?201:200)&&/^application\/(?:[\w.-]+\+)?json(?:;|$)/i.test(o.headers.get("content-type")??"")||(await(o.body?.cancel()),ib());const s=await yr(o,{maxBytes:n?65536:Qy,signal:r,fatalUtf8:!0});return await e.current(),s}catch(i){if(i instanceof it)throw i;return e.check(),ib("network")}}async function cb(e,t,n){const r=tb.safeParse(await sb(e,`${t}/refs/branches/${encodeURIComponent(n)}`));return r.success&&r.data.name===n||ib(),r.data.target.hash}async function lb(e,t,n,r){const i=`${t}/src/${r}/${ab(n)}`,a=rb.safeParse(await sb(e,`${i}?format=meta`));a.success&&a.data.path===n||ib();const o=ob(JSON.stringify(await sb(e,i)));return(new TextEncoder).encode(o).length!==a.data.size&&ib(),e.check(),{id:n,name:n,kind:"note",notes:o,secret:"",fields:{commit:r}}}function db(e){if(!/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,99}$/.test(e.owner)||!/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,99}$/.test(e.repo)||!e.branch||e.branch.length>255||/[\s~^:?*\[\\]/.test(e.branch)||Array.from(e.branch).some(e=>e.charCodeAt(0)<33||127===e.charCodeAt(0))||e.branch.includes("..")||e.branch.includes("@{")||e.branch.split("/").some(e=>!e||e.startsWith(".")||e.endsWith(".")||e.endsWith(".lock")))throw new it("configuration","Use a repository owner, name and existing branch for the Codeberg backup.");return`/api/v1/repos/${encodeURIComponent(e.owner)}/${encodeURIComponent(e.repo)}`}function ub(e){if(Object.keys(e).some(e=>!["backup_owner","backup_repo","backup_branch"].includes(e)))throw new it("configuration","Unknown Codeberg backup parameter.");const t={owner:(e.backup_owner??"").trim(),repo:(e.backup_repo??"").trim(),branch:(e.backup_branch??"").trim()};return t.owner||t.repo||t.branch?(db(t),Object.freeze(t)):null}async function pb(e,t,n){const r=Cn(e);if(!["databricks","discord"].includes(r.configuration.providerId))return;const i=n instanceof _r&&("denied"===n.code||!!n.oauthError);await tn(e,cn(r),Sr(r.configuration),e=>{const n=e.privateState.recovery.find(e=>e.id===t);return!n||n.grant&&"refresh"!==n.credentials?.phase||(n.credentials={...n.credentials,phase:i?"exchange-denied":"exchange-unobserved",deadline:"0"},e.configuration.parameters.authorization_outcome=i?"denied":"exchange-unobserved"),e})}const hb=qr().min(1).max(1024),fb=Ur({id:Vr().int().positive(),login:hb,full_name:qr().max(1024).optional()}),mb=Gr(Ur({id:Vr().int().positive(),full_name:hb,html_url:qr().url().max(4096)})).max(100);function gb(e){return{access:e.accessToken,refresh:e.refreshToken??""}}async function wb(e,t,n){return mr({url:e,method:"GET",headers:new Headers({accept:"application/json",authorization:`Bearer ${t.accessToken}`})},n)}async function vb(e,t){const n=fb.parse(await wb("https://codeberg.org/api/v1/user",e,t)),r=n.full_name||n.login;return wr(n.login,gb(e)),wr(r,gb(e)),{id:String(n.id),label:r,kind:"account",assurance:"account-verified"}}const yb=qr().min(1).max(256),bb=Ur({client_id:yb,user_id:yb,login:yb,scopes:Gr(qr().min(1).max(512)).max(256),expires_in:Vr().finite().positive().max(31536e3)}),kb=Ur({data:Gr(Ur({id:yb,login:yb,display_name:yb})).length(1)}),xb="https://vercel.com",Ib=["openid","email","profile","offline_access"];Ur({state:qr().min(32).max(512),code:qr().min(1).max(8192).regex(/^[!-~]+$/).optional(),error:qr().min(1).max(256).optional()}).refine(e=>Boolean(e.code)!==Boolean(e.error));const jb=Ur({sub:qr().min(1).max(256),preferred_username:qr().min(1).max(1024).optional(),email:qr().min(1).max(1024).optional(),name:qr().min(1).max(1024).optional()}),_b=qr().min(1).max(1024),Sb=qr().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);async function Ab(e,t,n,r){const i=new Headers({accept:"application/json",authorization:`Bearer ${t.accessToken}`});return void 0!==r&&i.set("content-type","application/json"),mr({url:e,method:void 0===r?"GET":"POST",headers:i,body:r},n)}function Cb(e,t,n="account",r="account-verified"){return{id:e,label:t,kind:n,assurance:r}}async function Eb(e,t,n,r,i){if(!n.protocolValid||null!==n.expiresAt&&n.expiresAt<=Date.now())throw new _r("provider");const a=e.providerId,o=await async function(e,t,n,r,i){const a=e.providerId;let o;try{const s=await async function(e,t,n,r,i){const a=e.providerId;if("discord"===a)return async function(e,t,n,r){if("discord"!==e.providerId||"discord"!==t.providerId||t.clientId!==e.clientId||"https://discord.com"!==t.issuer||"https://discord.com/api/oauth2/token"!==t.endpoint)throw new _r("provider");const i=new Headers({authorization:`Bearer ${n.accessToken}`,accept:"application/json"}),a=Ur({application:Ur({id:qr().min(1).max(256)}),scopes:Gr(qr().min(1).max(512)).max(256),expires:qr().datetime({offset:!0}),user:Ur({id:qr().min(1).max(256)}).optional()}).parse(await mr({url:"https://discord.com/api/v10/oauth2/@me",method:"GET",headers:i},r));if(a.application.id!==e.clientId||!a.user||Date.parse(a.expires)<=Date.now()||t.scopes.some(e=>!a.scopes.includes(e))||n.scopes?.some(e=>!a.scopes.includes(e)))throw new _r("provider");const o=Ur({id:qr().min(1).max(256),username:qr().min(1).max(1024),global_name:qr().max(1024).nullable().optional()}).parse(await mr({url:"https://discord.com/api/v10/users/@me",method:"GET",headers:i},r));if(o.id!==a.user.id)throw new _r("provider");return wr(o.id,{access:n.accessToken}),wr(o.global_name||o.username,{access:n.accessToken}),{id:o.id,label:o.global_name||o.username,kind:"account",assurance:"account-verified"}}(e,t,n,r);if("twitch"===a)return async function(e,t,n,r){const i=e.clientId;if("twitch"!==e.providerId||!i||t.clientId!==i||!n.protocolValid||!n.scopes)throw new _r("provider");const a=bb.safeParse(await mr({url:"https://id.twitch.tv/oauth2/validate",method:"GET",headers:new Headers({authorization:`OAuth ${n.accessToken}`})},r));if(!a.success||a.data.client_id!==i)throw new _r("provider");const o=a.data.scopes;if(t.scopes.some(e=>!o.includes(e))||n.scopes.some(e=>!o.includes(e))||o.some(e=>!n.scopes?.includes(e)))throw new _r("scope");const s=kb.safeParse(await mr({url:"https://api.twitch.tv/helix/users",method:"GET",headers:new Headers({authorization:`Bearer ${n.accessToken}`,"Client-Id":i})},r)),c=s.success?s.data.data[0]:null;if(!c||c.id!==a.data.user_id||c.login!==a.data.login)throw new _r("provider");return{id:c.id,label:c.display_name,kind:"account",assurance:"account-verified"}}(e,t,n,r);if("vercel"===a)return async function(e,t,n,r,i){!function(e,t){if("vercel"!==e.providerId||"vercel"!==t.providerId||t.issuer!==xb||!t.clientId||e.clientId!==t.clientId)throw new _r("provider")}(e,t);const a=i?.id??await async function(e,t,n){if(!t.idToken||"RS256"!==gi(t.idToken).header.alg)throw new _r("provider");const r="https://vercel.com/.well-known/jwks";return(await Wo({token:t.idToken,nonce:e.state,issuer:xb,clientId:e.clientId??"",jwksUri:r,fetchImpl:(e,t)=>{if(String(e)!==r)throw new _r("provider");return n.fetch(e,{...t,credentials:"omit",redirect:"error",mode:"cors",cache:"no-store",referrerPolicy:"no-referrer"})}})).sub}(t,n,r),o=jb.parse(await mr({url:"https://api.vercel.com/login/oauth/userinfo",method:"GET",headers:new Headers({accept:"application/json",authorization:`Bearer ${n.accessToken}`})},r));if(o.sub!==a)throw new _r("provider");const s=o.name??o.preferred_username??o.email??o.sub,c={access:n.accessToken,refresh:n.refreshToken??"",assertion:n.idToken??""};return wr(o.sub,c),wr(s,c),{id:o.sub,label:s,kind:"identity-account",assurance:"account-verified"}}(e,t,n,r,i);if("codeberg"===a)return vb(n,r);if("auth0"===a||"okta"===a)return Cr(e,t,n,r,i);if("databricks"===a)return Er(e,t,n,r);if("crowdin"!==a)return null;const o=Ur({data:Ur({id:Vr().int().positive(),username:qr().min(1).max(1024),fullName:qr().max(1024).optional()})}).parse(await mr({url:"https://api.crowdin.com/api/v2/user",method:"GET",headers:new Headers({accept:"application/json",authorization:`Bearer ${n.accessToken}`})},r));return{id:String(o.data.id),label:o.data.fullName||o.data.username,kind:"account",assurance:"account-verified"}}(e,t,n,r,i);if(s)o=s;else if(["microsoft","microsoft-teams"].includes(a))if(i){const e=Ur({id:Sb,displayName:_b}).parse(await Ab("https://graph.microsoft.com/v1.0/me?$select=id,displayName",n,r));if(!i.id.endsWith(`:${e.id}`))throw new _r("provider");o={...i,label:e.displayName}}else o=await async function(e,t,n,r){if(!n.idToken||!t.clientId)throw new _r("provider");const i=Sb.parse(gi(n.idToken).claims.tid),a=(e.parameters.tenant??"common").trim().toLowerCase(),o="9188040d-6c67-4c5b-b112-36a304b66dad";if("organizations"===a&&i.toLowerCase()===o||"consumers"===a&&i.toLowerCase()!==o)throw new _r("provider");if(Sb.safeParse(a).success&&a.toLowerCase()!==i.toLowerCase())throw new _r("provider");const s=`https://login.microsoftonline.com/${i}/discovery/v2.0/keys`,c=await Wo({token:n.idToken,nonce:t.state,issuer:`https://login.microsoftonline.com/${i}/v2.0`,clientId:t.clientId,jwksUri:s,fetchImpl:(e,t)=>{if(String(e)!==s)throw new _r("provider");return r.fetch(e,{...t,credentials:"omit",redirect:"error",mode:"cors",cache:"no-store",referrerPolicy:"no-referrer"})}}),l=Ur({id:Sb,displayName:_b}).parse(await Ab("https://graph.microsoft.com/v1.0/me?$select=id,displayName",n,r));if(c.tid!==i||c.oid!==l.id)throw new _r("provider");return Cb(`${i}:${l.id}`,l.displayName,"tenant-account")}(e,t,n,r);else if("openrouter"===a)o=await async function(e,t){const n=Ur({data:Ur({label:_b})}).parse(await Ab("https://openrouter.ai/api/v1/key",e,t)),r=await crypto.subtle.digest("SHA-256",(new TextEncoder).encode(e.accessToken));return Cb([...new Uint8Array(r)].map(e=>e.toString(16).padStart(2,"0")).join(""),n.data.label,"authorized-key","credential-valid")}(n,r);else{const e=qv(a);if(!e)throw new _r("provider");o=function(e,t){if("workos"===e){const e=Ur({sub:_b,email:_b,name:_b.optional()}).parse(t);return Cb(e.sub,e.name??e.email)}if("resend"===e)return Ur({data:Gr(Ur({id:_b,name:_b})).max(1e3)}).parse(t),Cb("https://api.resend.com","Resend domain access verified","api-resource","credential-valid");if("gitlab"===e){const e=Ur({id:Vr().int().positive(),username:_b,name:_b.optional()}).parse(t);return Cb(String(e.id),e.name??e.username)}if("dropbox"===e){const e=Ur({account_id:_b,email:_b,name:Ur({display_name:_b})}).parse(t);return Cb(e.account_id,e.name.display_name)}if("spotify"===e){const e=Ur({id:_b,display_name:_b.nullable().optional()}).parse(t);return Cb(e.id,e.display_name??e.id)}const n=Ur({sub:_b,email:_b.optional(),name:_b.optional()}).parse(t);return Cb(n.sub,n.name??n.email??n.sub)}(a,await Ab(e,n,r,"dropbox"===a?"null":void 0))}}catch(s){if(s instanceof gr&&"authorization"===s.code)throw new _r("expired");if(s instanceof gr&&"permission"===s.code)throw new _r("scope");if(s instanceof _r)throw s;throw new _r("provider")}return o}(e,t,n,r,i),s=function(e,t){return t&&["microsoft","microsoft-teams"].includes(e)?[...new Set(t.map(e=>e.replace(/^https:\/\/graph\.microsoft\.com\//,"")))]:t}(a,n.scopes),c={access:n.accessToken,refresh:n.refreshToken??"",assertion:n.idToken??""};wr(o.id,c),wr(o.label,c);for(const l of s??[])wr(l,c);if(!["openrouter","codeberg","crowdin"].includes(a)&&(!s||t.scopes.some(e=>!s.includes(e))))throw new _r("scope");if(Object.values(e.targetIds).some(e=>e!==o.id))throw new _r("provider");return{identity:o,targets:[{id:o.id,label:o.label,kind:o.kind}],scopes:s}}async function Tb(e,t,n){if(function(e,t){if("twitch"!==t.configuration.providerId||"oauth"!==t.configuration.method||"twitch"!==e.providerId||"user"!==e.actor||"revoke"!==e.kind||e.fingerprint!==t.configuration.fingerprint)throw new _r("cleanup");const n=e.grant;if(n&&(n.providerId!==e.providerId||n.actor!==e.actor||n.fingerprint!==e.fingerprint||n.targetId!==e.targetId))throw new _r("cleanup")}(e,t),function(e,t){const n=e.credentials?.phase??"",r=!!e.grant&&"verify"===n,i=e.credentials?.device_parent;if(!r&&vn(t.connectionId,e.id)||i&&vn(t.connectionId,i)||["device-poll","refresh"].includes(n)&&Number(e.credentials?.deadline)>Date.now())throw new _r("cleanup")}(e,t),e.grant){const r=e.grant;if("oauth"!==r.kind||!r.clientId||r.clientId!==t.configuration.clientId)throw new _r("cleanup");const i=await Tr("https://id.twitch.tv/oauth2/revoke",new URLSearchParams({client_id:r.clientId,token:r.accessToken}),n,void 0,!1);if(200!==i.status&&400!==i.status)throw new _r("cleanup");return await async function(e,t){try{await mr({url:"https://id.twitch.tv/oauth2/validate",method:"GET",headers:new Headers({authorization:`OAuth ${e}`})},t)}catch(n){if(n instanceof gr&&401===n.status)return;throw new _r("cleanup")}throw new _r("cleanup")}(r.accessToken,n),await async function(e,t){const n=an(e);n&&n.privateState.grants[t.actor]?.accessToken===t.accessToken&&n.privateState.grants[t.actor]?.fingerprint===t.fingerprint&&await tn(e,cn(n),Sr(n.configuration),e=>(e.privateState.grants=Object.fromEntries(Object.entries(e.privateState.grants).filter(([e])=>e!==t.actor)),e.privateState.verification=null,e.runtime=br(),e))}(t.connectionId,r),"local-credential-forgotten"}if("revoke"!==e.kind||!["device-unobserved","device-poll"].includes(e.credentials?.phase??""))throw new _r("cleanup");return"local-credential-forgotten"}function Nb(e){const t=Cn(e);if("twitch"!==t.configuration.providerId||"oauth"!==t.configuration.method||!t.configuration.clientId)throw new _r("provider");return t}async function zb(e,t,n){n.assertCurrent();const r=Nb(e);await rn(e,cn(r));const i=r.privateState.pending.user;if(!i||i.state!==t.state||i.fingerprint!==t.fingerprint||r.configuration.fingerprint!==t.fingerprint)throw new _r("expired");if(t.expiresAt<=Date.now())throw new _r("expired")}async function $b(e,t,n){const r=Nb(e);r.privateState.pending.user?.state===t.state&&await tn(e,cn(r),Sr(r.configuration),e=>{const r=e.privateState.recovery.find(e=>e.id===`oauth:${t.state}`);return e.privateState.pending=Object.fromEntries(Object.entries(e.privateState.pending).filter(([e,n])=>"user"!==e||n.state!==t.state)),r?.grant||(n&&r?(r.credentials={...r.credentials,phase:"device-unobserved",deadline:"0"},e.configuration.parameters.authorization_outcome="exchange-unobserved"):e.privateState.recovery=e.privateState.recovery.filter(e=>e.id!==`oauth:${t.state}`)),e})}async function Pb(e,t){if("twitch"===e.configuration.providerId)return async function(e,t){const n=t;n.assertCurrent();const r=e.privateState.grants.user;if("twitch"!==e.configuration.providerId||!r?.refreshToken||e.privateState.recovery.length||Object.keys(e.privateState.pending).length)throw new _r("cleanup");const i=e.connectionId,a=await async function(e,t,n){const r=t.targetId??e.runtime.identity?.id??"twitch",i={id:`twitch-refresh:${hr(32)}`,kind:"revoke",providerId:"twitch",actor:"user",fingerprint:t.fingerprint,targetId:r,grant:{...t,targetId:r},credentials:{phase:"refresh",deadline:String(Date.now()+6e4),identity_id:e.runtime.identity?.id??""}};return await tn(e.connectionId,cn(e),Sr(e.configuration),e=>(n.assertCurrent(),e.privateState.verification=null,e.privateState.recovery.push(i,{...i,id:`old-access:${i.id}`,credentials:{phase:"old-access",device_parent:i.id}}),e)),i}(e,r,n),o=En(i,a.id);let s=!1,c=!1,l=!1;try{const o=await ar(e.configuration,r.refreshToken,n);s=!0;const d={...r,targetId:a.targetId,accessToken:o.accessToken,refreshToken:o.refreshToken,expiresAt:o.expiresAt,scopes:o.scopes};await async function(e,t,n,r){try{await zn(e,t.id,n,Sr)}catch{const i=Nb(e);throw await Tb({...t,grant:n,credentials:{phase:"verify",deadline:"0"}},{connectionId:e,configuration:i.configuration},r),bn(e,t.id),c=!0,new _r("storage")}const i=Nb(e),a=i.privateState.recovery.find(e=>e.id===`old-access:${t.id}`);a?.grant?.accessToken===n.accessToken&&await tn(e,cn(i),Sr(i.configuration),e=>(e.privateState.recovery=e.privateState.recovery.filter(e=>e.id!==a.id),e))}(i,a,d,t),n.assertCurrent();const u=Nb(i),p=u.privateState.recovery.find(e=>e.id===a.id)?.grant;if(!p)throw new _r("storage");const h=await Eb(u.configuration,function(e,t){return{providerId:"twitch",actor:"user",fingerprint:e.configuration.fingerprint,targetId:t.targetId,issuer:"https://id.twitch.tv",endpoint:"https://id.twitch.tv/oauth2/token",clientId:e.configuration.clientId,state:hr(32),verifier:hr(32),redirectUri:$n(),createdAt:Date.now(),expiresAt:Date.now()+6e4,scopes:Nr(zr("twitch"),e.configuration,"user")}}(u,d),o,n,e.runtime.identity??void 0);await Tn(i,a.id,h,Sr,n,{revision:u.revision,grant:p}),l=!0}catch(d){throw c&&await async function(e,t){const n=Nb(e),r=n.privateState.recovery.find(e=>e.id===t);"refresh"===r?.credentials?.phase&&await tn(e,cn(n),Sr(n.configuration),e=>{const n=e.privateState.recovery.find(e=>e.id===t);return n&&(n.credentials={...n.credentials,phase:"verify",deadline:"0"}),e})}(i,a.id),s||await async function(e,t,n){const r=Nb(e);await tn(e,cn(r),Sr(r.configuration),e=>{const r=e.privateState.recovery.find(e=>e.id===t);return r&&(r.credentials={...r.credentials,deadline:"0"}),e.configuration.parameters.authorization_outcome=n?"refresh-denied":"refresh-unobserved",e})}(i,a.id,d instanceof _r&&"invalid_grant"===d.oauthError),d}finally{o(),l?await Nn(i):await Nn(i).catch(()=>{})}}(e,t);const n=e.privateState.grants.user,r=zr(e.configuration.providerId);if(!n?.refreshToken||!r.refresh||e.privateState.recovery.length)throw new _r("expired");const i=e.connectionId,a=$n(),o=n.targetId??e.configuration.providerId,s={phase:"refresh",deadline:String(Date.now()+6e4),identity_id:e.runtime.identity?.id??"",integration_id:e.configuration.parameters.integration_id??""},c={id:`oauth-refresh:${hr(32)}`,kind:"databricks"===e.configuration.providerId?"revoke":"configure",providerId:n.providerId,actor:n.actor,fingerprint:n.fingerprint,targetId:o,grant:{...n,targetId:o},credentials:s};await tn(i,cn(e),Sr(e.configuration),e=>(t.assertCurrent(),e.privateState.recovery.push(c),e.privateState.verification=null,e));const l=await async function(e,t,n,r,i,a){const o=En(e.connectionId,r.id);try{let o;try{o=await ar(e.configuration,n,a)}catch(s){throw s instanceof Error&&await pb(e.connectionId,r.id,s),s instanceof _r&&"invalid_grant"===s.oauthError&&await async function(e,t){const n=Cn(e);await tn(e,cn(n),Sr(n.configuration),e=>(e.privateState.recovery=e.privateState.recovery.filter(e=>e.id!==t),e.privateState.verification=null,e.runtime.grants=e.runtime.grants.map(e=>({...e,needsReauth:!0})),e))}(e.connectionId,r.id),s}const c={...o,refreshToken:o.refreshToken??t.refreshToken,scopes:o.scopes??t.scopes},l={...t,targetId:i,accessToken:c.accessToken,refreshToken:c.refreshToken,expiresAt:c.expiresAt,scopes:c.scopes};return await zn(e.connectionId,r.id,l,Sr),c}finally{o()}}(e,n,n.refreshToken,c,o,t);t.assertCurrent();const d=Cn(i),u=d.privateState.recovery.find(e=>e.id===c.id)?.grant;if(!u)throw new _r("storage");const p=function(e,t,n,r){const i=Ir(zr(t.providerId),e.configuration);return{providerId:t.providerId,actor:t.actor,fingerprint:t.fingerprint,targetId:n,issuer:i.issuer,endpoint:i.token,clientId:t.clientId,state:hr(32),verifier:hr(32),redirectUri:r,createdAt:Date.now(),expiresAt:Date.now()+6e5,scopes:Nr(zr(t.providerId),e.configuration,t.actor)}}(d,n,o,a),h=await Eb(d.configuration,p,l,t,e.runtime.identity??void 0);await Tn(i,c.id,h,Sr,t,{revision:d.revision,grant:u})}function Ob(){throw new it("stale","The saved Codeberg backup authority changed.")}function Rb(e,t){const n=Cn(e);return("codeberg"!==n.configuration.providerId||"oauth"!==n.configuration.method||!n.privateState.verification||n.privateState.verification.fingerprint!==n.configuration.fingerprint||n.privateState.recovery.length>0||Object.keys(n.privateState.pending).length>0||Bt(ub(n.configuration.parameters))!==Bt(t))&&Ob(),n}ao();const Lb=524288,Ub=qr().regex(/^[a-f0-9]{40}$/),Db=Ur({type:Dr("file"),path:qr(),sha:Ub,encoding:Dr("base64"),size:Vr().int().min(1).max(Lb),content:qr().max(75e4)}),qb=Ur({name:qr(),commit:Ur({id:Ub})}),Mb=Ur({content:Ur({type:Dr("file"),path:qr(),sha:Ub}),commit:Ur({sha:Ub})});function Kb(e="response"){throw new it(e,"The encrypted Codeberg backup operation did not complete.")}function Fb(e){return/^backups\/[a-f0-9-]{36}\.json$/.test(e)||"opensesame-vault.backup.json"===e||Kb("configuration"),e.split("/").map(encodeURIComponent).join("/")}function Gb(e){(new TextEncoder).encode(e).length>Lb&&Kb("unsupported");try{return Jt(Wt(e))}catch{return Kb()}}async function Bb(e,t,n,r="GET"){await e.current();const i=AbortSignal.any([e.signal,AbortSignal.timeout(2e4)]);try{const a=new Headers({Authorization:`Bearer ${e.grant.accessToken}`,Accept:"application/json"});void 0!==n&&a.set("Content-Type","application/json");const o={method:r,headers:a,signal:i,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"};void 0!==n&&(o.body=JSON.stringify(n));const s=await e.transport.fetch(`https://codeberg.org${t}`,o);e.check(),await async function(e,t){if(!t.ok||t.redirected){if(await(t.body?.cancel()),401===t.status){try{await e.invalidate()}finally{e.close()}Kb("authentication")}404===t.status&&Kb("not-found"),409!==t.status&&422!==t.status||Kb("configuration"),Kb()}}(e,s),s.status!==("POST"===r?201:200)&&(await(s.body?.cancel()),Kb());const c=await yr(s,{maxBytes:1048576,signal:i,fatalUtf8:!0});return await e.current(),c}catch(a){if(a instanceof it)throw a;return e.check(),Kb("network")}}async function Vb(e,t,n){const r=qb.safeParse(await Bb(e,`${t}/branches/${encodeURIComponent(n)}`));return r.success&&r.data.name===n||Kb(),r.data.commit.id}async function Hb(e,t,n,r,i){const a=Fb(r),o=i??await Vb(e,t,n),s=Db.safeParse(await Bb(e,`${t}/contents/${a}?ref=${o}`));let c;s.success&&s.data.path===r||Kb();try{const e=s.data.content.replaceAll("\n",""),t=jo(e);t.length===s.data.size&&Io(t)===e||Kb();const n=new Uint8Array(await crypto.subtle.digest("SHA-1",new Uint8Array([...(new TextEncoder).encode(`blob ${t.length}\0`),...t])));Array.from(n,e=>e.toString(16).padStart(2,"0")).join("")!==s.data.sha&&Kb(),c=Gb(new TextDecoder("utf-8",{fatal:!0}).decode(t))}catch{return Kb()}return e.check(),{id:r,name:r,kind:"note",notes:c,secret:"",fields:{sha:s.data.sha,commit:o}}}const Jb="https://api.github.com",Wb=Ur({id:Vr().int().positive().safe(),login:qr().min(1).max(39).regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/),type:Dr("User")}),Zb=Ur({id:Vr().int().positive().safe(),full_name:qr().min(3).max(256).regex(/^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9_.-]+$/),html_url:qr().url()});function Xb(){const e=en("github");if(!e.available)throw new Error(e.reason??"GitHub does not permit this browser API")}function Yb(e){const t=e.trim();if(!t||t.length>16384||!/^[!-~]+$/.test(t))throw new Error("Enter a valid GitHub personal access token");return t}function Qb(e,t){return{url:`${Jb}${e}`,method:"GET",headers:new Headers({Authorization:`Bearer ${t}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"})}}async function ek(e,t){Xb();const n=await mr(Qb("/user",e),t),r=Wb.safeParse(n);if(!r.success)throw new gr("response");return wr(r.data.login,{api_key:e}),{id:String(r.data.id),label:r.data.login}}const tk={publicParameters:["backup_owner","backup_repo","backup_branch"],privateCredentials:["api_key"]};function nk(e,t=!1){const n=an(e);if(!n||"github"!==n.configuration.providerId||"api-key"!==n.configuration.method)throw new Error("Saved GitHub personal-token connection not found");return An(n),t&&nn(n),n}async function rk(){const e=(new TextEncoder).encode("github:personal-token:v1:https://api.github.com:user:user/repos:2022-11-28");return[...new Uint8Array(await crypto.subtle.digest("SHA-256",e))].map(e=>e.toString(16).padStart(2,"0")).join("")}function ik(e,t,n,r,i,a=0){const o=Math.max(Date.now(),a+1),s=kr();return s.credentials={api_key:r},s.grants.app={kind:"api-key",providerId:"github",actor:"app",fingerprint:n.fingerprint,targetId:i.id,accessToken:r,expiresAt:null,scopes:null},s.verification={fingerprint:n.fingerprint,verifiedAt:o,kind:"provider"},{connectionId:e,revision:t,configuration:n,privateState:s,runtime:{verifiedAt:o,identity:{...i,kind:"user",assurance:"account-verified"},targets:[{id:Jb,label:"GitHub API",kind:"api"}],grants:[{actor:"app",label:"Personal access token",permissionState:"provider-managed",grantedScopes:[],expiresAt:null,needsReauth:!1}]}}}async function ak(e,t){return tn(e.connectionId,{revision:e.revision,fingerprint:e.configuration.fingerprint},tk,e=>(t.assertCurrent(),e.privateState.verification=null,e.runtime.grants=e.runtime.grants.map(e=>({...e,needsReauth:!0})),e))}const ok={classification:e=>{if("github"!==e.providerId||"api-key"!==e.method)throw new Error("GitHub personal-token cleanup belongs to its saved connection");return tk},cleanup:async(e,t)=>{const n=e.grant;if("github"!==t.configuration.providerId||"api-key"!==t.configuration.method||"github"!==e.providerId||e.fingerprint!==t.configuration.fingerprint||"revoke"!==e.kind||!n||"api-key"!==n.kind||n.providerId!==e.providerId||n.actor!==e.actor||n.fingerprint!==e.fingerprint||n.targetId!==e.targetId)throw new Error("GitHub personal-token cleanup changed; reload the saved connection");return"local-credential-forgotten"}};function sk(){throw new it("stale","The saved GitHub backup authority changed.")}ao();const ck=524288,lk=qr().regex(/^[a-f0-9]{40}$/),dk=Ur({type:Dr("file"),path:qr(),sha:lk,encoding:Dr("base64"),size:Vr().int().min(1).max(ck),content:qr().max(75e4)}),uk=Ur({ref:qr(),object:Ur({type:Dr("commit"),sha:lk})}),pk=Ur({content:Ur({type:Dr("file"),path:qr(),sha:lk}),commit:Ur({sha:lk})});function hk(e="response"){throw new it(e,"The encrypted GitHub backup operation did not complete.")}function fk(e){return(!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(e.owner)||!/^[A-Za-z0-9_.-]{1,100}$/.test(e.repo)||/^\.{1,2}$/.test(e.repo)||!e.branch||e.branch.length>255||/[\s~^:?*\[\\]/.test(e.branch)||Array.from(e.branch).some(e=>e.charCodeAt(0)<33||127===e.charCodeAt(0))||e.branch.includes("..")||e.branch.includes("@{")||e.branch.split("/").some(e=>!e||e.startsWith(".")||e.endsWith(".")||e.endsWith(".lock")))&&hk("configuration"),`/repos/${encodeURIComponent(e.owner)}/${encodeURIComponent(e.repo)}`}function mk(e){return/^backups\/[a-f0-9-]{36}\.json$/.test(e)||"opensesame-vault.backup.json"===e||hk("configuration"),e.split("/").map(encodeURIComponent).join("/")}function gk(e){Object.keys(e).some(e=>!["backup_owner","backup_repo","backup_branch"].includes(e))&&hk("configuration");const t={owner:(e.backup_owner??"").trim(),repo:(e.backup_repo??"").trim(),branch:(e.backup_branch??"").trim()};return t.owner||t.repo||t.branch?(fk(t),t):null}function wk(e){(new TextEncoder).encode(e).length>ck&&hk("unsupported");try{return Jt(Wt(e))}catch{return hk()}}async function vk(e,t,n){await e.current();const r=AbortSignal.any([e.signal,AbortSignal.timeout(2e4)]);try{const i=new Headers({Authorization:`Bearer ${Yb(e.saved.privateState.credentials.api_key??"")}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"});void 0!==n&&i.set("Content-Type","application/json");const a={method:void 0===n?"GET":"PUT",headers:i,signal:r,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"};void 0!==n&&(a.body=JSON.stringify(n));const o=await e.transport.fetch(`${Jb}${t}`,a);e.check(),await async function(e,t){if(!t.ok||t.redirected){if(await(t.body?.cancel()),401===t.status){try{await ak(e.saved,e.transport)}finally{e.close()}hk("authentication")}404===t.status&&hk("not-found"),409!==t.status&&422!==t.status||hk("configuration"),hk()}}(e,o);const s=await yr(o,{maxBytes:1048576,signal:r,fatalUtf8:!0});return await e.current(),s}catch(i){if(i instanceof it)throw i;return e.check(),hk("network")}}function yk(e){if(!e.project||e.project.length>256||!e.project.split("/").every(e=>/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/.test(e)&&!e.endsWith(".")&&!e.endsWith(".git"))||"@"===e.branch||e.branch.startsWith("-")||!e.branch||e.branch.length>255||/[\s~^:?*\[\\]/.test(e.branch)||Array.from(e.branch).some(e=>e.charCodeAt(0)<33||127===e.charCodeAt(0))||e.branch.includes("..")||e.branch.includes("@{")||e.branch.split("/").some(e=>!e||e.startsWith(".")||e.endsWith(".")||e.endsWith(".lock")))throw new it("configuration","Use a GitLab project and existing branch for the encrypted backup.");return`/api/v4/projects/${encodeURIComponent(e.project)}`}function bk(e){if(Object.keys(e).some(e=>!["backup_project","backup_branch"].includes(e)))throw new it("configuration","Unknown GitLab backup parameter.");const t={project:(e.backup_project??"").trim(),branch:(e.backup_branch??"").trim()};return t.project||t.branch?(yk(t),Object.freeze(t)):null}ao();const kk=Ur({id:Vr().int().positive().max(Number.MAX_SAFE_INTEGER),path_with_namespace:qr(),archived:Dr(!1),repository_access_level:Mr(["enabled","private"])}),xk=Ur({name:qr(),can_push:Dr(!0),commit:Ur({id:qr().regex(/^[a-f0-9]{40}$/)})});async function Ik(e,t,n){if("gitlab"!==e.providerId)return;const r=bk(e.parameters);if(!r)return;const i=yk(r),a=Fd(e,t),o=e=>mr({url:`https://gitlab.com${e}`,method:"GET",headers:a,signal:n.signal},n),s=kk.safeParse(await o(i));if(!s.success)throw new it("response","GitLab did not prove the backup project.");const c=s.data;if(r.project!==String(c.id)&&r.project!==c.path_with_namespace)throw new it("response","GitLab returned a different backup project.");const l=xk.safeParse(await o(`${i}/repository/branches/${encodeURIComponent(r.branch)}`));if(!l.success||l.data.name!==r.branch)throw new it("response","GitLab returned a different backup branch.")}function jk(){throw new it("stale","The saved GitLab backup authority changed.")}function _k(e,t){const n=an(e);return n&&"gitlab"===n.configuration.providerId&&"api-key"===n.configuration.method&&Bt(bk(n.configuration.parameters))===Bt(t)||jk(),An(n),nn(n),n}ao();const Sk=524288,Ak=qr().regex(/^[a-f0-9]{40}$/),Ck=Ur({file_path:qr(),encoding:Dr("base64"),size:Vr().int().min(1).max(Sk),content:qr().max(75e4),content_sha256:qr().regex(/^[a-f0-9]{64}$/),commit_id:Ak,last_commit_id:Ak}),Ek=Ur({name:qr(),can_push:Dr(!0),commit:Ur({id:Ak})}),Tk=Ur({file_path:qr(),branch:qr()});function Nk(e="response"){throw new it(e,"The encrypted GitLab backup operation did not complete.")}function zk(e){return/^backups\/[a-f0-9-]{36}\.json$/.test(e)||"opensesame-vault.backup.json"===e||Nk("configuration"),encodeURIComponent(e)}function $k(e){(new TextEncoder).encode(e).length>Sk&&Nk("unsupported");try{return Jt(Wt(e))}catch{return Nk()}}async function Pk(e,t,n,r="GET"){await e.current();const i=AbortSignal.any([e.signal,AbortSignal.timeout(2e4)]);try{const a=new Headers({Authorization:`Bearer ${e.saved.privateState.credentials.api_key}`,Accept:"application/json"});void 0!==n&&a.set("Content-Type","application/json");const o={method:r,headers:a,signal:i,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"};void 0!==n&&(o.body=JSON.stringify(n));const s=await e.transport.fetch(`https://gitlab.com${t}`,o);e.check(),await async function(e,t){if(!t.ok||t.redirected){if(await(t.body?.cancel()),401===t.status){try{await e.invalidate()}finally{e.close()}Nk("authentication")}404===t.status&&Nk("not-found"),400!==t.status&&409!==t.status&&422!==t.status||Nk("configuration"),Nk()}}(e,s),s.status!==("POST"===r?201:200)&&(await(s.body?.cancel()),Nk()),/^application\/(?:[\w.-]+\+)?json(?:;|$)/i.test(s.headers.get("content-type")??"")||(await(s.body?.cancel()),Nk());const c=await yr(s,{maxBytes:1048576,signal:i,fatalUtf8:!0});return await e.current(),c}catch(a){if(a instanceof it)throw a;return e.check(),Nk("network")}}async function Ok(e,t,n){const r=Ek.safeParse(await Pk(e,`${t}/repository/branches/${encodeURIComponent(n)}`));return r.success&&r.data.name===n||Nk(),r.data.commit.id}async function Rk(e,t,n,r,i){const a=zk(r),o=i??await Ok(e,t,n),s=Ck.safeParse(await Pk(e,`${t}/repository/files/${a}?ref=${o}`));let c;s.success&&s.data.file_path===r&&s.data.commit_id===o||Nk();try{const e=s.data.content.replaceAll("\n",""),t=jo(e);t.length===s.data.size&&Io(t)===e||Nk();const n=new Uint8Array(await crypto.subtle.digest("SHA-256",li(t)));Array.from(n,e=>e.toString(16).padStart(2,"0")).join("")!==s.data.content_sha256&&Nk(),c=$k(new TextDecoder("utf-8",{fatal:!0}).decode(t))}catch{return Nk()}return e.check(),{id:r,name:r,kind:"note",notes:c,secret:"",fields:{last_commit_id:s.data.last_commit_id,commit:o}}}const Lk={publicParameters:["endpoint","region","bucket","access_key_id","prefix"],privateCredentials:["secret_access_key","session_token"]};async function Uk(e){const t=(new TextEncoder).encode(Bt({contract:"s3:sigv4:ListObjectsV2:v1",parameters:e}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",t))].map(e=>e.toString(16).padStart(2,"0")).join("")}function Dk(e){const t=JSON.stringify([e.secret_access_key??"",e.session_token??""]);return No(zo((new TextEncoder).encode(t)))}function qk(e,t=!1){const n=an(e);if(!n||"s3"!==n.configuration.providerId||"api-key"!==n.configuration.method)throw new Error("Saved S3 browser connection not found");if(An(n),t&&("connected"!==Pn(e,n.revision,n.configuration,n.runtime,n.privateState).status||n.privateState.grants.app?.accessToken!==Dk(n.privateState.credentials)))throw new Error("Verify S3 bucket permission before use");return n}function Mk(e,t,n,r,i=0){const a=Math.max(Date.now(),i+1),o=n.parameters.bucket??"",s=kr();return s.credentials=r,s.grants.app={kind:"api-key",providerId:"s3",actor:"app",fingerprint:n.fingerprint,targetId:o,accessToken:Dk(r),expiresAt:null,scopes:null},s.verification={fingerprint:n.fingerprint,verifiedAt:a,kind:"provider"},{connectionId:e,revision:t,configuration:n,privateState:s,runtime:{verifiedAt:a,identity:{id:o,label:o,kind:"bucket",assurance:"credential-valid"},targets:[{id:o,label:o,kind:"bucket"}],grants:[{actor:"app",label:"S3 signing credentials",permissionState:"provider-managed",grantedScopes:[],expiresAt:null,needsReauth:!1}]}}}async function Kk(e,t){return tn(e.connectionId,cn(e),Lk,e=>(t.assertCurrent(),e.privateState.verification=null,e),()=>t.assertCurrent())}const Fk={credentialSlots:["secret_access_key","session_token"],classification:e=>{if("s3"!==e.providerId||"api-key"!==e.method)throw new Error("S3 cleanup belongs to its saved browser connection");return Lk},cleanup:async(e,t)=>{const n=e.grant;if("s3"!==t.configuration.providerId||"api-key"!==t.configuration.method||"s3"!==e.providerId||"revoke"!==e.kind||e.fingerprint!==t.configuration.fingerprint||!n||"api-key"!==n.kind||n.actor!==e.actor||"s3"!==n.providerId||n.fingerprint!==e.fingerprint||n.targetId!==e.targetId)throw new Error("S3 cleanup changed; reload the saved browser connection");return"local-credential-forgotten"}};function Gk(){throw new it("stale","The saved S3 backup authority changed.")}function Bk(){throw new it("unsupported","Open this saved S3 connection for explicit vault backup or restore.")}function Vk(e){const t=(new TextEncoder).encode(e);if(t.length>Oo)throw new it("unsupported","This S3 backup exceeds 4 MiB.");try{Zt(e)}catch{throw new it("response","The S3 object is not a valid encrypted vault backup.")}return t}function Hk(e,t){return{id:e,name:e,kind:"note",notes:t,secret:""}}async function Jk(e,t){await e.current();const n=await is(as(t,{onFailure:e=>({ok:!1,error:e}),onSuccess:e=>({ok:!0,value:e})}));if(await e.current(),n.ok)return n.value;const r=n.error;if("SecretFsRejected"===r._tag&&"permission"===r.kind){try{await Kk(e.saved,e.transport)}finally{e.close()}throw new it("authentication","S3 refused this saved signing credential. Verify the connection again.")}throw new it("SecretFsNotFound"===r._tag?"not-found":"SecretFsConflict"===r._tag?"configuration":"SecretFsRejected"===r._tag?"response":"network","The encrypted S3 backup operation did not complete.")}const Wk={async backup(e,t,n){n();const{backUpVaultToSecretBackend:r}=await Mo(async()=>{const{backUpVaultToSecretBackend:e}=await import("./secret-backends-_-CBukTJ.js").then(e=>e.z);return{backUpVaultToSecretBackend:e}},[]);return n(),r(e,t,void 0,n)},async restore(e,t,n,r){r();const{restoreVaultFromSecretBackend:i}=await Mo(async()=>{const{restoreVaultFromSecretBackend:e}=await import("./secret-backends-_-CBukTJ.js").then(e=>e.z);return{restoreVaultFromSecretBackend:e}},[]);return r(),i(e,t,n,void 0,r)}};function Zk({handle:e,onFlash:t}){return jy(t,Iy(e.backend.signal,e.session.signal))}function Xk({handle:e,onFlash:t,fixedReference:n}){const r=Zk({handle:e,onFlash:t}),[i,a]=Ce.useState(n??""),[o,s]=Ce.useState("");return Ee.jsxs("form",{className:"cx-form panel__body","aria-label":"Restore vault backup",onSubmit:function(t){t.preventDefault();const n=o;s(""),r.run(async t=>{const r=await Wk.restore(e,i,n,t.check);return t.check(),`${r} items restored from encrypted backup`})},children:[Ee.jsx(O,{label:"Backup name or ID",value:i,disabled:r.busy,readOnly:void 0!==n,onValueChange:a}),Ee.jsx(O,{label:"Backup password or PIN",value:o,type:"password",autoComplete:"off",disabled:r.busy,onValueChange:s}),Ee.jsxs(U,{label:"Restore encrypted vault backup",disabled:r.busy||!i||!o,busy:r.busy,icon:Ee.jsx(D,{size:18}),children:[r.failure?Ee.jsx(Oe,{tone:"err",label:r.failure}):null,r.result?Ee.jsx(Oe,{tone:"ok",label:r.result}):null]}),Ee.jsx(q,{id:`backend-restore-${e.session.id}`,title:"Restore vault backup",message:r.failure})]})}function Yk({handle:e,onFlash:t}){const n=Zk({handle:e,onFlash:t}),[r,i]=Ce.useState("opensesame-vault-backup"),[a,o]=Ce.useState("");return Ee.jsxs("form",{className:"cx-form panel__body","aria-label":"Back up vault",onSubmit:function(t){t.preventDefault(),n.run(async t=>{const n=await Wk.backup(e,r,t.check);return t.check(),o(n.id),"Encrypted vault backup saved and verified"})},children:[Ee.jsx(O,{label:"Backup name",value:r,disabled:n.busy,onValueChange:i}),a?Ee.jsx(O,{label:"Saved backup ID",value:a,readOnly:!0,mono:!0}):null,Ee.jsxs(U,{label:"Back up encrypted vault",disabled:n.busy||!r,busy:n.busy,icon:Ee.jsx(W,{size:18}),children:[n.failure?Ee.jsx(Oe,{tone:"err",label:n.failure}):null,n.result?Ee.jsx(Oe,{tone:"ok",label:n.result}):null]}),Ee.jsx(q,{id:`backend-backup-${e.session.id}`,title:"Back up vault",message:n.failure})]})}function Qk(e){const{capabilities:t,createItem:n}=e.handle.backend,r=t.create&&t.get&&!!n&&!!t.vaultBackup;return r||t.get?Ee.jsxs("section",{className:"panel","aria-label":"Encrypted vault backups",children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsxs("h2",{children:[Ee.jsx("span",{className:"cx-step",children:"5"})," Vault backups"]})}),r?Ee.jsx(Yk,{...e}):null,t.get?Ee.jsx(Xk,{...e}):null]}):null}const ex={bitbucket:(e,t,n)=>{const r=Hy(t);if(!r)throw new Error("Configure a Bitbucket backup repository first.");return async function(e,t,n){const r=Object.freeze({...t}),i=Vy(r),a=await async function(e,t,n){const r=function(e){const t=e.transport??Vt().capture();if(t.assertCurrent(),!t.signal)throw new it("configuration","The native provider has no captured lifetime.");const n=at(e.vault),r=new AbortController,i=AbortSignal.any([t.signal,r.signal,...e.signal?[e.signal]:[]]),a=()=>{i.throwIfAborted(),t.assertCurrent(),e.assertCurrent?.(),n.current()},o={signal:i,assertCurrent:a,fetch:(e,n)=>(a(),t.fetch(e,{...n,signal:AbortSignal.any([i,...e instanceof Request?[e.signal]:[],...n?.signal?[n.signal]:[]])}))},s=e.vault.onLock(()=>r.abort());return{transport:o,signal:i,check:a,close:()=>{r.abort(),s(),n.close()}}}(n);let i=()=>{},a=!1;const o=()=>{a||(a=!0,r.close(),i(),r.signal.removeEventListener("abort",o))};try{r.check();const n=Yy(e,t),a=Rd("bitbucket",n.configuration.parameters),s=Bt({configuration:n.configuration,privateState:n.privateState,runtime:n.runtime}),c=()=>{r.check();const i=Yy(e,t);i.revision===n.revision&&Bt({configuration:i.configuration,privateState:i.privateState,runtime:i.runtime})===s||Xy()},l=async()=>{c(),await rn(e,cn(n)),c()};i=Ei(()=>{try{c()}catch{o()}}),r.signal.addEventListener("abort",o,{once:!0}),await l(),await Od(a)!==n.configuration.fingerprint&&Xy();const d=await async function(e,t,n){try{return await mr(Gd(t,e.privateState.credentials),n)}catch(r){throw r instanceof gr&&"authorization"===r.code&&await Wd(e,t,n),r}}(n,a,r.transport);return a.profile.verify||Xy(),jr("Bitbucket",a.profile.verify,d,n.privateState.credentials).label!==n.runtime.identity?.label&&Xy(),await Zy(a,n.privateState.credentials,r.transport),await l(),{...r,saved:n,headers:Fd(a,n.privateState.credentials),check:c,current:l,close:o,invalidate:()=>Wd(n,a,r.transport)}}catch(s){throw o(),s}}(e,r,n);try{await cb(a,i,r.branch);const t=Object.freeze({id:crypto.randomUUID(),backendId:`native-bitbucket-backup:${e}`,authenticatedAt:(new Date).toISOString(),signal:a.signal}),n=function(e,t,n,r){const i=t=>{e.check(),t!==r&&ib("stale")};async function a(r,a,o,s){i(o),ab(r),(!a.name.trim()||"note"!==a.kind||a.secret||a.username||a.url)&&ib("configuration");const c=ob(a.notes),l=await cb(e,t,n);void 0!==s?(eb.safeParse(s).success&&s===l||ib("configuration"),await lb(e,t,r,l)):await async function(e,t,n,r){try{return await sb(e,`${t}/src/${n}/${ab(r)}?format=meta`),!0}catch(i){if(i instanceof it&&"not-found"===i.code)return!1;throw i}}(e,t,l,r)&&ib("configuration");const d=new URLSearchParams({branch:n,parents:l,message:"Back up encrypted OpenSesame vault"}),u=new URLSearchParams({[`/${r}`]:c}),p=nb.safeParse(await sb(e,`${t}/src?${d}`,u));p.success&&p.data.hash!==l&&p.data.parents[0]?.hash===l||ib();const h=await lb(e,t,r,p.data.hash);return h.notes!==c&&ib(),h}return{getItem:async function(r,a){return i(a),ab(r),lb(e,t,r,await cb(e,t,n))},createItem:async(e,t)=>(e.fields&&Object.keys(e.fields).length&&ib("configuration"),a(`backups/${crypto.randomUUID()}.json`,e,t)),updateItem:async(e,t,n)=>(t.fields?.commit&&eb.safeParse(t.fields.commit).success&&!Object.keys(t.fields).some(e=>"commit"!==e)||ib("configuration"),a(e,t,n,t.fields.commit)),disconnect:async t=>{t!==r&&ib("stale"),e.close()}}}(a,i,r.branch,t);return{backend:{id:t.backendId,name:a.saved.configuration.displayName,signal:a.signal,capabilities:{itemKinds:["note"],itemFields:["notes"],vaultBackup:{kind:"note",field:"notes",maxBytes:Qy},list:!1,get:!0,create:!0,update:!0,delete:!1,import:!1},authenticate:async()=>ib("unsupported"),listItems:async()=>ib("unsupported"),getNotes:async(e,t)=>(await n.getItem(e,t)).notes,...n},session:t}}catch(o){throw a.close(),o}}(e,r,n)},gitlab:(e,t,n)=>{const r=bk(t);if(!r)throw new Error("Configure a GitLab backup project first.");return async function(e,t,n){const r=Object.freeze({...t}),i=yk(r),a=r.branch,o=await async function(e,t,n){const r=function(e){const t=e.transport??Vt().capture();if(t.assertCurrent(),!t.signal)throw new it("configuration","The native provider has no captured lifetime.");const n=at(e.vault),r=new AbortController,i=AbortSignal.any([t.signal,r.signal,...e.signal?[e.signal]:[]]),a=()=>{i.throwIfAborted(),t.assertCurrent(),e.assertCurrent?.(),n.current()},o={signal:i,assertCurrent:a,fetch:(e,n)=>(a(),t.fetch(e,{...n,signal:AbortSignal.any([i,...e instanceof Request?[e.signal]:[],...n?.signal?[n.signal]:[]])}))},s=e.vault.onLock(()=>r.abort());return{transport:o,signal:i,check:a,close:()=>{r.abort(),s(),n.close()}}}(n);let i=()=>{},a=!1;const o=()=>{a||(a=!0,r.close(),i(),r.signal.removeEventListener("abort",o))};try{r.check();const n=_k(e,t),a=Rd("gitlab",n.configuration.parameters),s=Bt({configuration:n.configuration,privateState:n.privateState,runtime:n.runtime}),c=()=>{r.check();const i=_k(e,t);i.revision===n.revision&&Bt({configuration:i.configuration,privateState:i.privateState,runtime:i.runtime})===s||jk()},l=async()=>{c(),await rn(e,cn(n)),c()};i=Ei(()=>{try{c()}catch{o()}}),r.signal.addEventListener("abort",o,{once:!0}),await l(),await Od(a)!==n.configuration.fingerprint&&jk();const d=await async function(e,t,n){try{return await mr(Gd(t,e.privateState.credentials),n)}catch(r){throw r instanceof gr&&"authorization"===r.code&&await Wd(e,t,n),r}}(n,a,r.transport);return a.profile.verify||jk(),jr("GitLab",a.profile.verify,d,n.privateState.credentials).label!==n.runtime.identity?.label&&jk(),await Ik(a,n.privateState.credentials,r.transport),await l(),{...r,saved:n,check:c,current:l,close:o,invalidate:()=>Wd(n,a,r.transport)}}catch(s){throw o(),s}}(e,r,n);try{await Ok(o,i,a);const t=Object.freeze({id:crypto.randomUUID(),backendId:`native-gitlab-backup:${e}`,authenticatedAt:(new Date).toISOString(),signal:o.signal}),n=function(e,t,n,r){const i=t=>{e.check(),t!==r&&Nk("stale")};async function a(r,a){return i(a),Rk(e,t,n,r)}async function o(r,o,s,c){i(s);const l=zk(r);(!o.name.trim()||"note"!==o.kind||o.secret||o.username||o.url)&&Nk("configuration");const d=$k(o.notes);void 0!==c&&(Ak.safeParse(c).success||Nk("configuration"),(await a(r,s)).fields.last_commit_id!==c&&Nk("configuration"));const u={commit_message:"Back up encrypted OpenSesame vault",branch:n,encoding:"base64",content:Io((new TextEncoder).encode(d))};void 0!==c&&(u.last_commit_id=c);const p=Tk.safeParse(await Pk(e,`${t}/repository/files/${l}`,u,void 0===c?"POST":"PUT"));p.success&&p.data.file_path===r&&p.data.branch===n||Nk();const h=await Rk(e,t,n,r,await Ok(e,t,n));return h.notes!==d&&Nk(),h}return{getItem:a,createItem:async(e,t)=>(e.fields&&Object.keys(e.fields).length&&Nk("configuration"),o(`backups/${crypto.randomUUID()}.json`,e,t)),updateItem:async(e,t,n)=>(t.fields?.last_commit_id&&!Object.keys(t.fields).some(e=>"last_commit_id"!==e)||Nk("configuration"),o(e,t,n,t.fields.last_commit_id)),disconnect:async t=>{t!==r&&Nk("stale"),e.close()}}}(o,i,a,t);return{backend:{id:t.backendId,name:o.saved.configuration.displayName,signal:o.signal,capabilities:{itemKinds:["note"],itemFields:["notes"],vaultBackup:{kind:"note",field:"notes",maxBytes:Sk},list:!1,get:!0,create:!0,update:!0,delete:!1,import:!1},authenticate:async()=>Nk("unsupported"),listItems:async()=>Nk("unsupported"),getNotes:async(e,t)=>(await n.getItem(e,t)).notes,...n},session:t}}catch(s){throw o.close(),s}}(e,r,n)},"azure-sm":(e,t,n)=>Ga(e,n),"azure-key-vault-secrets":(e,t,n)=>Ga(e,n),s3:(e,t,n)=>async function(e,t){const n=await async function(e,t){const n=t.transport??Gt(),r={signal:t.signal,assertCurrent:t.assertCurrent},i=t.vault;n.assertCurrent();const a=n.signal;if(!a)throw new it("configuration","The native provider has no captured lifetime.");a.throwIfAborted(),r.signal?.throwIfAborted(),r.assertCurrent?.();const o=function(e,t,n,r,i){const a=qk(e,!0),o=at(r),s=new AbortController,c=AbortSignal.any([n,s.signal,...i.signal?[i.signal]:[]]),l=Dk(a.privateState.credentials),d=()=>{c.throwIfAborted(),t.assertCurrent(),i.assertCurrent?.(),o.current();const n=qk(e,!0);n.revision===a.revision&&n.configuration.fingerprint===a.configuration.fingerprint&&Dk(n.privateState.credentials)===l||Gk(),c.throwIfAborted()};let u=()=>{},p=()=>{},h=!1;const f=()=>{h||(h=!0,s.abort(),o.close(),u(),p(),c.removeEventListener("abort",f))};u=Ei(()=>{try{d()}catch{f()}}),p=r.onLock(f),c.addEventListener("abort",f,{once:!0});try{d()}catch(m){throw f(),m}return{saved:a,transport:t,signal:c,check:d,close:f,async current(){d(),await rn(e,cn(a)),d()}}}(e,n,a,i,r);try{await o.current();const e=await Uk(o.saved.configuration.parameters);return o.check(),e!==o.saved.configuration.fingerprint&&Gk(),o}catch(s){throw o.close(),s}}(e,t);try{const t=Object.freeze({id:crypto.randomUUID(),backendId:`native-s3:${e}`,authenticatedAt:(new Date).toISOString(),signal:n.signal}),r=function(e,t){const n=function(e){const{parameters:t}=e.saved.configuration,n=e.saved.privateState.credentials;return Ro({endpoint:t.endpoint??"",region:t.region??"",bucket:t.bucket??"",prefix:t.prefix??"",prefixMode:"literal",credentials:{accessKeyId:t.access_key_id??"",secretAccessKey:qo(n.secret_access_key??""),sessionToken:n.session_token?qo(n.session_token):void 0},maxBytes:Oo,fetch:e.transport.fetch,signal:e.signal,assertCurrent:e.check})}(e);function r(n){if(e.check(),n!==t)throw new it("stale","This S3 backup belongs to another session.")}return{getItem:async function(t,i){r(i);const a=await Jk(e,n.read(t));let o;e.check();try{o=new TextDecoder("utf-8",{fatal:!0}).decode(a.bytes)}catch{throw new it("response","The S3 backup is not valid UTF-8 ciphertext.")}return Vk(o),e.check(),Hk(t,o)},createItem:async function(t,i){if(r(i),!t.name.trim()||"note"!==t.kind||t.secret)throw new it("configuration","Store a named encrypted backup as an S3 note.");const a=Vk(t.notes),o=`backups/${crypto.randomUUID()}.json`;return await Jk(e,n.write(o,a,{ifRevision:null})),e.check(),Hk(o,t.notes)}}}(n,t);return{backend:{id:t.backendId,name:n.saved.configuration.displayName,signal:n.signal,capabilities:{itemKinds:["note"],itemFields:["notes"],vaultBackup:{kind:"note",field:"notes",maxBytes:Oo},list:!1,get:!0,create:!0,update:!1,delete:!1,import:!1},authenticate:async()=>Bk(),listItems:async()=>Bk(),getNotes:async(e,t)=>(await r.getItem(e,t)).notes,...r,disconnect:async e=>{if(e!==t)throw new it("stale","This S3 backup belongs to another session.");n.close()}},session:t}}catch(r){throw n.close(),r}}(e,n),codeberg:(e,t,n)=>{const r=ub(t);if(!r)throw new Error("Configure a Codeberg backup repository first.");return async function(e,t,n){const r=Object.freeze({...t}),i=db(r),a=r.branch,o=await async function(e,t,n){const r=function(e){const t=e.transport??Vt().capture();if(t.assertCurrent(),!t.signal)throw new it("configuration","The native provider has no captured lifetime.");const n=at(e.vault),r=new AbortController,i=AbortSignal.any([t.signal,r.signal,...e.signal?[e.signal]:[]]),a=()=>{i.throwIfAborted(),t.assertCurrent(),e.assertCurrent?.(),n.current()},o={...t,signal:i,assertCurrent:a,fetch:(e,n)=>(a(),t.fetch(e,{...n,signal:AbortSignal.any([i,...e instanceof Request?[e.signal]:[],...n?.signal?[n.signal]:[]])}))},s=e.vault.onLock(()=>r.abort());return{transport:o,signal:i,check:a,close:()=>{r.abort(),s(),n.close()}}}(n);let i=()=>{},a=!1;const o=()=>{a||(a=!0,i(),r.signal.removeEventListener("abort",o),r.close())};try{r.check(),i=function(e,t,n,r){n.check();const i=Bt(Rb(e,t).configuration);return Ei(()=>{try{n.check(),Bt(Cn(e).configuration)!==i&&Ob()}catch{r()}})}(e,t,r,o);const{saved:n,grant:a}=await async function(e,t,n){n.assertCurrent();const r=Rb(e,t),i=Bt(r.configuration),a=r.privateState.grants.user?.expiresAt;null!=a&&a<=Date.now()&&await Pb(r,n),n.assertCurrent();const o=Rb(e,t);Bt(o.configuration)!==i&&Ob();const s=function(e){const t=e.privateState.grants.user;return(!t||"codeberg"!==t.providerId||"oauth"!==t.kind||"user"!==t.actor||t.fingerprint!==e.configuration.fingerprint||t.clientId!==e.configuration.clientId||"https://codeberg.org"!==t.issuer||"https://codeberg.org/login/oauth/access_token"!==t.endpoint||!t.accessToken||Array.from(t.accessToken).some(e=>e.charCodeAt(0)<33||127===e.charCodeAt(0))||null!==t.expiresAt&&t.expiresAt<=Date.now())&&Ob(),t}(o);return{saved:o,grant:s}}(e,t,r.transport),s=Bt({configuration:n.configuration,privateState:n.privateState}),c=()=>{r.check(),null!==a.expiresAt&&a.expiresAt<=Date.now()&&Ob();const i=Rb(e,t);i.revision===n.revision&&Bt({configuration:i.configuration,privateState:i.privateState})===s||Ob()};i(),i=Ei(()=>{try{c()}catch{o()}}),r.signal.addEventListener("abort",o,{once:!0});const l=async()=>{c(),await rn(e,cn(n)),c()};await l();const d=await vb(a,r.transport);c(),d.id!==n.runtime.identity?.id&&Ob();const u=()=>async function(e,t,n){try{await tn(e.connectionId,cn(e),Sr(e.configuration),e=>(e.privateState.verification=null,e.runtime.verifiedAt=null,e.runtime.grants=e.runtime.grants.map(e=>({...e,needsReauth:!0})),e),t.assertCurrent)}finally{n()}}(n,r.transport,o);return{...r,saved:n,grant:a,check:c,current:l,close:o,invalidate:u}}catch(s){throw o(),s}}(e,r,n);try{await Vb(o,i,a);const t=Object.freeze({id:crypto.randomUUID(),backendId:`native-codeberg-backup:${e}`,authenticatedAt:(new Date).toISOString(),signal:o.signal}),n=function(e,t,n,r){const i=t=>{e.check(),t!==r&&Kb("stale")};async function a(r,a){return i(a),Hb(e,t,n,r)}async function o(r,o,s,c){i(s);const l=Fb(r);(!o.name.trim()||"note"!==o.kind||o.secret||o.username||o.url)&&Kb("configuration");const d=Gb(o.notes);void 0!==c&&(Ub.safeParse(c).success||Kb("configuration"),(await a(r,s)).fields.sha!==c&&Kb("configuration"));const u={message:"Back up encrypted OpenSesame vault",branch:n,content:Io((new TextEncoder).encode(d))};void 0!==c&&(u.sha=c);const p=Mb.safeParse(await Bb(e,`${t}/contents/${l}`,u,void 0===c?"POST":"PUT"));p.success&&p.data.content.path===r||Kb();const h=await Hb(e,t,n,r,p.data.commit.sha);return h.fields.sha===p.data.content.sha&&h.notes===d||Kb(),h}return{getItem:a,createItem:async(e,t)=>(e.fields&&Object.keys(e.fields).length&&Kb("configuration"),o(`backups/${crypto.randomUUID()}.json`,e,t)),updateItem:async(e,t,n)=>(t.fields?.sha&&!Object.keys(t.fields).some(e=>"sha"!==e)||Kb("configuration"),o(e,t,n,t.fields.sha)),disconnect:async t=>{t!==r&&Kb("stale"),e.close()}}}(o,i,a,t);return{backend:{id:t.backendId,name:o.saved.configuration.displayName,signal:o.signal,capabilities:{itemKinds:["note"],itemFields:["notes"],vaultBackup:{kind:"note",field:"notes",maxBytes:Lb},list:!1,get:!0,create:!0,update:!0,delete:!1,import:!1},authenticate:async()=>Kb("unsupported"),listItems:async()=>Kb("unsupported"),getNotes:async(e,t)=>(await n.getItem(e,t)).notes,...n},session:t}}catch(s){throw o.close(),s}}(e,r,n)},github:(e,t,n)=>{const r=gk(t);if(!r)throw new Error("Configure a GitHub backup repository first.");return async function(e,t,n){const r=fk(t),i=t.branch,a=await async function(e,t){const n=t.transport??Gt();if(n.assertCurrent(),!n.signal)throw new it("configuration","The native provider has no captured lifetime.");const r=nk(e,!0),i=at(t.vault),a=new AbortController,o=AbortSignal.any([n.signal,a.signal,...t.signal?[t.signal]:[]]),s=Bt({configuration:r.configuration,privateState:r.privateState}),c=()=>{o.throwIfAborted(),n.assertCurrent(),t.assertCurrent?.(),i.current();const a=nk(e,!0);a.revision===r.revision&&Bt({configuration:a.configuration,privateState:a.privateState})===s||sk()};let l=()=>{},d=()=>{},u=!1;const p=()=>{u||(u=!0,a.abort(),i.close(),l(),d(),o.removeEventListener("abort",p))};l=Ei(()=>{try{c()}catch{p()}}),d=t.vault.onLock(p),o.addEventListener("abort",p,{once:!0});const h=async()=>{c(),await rn(e,cn(r)),c()};try{return await h(),r.configuration.fingerprint!==await rk()&&sk(),c(),{saved:r,transport:n,signal:o,check:c,current:h,close:p}}catch(f){throw p(),f}}(e,n);try{const t=Object.freeze({id:crypto.randomUUID(),backendId:`native-github-backup:${e}`,authenticatedAt:(new Date).toISOString(),signal:a.signal}),n=function(e,t,n,r){const i=t=>{e.check(),t!==r&&hk("stale")};async function a(r,a){return i(a),async function(e,t,n,r){const i=mk(r),a=uk.safeParse(await vk(e,`${t}/git/ref/heads/${n.split("/").map(encodeURIComponent).join("/")}`));a.success&&a.data.ref===`refs/heads/${n}`||hk();const o=dk.safeParse(await vk(e,`${t}/contents/${i}?ref=${a.data.object.sha}`));let s;o.success&&o.data.path===r||hk();try{const e=o.data.content.replaceAll("\n",""),t=jo(e);t.length===o.data.size&&Io(t)===e||hk();const n=new Uint8Array(await crypto.subtle.digest("SHA-1",new Uint8Array([...(new TextEncoder).encode(`blob ${t.length}\0`),...t])));Array.from(n,e=>e.toString(16).padStart(2,"0")).join("")!==o.data.sha&&hk(),s=wk(new TextDecoder("utf-8",{fatal:!0}).decode(t))}catch{return hk()}return e.check(),{id:r,name:r,kind:"note",notes:s,secret:"",fields:{sha:o.data.sha,commit:a.data.object.sha}}}(e,t,n,r)}async function o(r,o,s,c){i(s);const l=mk(r);(!o.name.trim()||"note"!==o.kind||o.secret||o.username||o.url)&&hk("configuration");const d=wk(o.notes);void 0!==c&&(lk.safeParse(c).success||hk("configuration"),(await a(r,s)).fields.sha!==c&&hk("configuration"));const u={message:"Back up encrypted OpenSesame vault",branch:n,content:Io((new TextEncoder).encode(d))};void 0!==c&&(u.sha=c);const p=pk.safeParse(await vk(e,`${t}/contents/${l}`,u));p.success&&p.data.content.path===r||hk();const h=await a(r,s);return h.fields.sha===p.data.content.sha&&h.notes===d||hk(),h}return{getItem:a,createItem:async(e,t)=>(e.fields&&Object.keys(e.fields).length&&hk("configuration"),o(`backups/${crypto.randomUUID()}.json`,e,t)),updateItem:async(e,t,n)=>(t.fields?.sha&&!Object.keys(t.fields).some(e=>"sha"!==e)||hk("configuration"),o(e,t,n,t.fields.sha)),disconnect:async t=>{t!==r&&hk("stale"),e.close()}}}(a,r,i,t);return{backend:{id:t.backendId,name:a.saved.configuration.displayName,signal:a.signal,capabilities:{itemKinds:["note"],itemFields:["notes"],vaultBackup:{kind:"note",field:"notes",maxBytes:ck},list:!1,get:!0,create:!0,update:!0,delete:!1,import:!1},authenticate:async()=>hk("unsupported"),listItems:async()=>hk("unsupported"),getNotes:async(e,t)=>(await n.getItem(e,t)).notes,...n},session:t}}catch(o){throw a.close(),o}}(e,r,n)}};function tx({view:e,onFlash:t}){const{connectionId:n,revision:r,fingerprint:i,providerId:a}=e,{backup_project:o="",backup_owner:s="",backup_repo:c="",backup_branch:l=""}=e.configuration.parameters,[d,u]=Ce.useState(null),[p,h]=Ce.useState(null);return Ce.useEffect(()=>{const e=new AbortController;let t=null;const d=()=>{e.signal.throwIfAborted(),function(e,t,n,r){const i=on(e);if(!i||!Zv(i)||i.providerId!==r||i.revision!==t||i.fingerprint!==n)throw new Error("The saved backup connection changed. Reopen its configuration.")}(n,r,i,a)},p=()=>u(null);return async function(){try{if(d(),"azure-sm"!==a&&"azure-key-vault-secrets"!==a&&"s3"!==a&&"github"!==a&&"codeberg"!==a&&"gitlab"!==a&&"bitbucket"!==a)throw new Error("No native backup adapter is configured.");const r=ex[a],i=await r(n,"gitlab"===a?{backup_project:o,backup_branch:l}:{backup_owner:s,backup_repo:c,backup_branch:l},{vault:Ht,signal:e.signal,assertCurrent:d});t=i,d(),i.session.signal?.throwIfAborted(),i.session.signal?.addEventListener("abort",p,{once:!0}),u(i)}catch{t&&t.backend.disconnect(t.session),e.signal.aborted||h("The saved backup authority is no longer available.")}}(),()=>{t?.session.signal?.removeEventListener("abort",p),e.abort(),t&&t.backend.disconnect(t.session)}},[n,r,i,a,o,s,c,l]),Ee.jsxs(Ee.Fragment,{children:[d?Ee.jsx(Qk,{handle:d,onFlash:t}):null,Ee.jsx(q,{id:`native-backup-${e.connectionId}`,title:"Encrypted vault backups",message:p})]})}function nx(e){return"databricks"===e.providerId?$r(e.parameters.domain??"").settings:zr(e.providerId).settingsUrl}function rx(e,t){const n=Cn(e),r=n.privateState.recovery.find(e=>e.id===t),i=zr(n.configuration.providerId),a=nx(n.configuration);if(!r||"oauth"!==n.configuration.method||!a)throw new _r("cleanup");const o=vn(e,r.id)||["exchange","refresh"].includes(r.credentials?.phase??"")&&Number(r.credentials?.deadline)>Date.now();return{url:a,message:"databricks"===i.id?"Revoke this app’s consent in your Databricks workspace. Already issued tokens can remain valid until their expiry; confirming only forgets this browser’s saved credential and failed authorization.":`Open ${i.name} authorization settings and revoke the application or key for this connection. Confirm only after that provider action is complete. This confirmation clears the failed authorization; it does not verify a working connection.`,canConfirm:!o&&["configure","revoke"].includes(r.kind)}}function ix(e,t,n={}){const r=Pr.pick({displayName:!0,icon:!0}).safeParse({displayName:void 0===e.displayName?t.displayName:e.displayName.trim(),icon:e.icon??t.icon});if(!r.success)throw new Error("Enter a valid connection name and PNG or JPEG icon");return wr(r.data.displayName,n),vr(r.data.icon,n),r.data}const ax=Ur({data:Ur({display_name:qr().max(256).optional(),entity_id:qr().max(256).optional(),policies:Gr(qr().min(1).max(256)).max(128),ttl:Vr().finite().nonnegative().max(31536e4),renewable:Fr()})});function ox(e){let t;try{t=new URL(e)}catch{throw new Error("Enter the instance's HTTPS origin")}if("https:"!==t.protocol||t.username||t.password||t.search||t.hash||"/"!==t.pathname)throw new Error("Enter the instance's HTTPS origin without a path or credentials");return t.origin}function sx(e,t){if(!/^[!-~]{1,32768}$/.test(e))throw new Error("Enter a valid provider token");if(t&&!/^[A-Za-z0-9_/-]{1,256}$/.test(t))throw new Error("Enter a provider namespace using letters, numbers, dashes and slashes");const n=new Headers({"X-Vault-Token":e});return t&&n.set("X-Vault-Namespace",t),n}async function cx(e,t,n,r){const i=ox(e),a=await mr({url:`${i}/v1/auth/token/lookup-self`,method:"GET",headers:sx(n,t)},r),o=ax.safeParse(a);if(!o.success)throw new gr("response");const{data:s}=o.data;if([s.entity_id??"",s.display_name??"",...s.policies].some(e=>e.includes(n)))throw new gr("response");const c=Date.now();return{entityId:s.entity_id||null,tokenLabel:s.display_name??"Provider token",policies:s.policies,renewable:s.renewable,expiresAt:0===s.ttl?null:c+1e3*s.ttl,verifiedAt:c}}async function lx(e,t,n,r){const i=ox(e),a=new AbortController,o=setTimeout(()=>a.abort(),15e3);r.assertCurrent();try{const e=await r.fetch(`${i}/v1/auth/token/revoke-self`,{method:"POST",headers:sx(n,t),signal:a.signal,credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer",mode:"cors"});if(r.assertCurrent(),401===e.status)throw new gr("authorization",401);if(403===e.status)throw new gr("permission",403);if(!e.ok||e.redirected)throw new gr("response",e.status);if(await(e.body?.cancel().catch(()=>{})),a.signal.aborted)throw new gr("network");r.assertCurrent()}catch(s){if(s instanceof gr)throw s;throw new gr("network")}finally{clearTimeout(o)}}function dx(e){if(!["vault","openbao"].includes(e.providerId))throw new Error("Select a Vault or OpenBao instance");const t=ox(e.endpoint),n=e.authMount||"oidc";if(!/^[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)*$/.test(n)||n.length>256)throw new Error("Enter the instance's OIDC auth mount");if(!/^[A-Za-z0-9_/-]{0,256}$/.test(e.namespace))throw new Error("Enter a valid provider namespace");if(!/^[A-Za-z0-9_.-]{0,256}$/.test(e.role))throw new Error("Enter a valid provider OIDC role");return{...e,endpoint:t,authMount:n}}function ux(e){const t=new Headers({accept:"application/json","content-type":"application/json"});return e&&t.set("X-Vault-Namespace",e),t}function px(){return[...crypto.getRandomValues(new Uint8Array(32))].map(e=>e.toString(16).padStart(2,"0")).join("")}const hx=Ur({auth:Ur({client_token:qr().min(1).max(32768).regex(/^[!-~]+$/),lease_duration:Vr().finite().nonnegative().max(31536e4)})}),fx={publicParameters:["endpoint","namespace","auth_mount","role","authorization_outcome"],privateCredentials:["api_key","oidc_nonce"]};function mx(e){const t=an(e);if(!t||!["vault","openbao"].includes(t.configuration.providerId)||"oidc"!==t.configuration.method)throw new Error("Saved Vault OIDC connection not found");return t}function gx(e){const t=mx(e),n=t.configuration.parameters;return dx({providerId:"vault"===t.configuration.providerId?"vault":"openbao",endpoint:n.endpoint??"",namespace:n.namespace??"",authMount:n.auth_mount??"oidc",role:n.role??""})}async function wx(e,t=Gt()){t.assertCurrent();const n=dx(e),r={endpoint:n.endpoint,namespace:n.namespace,auth_mount:n.authMount,role:n.role};if(e.connectionId){const n=mx(e.connectionId);if(n.configuration.providerId!==e.providerId||void 0!==e.revision&&n.revision!==e.revision)throw new Error("Connector changed; reload before signing in");if(await rn(n.connectionId,cn(n)),JSON.stringify(Object.fromEntries(Object.entries(n.configuration.parameters).filter(([e])=>"authorization_outcome"!==e)))===JSON.stringify(r))return async function(e,t,n,r){const i=ix(t,e.configuration,e.privateState.credentials);if(i.displayName===e.configuration.displayName&&i.icon===e.configuration.icon)return e.connectionId;if(e.privateState.recovery.length||Object.keys(e.privateState.pending).length)throw new Error("Finish provider authorization cleanup before editing this connection");return await tn(e.connectionId,cn(e),r,e=>(n.assertCurrent(),e.configuration={...e.configuration,...i},e),()=>n.assertCurrent()),e.connectionId}(n,e,t,fx);throw new Error("Disconnect this instance before changing its authorization binding")}const i=px(),a=`conn_vault_${crypto.randomUUID()}`,o=ix(e,{displayName:"vault"===e.providerId?"HashiCorp Vault":"OpenBao",icon:""});return await hn({connectionId:a,configuration:{version:1,providerId:e.providerId,method:"oidc",...o,parameters:r,requestedScopes:{},targetIds:{},fingerprint:i},privateState:kr(),runtime:br()},fx,()=>t.assertCurrent()),a}async function vx(e,t,n=Gt()){const r=On(n);r.assertCurrent();const i=mx(e);if(i.privateState.recovery.length||Object.keys(i.privateState.pending).length)throw new Error("Finish or cancel the pending authorization first");await rn(e,cn(i));const a=px(),o=await async function(e,t,n,r){const i=dx(e);!function(e){const t=new URL(e);if("https:"!==t.protocol&&("http:"!==t.protocol||!["localhost","127.0.0.1","[::1]"].includes(t.hostname))||t.username||t.password||t.search||t.hash)throw new Error("Register a secure browser callback URL")}(t);const a=await mr({url:`${i.endpoint}/v1/auth/${i.authMount}/oidc/auth_url`,method:"POST",headers:ux(i.namespace),body:JSON.stringify({role:i.role,redirect_uri:t,client_nonce:n})},r),o=Ur({data:Ur({auth_url:qr().min(1).max(16384)})}).safeParse(a);if(!o.success)throw new gr("response");const s=function(e){let t;try{t=new URL(e)}catch{throw new gr("response")}if("https:"!==t.protocol||t.username||t.password||t.hash)throw new Error("The instance did not return a browser OIDC authorization URL");return t}(o.data.data.auth_url),c=s.searchParams,l=c.get("state"),d=c.get("nonce");if(!l||!/^[!-~]{16,512}$/.test(l)||!d||!/^[!-~]{1,512}$/.test(d)||c.get("redirect_uri")!==t||"code"!==c.get("response_type")||"query"!==(c.get("response_mode")??"query")||["state","nonce","redirect_uri","response_type","response_mode"].some(e=>c.getAll(e).length>1))throw new Error("The instance did not return a browser OIDC authorization URL");return{authorizationUrl:s.href,state:l,nonce:d}}(gx(e),t,a,r),s=Date.now(),c=s+3e5;return await tn(e,cn(i),fx,e=>(r.assertCurrent(),e.privateState.credentials.oidc_nonce=o.nonce,e.privateState.pending.user={providerId:e.configuration.providerId,actor:"user",fingerprint:e.configuration.fingerprint,state:o.state,verifier:a,redirectUri:t,createdAt:s,expiresAt:c,scopes:[],endpoint:e.configuration.parameters.endpoint},e)),{connectionId:e,authorizationUrl:o.authorizationUrl,state:o.state,expiresAt:c}}async function yx(e,t){const n=mx(e);return t&&n.privateState.pending.user?.state!==t?on(e):tn(e,cn(n),fx,e=>(e.privateState.pending=Object.fromEntries(Object.entries(e.privateState.pending).filter(([e])=>"user"!==e)),e.privateState.credentials=Object.fromEntries(Object.entries(e.privateState.credentials).filter(([e])=>"oidc_nonce"!==e)),e))}function bx(e,t){const n=mx(e),r=gx(e),i=n.privateState.recovery.find(e=>e.id===t);if(!i||"revoke"!==i.kind||"user"!==i.actor||i.providerId!==r.providerId||i.fingerprint!==n.configuration.fingerprint||i.grant&&("oidc"!==i.grant.kind||i.grant.endpoint!==r.endpoint)||void 0!==i.credentials?.namespace&&i.credentials.namespace!==r.namespace)throw new Error("Provider revocation confirmation belongs to another Vault connection");return{record:n,input:r,entry:i}}function kx(e,t){return!(vn(e.connectionId,t.id)||0!==Object.keys(e.privateState.pending).length||"exchange"===t.credentials?.phase&&Number(t.credentials.deadline)>Date.now())}function xx(e){let t,n=e.initial;const r=!n&&e.stale&&"absent"===e.read(e.stale)?e.stale:void 0,i=()=>{throw new Error("Provider sign-in selection changed")},a=()=>{const r=n??t;r&&"same-provider"!==e.read(r)&&i()};return{check:a,select(o){a(),!o||o===r&&"absent"===e.read(o)||("same-provider"!==e.read(o)&&i(),n?o!==n&&i():((e.existing.has(o)||t&&t!==o)&&i(),t=o))},bind(r){a(),(n&&n!==r||t&&t!==r)&&i(),"same-provider"!==e.read(r)&&i(),n=r}}}function Ix(e,t,n,r,i){let a=!0;const o=()=>{if(!a)throw new Error("Provider sign-in was cancelled");n(),i.check()},s=i=>{if(a){a=!1;try{if(e)return void e();if(i){try{n()}catch{return}t?.()}}finally{r()}}};return{check:o,bind(e){o(),i.bind(e)},selectConnection(e){if(a)try{o(),i.select(e)}catch{s(!0)}},finish:()=>s(!1),cancel:()=>s(!0),current:()=>{try{return o(),!0}catch{return!1}}}}function jx(e){const{read:t,required:n,retain:r,forget:i}=e;return{retry:async e=>{const t=n();if(!t.recovery.some(t=>t.id===e))throw new Error("Reload this connection before retrying cleanup");return r(await Nn(t.connectionId))},revocationInstructions:e=>{const n=t(),r=n?.recovery.find(t=>t.id===e);return n&&r?"mcp"===n.configuration.method?null:"oidc"===n.configuration.method&&["vault","openbao"].includes(n.providerId)?"configure"===r.kind?null:function(e,t){const{record:n,input:r,entry:i}=bx(e,t);return{url:"vault"===r.providerId?"https://developer.hashicorp.com/vault/api-docs/auth/token#revoke-a-token":"https://openbao.org/api-docs/auth/token/#revoke-a-token",message:`Ask the ${"vault"===r.providerId?"HashiCorp Vault":"OpenBao"} administrator for ${r.endpoint} to revoke this connection's OIDC-issued token, or confirm that it has already expired or been revoked. Namespace: ${r.namespace||"root"}; auth mount: ${r.authMount}; role: ${r.role||"provider default"}. Confirm only after that administrator action. This confirmation only forgets the selected local recovery credential; it does not verify provider revocation or a working connection.`,acknowledgementLabel:"An administrator revoked this connection token or confirmed it is expired",canConfirm:kx(n,i)}}(n.connectionId,e):"oauth"===n.configuration.method&&nx(n.configuration)?rx(n.connectionId,e):null:null},loadRevocationInstructions:async e=>{const n=t();return"mcp"===n?.configuration.method&&n.recovery.some(t=>t.id===e)?async function(e,t){return fn(e,async()=>{const n=gn(e);return await rn(e,cn(n)),Ww(e,t)})}(n.connectionId,e):null},confirmRevocation:async(e,t)=>{const i=n();if("mcp"===i.configuration.method){if(void 0===t)throw new Error("Review the provider revocation guide before confirming");return r(await async function(e,t,n){return fn(e,async()=>{if(!Ww(e,t).canConfirm)throw new mn("pending");const r=gn(e);if(r.revision!==n)throw new mn("pending");const i=await tn(e,cn(r),wn,n=>{if(!n.privateState.recovery.find(e=>e.id===t)||vn(e,t))throw new mn("pending");return n.privateState.recovery=n.privateState.recovery.filter(e=>e.id!==t),n.privateState.grants={},n.privateState.pending={},n.privateState.credentials={},n.privateState.verification=null,n.runtime.verifiedAt=null,n.runtime.grants=[],n});return yn(e,t),bn(e,t),kn(e,t),i})}(i.connectionId,e,t))}if("oidc"===i.configuration.method&&["vault","openbao"].includes(i.providerId))return r(await async function(e,t){const{record:n,entry:r}=bx(e,t),i=Gt(),a=()=>{i.assertCurrent();const n=bx(e,t);if(!kx(n.record,n.entry))throw new Error("Provider authorization is still pending; retry confirmation after it settles")};a();const o=JSON.stringify(r),s=await tn(e,cn(n),fx,e=>{if(a(),JSON.stringify(e.privateState.recovery.find(e=>e.id===t))!==o)throw new Error("Provider cleanup changed; review it before confirming");return e.privateState.recovery=e.privateState.recovery.filter(e=>e.id!==t),e.privateState.credentials.api_key===r.grant?.accessToken&&(e.privateState.credentials=Object.fromEntries(Object.entries(e.privateState.credentials).filter(([e])=>"api_key"!==e))),e.privateState.verification=null,e.runtime=br(),e},a);return bn(e,t),s}(i.connectionId,e));if("oauth"!==i.configuration.method)throw new Error("This provider requires its own cleanup operation");return r(await async function(e,t){if(!rx(e,t).canConfirm)throw new _r("cleanup");const n=Cn(e),r=await tn(e,cn(n),Sr(n.configuration),e=>{const n=e.privateState.recovery.find(e=>e.id===t);if(!n||!["configure","revoke"].includes(n.kind))throw new _r("cleanup");return e.privateState.recovery=e.privateState.recovery.filter(e=>e.id!==t),e.privateState.verification=null,e.runtime.verifiedAt=null,e.runtime.grants=e.runtime.grants.map(e=>({...e,needsReauth:!0})),e});return bn(e,t),r}(i.connectionId,e))},remove:async()=>{if(await Rn(n().connectionId),t())throw new Error("Provider connection removal was not committed");i()}}}function _x(e,t,n){const r=function(e,t){let n=t,r=null;const i=()=>{if(!n)return null;const t=on(n);if(t&&t.providerId!==e.id)throw new Error("This connection belongs to another provider");return t},a=e=>(r=e?{revision:e.revision,fingerprint:e.configuration.fingerprint}:null,e);return{load:()=>a(i()),read:i,required:()=>{const e=i();if(!e)throw new Error("Save this provider's configuration first");if(!r||r.revision!==e.revision||r.fingerprint!==e.configuration.fingerprint)throw new Error("This connection changed; reload and review it before continuing");return e},retain:t=>{if(t.providerId!==e.id)throw new Error("Provider returned another connection binding");return n=t.connectionId,a(t),t},forget:()=>{n=void 0,r=null}}}(e,t),{load:i,read:a,required:o,retain:s}=r,c=function(e,t,n,r){let i;return{reserve:a=>{if(!["oauth","oidc","mcp"].includes(a))return;const o=xx({initial:t()?.connectionId,stale:n,existing:new Set(Si().map(e=>e.connectionId)),read:t=>{const n=on(t);return n?n.providerId===e?"same-provider":"other-provider":"absent"}}),s=Ln(),c=s.prepareAuthorization?.();let l;const d=()=>{i===p&&(i=void 0);const e=l;l=void 0,e?.()};let u;const p=Ix(c,s.cancelAuthorization,()=>u?.(),d,o);try{return u=s.captureAuthorizationGuard?.(),i=p,c&&(l=r?.(Object.freeze({method:a,cancel:p.cancel,current:p.current,selectConnection:p.selectConnection}))),p.current()||d(),p.check(),p}catch(h){throw p.finish(),h}},cancel:()=>i?.cancel()}}(e.id,a,t,n),l=function(e,t){const{read:n,required:r,retain:i}=t;return async(t,a,o)=>{if(a?.(),e.refused)throw new Error("This provider connection is unavailable");const s=n()?r():null;if(s&&s.configuration.method!==t.method)throw new Error("Remove this connection before choosing another authorization method");const c=await Lw(t.method,e.id).configure({...t,providerId:e.id,connectionId:s?.connectionId,revision:s?.revision});return o?.(c.connectionId),a?.(),i(c)}}(e,r);return{load:i,configure:l,test:async t=>{if(e.refused)throw new Error("This provider connection is unavailable");const n=Lw(t.method,e.id);if(!n.test)throw new Error("This provider verifies only when it is saved");return n.test({...t,providerId:e.id})},cancelAuthorization:c.cancel,connect:async t=>{const n=c.reserve(t.method);try{const r=await l(t,n?.check,n?.bind);if(n?.check(),"connected"===r.status)return r;const a=Lw(t.method,e.id);if(!a.authorize)throw new Error("This provider requires verified credentials");await a.authorize(r.connectionId),n?.check();const o=i();if(!o||"connected"!==o.status)throw new Error("Provider authorization did not complete");return o}finally{n?.finish()}},authorize:async t=>{const n=o(),r=c.reserve(n.configuration.method);try{const a=Lw(n.configuration.method,e.id);if(!a.authorize)throw new Error("This method does not use provider consent");await a.authorize(n.connectionId,t),r?.check(),i()}finally{r?.finish()}},verify:async()=>{const t=o();return s(await Lw(t.configuration.method,e.id).verify(t.connectionId))},invoke:async(t,n,r)=>{r?.throwIfAborted();const i=o();if("connected"!==i.status)throw new Error("Verify this provider connection before using it");const a=Lw(i.configuration.method,e.id),s=await(void 0===r?a.invoke(i.connectionId,t,n):a.invoke(i.connectionId,t,n,r));return r?.throwIfAborted(),s},...jx(r)}}async function Sx(e,t,n,r){const i=Object.fromEntries(Object.entries(r).map(([e,t])=>[e,t.trim()]));wr(t.displayName,i),vr(t.icon??"",i);for(const a of Object.values(n))wr(a,i);"google-wallet"===e.provider.id&&(function(e){const t=bm(e.issuer_id??"",e.class_id??"",e.service_account_email??"");if("issuer_id"===t)throw new Error("Enter the numeric Google Wallet issuer id");if("class_id"===t)throw new Error("Enter a Google Wallet class id belonging to this issuer");if("service_account_email"===t)throw new Error("Enter a valid service account email")}(n),await async function(e){try{const t=xm(e);if(!t)throw new Error("Invalid private key envelope");await crypto.subtle.importKey(ym.key.format,li(jo(t.body)),{name:ym.key.algorithm,hash:ym.key.hash},!1,[ym.key.usage])}catch{throw new Error("Enter a valid PKCS#8 RSA private key")}}(r.service_account_key??""))}function Ax(e){const t=He(e);return t?wi(t):null}function Cx(e){const t=Ax(e);if(!t)throw new Error("This provider has no local configuration contract");return t}function Ex(e){return{revision:e.revision,fingerprint:e.configuration.fingerprint}}function Tx(e,t){Cx(e);const n=an(t);if(!n||n.configuration.providerId!==e||"native-local"!==n.configuration.method)throw new Error("Saved local provider configuration not found");return n}function Nx(e,t){return No(zo((new TextEncoder).encode(Bt({providerId:e,parameters:t}))))}function zx(e,t,n){if(void 0!==t.parameters[e.name])throw new Error(`${e.label} must remain sealed`);const r=t.credentials[e.name],i=n?.privateState.credentials[e.name],a=r?.trim()?r:i??"";if(e.required&&!a.trim())throw new Error(`Enter ${e.label.toLowerCase()}`);return a}function $x(e,t){if(void 0!==t.credentials[e.name])throw new Error(`${e.label} is not a secret field`);const n=t.parameters[e.name]?.trim()??"";if(e.required&&!n)throw new Error(`Enter ${e.label.toLowerCase()}`);return n}function Px(e,t,n){if(void 0!==t.parameters[e.name]&&void 0!==t.credentials[e.name])throw new Error(`${e.label} was supplied in the wrong field`);return e.secret?{secret:!0,value:zx(e,t,n)}:{secret:!1,value:$x(e,t)}}function Ox(e,t,n){if("native-local"!==t.method||Object.keys(t.requestedScopes).length>0||Object.keys(t.targetIds).length>0)throw new Error("Select only this provider's local configuration fields");const r={},i={},a=new Set([...Object.keys(t.parameters),...Object.keys(t.credentials)]);for(const o of e.provider.configurationFields??[]){const{secret:e,value:s}=Px(o,t,n);s&&(e?i[o.name]=s:r[o.name]=s),a.delete(o.name)}if(a.size>0)throw new Error("This provider received an unsupported configuration field");if(!t.displayName.trim()||t.displayName.trim().length>256)throw new Error("Enter a valid connection name");return{parameters:r,credentials:i}}function Rx(e,t,n,r){const i=Math.max(Date.now(),(t?.runtime.verifiedAt??0)+1),a={version:1,providerId:e.providerId,method:"native-local",displayName:e.displayName.trim(),icon:e.icon??"",parameters:n,requestedScopes:{},targetIds:{},fingerprint:Nx(e.providerId,n)},o=kr();return o.credentials=r,o.verification={fingerprint:a.fingerprint,verifiedAt:i,kind:"configuration"},{connectionId:t?.connectionId??`native-local-${crypto.randomUUID()}`,configuration:a,privateState:o,runtime:{verifiedAt:i,identity:{id:`configuration-${a.fingerprint.slice(0,16)}`,label:"Locally validated configuration",kind:"configuration",assurance:"credential-valid"},targets:[],grants:[]}}}async function Lx(e,t=Gt()){t.assertCurrent();const n=Cx(e.providerId),r=e.connectionId?Tx(e.providerId,e.connectionId):null;if(r&&r.revision!==e.revision)throw new Error("Local configuration changed; reload before saving");const{parameters:i,credentials:a}=Ox(n,e,r);await Sx(n,e,i,a);const o=Rx(e,r,i,a);return r?(await rn(r.connectionId,Ex(r)),tn(r.connectionId,Ex(r),n.classification,()=>(t.assertCurrent(),{...o,revision:r.revision}),()=>t.assertCurrent())):hn(o,n.classification,()=>t.assertCurrent())}function Ux(e){const{providerId:t,parameters:n,fingerprint:r}=e.configuration;if(Nx(t,n)!==r)throw new Error("Local configuration binding changed; configure again")}async function Dx(e,t){const n={providerId:t.configuration.providerId,connectionId:t.connectionId,revision:t.revision,displayName:t.configuration.displayName,icon:t.configuration.icon,method:"native-local",parameters:t.configuration.parameters,credentials:t.privateState.credentials,requestedScopes:{},targetIds:{}},r=Ox(e,n,t);return await Sx(e,n,r.parameters,r.credentials),{input:n,...r}}async function qx(e,t=Gt()){t.assertCurrent();const n=Tx(an(e)?.configuration.providerId??"",e),r=Cx(n.configuration.providerId);Ux(n),await rn(e,Ex(n));const{input:i,parameters:a,credentials:o}=await Dx(r,n),s=Rx(i,n,a,o);return tn(e,Ex(n),r.classification,()=>(t.assertCurrent(),Ux(n),{...s,revision:n.revision}),()=>t.assertCurrent())}async function Mx(e,t,n=Gt()){if(n.assertCurrent(),Object.keys(t).length>0)throw new Error("Local configuration review accepts no input");const r=an(e);if(!r)throw new Error("Saved local provider configuration not found");const i=Cx(r.configuration.providerId),a=Tx(r.configuration.providerId,e);if(Ux(a),await Dx(i,a),"connected"!==Pn(a.connectionId,a.revision,a.configuration,a.runtime,a.privateState).status)throw new Error("Verify this local configuration before reviewing it");return await rn(e,Ex(a)),n.assertCurrent(),{label:`${i.provider.displayName} local configuration`,items:[{id:"status",label:"Configuration verified locally; provider access was not checked"},...Object.entries(a.configuration.parameters).map(([e,t])=>({id:e,label:`${i.provider.configurationFields?.find(t=>t.name===e)?.label??e}: ${t}`}))]}}function Kx(e){if("native-local"!==e.method)throw new Error("Local configuration cleanup belongs to another method");return Cx(e.providerId).classification}const Fx={classification:Kx,credentialSlots:e=>Kx(e).privateCredentials,cleanup:async(e,t)=>{if(Cx(t.configuration.providerId),"native-local"!==t.configuration.method||"revoke"!==e.kind||e.providerId!==t.configuration.providerId||e.fingerprint!==t.configuration.fingerprint||"native-local"!==e.grant?.kind||e.grant.providerId!==e.providerId||e.grant.fingerprint!==e.fingerprint||e.grant.actor!==e.actor)throw new Error("Local configuration cleanup changed; reload before removal");return"local-credential-forgotten"}};function Gx(e,t){return{id:"oidc",label:"Sign in",available:t.has("oidc",e.id),authorizeFirst:!0,authorizationActor:"user",fields:[{id:"endpoint",label:"Instance HTTPS origin",kind:"url",secret:!1,required:!0,placeholder:"https://vault.example.com"},{id:"auth_mount",label:"OIDC auth mount",kind:"text",secret:!1,required:!0,defaultValue:"oidc"},{id:"role",label:"Role (optional)",kind:"text",secret:!1,required:!1},{id:"namespace",label:"Namespace (optional)",kind:"text",secret:!1,required:!1}],scopeGroups:[]}}const Bx={"built-in":"Built in",companion:"Companion configuration","refuses-browser":"Direct browser access","driver-pending":"Direct browser access","runtime-inactive":"Connection activation","no-key-check":"API key","no-contract":"Browser connection",policy:"Not offered","needs-client-secret":"OAuth","no-public-contract":"Authorization"};function Vx(e){return[{id:"backup_owner",label:"Backup repository owner",kind:"text",secret:!1,required:!1,help:`For vault backups, supply owner, repository and an existing branch. ${e}`},{id:"backup_repo",label:"Backup repository name",kind:"text",secret:!1,required:!1},{id:"backup_branch",label:"Backup repository branch",kind:"text",secret:!1,required:!1,help:"Use an existing branch. Encrypted backup envelopes are limited to 512 KiB."}]}function Hx(e){return"vercel"===e.id?"Sign in with Vercel":"cimd"===e.mode?"Managed OAuth":"openrouter-key"===e.mode?"Authorize with OpenRouter":"Bring Your Own OAuth App"}function Jx(e){return"vercel"===e.id?"Authorize your Vercel account with a public Sign in with Vercel app. This connection verifies account identity.":"codeberg"===e.id?"Authorize your Codeberg account with a public OAuth app. Codeberg manages OAuth access without granular permission scopes.":"cimd"===e.mode?"This self-hosted application publishes its public OAuth client metadata at the HTTPS address below. The provider verifies that document before your consent; no confidential credential is used.":"openrouter-key"===e.mode?"Authorize with OpenRouter to create a key for this connection. Review its provider settings before granting access.":"google-token"===e.mode?"Register a Google web client for the JavaScript origin below. Google opens a consent popup and issues a short-lived access token; renew it with another consent action.":"device-code"===e.mode?"Enter your Twitch public client ID and select permissions. Sign in opens Twitch’s device authorization page to approve this connection.":"Register a public browser application. Copy the callback below and select the permissions you need. No client secret is used."}function Wx(e,t,n){const r=e.methods.find(e=>"oauth"===e.kind),i=new Map(("codeberg"===t.id?[]:("oauth"===r?.kind?r.preset?.scopes??[]:[]).filter(e=>Or(t,e.name))).map(e=>[e.name,e]));for(const o of t.requiredScopes)i.set(o,{name:o,description:"Required to verify the provider account for this connection.",default:!0});const a=function(e,t){if("openrouter-key"===e.mode)return[];const n=[{id:"client_id",label:`${e.name} public client ID`,kind:"text",secret:!1,required:!0,readOnly:"cimd"===e.mode,defaultValue:"cimd"===e.mode?new URL("native-client.json",t).href:void 0}];"device-code"!==e.mode&&n.push({id:"google-token"===e.mode?"javascript_origin":"redirect_uri",label:"google-token"===e.mode?"Authorized JavaScript origin":"OAuth callback URL",kind:"url",secret:!1,required:!1,readOnly:!0,displayOnly:!0,defaultValue:"google-token"===e.mode?new URL(t).origin:"implicit"===e.mode?new URL("native-implicit.html",t).href:t});for(const r of e.publicParameters)"domain"===r&&n.push({id:r,label:`${e.name} tenant domain`,kind:"text",secret:!1,required:!0,placeholder:"auth0"===e.id?"acme.us.auth0.com":"okta"===e.id?"acme.okta.com":"dbc-example.cloud.databricks.com"}),"integration_id"===r&&n.push({id:r,label:"OAuth integration ID",kind:"text",secret:!1,required:!1,help:"Enables revoking this app’s consent when disconnecting."}),"tenant"===r&&n.push({id:r,label:"Microsoft tenant ID",kind:"text",secret:!1,required:!1,defaultValue:"common",help:"Use a directory UUID, common, organizations, or consumers. Register this callback as a Single-page application redirect."}),"instance_url"===r&&n.push({id:r,label:"GitLab instance",kind:"url",secret:!1,required:!1,readOnly:!0,defaultValue:"https://gitlab.com",help:"This public browser profile is verified for GitLab.com. Disable the Confidential setting when registering your application."});return n}(t,n);return"codeberg"===t.id&&a.push(...Vx("Your Codeberg account must have repository write access.")),{id:"oauth",authorizeFirst:!0,available:!0,label:Hx(t),instructions:Jx(t),fields:a,scopeGroups:i.size?[{actor:"user",label:"User permissions",help:"The account-verification permissions must remain selected to connect. Other permissions are optional.",choices:[...i.values()],requiredScopes:t.requiredScopes}]:[],links:[{label:`${t.name} browser authorization guide`,url:t.docsUrl}]}}function Zx(e){return{id:"mcp_authentication",label:"MCP authentication",kind:"choice",secret:!1,required:!0,defaultValue:e?"oauth":"",choices:[{id:"bearer",label:"Bring your own bearer token"},{id:"header",label:"Bring your own credential header"},{id:"anonymous",label:"No authentication (anonymous)"},...e?[{id:"oauth",label:"Provider OAuth authorization"}]:[]]}}function Xx(e,t,n){if("ok"===t.status&&!1===t.configurable)return n;const r=Dn(e),i=e=>["bearer","header","anonymous"].map(t=>({...e,when:{fieldId:"mcp_authentication",value:t}})),a={id:"mcp_url",label:"MCP server endpoint",kind:"url",secret:!1,required:!0,defaultValue:t.url},o={...a,id:"mcp_resource",label:"MCP resource audience",defaultValue:"ok"===t.status?t.resource??t.url:t.url},s={id:"mcp_transport",label:"MCP transport",kind:"choice",secret:!1,required:!0,defaultValue:new URL(t.url).pathname.endsWith("/sse")?"sse":"streamable-http",choices:[{id:"streamable-http",label:"Streamable HTTP"},{id:"sse",label:"Legacy SSE"}]};return{...n,label:"MCP",authorizeFirst:!0,instructions:"Choose the MCP authentication contract documented by your server. Operator-supplied credentials are sealed as Token items in the open vault. Anonymous sends no credential. A connection is verified only after actual MCP initialization and tool discovery; this choice does not change the server's authentication requirements.",fields:[Zx(r),...n.fields.map(e=>({...e,when:{fieldId:"mcp_authentication",value:"oauth"}})),...i(a),...i(o),...i(s),{id:"mcp_post_endpoint",label:"MCP messages endpoint",kind:"url",secret:!1,required:!0,when:{fieldId:"mcp_transport",value:"sse"},help:"Pin the exact same-origin messages path for Legacy SSE. Server announcements cannot choose another destination."},{id:"mcp_header",label:"MCP credential header",kind:"text",secret:!1,required:!0,defaultValue:"X-API-Key",when:{fieldId:"mcp_authentication",value:"header"},help:"Use the provider's documented credential header. Cookies, transport headers and MCP session headers are not allowed."},...["bearer","header"].map(e=>({id:"mcp_token",label:"MCP credential",kind:"text",secret:!0,required:!0,when:{fieldId:"mcp_authentication",value:e},help:"Stored only in the original vault. Leave blank to retain the same saved destination and authentication binding."}))]}}function Yx(e,t,n){const r=n.reason??qn(e,t)??void 0;return n.available||void 0!==r?{unavailableKind:"no-public-contract",unavailableReason:r??"The provider has not advertised a public browser authorization contract for its MCP server."}:{unavailableKind:"runtime-inactive",unavailableReason:n.inactiveReason??"Enable External connectors in Settings › Features to activate this connection on this device."}}function Qx(e,t,n){const r="ok"===t.status?t:null,i=n.defaultScopes??r?.defaultScopes??[];return{id:"mcp",authorizeFirst:!0,preferredRank:"ok"===r?.status&&"manual"!==r.registration?10:40,label:r&&"manual"!==r.registration?"Managed MCP":"MCP",available:n.available,...Yx(e,t,n),instructions:"Connect to this provider's published MCP server. OpenSesame verifies its advertised tools before reporting a connection.",fields:"manual"===r?.registration?[{id:"client_id",label:"Public MCP client ID",kind:"text",secret:!1,required:!0}]:[],scopeGroups:r?[{actor:n.actor,label:"MCP permissions",choices:r.scopes.map(e=>({name:e,description:"Permission advertised by the provider's MCP authorization server.",default:i.includes(e)}))}]:[]}}function eI(e,t,n){return{id:e,label:t,kind:"url",secret:!1,required:!0,defaultValue:n&&!/[{}]/.test(n)?n:void 0}}const tI=new Set(Rr.forbiddenParameters);function nI(e){const t={fieldId:"resource_protocol",value:"mcp"};return[{id:"resource_protocol",label:"Resource API protocol",kind:"choice",secret:!1,required:!1,defaultValue:e.protocol,choices:[{id:"json",label:"JSON HTTP API"},{id:"mcp",label:"MCP"}],help:"MCP verifies initialization and advertised tools before connecting. JSON verifies an actual resource read."},{id:"mcp_endpoint",label:"MCP server endpoint",kind:"url",secret:!1,required:!0,defaultValue:e.endpoint,when:t,help:"The exact MCP request URL; the API resource above remains its OAuth audience. Never put credentials in a URL."},{id:"mcp_transport",label:"MCP transport",kind:"choice",secret:!1,required:!0,defaultValue:e.transport??"streamable-http",when:t,choices:[{id:"streamable-http",label:"Streamable HTTP"},{id:"sse",label:"Legacy SSE"}]},{id:"mcp_post_endpoint",label:"MCP messages endpoint",kind:"url",secret:!1,required:!1,defaultValue:e.postEndpoint,when:t,help:"Required for Legacy SSE. Pin the provider's exact same-origin messages path; a server announcement cannot expand this destination."}]}function rI(e){return{id:"client_secret",label:"OAuth client secret",kind:"text",secret:!0,required:!0,when:{fieldId:"token_auth_method",value:e},help:"Stored as a sealed Token item in your open vault. This operator credential is not a public application secret. Leave blank only when retaining the same saved configuration."}}function iI(e,t=!1){return t?e.filter(e=>!tI.has(e.id)):e}function aI(e,t=!1){return[{actor:"user",label:"Permissions",choices:e.scopes,requiredScopes:t?[...Rr.scopes]:void 0}]}function oI(e,t,n,r={}){return{id:"oauth",label:"Bring Your Own OAuth App",authorizeFirst:!0,available:n,unavailableReason:n?void 0:"Enable External connectors to configure this OAuth application on this device.",instructions:"Configure your registered OAuth application and exact API resource. Authorization uses PKCE. A connection is verified only after the configured resource returns JSON with its issued access token. Disconnect forgets local authorization; revoke provider access in your application's settings.",fields:iI([{id:"client_id",label:"OAuth client ID",kind:"text",secret:!1,required:!0},{id:"redirect_uri",label:"OAuth callback URL",kind:"url",secret:!1,required:!1,readOnly:!0,displayOnly:!0,defaultValue:t},eI("issuer","OAuth issuer URL",e.serverUrl),eI("authorization_endpoint","Authorization endpoint",e.authorizationEndpoint),eI("token_endpoint","Token endpoint",e.tokenEndpoint),{id:"token_relay_url",label:"Token relay URL (optional)",kind:"url",secret:!1,required:!1,help:"Use a relay you control to keep the client secret off this device. The relay receives the authorization-code form and performs the exchange at the token endpoint."},eI("resource","API resource URL",e.verify?.url??e.userinfoEndpoint),{id:"token_auth_method",label:"Token endpoint authentication",kind:"choice",secret:!1,required:!0,defaultValue:e.tokenAuth,choices:[{id:"none",label:"Public client (PKCE)"},{id:"client_secret_basic",label:"Client secret in HTTP Basic"},{id:"client_secret_post",label:"Client secret in request body"}]},...(i=r.resourceParameter??e.resourceParameter,i?[{id:"resource_parameter",label:"Authorization resource parameter",kind:"choice",secret:!1,required:!0,defaultValue:i,choices:[{id:"send",label:"Send the configured API resource"},{id:"omit",label:"Use scopes without a resource parameter"}],help:"Select the authorization-server contract. The configured API resource is always checked before this connection is verified."}]:[]),...nI(r),rI("client_secret_basic"),rI("client_secret_post")],r.accountOnly),scopeGroups:aI(e,r.accountOnly),links:e.consoleUrl?[{label:"Register an application",url:e.consoleUrl}]:[]};var i}function sI(e,t,n,r,i,a={}){const o=oI(e,t,n,a),s=o.fields.find(e=>"token_auth_method"===e.id);if(!s)throw new Error("Expected an OAuth application contract");const c="cimd"===i.mode?"cimd":"provider",l=["none","client_secret_basic","client_secret_post"];return{...o,preferredRank:r.preferredRank,label:"OAuth application",fields:[{...s,label:"OAuth application",defaultValue:c,choices:[{id:c,label:"cimd"===i.mode?"Provider-managed metadata (CIMD)":r.label},...s.choices??[]]},...r.fields.map(e=>({...e,when:{fieldId:"token_auth_method",value:c}})),...o.fields.filter(e=>"token_auth_method"!==e.id).flatMap(e=>e.when?[e]:l.map(t=>({...e,when:{fieldId:"token_auth_method",value:t}})))],scopeGroups:"codeberg"===i.id?r.scopeGroups:r.scopeGroups.length?r.scopeGroups.map(e=>({...e,choices:[...new Map([...(o.scopeGroups.find(t=>t.actor===e.actor)?.choices??[]).map(e=>({...e,default:!1})),...e.choices].map(e=>[e.name,e])).values()]})):o.scopeGroups,instructions:`${r.instructions}\n${o.instructions}`,links:[...r.links??[],...o.links??[]]}}function cI(e){return{id:e.name,label:e.label,kind:e.choices?"choice":"text",secret:e.secret,required:e.required,placeholder:e.placeholder,choices:e.choices?.map(e=>({id:e.value,label:e.label}))}}function lI(e){return[...e.templateParams.map(cI),...e.additionalCredentials.map(e=>({id:e.name,label:e.label,kind:"text",secret:!0,required:e.required,placeholder:e.placeholder}))]}function dI(e,t){const n={id:"api_key",label:`${e} API key`,kind:"text",secret:!0,required:!0,placeholder:t.keyPrefix??void 0};return 0===t.credentialVariants.length?[n,...lI(t)]:[{id:"credential_variant",label:"Credential type",kind:"choice",secret:!1,required:!0,choices:t.credentialVariants.map(e=>({id:e.id,label:e.label})),defaultValue:t.credentialVariants[0]?.id},...t.credentialVariants.flatMap(t=>[{...n,label:`${e} ${t.label}`,help:t.description},...lI(t)].map(e=>({...e,when:{fieldId:"credential_variant",value:t.id}})))]}function uI(e){return[{actor:"user",label:"Permissions",help:"Permissions requested from this provider when you authorize the connection.",choices:e.scopes.map(e=>({name:e.name,description:e.description,default:e.default}))}]}function pI(e,t){return t?"no-contract":e&&"none"!==e.tokenAuth?"needs-client-secret":"no-public-contract"}function hI(e){return e?"none"===e.tokenAuth?"This provider's public OAuth application route is not supported here. Use its supported MCP authorization route when available.":"This provider requires a confidential OAuth client. Register your own application with it and add its client ID and secret: the secret is sealed in your vault on this device and sent only to the provider's token endpoint.":"This provider does not publish a browser OAuth application contract. Use another supported connection method."}function fI(e,t,n){const r=t.preset??e.preset;return{id:"oauth",authorizeFirst:!0,preferredRank:50,label:"Bring Your Own OAuth App",available:t.available&&null!==r,unavailableReason:t.reason??hI(r),unavailableKind:pI(r,t.reason),instructions:"Register a public browser application with this provider. Use the callback shown below and authorize only the permissions you need.",fields:r?[{id:"client_id",label:"Public OAuth client ID",kind:"text",secret:!1,required:!0},{id:"redirect_uri",label:"OAuth callback URL",kind:"url",secret:!1,required:!1,defaultValue:n,readOnly:!0,displayOnly:!0},...r.templateParams.map(cI)]:[],scopeGroups:t.scopeGroups??(r?uI(r):[]),links:r?.consoleUrl?[{label:"Register an application",url:r.consoleUrl}]:[]}}function mI(e,t,n){const r=t.preset;return{id:"api-key",label:"API Key",preferredRank:30,available:n.available&&!!r&&(!!r.auth&&!!r.verify||r.credentialVariants.some(e=>!!e.auth&&!!e.verify)),unavailableReason:n.reason??"This provider does not publish a browser-verifiable API-key route in the connector contract.",unavailableKind:n.reason?"no-contract":"no-key-check",instructions:r?.instructions??"Use a provider-supported browser authentication method when available.",fields:r?dI(e.name,r):[],scopeGroups:[],links:r?.keyUrl?[{label:`Create ${e.name} credentials`,url:r.keyUrl}]:[]}}function gI(e,t,n){const r=Mn(e),i=t.oauth.preset??n.preset??r?.preset,a=t.oauth.profile,o=r??{};if(t.oauth.available&&a){const n={...Wx(e,a,t.callbackUrl),preferredRank:20};return i?sI(i,t.callbackUrl,!0,n,a,{...o,resourceParameter:"google-token"===a.mode?"omit":void 0,accountOnly:"google-token"===a.mode}):n}return"google-token"===a?.mode&&i&&t.oauth.registeredAvailable?{...oI(i,t.callbackUrl,!0,{resourceParameter:"omit",accountOnly:!0}),preferredRank:35}:a&&!i?fI(n,t.oauth,t.callbackUrl):a&&i?sI(i,t.callbackUrl,t.oauth.available||!0===t.oauth.registeredAvailable,Wx(e,a,t.callbackUrl),a):i?{...oI(i,t.callbackUrl,t.oauth.available,{resourceParameter:o.resourceParameter}),preferredRank:35}:fI(n,t.oauth,t.callbackUrl)}async function wI(e,t,n,r){if(!or())throw new Error("Google GIS popup authorization is unavailable with enforced Cross-Origin-Opener-Policy same-origin");r();const i=Ln().prepareImplicitAuthorization;if(!i)throw new Error("Google consent window is unavailable");const a=await i("google");try{r();const i=Date.now()+6e5,o=new URL(a.redirectUri);o.hash=new URLSearchParams({clientId:e,scopes:JSON.stringify(t),state:a.state,expiresAt:String(i)}).toString(),await a.authorize(o.href,{expiresAt:i,retain:n})}finally{a.close()}}function vI(){return Ht.isGenuineSession()?void 0:"Open your own vault to connect this provider. Guest sessions do not store provider credentials."}function yI(e){const t=Ht.isGenuineSession(),n="google"===e&&!or();return{registeredAvailable:t&&Rw("oauth",e)&&ns(e),available:t&&ns(e)&&!Ow("oauth")&&!n,reason:t?n?"Google consent is unavailable under this deployment's isolation policy.":void 0:vI(),profile:xr(e)??void 0}}function bI(){const e=Ht.getSnapshot();return JSON.stringify([e.status,e.tomb,e.guest,e.awaitingSecondStep,e.decoy])}function kI(e,t){const{pathname:n,search:r}=Te(),[i,a]=Ce.useState(0),o=Ce.useMemo(()=>({providerId:e,pathname:n,search:r,generation:i}),[e,n,r,i]),s=Ce.useRef(o);s.current=o;const c=Ce.useRef(null),l=Ce.useRef(null),[d,u]=Ce.useState(null),p=Ce.useRef(()=>{});Ce.useLayoutEffect(()=>{const e={owner:o};c.current=e;let t=bI();const n=()=>{if(c.current!==e)return;c.current=null;const t=l.current;l.current=null,u(e=>e===t?null:e),a(e=>e+1),t?.retire(!0)};p.current=n;const r=Ht.onLock(n),i=Ht.subscribe(()=>{const e=bI();t!==e&&(t=e,n())});return()=>{r(),i(),c.current===e&&(c.current=null),l.current?.lease===e&&l.current.retire(!0)}},[o]);const h=Ce.useRef(t);Ce.useLayoutEffect(()=>{!function(e,t,n,r){const i=t.current;t.current=e;const a=n.current?.ticket;a?.selectConnection?.(e);const o=i&&i!==e;(a?.selectConnection?!a.current():o)&&r.current()}(t,h,l,p)});const f=Ce.useCallback(e=>{const t=function(e,t,n,r){return()=>{const i=e.current;if(!i||t.current!==n)throw r.cancel(),new Error("This provider sign-in page ended");return i}}(c,s,o,e),n=t();if(l.current?.retire(!0),t()!==n)throw e.cancel(),new Error("This provider sign-in page ended");let r=!1;const i={ticket:e,owner:o,lease:n,retire(t=!1){r||(r=!0,l.current===i&&(l.current=null),c.current===n&&u(e=>e===i?null:e),t&&e.cancel())}};if(l.current=i,e.selectConnection?.(h.current),!e.current())throw i.retire(!0),new Error("This provider sign-in selection ended");return u(i),()=>i.retire()},[o]),m=Ce.useCallback(()=>{const e=c.current;return()=>null!==e&&c.current===e&&s.current===o},[o]);return{generation:i,onAuthorization:f,captureUiCurrent:m,authorization:d?.owner===o&&d.ticket.current()?d.ticket:null}}function xI(e){const t=Ew(e);return t?t.ui(e).actions.map(e=>({id:e.id,label:e.label,available:!0,fields:e.fields,resultOrigins:e.resultOrigins??[]})):[]}function II(e){return"discord"===e.providerId&&e.grants.some(e=>"user"===e.actor&&e.grantedScopes.includes("guilds"))?[{id:"provider.guilds.read",label:"List servers",available:!0,fields:[],resultOrigins:["https://discord.com"]}]:[]}function jI(e,t){const n=Ow("api-key"),r=Nw(e.id)&&!n&&Ht.isGenuineSession();if("github"===e.id)return function(e,t){return{providerId:e.id,name:e.displayName,docsUrl:"https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens",disconnectExplanation:"Disconnect forgets this device's token. Revoke the token in GitHub's settings to end its other uses.",methods:[{id:"api-key",label:"Personal access token",available:t,unavailableReason:t?void 0:"GitHub personal-token access is unavailable in this browser runtime.",fields:[{id:"api_key",label:"GitHub personal access token",kind:"text",secret:!0,required:!0},...Vx("The token needs Contents read/write access.")],scopeGroups:[],links:[{label:"Create a fine-grained token",url:"https://github.com/settings/personal-access-tokens/new"},{label:"Create a classic token",url:"https://github.com/settings/tokens/new"}]}],actions:[]}}(e,r);if("s3"===e.id)return function(e,t){return{providerId:"s3",name:e.displayName,docsUrl:e.docsUrl,disconnectExplanation:"Disconnect forgets this device's signing credentials. Revoke a shared key at the provider to end its other uses.",methods:[{id:"api-key",label:"S3 signing credentials",available:t,unavailableReason:"S3 signing and bucket verification are unavailable in this browser runtime.",scopeGroups:[],fields:[{id:"endpoint",label:"S3 HTTPS service origin",kind:"url",secret:!1,required:!0,placeholder:"https://s3.us-east-1.amazonaws.com"},{id:"region",label:"Region",kind:"text",secret:!1,required:!0,defaultValue:"us-east-1"},{id:"bucket",label:"Bucket",kind:"text",secret:!1,required:!0},{id:"access_key_id",label:"Access key ID",kind:"text",secret:!1,required:!0},{id:"secret_access_key",label:"Secret access key",kind:"text",secret:!0,required:!0},{id:"session_token",label:"Session token (optional)",kind:"text",secret:!0,required:!1},{id:"prefix",label:"Object prefix (optional)",kind:"text",secret:!1,required:!1}],instructions:"Allow this site's origin to use GET and PUT with Authorization, Content-Type, If-None-Match, x-amz-date, x-amz-content-sha256 and, for temporary credentials, x-amz-security-token in your bucket's CORS policy. Connection verification checks ListObjectsV2 permission for this bucket and prefix. Encrypted backup and restore also require PutObject and GetObject permission within that prefix."}],actions:[]}}(e,r);const i=Ew(e.id);if(i)return function(e,t,n){return{providerId:e.id,name:e.displayName,docsUrl:e.docsUrl,disconnectExplanation:n.disconnectExplanation,methods:[gy(e.id,{id:"api-key",label:n.methodLabel,available:t,unavailableReason:`${e.displayName} signing is unavailable in this browser runtime.`,instructions:n.instructions,fields:n.fields,scopeGroups:[],links:n.links})],actions:[]}}(e,r,i.ui(e.id));const a=Oa(e.id);if(!a)return function(e,t){if(La(e)||function(e){return nt(e)||null!==Zi(e)||Ba(e)||sd(e)||null!==Ew(e)||["github","aws-kms","gcp-kms","s3","tailscale"].includes(e)}(e))return null;const n=He(e);if(!n)return null;if(Ax(n.id)){const r=function(e,t){return Ax(e.id)?{providerId:e.id,name:e.displayName,docsUrl:e.docsUrl,methods:[{id:"native-local",label:"Local configuration",available:t,unavailableKind:t?void 0:"runtime-inactive",unavailableReason:t?void 0:"Enable External connectors and open your own vault to save this configuration on this device.",instructions:`Enter the ${e.displayName} configuration to validate and seal in this vault. Verification checks only the saved configuration; it makes no provider request and does not verify provider access or an account.`,fields:t?(e.configurationFields??[]).map(e=>({id:e.name,label:e.label,kind:"text",secret:e.secret,required:e.required,help:e.secret?"Sealed in this vault and never rendered after saving.":void 0})):[],scopeGroups:[]}],actions:[],disconnectExplanation:"Remove forgets this device's sealed configuration. It makes no provider request and does not revoke provider access or delete provider data."}:null}(n,t.has("native-local",n.id));if(r)return{...r,providerId:e}}if(["vault","openbao"].includes(n.id)){const r=function(e,t){const n=t.has("api-key",e.id);return{id:"api-key",label:`${e.displayName} token`,available:n,unavailableReason:`${e.displayName} token verification is unavailable in this browser runtime.`,instructions:`Use a restricted ${e.displayName} token for your own HTTPS instance. Allow this app's origin in the instance CORS policy. Access is verified with token lookup-self; provider policies determine permissions. Disconnect forgets the local token and does not revoke other uses of it.`,fields:n?[{id:"endpoint",label:"Instance HTTPS origin",kind:"url",secret:!1,required:!0,placeholder:"https://vault.example.com",help:"Use the instance origin without a path, query or embedded credentials."},{id:"namespace",label:"Namespace (optional)",kind:"text",secret:!1,required:!1,help:"Provider namespace used in the X-Vault-Namespace header, when required by your instance."},{id:"api_key",label:"Provider token",kind:"text",secret:!0,required:!0,help:"Enter the token once. It is verified before being sealed on this device."}]:[],scopeGroups:[],links:[{label:`${e.displayName} token verification`,url:"vault"===e.id?"https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token-self":"https://openbao.org/api-docs/auth/token/#lookup-a-token-self"}]}}(n,t);return{providerId:e,name:n.displayName,docsUrl:n.docsUrl,methods:[Gx(n,t),r],actions:[]}}const{method:r,disposition:i}=function(e){const t=Un(e);return{method:{id:"native-local",label:Bx[t.kind],available:!1,unavailableKind:t.kind,unavailableReason:t.summary,fields:[],scopeGroups:[]},disposition:t}}(n);return{providerId:e,name:n.displayName,docsUrl:n.docsUrl,methods:[r],actions:[],externalLinks:i.sources.filter(e=>e.url!==n.docsUrl),configurationLinks:i.alternative?[i.alternative]:[]}}(e.id,(o=n,{has:(e,t)=>{return Ht.isGenuineSession()&&!Ow(e)&&("oidc"===e?"vault"===(n=t)||"openbao"===n:"native-local"===e?Rw(e,t):Nw(t)&&!o);var n}}));var o;const s=function(e,t,n){const r=function(e,t,n){const r=e.primaryMethod?n??e.primaryMethod:void 0,i=[];for(const a of e.methods)r&&a.kind!==r||("api-key"===a.kind&&i.push(mI(e,a,t.apiKey)),"oauth"===a.kind&&i.push(gI(e,t,a)),"mcp"===a.kind&&i.push(Xx(e.id,a.mcp,Qx(e.id,a.mcp,t.mcp))));if(!(r&&"oauth"!==r||i.some(e=>"oauth"===e.id))){const n=function(e,t){if(t.oauth.available&&t.oauth.profile)return gI(e,t,{preset:t.oauth.preset??null});const n=Mn(e);return n?{...oI(n.preset,t.callbackUrl,t.oauth.registeredAvailable??t.oauth.available,n),preferredRank:35}:(t.oauth.available||t.oauth.registeredAvailable)&&(t.oauth.profile||t.oauth.preset)?gI(e,t,{preset:t.oauth.preset??null}):null}(e,t);n&&i.unshift(n)}return i}(e,t,n).map(t=>gy(e.id,t));return 0===r.length&&r.push({id:n??"oauth",label:"Provider authorization",available:!1,unavailableKind:"no-public-contract",unavailableReason:`${e.name} publishes a hosted managed connection but no public browser authentication contract. This self-hosted app cannot provision the provider's hosted application.`,fields:[],scopeGroups:[]}),{providerId:e.id,name:e.name,docsUrl:e.docsUrl,disconnectExplanation:"settings"===t.oauth.profile?.revoke?"Disconnect forgets the local authorization. Revoke the application or key in your provider's authorization settings to end its provider access.":"Disconnect removes this device's connection. API keys are forgotten locally; revoke a shared key at the provider if you also want to end its other uses.",methods:e.refused?r.map(e=>({...e,available:!1,unavailableKind:"policy",unavailableReason:"This payment connection is unavailable under the product's connection policy."})):r,actions:[]}}(a,{callbackUrl:new URL("/OpenSesame/auth/native-connector.html",window.location.origin).href,apiKey:{available:r},oauth:yI(e.id),mcp:{available:Ht.isGenuineSession()&&("linear"===e.id?Rw("mcp",e.id):Fw(e.id))&&!Ow("mcp"),reason:Kn(e.id)??void 0,inactiveReason:vI(),actor:"user",defaultScopes:"linear"===e.id?["read"]:void 0}},t);return"linear"===e.id?{...s,methods:s.methods.filter(e=>e.id===(t??"mcp"))}:s}function _I(e,t){const n=rs(e.configuration);if(n&&"mcp"===e.configuration.parameters.resource_protocol)return[];const r=n?[{id:"provider.resource.read",label:"Read configured API resource"}]:(i=e.providerId,"api-key"!==e.configuration.method?[]:Cp.filter(e=>e.providerId===i).map(({id:e,label:t})=>({id:e,label:t})));var i;return(r.length?r:[{id:"provider.read",label:"native-local"===e.configuration.method?`Review ${t} configuration`:`Check ${t} access`}]).map(e=>({...e,available:!0,fields:[],resultOrigins:[]}))}function SI(e,t){const n=e.configuration.parameters;return(["s3","azure-sm","azure-key-vault-secrets"].includes(e.providerId)||["github","codeberg","bitbucket"].includes(e.providerId)&&n.backup_owner&&n.backup_repo&&n.backup_branch||"gitlab"===e.providerId&&"api-key"===e.configuration.method&&n.backup_project&&n.backup_branch)&&Zv(e)?Ee.jsx(tx,{view:e,onFlash:t},`${e.connectionId}/${e.revision}/${e.fingerprint}`):null}function AI(e){return"mcp"===e.configuration.method||rs(e.configuration)&&"mcp"===e.configuration.parameters.resource_protocol}function CI({provider:e,connection:t,onFlash:n,onChanged:r,renderConfiguration:i}){!function(e){const t=Ce.useSyncExternalStore(vv,wv,wv),n=void 0!==e&&t.present&&"needs-host"===function(e){const t=bv(e);return 0===t.length||function(e){return hv.present&&bv(e).some(e=>hv.granted.includes(e))}(e)?null:{state:hv.present?"needs-host":"absent",hosts:t}}(e)?.state;Ce.useEffect(()=>{n&&e&&Iv(e)},[n,e])}(e.id);const a=kI(e.id,t?.connectionId),o=Ce.useMemo(()=>_x({id:e.id,refused:Oa(e.id)?.refused??!1},t?.connectionId,a.onAuthorization),[e.id,t?.connectionId,a.onAuthorization]),[,s]=Ce.useState(0),c=o.load(),l=jI(e,c?.configuration.method),{hash:d}=Te();if(Ce.useEffect(()=>{"#connector"!==d&&"#complete"!==d||document.getElementById(d.slice(1))?.focus()},[d]),!l)return null;const u=function(e,t){const n=!!t&&e.methods.some(e=>e.id===t.configuration.method&&e.available)&&Rw(t.configuration.method,t.providerId);return{...e,actions:t&&"mcp"!==t.configuration.method?[..._I(t,e.name),...["vault","openbao"].includes(e.providerId)?[{id:"provider.secret.read",label:"Read secret",available:!0,fields:[{id:"mount",label:"KV v2 mount",kind:"text",secret:!1,required:!0,defaultValue:"secret"},{id:"path",label:"Secret path",kind:"text",secret:!1,required:!0,placeholder:"app/config"}],resultOrigins:[]}]:[],...["codeberg","github"].includes(e.providerId)?[{id:"provider.repositories.read",label:"Read repositories",available:!0,fields:[],resultOrigins:["github"===e.providerId?"https://github.com":"https://codeberg.org"]}]:[],..."s3"===e.providerId?[{id:"provider.objects.read",label:"List object keys",available:!0,fields:[],resultOrigins:[]}]:[],...xI(e.providerId),...II(t)].map(e=>({...e,available:n,reason:n?void 0:"This provider action is unavailable in this browser runtime."})):[]}}(l,c),p=u.methods.map(e=>e.available?1:0).join(""),h=e=>{s(e=>e+1),r()},f=Ee.jsx(xy,{descriptor:u,controller:o,view:c,authorization:a.authorization,onFlash:n,onChanged:h},`${e.id}/${c?.connectionId??"new"}/${c?.revision??0}/${p}/${a.generation}`);return Ee.jsxs("div",{className:"cx-setup",children:[Ee.jsx(Nv,{step:2,title:c&&Zv(c)?"Configure":"Connect",focus:!0,children:i?i(f):f}),c?Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(Fy,{descriptor:u,controller:o,view:c,onFlash:n,onChanged:h,onRemoved:()=>h(),authorization:a.authorization}),SI(c,n),AI(c)?Ee.jsx(By,{view:c,controller:o,onFlash:n,onChanged:h,disabled:!!a.authorization}):null]}):null]})}function EI(e){return"linear"===e||Ba(e)||sd(e)}function TI(e,t){if(!e||"active"!==e.status)return!1;if("linear"===e.providerId){const n=jd(e.connectionId);return[n?.app,n?.user].some(e=>!!e&&!e.needsReauth&&!!e.workspaceId&&(null===e.expiresAt||e.expiresAt>t))}return!1}function NI(e,t){const n=Ba(e.id)||sd(e.id)?null:jI(e),r=n?.methods.map(e=>({method:e.id,available:e.available,configurable:Yv(e)}))??[{method:"specialized",available:EI(e.id),configurable:!1}],i="linear"!==e.id||r.some(e=>e.available||e.configurable)?r:[...r,{method:"specialized",available:EI(e.id),configurable:!1}],a=Date.now(),o=n?_n(n.methods.filter(e=>!e.available).map(e=>e.unavailableKind)):void 0;return function(e,t){if(Ra(e.id))return{kind:"unavailable",glyph:"blocked",reason:"policy"};const n=t.connection;if(n?.providerId===e.id&&"revoked"!==n.status&&function(e){return e.routes.some(e=>e.available||e.configurable)||!!e.nativeView||!0===e.specializedVerified}(t)){const r=t.nativeView,i=function(e,t,n){return!!n&&n.providerId===e&&n.configuration.providerId===e&&n.connectionId===t&&n.fingerprint===n.configuration.fingerprint}(e.id,n.connectionId,r)?function(e,t){const n=function(e){if("mcp"!==e.configuration.method)return!1;const t=e.configuration.targetIds.mcp;return!!t&&!0===Oa(e.providerId)?.methods.some(n=>"mcp"===n.kind&&"ok"===n.mcp.status&&n.mcp.url===e.configuration.parameters.mcp_url&&(n.mcp.resource??n.mcp.url)===t)&&e.targets.some(e=>"mcp-resource"===e.kind&&e.id===t)}(e);return"connected"===e.status&&("mcp"!==e.configuration.method||n)&&0===e.recovery.length&&("native-local"===e.configuration.method||n||e.grants.length>0)&&null!==e.verifiedAt&&Number.isFinite(e.verifiedAt)&&e.verifiedAt>=0&&Number.isFinite(t)&&e.grants.every(e=>!e.needsReauth&&(null===e.expiresAt||e.expiresAt>t))}(r,t.now):!r&&!0===t.specializedVerified;return"active"===n.status&&i?{kind:"configure",glyph:"ellipsis",connectionId:n.connectionId}:{kind:"resume",glyph:"arrow",connectionId:n.connectionId}}const r=ld.find(e=>t.routes.some(t=>t.method===e&&(t.available||t.configurable)));if(r)return{kind:"connect",glyph:"plus",method:r};const i=t.nativeInstall;return i?.href.trim()&&i.label.trim()?dd({kind:"native",glyph:"computer",install:i},t):dd(t.nativeRequired?{kind:"native",glyph:"computer"}:{kind:"unavailable",glyph:"blocked"},t)}(e,{routes:i,connection:t,nativeView:t?on(t.connectionId):null,specializedVerified:TI(t,a),nativeRequired:!i.some(e=>e.available)&&"companion"===o,unavailableKind:o,now:a})}function zI(e,t){const n=t.filter(t=>t.providerId===e.id&&"revoked"!==t.status);return n.find(t=>"configure"===NI(e,t).kind)??n.find(t=>"resume"===NI(e,t).kind)??n[0]??null}const $I={oidc:"OpenID Connect (OIDC)",saml:"SAML 2.0",ldap:"LDAP / Active Directory","better-auth":"Email and password",supabase:"Email and password"},PI={oidc:"OIDC",saml:"SAML",ldap:"LDAP","better-auth":"Email/password",supabase:"Email/password"};function OI(e,t){return"byo-identity"===t&&"better-auth"===e?"Cookie session (Better Auth API)":"byo-identity"===t&&"supabase"===e?"Token session (Supabase Auth API)":$I[e]}function RI(e){return Pc(e.id)?"Managed":"openrouter"===e.id?"Delegated sign-in":"api_key"===e.authKind?"API key":"configuration"===e.authKind?"Configuration":"OAuth"}function LI(e,t){const n="ai_model_provider"===e.category?Gl(e.id):null;return n?`${t} · ${n}`:t}function UI(){const e=document.querySelector("#catalog .conn-tile summary, #catalog .conn-tile a, #catalog .conn-tile button");return e?.focus(),null!==e&&document.activeElement===e}function DI({providers:e,connections:t=[]}){const n=Fe(UI),{hash:r}=Te();Ce.useEffect(()=>{r.startsWith("#catalog-")&&n.close()},[r,n.close]);const i=Dt("connections.catalog"),a=Dt("connections.provider-picker");Ce.useEffect(()=>(a(document.getElementById("command-bar-input")),()=>a(null)),[a]);const o=(n.query??"").trim().toLocaleLowerCase(),s=Xc(e??[],{includeFeatured:!0,includeFamilies:!0}).filter(e=>el(e,o)),c=(e??[]).some(e=>e.missingConfig.some(e=>e.includes("CONNECTION_KEY")));return Ee.jsxs("section",{id:"catalog",className:"panel",ref:i,children:[Ee.jsxs("div",{className:"panel__head conn-catalog__head",children:[Ee.jsx("h2",{children:"Add a connection"}),Ee.jsx(ze,{id:"catalog-add",className:"icon-btn icon-btn--sm","aria-label":"Add a custom connection",title:"Add a custom connection",to:"/connections/custom-oidc",children:Ee.jsx(Z,{size:16})})]}),Ee.jsx("div",{className:"panel__body",children:null===e?Ee.jsx("p",{className:"hint",children:"Loading the connector catalog…"}):Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(q,{id:"connections:sealing",title:"Connection sealing",tone:"warn",message:c?"Connection sealing is not available yet on this deployment. Ask an operator to finish setup, then try again.":null}),Ee.jsx("ul",{className:"conn-grid",children:s.map(e=>Ee.jsx(qI,{provider:e,methods:Yc(e),connection:zI(e,t)},e.id))}),0===s.length?Ee.jsxs("div",{className:"empty conn-marketplace-empty",children:[Ee.jsx("h3",{children:"No matching connectors"}),Ee.jsx("p",{children:"Try a provider name, tag, or connector ID."}),Ee.jsx(Ka,{tip:"keymap"}),Ee.jsx(B,{label:"Clear search",small:!0,onClick:n.close,children:Ee.jsx(H,{size:16})})]}):null]})})]})}function qI({provider:e,methods:t,connection:n}){const r=NI(e,n),i="configure"===r.kind||"resume"===r.kind?p(e,n,n?on(n.connectionId)?.configuration.method:void 0):null,a=function(e){const t=function(e){const t=Zi(e);return t?[...new Set(t.protocols.map(e=>PI[e]))].join(" · "):null}(e.id);if(t)return t;const n=Oa(e.id);if(!n)return LI(e,RI(e));const r=n.methods.flatMap(e=>"mcp"===e.kind?["MCP"]:"oauth"===e.kind&&e.preset?["OAuth"]:"api-key"===e.kind&&e.preset?["API key"]:[]);return LI(e,[...new Set(r)].join(" · ")||"Configuration")}(e),o=e.displayName.toLowerCase()===a.toLowerCase()||t.some(e=>e.toLowerCase()===a.toLowerCase()),s=`catalog-${encodeURIComponent(e.id)}-tags`,{hash:c}=Te();return Ee.jsx("li",{className:"conn-tile"+(c===`#catalog-${encodeURIComponent(e.id)}`?" is-selected":""),id:`catalog-${encodeURIComponent(e.id)}`,children:Ee.jsxs(MI,{provider:e,action:r,describedBy:s,children:[Ee.jsx(Ri,{providerId:e.id,displayName:e.displayName,size:32}),Ee.jsxs("span",{className:"conn-tile__copy",children:[Ee.jsx("span",{className:"conn-tile__name",children:e.displayName}),o?null:Ee.jsx("span",{className:"conn-tile__kind",children:a}),Ee.jsx("span",{className:"conn-tile__tags",id:s,children:t.map(e=>Ee.jsx("span",{className:"conn-tag conn-tag--method",children:e},e))})]}),i?Ee.jsx(Oe,{tone:Re(i.tone),label:i.label}):null]})})}function MI({provider:e,action:t,describedBy:n,children:r}){if("configure"===t.kind)return Ee.jsx(Bl,{provider:e,connectionId:t.connectionId,describedBy:n,children:r});if("native"===t.kind||"unavailable"===t.kind){const e=t.reason?Sn[t.reason]:"native"===t.kind?"Desktop app required":"Unavailable",i=Ee.jsxs(Ee.Fragment,{children:[r,Ee.jsx("native"===t.kind?X:Y,{className:"conn-tile__go",size:18,title:e})]});return"native"===t.kind&&t.install?Ee.jsx("a",{className:"conn-tile__link",tabIndex:-1,href:t.install.href,"aria-label":t.install.label,"aria-describedby":n,children:i}):Ee.jsx("span",{className:"conn-tile__link",title:e,children:i})}return Ee.jsxs(ze,{className:"conn-tile__link",tabIndex:-1,"aria-label":`${"resume"===t.kind?"Resume sign-in to":"Connect"} ${e.displayName}`,"aria-describedby":n,to:ka(e.id,"resume"===t.kind?t.connectionId:void 0),children:[r,Ee.jsx("resume"===t.kind?Q:Z,{className:"conn-tile__go",size:18})]})}const KI="Connections could not be read.";function FI({failed:e}){return Ee.jsxs(Ee.Fragment,{children:[e?Ee.jsx(Oe,{tone:"err",label:KI}):null,Ee.jsx(q,{id:"connections:read",title:"Connections",message:e?KI:null})]})}function GI({more:e,pending:t,onMore:n}){if(e<=0)return null;const r=t?"Loading connections":`Load ${e} more`;return Ee.jsx("div",{className:"conn-pad",children:Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm",disabled:t,"aria-label":r,title:r,onClick:()=>{t||n()},children:Ee.jsx(Z,{size:16})})})}function BI(){return Ee.jsxs("div",{className:"empty",children:[Ee.jsx("h3",{children:"Nothing connected"}),Ee.jsx(Ka,{tip:"rail"})]})}function VI({connections:e,providers:t,loading:n,setupRequired:r,hostConfigured:i=!1,tools:a,sheet:o,imported:s}){const c=Dt("connections.connected"),[l,d]=Ce.useState(Nc),[u,p]=Ce.useTransition(),h=(e??[]).filter(xa),f=h.slice(0,l),m=Me(h.length,l);return Ee.jsxs("section",{id:"connected",className:"panel",ref:c,children:[Ee.jsxs("div",{className:"panel__head",children:[Ee.jsx("h2",{children:"Connected"}),Ee.jsx(FI,{failed:null===e&&!n&&i&&!r}),a?Ee.jsx("div",{className:"vtree__keys",children:a}):null]}),Ee.jsxs("div",{className:"panel__body panel__body--tight",children:[o,null!==e&&0===h.length?s?null:BI():r?Ee.jsx("div",{className:"empty conn-gate",children:Ee.jsx("h3",{children:"Choose an organization"})}):null===e?n?Ee.jsx("div",{className:"conn-pad",children:Ee.jsx("p",{className:"hint",children:"Reading connections…"})}):i?null:BI():Ee.jsxs(Ee.Fragment,{children:[Ee.jsx("ul",{className:"conn-list",children:f.map(e=>Ee.jsx(HI,{connection:e,provider:t.find(t=>t.id===e.providerId)??He(e.providerId)??null},e.connectionId))}),Ee.jsx(GI,{more:m,pending:u,onMore:()=>p(()=>{d(e=>e+Nc)})})]}),s]})]})}function HI({connection:e,provider:t}){const n="active"===e.status&&"google-drive"===t?.id&&ot(e)?{..._a.active,label:"Account verified"}:null,r=on(e.connectionId)?.configuration.method,i="active"===e.status&&t&&os(t,r)?{..._a.active,label:"Configured"}:null,a=n??i??_a[e.status],{hash:o}=Te();return Ee.jsxs("li",{className:"conn-service"+(o===`#connected-${encodeURIComponent(e.connectionId)}`?" is-selected":""),id:`connected-${encodeURIComponent(e.connectionId)}`,children:[Ee.jsx(Ri,{providerId:e.providerId,displayName:e.displayName}),Ee.jsxs("div",{className:"conn-service__copy",children:[Ee.jsx("h3",{children:e.displayName}),Ee.jsx("p",{children:Sa(e,t,r)})]}),Ee.jsxs("div",{className:"conn-service__actions",children:[Ee.jsx(Oe,{tone:Re(a.tone),label:a.label}),Ee.jsx(JI,{connection:e,provider:t})]})]})}function JI({connection:e,provider:t}){return t&&"configure"===NI(t,e).kind?Ee.jsx(Bl,{provider:t,connectionId:e.connectionId,layout:"service"}):Ee.jsxs(ze,{className:"btn btn--sm",to:ka(e.providerId,e.connectionId),"aria-label":`Settings for ${e.displayName}`,children:[Ee.jsx(ee,{size:16})," Settings"]})}function WI({token:e,teamId:t,projectId:n,onToken:r,onTeamId:i,onProjectId:a}){return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(O,{label:"Vercel access token",type:"password",value:e,autoComplete:"off",mono:!0,onValueChange:r}),Ee.jsxs("div",{className:"cx-grid",children:[Ee.jsx(O,{label:"Team ID",value:t,mono:!0,onValueChange:i}),Ee.jsx(O,{label:"Project ID",value:n,mono:!0,onValueChange:a})]}),Ee.jsx("div",{className:"cx-links",children:Ee.jsx(Uv,{href:"https://vercel.com/account/settings/tokens",children:"Vercel tokens"})})]})}function ZI({relay:t,onFlash:n,onSealed:r}){const{tomb:i}=Ot(),a=h(),[o,s]=Ce.useState(""),[c,l]=Ce.useState(""),[d,u]=Ce.useState(a?.teamId??""),[p,f]=Ce.useState(a?.projectId??""),[m,g]=Ce.useState(!1),w=t?o.trim().length>=32:c.trim().length>0;return Ee.jsxs("form",{className:"cx-form panel__body",onSubmit:async function(u){u.preventDefault(),g(!0);try{await async function(t,n,r={}){const i=mc(t);if(!i)throw new Error("A Vercel token or management key is required.");const a=gc(i);if(e(a),n&&!r.ephemeral)return hc=null,void(await vc(n,a));r.ephemeral||(hc=a)}(t?{...a??{token:""},manageKey:o.trim()}:{token:c.trim(),teamId:d,projectId:p,manageKey:a?.manageKey},i),s(""),l(""),n({tone:"ok",text:"Vercel Connect is ready on this device."}),r?.()}catch(h){n({tone:"err",text:Ia(h)})}finally{g(!1)}},children:[t?Ee.jsx(O,{label:"Relay management key",type:"password",value:o,autoComplete:"off",mono:!0,onValueChange:s}):Ee.jsx(WI,{token:c,teamId:d,projectId:p,onToken:l,onTeamId:u,onProjectId:f}),Ee.jsx(U,{label:m?"Sealing":"Seal in vault",icon:Ee.jsx(Y,{size:18}),busy:m,disabled:m||!w})]})}function XI(){const e=h();return[m()?"relay":"",e?.manageKey?"key":"",e?.token?"token":""].join("|")}function YI(){const e=Ce.useSyncExternalStore(f,XI,XI),t=e.startsWith("relay"),n=e.includes("|key"),r=e.endsWith("token");return{relay:t,canManage:t?n:r,canProve:t&&n,held:n||r}}const QI=[{id:"directory",name:"Nango",kind:"Directory",mark:"nango"},{id:"vercel",name:"Vercel Connect",kind:"Team",mark:"vercel"}];function ej({open:e,onToggle:t}){const n=e?"Close import":"Import connectors";return Ee.jsx("button",{id:"connectors-import",type:"button",className:"icon-btn icon-btn--sm","aria-label":n,title:n,"aria-expanded":e,onClick:t,children:Ee.jsx(e?H:D,{size:16})})}function tj({tomb:e,onFlash:t,onImported:n,onClose:r}){const i=YI(),[a,o]=Ce.useState(null);return Ee.jsxs("fieldset",{className:"conn-import","aria-label":"Import connectors",onKeyDown:function(e){"Escape"!==e.key||e.defaultPrevented||(e.preventDefault(),r())},children:[Ee.jsx("ul",{className:"conn-grid","aria-label":"Import from",children:QI.map(e=>Ee.jsx("li",{className:"conn-tile",children:Ee.jsxs("button",{type:"button",className:"conn-tile__link conn-import__choice","aria-pressed":a===e.id,onClick:()=>o(a===e.id?null:e.id),children:[Ee.jsx(Ri,{providerId:e.mark,displayName:e.name,size:32}),Ee.jsxs("span",{className:"conn-tile__copy",children:[Ee.jsx("span",{className:"conn-tile__name",children:e.name}),Ee.jsx("span",{className:"conn-tile__kind",children:e.kind})]}),"vercel"===e.id&&i.canManage?Ee.jsx(Oe,{tone:"ok",label:"Ready"}):null]})},e.id))}),"directory"===a?Ee.jsx(hl,{tomb:e||null,onSynced:()=>n()}):null,"vercel"===a?i.canManage?Ee.jsx(Oe,{tone:"ok",label:"Vercel Connect is ready on this device."}):Ee.jsx(ZI,{relay:i.relay,onFlash:t,onSealed:n}):null]})}const nj={readConnectorDirectory:At,syncConnectorDirectory:bt,tombUnlocked:ps};function rj({record:e,busy:t,onResync:n}){const r=St(e.endpoint),i=e.connections.length;return Ee.jsxs("div",{className:"conn-group conn-imported",id:"connected-imported",children:[Ee.jsxs("div",{className:"conn-imported__head",children:[Ee.jsxs("h3",{className:"conn-group__label",children:[r," · ",i," ",1===i?"connector":"connectors"," · synced"," ",Ct(e.syncedAt)]}),Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":`Import again from ${r}`,title:`Import again from ${r}`,disabled:t,onClick:n,children:Ee.jsx(V,{size:15})})]}),0===i?null:Ee.jsx("ul",{className:"conn-list","aria-label":`Imported from ${r}`,children:e.connections.map(e=>Ee.jsxs("li",{className:"conn-service",children:[Ee.jsx(Ri,{providerId:e.provider,displayName:e.displayName}),Ee.jsxs("div",{className:"conn-service__copy",children:[Ee.jsxs("h3",{children:[e.displayName,e.endUser?` · ${e.endUser}`:""]}),Ee.jsxs("p",{children:[e.integrationId," · ",e.connectionId]})]}),Ee.jsx("div",{className:"conn-service__actions",children:Ee.jsx(Oe,{tone:0===e.errors?"ok":"warn",label:0===e.errors?"Authorized":`${e.errors} ${1===e.errors?"error":"errors"}`})})]},`${e.integrationId}/${e.connectionId}`))})]})}function ij({connections:e,providers:t,onFlash:n,onChanged:r}){const[i,a]=Ce.useState(null),o=Dt("connections.attention"),s=ba(e);if(0===s.length)return null;async function c(e){a(e.connectionId);try{await async function(e,t,n){const r=l("about:blank");try{const{authorizationUrl:i}=await d(e.connectionId);r?r.location.href=i:window.location.href=i;const a=await u(e.connectionId,r);t("active"===a.result?{tone:"ok",text:`${e.displayName} is authorized.`}:"failed"===a.result?{tone:"err",text:a.connection.statusDetail??"The provider refused the authorization."}:{tone:"warn",text:"Authorization was not completed."}),n()}catch(i){r?.close(),t({tone:"err",text:Ia(i)})}}(e,n,r)}finally{a(null)}}return Ee.jsxs("section",{id:"attention",ref:o,className:"panel panel--attention","aria-labelledby":"conn-inbox-title",children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsx("h2",{id:"conn-inbox-title",children:"Needs attention"})}),Ee.jsx("ul",{className:"conn-list",children:s.map(e=>{const n=t.find(t=>t.id===e.providerId)??null,r=Aa(e.status);return Ee.jsxs("li",{id:`attention-${encodeURIComponent(e.connectionId)}`,className:"conn-service",children:[Ee.jsx(Ri,{providerId:e.providerId,displayName:e.displayName}),Ee.jsxs("div",{className:"conn-service__copy",children:[Ee.jsx("h3",{children:e.displayName}),Ee.jsx("p",{children:Sa(e,n)})]}),Ee.jsxs("div",{className:"conn-service__actions",children:[Ee.jsx(Oe,{tone:Re(Ea[r]),label:Ca[r]}),Ee.jsx(aj,{connection:e,busy:i,onFinish:c}),Ee.jsx(ze,{className:"btn btn--sm btn--ghost",to:ka(e.providerId,e.connectionId),children:"Details"})]})]},e.connectionId)})})]})}function aj({connection:e,busy:t,onFinish:n}){return ot(e)?null:Ee.jsx(B,{label:t===e.connectionId?"Authorizing":"Finish authorization",small:!0,disabled:null!==t,"aria-busy":t===e.connectionId,onClick:()=>{n(e)},children:Ee.jsx(Q,{size:16})})}const oj=e=>`linear_cleanup_${e}`,sj=e=>JSON.stringify([e.kind,e.accessToken,e.refreshToken??null,e.expiresAt,e.scopes]);function cj(e){if(!e)return[];try{return function(e){const t=JSON.parse(e);if(!Array.isArray(t)||t.length>32)throw new Error("Linear cleanup record could not be read; credentials were retained");return t.map(e=>{const t=_d(JSON.stringify(e));if(!t)throw new Error("Linear cleanup record could not be read; credentials were retained");return t})}(e)}catch{throw new Error("Linear cleanup record could not be read; credentials were retained")}}function lj(e){const t=new Map(e.map(e=>[sj(e),e]));if(t.size>32)throw new Error("Linear cleanup retry limit reached; credentials were retained");return[...t.values()]}async function dj(e,t,n){await Pd(e,async(e,r)=>{const i=oj(t),a=lj([...cj(e.secrets[i]),n]);return zd({...e,secrets:{...e.secrets,[i]:JSON.stringify(a)}},r)})}async function uj(e,t,n){await Pd(e,async(e,r)=>{const i=oj(t),a=cj(e.secrets[i]).filter(e=>!n.has(sj(e))),o={...e.secrets};return a.length?o[i]=JSON.stringify(a):Reflect.deleteProperty(o,i),zd({...e,secrets:o},r)})}const pj=new Map;async function hj(e,t,n){const r=`opensesame:linear-cleanup:${e}:${t}`,i=(pj.get(r)??Promise.resolve()).then(async()=>{const e=vi();return e?e.request(r,n):n()}),a=i.then(()=>{},()=>{});pj.set(r,a);try{return await i}finally{pj.get(r)===a&&pj.delete(r)}}const fj={fetch:async()=>{throw new mj("network")}};class mj extends Error{constructor(e,t=0,n){super({authorization:"Linear authorization expired or was refused. Reconnect Linear.",permission:"Linear refused this operation. Check the account permissions and granted scopes.","rate-limit":"Linear rate limited this request. Try again shortly.",response:"Linear did not complete the requested operation.",network:"Could not reach Linear. Check your connection and try again.",input:"Enter valid Linear operation details."}[e]),this.code=e,this.status=t,this.oauthError=n}code;status;oauthError;name="LinearApiError"}function gj(e,t){const n=e.safeParse(t);if(!n.success)throw new mj("input");return n.data}function wj(e,t){const n=e.safeParse(t);if(!n.success)throw new mj("response");return n.data}async function vj(e){const t=e.body?.getReader();if(!t)throw new mj("response",e.status);const n=[];let r=0;try{for(;;){const e=await t.read();if(e.done)break;if(r+=e.value.byteLength,r>262144)throw new mj("response");n.push(e.value)}const e=new Uint8Array(r);let i=0;for(const t of n)e.set(t,i),i+=t.byteLength;return JSON.parse((new TextDecoder).decode(e))}catch{throw new mj("response",e.status)}finally{await t.cancel().catch(()=>{}),t.releaseLock()}}const yj=Ur({error:Mr(["invalid_grant","invalid_client"])});async function bj(e,t,n=!1){const r=new AbortController,i=setTimeout(()=>r.abort(),15e3);try{const i=await fj.fetch(`https://api.linear.app${e}`,{...t,method:"POST",mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer",signal:r.signal}),a="/oauth/token"===e&&[400,401].includes(i.status)?await async function(e){try{const t=await vj(e),n=yj.safeParse(t);return n.success?n.data.error:void 0}catch{return}}(i):void 0;return i.ok||await(i.body?.cancel().catch(()=>{})),function(e,t){if(401===e.status)throw new mj("authorization",401,t);if(403===e.status)throw new mj("permission",403);if(429===e.status)throw new mj("rate-limit",429);if(!e.ok)throw new mj("response",e.status,t)}(i,a),n?(await(i.body?.cancel().catch(()=>{})),null):await vj(i)}catch(a){if(a instanceof mj)throw a;throw new mj("network")}finally{clearTimeout(i)}}const kj=Ur({kind:Mr(["oauth","api-key"]),token:qr().min(1).max(16384).regex(/^[!-~]+$/)}),xj=Ur({data:Br(qr(),Zr()).nullable().optional(),errors:Gr(Ur({extensions:Ur({code:qr().optional()}).optional()})).optional()});async function Ij(e,t,n,r){const i=gj(kj,e),a=await bj("/graphql",{headers:{accept:"application/json","content-type":"application/json",Authorization:"oauth"===i.kind?`Bearer ${i.token}`:i.token},body:JSON.stringify({query:t,variables:n})}),o=wj(xj,a);if(o.errors?.length){const e=o.errors.map(e=>e.extensions?.code);if(e.includes("AUTHENTICATION_ERROR"))throw new mj("authorization");if(e.includes("FORBIDDEN"))throw new mj("permission");throw new mj("response")}return wj(r,o.data??null)}const jj=Mr(["Issue","Comment","IssueLabel","Project","Cycle","Reaction"]),_j=Ur({url:qr().url().max(2048).refine(e=>{const t=new URL(e);return"https:"===t.protocol&&!t.username&&!t.password&&!t.hash}),resourceTypes:Gr(jj).min(1).max(6),teamId:qr().trim().min(1).max(256).optional(),label:qr().trim().max(256).optional(),secret:qr().min(32).max(1024).optional(),id:qr().uuid().optional()}),Sj=Ur({id:qr().min(1).max(256),enabled:Dr(!0)}),Aj=Ur({id:qr().min(1).max(256),enabled:Fr(),url:qr().url().nullable(),label:qr().max(256).nullable(),resourceTypes:Gr(qr().max(128)).max(64)}),Cj=Ur({webhooks:Ur({nodes:Gr(Aj).max(100),pageInfo:Ur({hasNextPage:Fr(),endCursor:qr().nullable()})})});async function Ej(e){const t=[];let n=null;for(let r=0;r<10;r+=1){const r=await Ij(e,"query OpenSesameWebhooks($after: String) { webhooks(first: 100, after: $after) { nodes { id enabled url label resourceTypes } pageInfo { hasNextPage endCursor } } }",{after:n},Cj);t.push(...r.webhooks.nodes);const i=r.webhooks.pageInfo;if(!i.hasNextPage)return t;if(!i.endCursor||i.endCursor===n)throw new mj("response");n=i.endCursor}throw new mj("response")}const Tj=qr().trim().min(1).max(256),Nj=qr().url().refine(e=>{const t=new URL(e);return"https:"===t.protocol&&"linear.app"===t.hostname&&!t.username&&!t.password}),zj=qr().min(1).max(16384).regex(/^[!-~]+$/),$j=Ur({access_token:zj,refresh_token:zj.optional(),token_type:qr().regex(/^Bearer$/i),expires_in:Vr().int().positive().max(31536e3),scope:Jr([qr().max(2048).transform(e=>e.split(/[\s,]+/)),Gr(Tj).max(64)])});async function Pj(e){const t=await bj("/oauth/token",{headers:{accept:"application/json","content-type":"application/x-www-form-urlencoded"},body:e.toString()}),n=wj($j,t),r={accessToken:n.access_token,expiresAt:Date.now()+1e3*n.expires_in,scopes:[...new Set(n.scope.filter(Boolean))]};return n.refresh_token&&(r.refreshToken=n.refresh_token),r}const Oj=Ur({clientId:Tj,clientSecret:zj.optional()}),Rj=Oj.extend({code:zj,verifier:qr().min(43).max(128).regex(/^[A-Za-z0-9._~-]+$/),redirectUri:qr().url().max(2048)}),Lj=Oj.extend({refreshToken:zj});async function Uj(e){const t=gj(Lj,e),n=new URLSearchParams({grant_type:"refresh_token",client_id:t.clientId,refresh_token:t.refreshToken});return t.clientSecret&&n.set("client_secret",t.clientSecret),Pj(n)}async function Dj(e,t="access_token"){if("oauth"!==e.kind)throw new mj("input");const n=gj(zj,e.token);await bj("/oauth/revoke",{headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({token:n,token_type_hint:t}).toString()},!0)}const qj=Ur({id:Tj,name:Tj,key:Tj}),Mj=Ur({viewer:Ur({id:Tj,name:Tj,email:qr().max(320)}),organization:Ur({id:Tj,name:Tj,urlKey:Tj}),teams:Ur({nodes:Gr(qj).max(1e3)})});async function Kj(e){const t=await Ij(e,"query OpenSesameAccount { viewer { id name email } organization { id name urlKey } teams(first: 100) { nodes { id name key } } }",{},Mj);return{...t,teams:t.teams.nodes}}const Fj=Ur({id:Tj,identifier:Tj,title:qr().min(1).max(1e4),description:qr().max(1e5).nullable(),url:Nj}),Gj="id identifier title description url",Bj=Ur({teamId:Tj,title:qr().trim().min(1).max(1e4),description:qr().max(1e5).optional()}),Vj=Ur({id:Tj,name:Tj,description:qr().max(1e5),url:Nj});function Hj(e){return e instanceof mj&&[400,401].includes(e.status)}async function Jj(e){try{await Dj({kind:"oauth",token:e})}catch(t){if(!(t instanceof Error&&Hj(t)))throw t;try{await Kj({kind:"oauth",token:e})}catch(n){if(n instanceof mj&&"authorization"===n.code)return;throw n}throw t}}async function Wj(e){let t=null;if(e.refreshToken)try{await Dj({kind:"oauth",token:e.refreshToken},"refresh_token")}catch(n){t=n instanceof Error?n:new Error("Linear cleanup failed")}try{await Jj(e.accessToken)}catch(n){t=n instanceof Error?n:new Error("Linear cleanup failed")}if(t)throw t}async function Zj(e,t,n){"kind"in e&&"oauth"!==e.kind||await async function(e,t,n){if(!e.refreshToken)return!1;try{return await Dj({kind:"oauth",token:e.refreshToken},"refresh_token"),!1}catch(i){if(!(i instanceof Error&&Hj(i)))throw i}const r=await async function(e,t){try{return await Uj({clientId:e,refreshToken:t})}catch(i){if(i instanceof mj&&"invalid_grant"===i.oauthError)return null;throw i}}(t,e.refreshToken);return!!r&&(await async function(e,t){try{await(t?.(e))}catch(i){try{await Wj(e)}catch{throw new Error("Linear rotated credentials could not be saved or revoked; revoke this application in Linear Settings")}throw i}}(r,n),await Jj(e.accessToken),await Dj({kind:"oauth",token:r.refreshToken??e.refreshToken},"refresh_token"),await Jj(r.accessToken),!0)}(e,t,n)||await Jj(e.accessToken)}async function Xj(e,t){let n=null,r=null;if(await Pd(e,async(i,a)=>{const o=xd(t),s=_d(i.secrets[o]),c=a[t];if(!s||!c||c.needsReauth)throw new Error(`Authorize the Linear ${t} account first`);if("oauth"!==s.kind||null!==s.expiresAt&&s.expiresAt>Date.now()+6e4)return n={kind:s.kind,token:s.accessToken},i;if(!s.refreshToken)throw new Error("Linear authorization expired; reconnect this account");const l=Ad(e);try{const e=await Uj({clientId:l.state.oauth.clientId,refreshToken:s.refreshToken}),d={...s,...e},u=l.options["app"===t?"appScopes":"userScopes"].some(e=>!d.scopes.includes(e));return u?r=new Error("Linear permissions changed; reconnect this account"):n={kind:"oauth",token:d.accessToken},zd({...i,secrets:{...i.secrets,[o]:JSON.stringify(d)}},{...a,[t]:{...c,grantedScopes:d.scopes,expiresAt:d.expiresAt,needsReauth:u}})}catch(d){if(!(d instanceof mj)||"authorization"!==d.code&&"invalid_grant"!==d.oauthError)throw d;return r=d,zd(i,{...a,[t]:{...c,needsReauth:!0}})}}),r)throw r;if(!n)throw new Error("Linear authorization is unavailable");return n}function Yj(e){const t=jd(e),n="configure"!==t?.recovery?.phase&&Qj(e);return{cleanupNeeded:n,temporaryAdmin:n&&!Ad(e).options.appScopes.includes("admin")}}function Qj(e){const t=jd(e);return!!(t?.recovery||t?.webhook||Ci()[e]?.linear_webhook_intent)}async function e_(e,t=!1){let n=!1;return await Pd(e,async(e,r)=>{if(!r.recovery&&!r.webhook&&!e.secrets.linear_webhook_intent)return e;const i=r.recovery?.workspaceId??r.app?.workspaceId??r.user?.workspaceId;if(!i)throw new Error("The original Linear workspace is required to recover this webhook");return n=!0,zd(e,{...r,app:r.app?{...r.app,needsReauth:!0}:null,recovery:t&&(r.webhook||e.secrets.linear_webhook_intent)?{workspaceId:i,phase:"cleanup"}:r.recovery??{workspaceId:i,phase:"cleanup"}})}),n}async function t_(e){await Pd(e,async(t,n)=>{if(!n.recovery)return t;if("configure"!==n.recovery.phase)throw new Error("Finish Linear webhook cleanup before completing recovery");const r=Ad(e).options;if(r.webhookEnabled&&!n.webhook)throw new Error("Configure the requested Linear webhook before completing recovery");if(!r.webhookEnabled&&n.webhook)throw new Error("Remove the previous Linear webhook before completing recovery");if(t.secrets.linear_webhook_intent)throw new Error("Finish the pending Linear webhook before completing recovery");return n.app?.grantedScopes.includes("admin")&&!r.appScopes.includes("admin")?zd(t,{...n,app:{...n.app,needsReauth:!0}}):zd(t,{...n,recovery:void 0})})}const n_="linear_webhook_intent",r_=Ur({id:qr().uuid(),secret:qr().min(32),fingerprint:qr(),url:qr().url(),resourceTypes:Gr(qr())});function i_(e){try{return r_.parse(JSON.parse(e??""))}catch{return null}}const a_=(e,t)=>JSON.stringify([...e].sort())===JSON.stringify([...t].sort());async function o_(e){await async function(e){const t=jd(e);if("cleanup"===t?.recovery?.phase){if(!t.app||t.app.needsReauth||t.app.workspaceId!==t.recovery.workspaceId)throw new Error("Reconnect the original Linear app account before recovering its webhook");await s_(e),await async function(e){await Pd(e,async(e,t)=>{if(!t.recovery)return e;if(t.webhook||e.secrets.linear_webhook_intent)throw new Error("Finish removing the old Linear webhook before recovering its configuration");return zd(e,{...t,recovery:{...t.recovery,phase:"configure"}})})}(e)}}(e);const t=Ad(e);if(!t.options.webhookEnabled)return void(await t_(e));const n=jd(e),r=t.options.webhookUrl?.trim()??"",i=t.options.webhookResourceTypes;if(n?.webhook?.url===r&&a_(n.webhook.resourceTypes,i))return void(await t_(e));if(n?.webhook)throw new Error("Remove the existing Linear webhook before changing its receiver");const a=Cd(t.state,t.options),o={id:crypto.randomUUID(),secret:[...crypto.getRandomValues(new Uint8Array(32))].map(e=>e.toString(16).padStart(2,"0")).join(""),fingerprint:a,url:r,resourceTypes:i};let s=!1,c=o;await Pd(e,async t=>{const n=i_(t.secrets[n_]);if(n){if(n.fingerprint!==a)throw new Error("Finish or remove the previous webhook setup before editing this connector");return c=n,s=!0,t}if(Cd(Ad(e).state,Ad(e).options)!==a)throw new Error("Linear configuration changed; retry webhook setup");return{...t,secrets:{...t.secrets,[n_]:JSON.stringify(o)}}});const l=await Xj(e,n?.app?"app":"user");await async function(e,t,n,r){const i=async()=>{const n=(await Ej(e)).find(e=>e.id===t.id);if(n&&(!n.enabled||n.url!==t.url||!a_(n.resourceTypes,t.resourceTypes)))throw new Error("Linear webhook does not match this configuration");return!!n};let a=n&&await i();if(!a)try{const n=await async function(e,t){const n=gj(_j,t),r={...n,resourceTypes:[...new Set(n.resourceTypes)]};return n.teamId||(r.allPublicTeams=!0),(await Ij(e,"mutation OpenSesameWebhook($input: WebhookCreateInput!) { webhookCreate(input: $input) { success webhook { id enabled } } }",{input:r},Ur({webhookCreate:Ur({success:Dr(!0),webhook:Sj})}))).webhookCreate.webhook}(e,{...t,label:r});if(n.id!==t.id||!n.enabled)throw new Error("Linear did not enable the requested webhook");a=!0}catch(o){if(!(await i()))throw o;a=!0}if(!a)throw new Error("Linear did not register this webhook")}(l,c,s,t.state.name),await Pd(e,async(t,n)=>{const o=Ad(e);if(Cd(o.state,o.options)!==a)throw new Error("Linear configuration changed; retry webhook setup");if(n.webhook?.id===c.id)return t;if(n.webhook)throw new Error("A different webhook was configured in another tab");const s={...t.secrets,linear_webhook_secret:c.secret};return Reflect.deleteProperty(s,n_),zd({...t,secrets:s},{...n,webhook:{id:c.id,url:r,resourceTypes:i}})}),await t_(e)}async function s_(e,t,n){t?.();const r=jd(e),i=i_(Ci()[e]?.[n_]),a=r?.webhook?.id??i?.id;if(!a)return;const o=n??await Xj(e,r?.app?"app":"user");await Pd(e,async(e,n)=>{if(t?.(),n.webhook&&n.webhook.id!==a)throw new Error("Linear webhook changed in another tab; reload before editing");const r=async()=>(await Ej(o)).some(e=>e.id===a);if(await r())try{await async function(e,t){const n=gj(qr().trim().min(1).max(256),t);await Ij(e,"mutation OpenSesameDeleteWebhook($id: String!) { webhookDelete(id: $id) { success } }",{id:n},Ur({webhookDelete:Ur({success:Dr(!0)})}))}(o,a)}catch(s){if(await r())throw s}const i={...e.secrets};return Reflect.deleteProperty(i,"linear_webhook_secret"),Reflect.deleteProperty(i,n_),zd({...e,secrets:i},{...n,webhook:null})})}async function c_(e,t,n){await hj(e,t,()=>async function(e,t,n){const r=xd(t),i=oj(t);let a="",o=[];await Pd(e,async(e,s)=>{n?.(),a=e.secrets[r]??"";const c=_d(a);if(o=lj([...cj(e.secrets[i]),...c?[c]:[]]),!o.length)return e;const l=s[t];return zd({...e,secrets:{...e.secrets,[i]:JSON.stringify(o)}},{...s,[t]:l?{...l,needsReauth:!0}:null})});for(const s of o){const r=new Set([sj(s)]);n?.(),await Zj(s,Ad(e).state.oauth.clientId,async n=>{const i={kind:"oauth",...n};await dj(e,t,i),r.add(sj(i))}),await uj(e,t,r)}await Pd(e,async(e,i)=>{if(n?.(),(e.secrets[r]??"")!==a)throw new Error("Linear authorization changed during cleanup; credentials were retained");const o={...e.secrets};return Reflect.deleteProperty(o,r),zd({...e,secrets:o},{...i,[t]:null})})}(e,t,n))}async function l_(e){const t=Si().find(t=>t.connectionId===e)?.fields.self_hosted_configuration,n=Ci()[e]?.linear_pending;await s_(e);for(const r of["app","user"])await c_(e,r);if(!(await Ti(e,e=>{const r=Id(e.row.fields.linear_authorization);if(e.row.fields.self_hosted_configuration!==t||e.secrets.linear_pending!==n||e.secrets.linear_app_grant||e.secrets.linear_user_grant||e.secrets.linear_cleanup_app||e.secrets.linear_cleanup_user||e.secrets.linear_webhook_intent||r.webhook)throw new Error("Linear configuration changed during disconnect; credentials were retained")})))throw new Error("Saved Linear connector not found")}const d_={version:1,providers:{linear:{fields:[{name:"workspace",label:"Linear workspace",placeholder:"Your Linear workspace name or ID",required:!0}],appScopeDefaults:["read","write","issues:create","comments:create"],userScopeDefaults:["read","write"],webhookResourceTypes:[{name:"Issue",description:"Issues",default:!0},{name:"Comment",description:"Issue comments",default:!0},{name:"IssueLabel",description:"Issue labels",default:!1},{name:"Project",description:"Projects",default:!1},{name:"Cycle",description:"Cycles",default:!1},{name:"Reaction",description:"Comment reactions",default:!1}],sources:["https://linear.app/developers/oauth-2-0-authentication","https://linear.app/developers/webhooks"]}}},u_=Ur({name:qr().min(1),description:qr(),default:Fr()}).strict(),p_=Ur({name:qr().regex(/^[a-z][a-zA-Z0-9]*$/),label:qr().min(1),placeholder:qr(),required:Fr()}).strict(),h_=e=>new Set(e.map(e=>e.name)).size===e.length,f_=Gr(qr().min(1)).refine(e=>new Set(e).size===e.length),m_=Ur({fields:Gr(p_).refine(h_).default([]),appScopeDefaults:f_.optional(),userScopeDefaults:f_.optional(),webhookResourceTypes:Gr(u_).refine(h_).default([]),sources:Gr(Xr().refine(e=>e.startsWith("https://")))}).strict(),g_=Ur({version:Dr(1),providers:Br(qr(),m_)}).strict().superRefine((e,t)=>{for(const[n,r]of Object.entries(e.providers)){const e=Oa(n);if(!e){t.addIssue({code:"custom",path:["providers",n],message:"Unknown connector plan"});continue}const i=new Set(v_(e).map(e=>e.name));for(const a of["appScopeDefaults","userScopeDefaults"])for(const e of r[a]??[])i.has(e)||t.addIssue({code:"custom",path:["providers",n,a],message:`Unknown OAuth scope: ${e}`})}});let w_;function v_(e){const t=e.methods.find(e=>"oauth"===e.kind&&e.preset);return"oauth"===t?.kind?t.preset?.scopes??[]:[]}function y_(e,t){return e.map(e=>({...e,default:t?t.includes(e.name):e.default}))}function b_(e){if(!e||e.refused)return;w_??=g_.parse(d_);const t=w_.providers[e.id],n=v_(e);return{fields:(t?.fields??[]).map(e=>({...e})),appScopes:y_(n,t?.appScopeDefaults),userScopes:t?.userScopeDefaults?y_(n,t.userScopeDefaults):[],webhookResourceTypes:(t?.webhookResourceTypes??[]).map(e=>({...e})),docsUrl:e.docsUrl}}function k_(e){return e.filter(e=>e.default).map(e=>e.name)}const x_="self_hosted_configuration";function I_(e){return!!e&&Si().some(t=>t.connectionId===e.connectionId&&void 0!==t.fields[x_])}function j_(e){const t=Si().find(t=>t.connectionId===e),n=t?.fields[x_];if(!n)return null;try{const t=md.safeParse(JSON.parse(n));if(!t.success)return null;const r=function(e){return{...e,key:"",mcpClientSecret:"",oauth:{...e.oauth,clientSecret:""}}}(t.data.state),i=function(e){switch(e.method){case"oauth":return"none"===e.oauth.tokenAuth?null:"oauth_client_secret";case"api-key":return"api_key";case"mcp":return"manual"===e.mcpRegistration?"mcp_client_secret":null;case"managed":return null}}(r);return{state:r,options:t.data.options,hasCredential:null!==i&&!!Ci()[e]?.[i]}}catch{return null}}function __(e){return"github_app"===e.kind&&null===e.lastSyncedAt}function S_(e){return e.enabled?"error"===e.status||"suspended"===e.status?"err":__(e)?"warn":"ok"===e.status?"ok":"warn":"idle"}function A_(e,t){if(!e.enabled)return"Backup off";if(e.lastError)return e.lastError;if(__(e))return"Automatic backups have not started";const n=e.lastSyncedAt?`Last sync ${e.lastSyncedAt}`:"Waiting for first sync";return t>0?`${n} · ${t} pending`:n}function C_({providerId:e="github"}){const{target:t,setTarget:n,pending:r,setPending:i,busy:a,setBusy:o,flash:s,setFlash:c}=function(e){const[t,n]=Ce.useState(null),[r,i]=Ce.useState(0),[a,o]=Ce.useState(!1),[s,c]=Ce.useState(null);return Ce.useEffect(()=>{const t=ms();let r=!0;const a=()=>{Ui(e).then(t=>{if(!r)return;const a=t.target;a&&function(e,t){return e.providerId===t||"github_app"===e.kind&&"github"===t}(a,e)?(n(a),i(t.pendingEvents)):(n(null),i(0))}).catch(()=>{r&&c("err")})};a();const o=Xt(a);return()=>{r=!1,o(),t()}},[e]),{target:t,setTarget:n,pending:r,setPending:i,busy:a,setBusy:o,flash:s,setFlash:c}}(e);if(!t)return null;const l=__(t),d=()=>{!a&&t.enabled&&(o(!0),c(null),Li(e).then(()=>(c("ok"),Ui(e))).then(e=>{e.target&&n(e.target),i(e.pendingEvents)}).catch(()=>(c("err"),Ui(e).then(e=>{e.target&&n(e.target),i(e.pendingEvents)}))).finally(()=>o(!1)))},u=t.owner&&t.repo?`${t.owner}/${t.repo}`:null;return Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"conn-github-fact","data-testid":"backup-sync-controls",children:[Ee.jsx("span",{className:"conn-github-presence__k",children:"Sync"}),Ee.jsxs("span",{className:"conn-backup-sync",children:[Ee.jsx(Oe,{tone:S_(t),label:A_(t,r)}),u?Ee.jsx("span",{className:"conn-backup-sync__repo",children:u}):null,l?null:Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm",disabled:a||!t.enabled,"aria-busy":a||void 0,"aria-label":"Sync vault backup now",title:"Sync vault backup now",onClick:d,children:Ee.jsx(V,{size:16})}),"ok"===s?Ee.jsx(Oe,{tone:"ok",label:"Synced"}):"err"===s?Ee.jsx(Oe,{tone:"err",label:"Sync failed"}):null]})]}),"github_app"===t.kind?Ee.jsx(T_,{providerId:e,enabled:t.enabled},e):null,l?Ee.jsx(E_,{busy:a,enabled:t.enabled,onBackup:d}):null]})}function E_({busy:e,enabled:t,onBackup:n}){return Ee.jsxs("section",{className:"cx-block cx-form","aria-label":"Choose backup direction",children:[Ee.jsx("p",{children:"Recovering this vault? Read and restore its encrypted backup first. Backing up this vault replaces the repository's backup. Automatic updates start after a successful manual backup."}),Ee.jsx(U,{label:"Back up this vault and enable automatic backups",disabled:e||!t,busy:e,icon:Ee.jsx(V,{size:18}),onClick:n})]})}function T_({providerId:e,enabled:t}){const{handle:n,busy:r,failure:i,setFailure:a,close:o,open:s}=function(e){const t=Ce.useRef(null),[n,r]=Ce.useState(null),[i,a]=Ce.useState(!1),[o,s]=Ce.useState("");Ce.useEffect(()=>()=>{const e=t.current;t.current=null,e?.abort()},[]);const c=()=>{const e=t.current;t.current=null,e?.abort(),r(null),a(!1)};return{handle:n,busy:i,failure:o,setFailure:s,close:c,open:()=>{c(),s("");const n=new AbortController;t.current=n;const i=()=>{if(n.signal.throwIfAborted(),t.current!==n)throw new DOMException("This restore ended.","AbortError")};a(!0),gs(e,{signal:n.signal,assertCurrent:i}).then(e=>{i(),e.backend.signal?.addEventListener("abort",()=>{t.current===n&&c()},{once:!0}),r(e)}).catch(()=>{n.signal.aborted||s("The encrypted GitHub backup could not be read.")}).finally(()=>{t.current===n&&a(!1)})}}}(e);return Ee.jsxs(Ee.Fragment,{children:[n?Ee.jsx(Qk,{handle:n,fixedReference:"opensesame-vault.backup.json",onFlash:e=>{"err"===e.tone&&a(e.text)}}):Ee.jsx(U,{label:"Read encrypted vault backup",disabled:r||!t,busy:r,icon:Ee.jsx(D,{size:18}),onClick:s,children:i?Ee.jsx(Oe,{tone:"err",label:i}):null}),r||n?Ee.jsx(U,{label:"Close encrypted backup",icon:Ee.jsx(H,{size:18}),onClick:o}):null,n?null:Ee.jsx(q,{id:`github-backup-read-${e}`,title:"Read encrypted vault backup",message:i})]})}const N_={readAwsKmsConfig:Qi,writeAwsKmsConfig:ta,clearAwsKmsConfig:ea};function z_(e){return{keyArn:e.keyArn,region:e.region,accessKeyId:e.accessKeyId,secretAccessKey:"",sessionToken:e.sessionToken??"",label:e.label??""}}function $_({configured:e,enrolled:t,label:n}){return Ee.jsxs("div",{className:"conn-aws-kms__status",children:[Ee.jsx(Oe,{tone:e?"ok":"idle",label:e?n||"AWS KMS sealed":"No AWS KMS credentials sealed yet"}),t?Ee.jsx(Oe,{tone:"ok",label:"Protects this vault's key"}):null,e?Ee.jsx(Oe,{tone:"ok",label:"Secret access key sealed"}):null]})}function P_({onFlash:e}){const t=function(e){const{status:t,guest:n,tomb:r,header:i}=Ot(),a="unlocked"===t&&!n&&Boolean(r),[o,s]=Ce.useState(Xi),[c,l]=Ce.useState(null),[d,u]=Ce.useState(!1),p=Boolean(c?.keyArn&&c.secretAccessKey),h=c?Yi(c):null,f=Boolean(c?.keyArn&&i?.protection?.records.some(e=>"aws-kms"===e.kind&&e.keyArn===c.keyArn));return Ce.useEffect(()=>{if(!a||!r)return l(null),void s(Xi());let e=!1;return N_.readAwsKmsConfig(r).then(t=>{e||(l(t.keyArn?t:null),s(z_(t)))}),()=>{e=!0}},[a,r]),{unlocked:a,form:o,busy:d,enrolled:f,configured:p,statusLabel:h?.label||h?.accessKeyId||null,setField:(e,t)=>{s(n=>({...n,[e]:t}))},save:async function(t){if(t.preventDefault(),r)if(f&&o.keyArn.trim()!==c?.keyArn)e({tone:"err",text:"A vault protector wraps with this key. Remove the protector before changing the key ARN."});else{u(!0);try{const t=await N_.writeAwsKmsConfig(r,{...o,keepExistingSecret:p});l(t),s(z_(t)),e({tone:"ok",text:"AWS KMS credentials sealed on this device."})}catch(n){e({tone:"err",text:Ia(n)})}finally{u(!1)}}else e({tone:"warn",text:"Unlock a vault to seal AWS KMS."})},forget:async function(){if(r){u(!0);try{await N_.clearAwsKmsConfig(r),l(null),s(Xi()),e({tone:"ok",text:"AWS KMS configuration removed."})}catch(t){e({tone:"err",text:Ia(t)})}finally{u(!1)}}}}}(e);return t.unlocked?Ee.jsxs("div",{className:"panel__body",children:[Ee.jsx($_,{configured:t.configured,enrolled:t.enrolled,label:t.statusLabel}),Ee.jsxs("form",{className:"conn-tile__body",onSubmit:e=>{t.save(e)},children:[Ee.jsx(na,{form:t.form,configured:t.configured,identityLocked:t.enrolled,onChange:t.setField}),Ee.jsx(U,{label:t.busy?"Saving AWS KMS":"Save AWS KMS",disabled:t.busy,children:t.enrolled||!t.configured?null:Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm",disabled:t.busy,"aria-label":"Remove AWS KMS configuration",title:"Remove AWS KMS configuration",onClick:()=>{t.forget()},children:Ee.jsx(F,{size:16})})})]})]}):Ee.jsx("div",{className:"panel__body",children:Ee.jsx(Oe,{tone:"warn",label:"Unlock a vault to configure AWS KMS on this device."})})}const O_={readGcpKmsConfig:aa,writeGcpKmsConfig:sa,clearGcpKmsConfig:oa};function R_(e){return{keyName:e.keyName,projectId:e.projectId,serviceAccountJson:"",label:e.label??""}}function L_({configured:e,enrolled:t,label:n}){return Ee.jsxs("div",{className:"conn-gcp-kms__status",children:[Ee.jsx(Oe,{tone:e?"ok":"idle",label:e?n||"Google Cloud KMS sealed":"No Google Cloud KMS credentials sealed yet"}),t?Ee.jsx(Oe,{tone:"ok",label:"Protects this vault's key"}):null,e?Ee.jsx(Oe,{tone:"ok",label:"Service account sealed"}):null]})}function U_({onFlash:e}){const t=function(e){const{status:t,guest:n,tomb:r,header:i}=Ot(),a="unlocked"===t&&!n&&Boolean(r),{form:o,setForm:s,saved:c,setSaved:l}=function(e,t){const[n,r]=Ce.useState(ia),[i,a]=Ce.useState(null);return Ce.useEffect(()=>{if(!e||!t)return a(null),void r(ia());let n=!1;return O_.readGcpKmsConfig(t).then(e=>{n||(a(e.keyName?e:null),r(R_(e)))}),()=>{n=!0}},[e,t]),{form:n,setForm:r,saved:i,setSaved:a}}(a,r),[d,u]=Ce.useState(!1),p=Boolean(c?.keyName&&c.serviceAccountJson),h=c?ra(c):null,f=Boolean(c?.keyName&&i?.protection?.records.some(e=>"gcp-kms"===e.kind&&e.keyName===c.keyName));return{unlocked:a,form:o,busy:d,enrolled:f,configured:p,statusLabel:h?.label||h?.projectId||null,setField:(e,t)=>{s(n=>({...n,[e]:t}))},save:async function(t){if(t.preventDefault(),r)if(f&&o.keyName.trim()!==c?.keyName)e({tone:"err",text:"A vault protector wraps with this key. Remove the protector before changing the crypto key."});else{u(!0);try{const t=await O_.writeGcpKmsConfig(r,{...o,keepExistingSecret:p});l(t),s(R_(t)),e({tone:"ok",text:"Google Cloud KMS credentials sealed on this device."})}catch(n){e({tone:"err",text:Ia(n)})}finally{u(!1)}}else e({tone:"warn",text:"Unlock a vault to seal Google Cloud KMS."})},forget:async function(){if(r){u(!0);try{await O_.clearGcpKmsConfig(r),l(null),s(ia()),e({tone:"ok",text:"Google Cloud KMS configuration removed."})}catch(t){e({tone:"err",text:Ia(t)})}finally{u(!1)}}}}}(e);return t.unlocked?Ee.jsxs("div",{className:"panel__body",children:[Ee.jsx(L_,{configured:t.configured,enrolled:t.enrolled,label:t.statusLabel}),Ee.jsxs("form",{className:"conn-tile__body",onSubmit:e=>{t.save(e)},children:[Ee.jsx(ca,{form:t.form,configured:t.configured,identityLocked:t.enrolled,onChange:t.setField}),Ee.jsx(U,{label:t.busy?"Saving Google Cloud KMS":"Save Google Cloud KMS",disabled:t.busy,children:t.enrolled||!t.configured?null:Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm",disabled:t.busy,"aria-label":"Remove Google Cloud KMS configuration",title:"Remove Google Cloud KMS configuration",onClick:()=>{t.forget()},children:Ee.jsx(F,{size:16})})})]})]}):Ee.jsx("div",{className:"panel__body",children:Ee.jsx(Oe,{tone:"warn",label:"Unlock a vault to configure Google Cloud KMS on this device."})})}const D_={"aws-kms":e=>Ee.jsx(P_,{onFlash:e}),"gcp-kms":e=>Ee.jsx(U_,{onFlash:e})};function q_({provider:e,online:t,canConfigure:n,configureHint:r,authorizeRef:i,onFlash:a,onChanged:o,onRememberOffer:s}){const c=ja(),l=function(e){switch(e){case"aws-kms":case"gcp-kms":return D_[e];default:return}}(e.id);let d=null;return l?d=c.acts(e)?l(a):null:n?ss(e)&&(d=Ee.jsx(Rl,{provider:e,online:t,onFlash:a,onConnected:o,onRememberOffer:s},e.id)):d=Ee.jsx("div",{className:"panel__body",children:Ee.jsx("p",{className:"hint",title:r,children:"Not configured."})}),null===d?null:Ee.jsxs("section",{className:"panel",id:"authorization",ref:i,children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsx("h2",{children:"Connect"})}),d]})}const M_="opensesame-passwords";function K_(e,t,n){const r=function(e,t){const n=e.trim().toLowerCase();if(!n||n.endsWith("/"))return null;const r=t.find(e=>e.toLowerCase()===n);if(r)return r;if(n.includes("/"))return null;const i=t.filter(e=>e.split("/")[1]?.toLowerCase()===n);return 1===i.length?i[0]??null:null}(e,t.map(e=>e.fullName));if(r){const e=t.find(e=>e.fullName===r);if(e)return{kind:"existing",choice:e}}const i=Di(e);if(i){const e=n.find(e=>e.accountLogin.toLowerCase()===i.owner.toLowerCase());if(!e)return{kind:"invalid",message:"Pick a repository under an account where the App is installed."};const r=G_(i.repo);if(!r)return{kind:"invalid",message:"Repository name is not valid."};const a=`${i.owner}/${r}`.toLowerCase(),o=t.find(e=>e.fullName.toLowerCase()===a);return o?{kind:"existing",choice:o}:{kind:"create",account:e,name:r}}const a=G_(e);if(!a)return{kind:"invalid",message:"Repository name is not valid."};const o=n[0];return o?{kind:"create",account:o,name:a}:{kind:"invalid",message:"Install the GitHub App, then choose a repository."}}function F_(e){const t=e.replace(/[^A-Za-z0-9._/-]/gu,""),n=t.indexOf("/");if(-1===n)return H_(t).slice(0,100);const r=H_(t.slice(0,n)).slice(0,39),i=H_(t.slice(n+1).replace(/\//gu,"")).slice(0,100);return t.endsWith("/")&&""===i?`${r}/`:`${r}/${i}`}function G_(e){const t=e.includes("/")?e.slice(e.indexOf("/")+1):e;return/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/u.test(t)?t.endsWith(".")||t.toLowerCase().endsWith(".git")?null:t:null}function B_(e){return Boolean(e?.enabled&&""!==e.repo)}function V_(e){const t=new Set,n=[];for(const r of e){const e=r.fullName.toLowerCase();r.fullName&&!t.has(e)&&(t.add(e),n.push(r))}return n}function H_(e){return e.replace(/^[.-]+/u,"").replace(/\.git$/iu,"")}function J_({state:e,inputId:t,listId:n,open:r,active:i,suggestions:a,skipBlur:o,setOpen:s,setActive:c,setFilter:l,choose:d}){return Ee.jsxs("div",{className:"conn-repo-combobox",children:[Ee.jsx(q,{id:`github-backup:repo-list:${e.connectionId}`,title:"Repositories",message:e.listError}),Ee.jsx(W_,{state:e,inputId:t,listId:n,open:r,active:i,suggestions:a,skipBlur:o,setOpen:s,setActive:c,setFilter:l,choose:d}),Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm conn-repo-combobox__toggle","aria-label":"Show repositories",title:"Show repositories","aria-expanded":r,"aria-controls":n,"data-testid":"github-repo-toggle",disabled:!e.online||e.busy,onMouseDown:e=>{e.preventDefault(),o.current=!0},onClick:()=>{l(e=>(s(t=>!t||""!==e),""))},children:Ee.jsx(te,{size:14,className:"conn-repo-combobox__caret"+(r?" is-open":"")})}),r?Ee.jsx(Z_,{listId:n,suggestions:a,active:i,loading:e.loading,listError:e.listError,skipBlur:o,setActive:c,choose:d}):null]})}function W_({state:e,inputId:t,listId:n,open:r,active:i,suggestions:a,skipBlur:o,setOpen:s,setActive:c,setFilter:l,choose:d}){const u=r&&a[i]?`${n}-${i}`:null;return Ee.jsx("input",{id:t,name:"repository",role:"combobox","aria-label":"Repository","aria-autocomplete":"list","aria-expanded":r,"aria-controls":n,...null===u?{}:{"aria-activedescendant":u},"data-testid":"github-repo-input",value:e.draft,placeholder:e.accounts[0]?`${e.accounts[0].accountLogin}/${M_}`:"owner/repo",disabled:!e.online||e.busy,spellCheck:!1,autoCapitalize:"off",autoCorrect:"off","aria-invalid":!(!e.issue&&!e.listError)||void 0,onChange:t=>{const n=F_(t.target.value);e.setIssue(null),e.setDraft(n),l(n),s(!0),c(0)},onFocus:()=>{e.beginDraft(),s(!0)},onBlur:()=>{o.current?o.current=!1:(s(!1),e.commit(F_(e.draft)))},onKeyDown:t=>function(e,t){if("Escape"===e.key)return e.preventDefault(),t.skipBlur.current=!0,t.setOpen(!1),t.setIssue(null),void(t.bound&&(t.setDraft(t.selected),t.setEditing(!1)));if("ArrowDown"===e.key)return e.preventDefault(),t.setOpen(!0),void t.setActive(e=>0===t.suggestions.length?0:Math.min(e+1,t.suggestions.length-1));if("ArrowUp"===e.key)return e.preventDefault(),void t.setActive(e=>Math.max(e-1,0));if("Enter"!==e.key)return;e.preventDefault();const n=t.suggestions[t.active];if(t.open&&n)return t.skipBlur.current=!0,void t.choose(n.value);t.choose(F_(e.currentTarget.value))}(t,{open:r,setOpen:s,active:i,setActive:c,suggestions:a,skipBlur:o,bound:e.bound,selected:e.selected,setDraft:e.setDraft,setEditing:e.setEditing,setIssue:e.setIssue,choose:d})})}function Z_({listId:e,suggestions:t,active:n,loading:r,listError:i,skipBlur:a,setActive:o,choose:s}){return Ee.jsx("div",{role:"listbox",id:e,className:"conn-repo-combobox__list","data-testid":"github-repo-list",children:0===t.length?Ee.jsx("div",{className:"conn-repo-combobox__empty",role:"presentation",children:r||null===i?r?"Loading…":"No matching repositories":Ee.jsx(Oe,{tone:"err",label:i})}):t.map((t,r)=>function(e,t,n,r,i,a,o){return Ee.jsx("div",{role:"option",id:`${n}-${t}`,className:t===r?"conn-repo-combobox__option is-active":"conn-repo-combobox__option","aria-selected":t===r,onMouseDown:t=>{t.preventDefault(),i.current=!0,o(e.value)},onMouseEnter:()=>a(t),children:e.label},`${e.kind}:${e.value}`)}(t,r,e,n,a,o,s))})}function X_({state:e}){const t=Ce.useId(),n=Ce.useId(),r=Ce.useRef(null),[i,a]=Ce.useState(!1),[o,s]=Ce.useState(0),[c,l]=Ce.useState(""),d=Ce.useRef(!1),u=Ce.useMemo(()=>function(e){const t=e.filter.trim().toLowerCase(),n=e.repos.filter(e=>!t||e.fullName.toLowerCase().includes(t)).map(e=>({kind:"existing",value:e.fullName,label:e.fullName}));if(e.listError)return n;const r=new Set(n.map(e=>e.value.toLowerCase())),i=[],a=K_(e.draft,e.repos,e.accounts);if("create"===a.kind){const e=`${a.account.accountLogin}/${a.name}`;r.has(e.toLowerCase())||(i.push({kind:"create",value:e,label:`New · ${e}`}),r.add(e.toLowerCase()))}for(const o of e.accounts){const e=`${o.accountLogin}/${M_}`;r.has(e.toLowerCase())||t&&!e.toLowerCase().includes(t)||(i.push({kind:"create",value:e,label:`New · ${e}`}),r.add(e.toLowerCase()))}return[...n,...i]}({draft:e.draft,filter:c,repos:e.repos,accounts:e.accounts,listError:e.listError}),[e.draft,c,e.repos,e.accounts,e.listError]);return function(e,t,n){Ce.useEffect(()=>{if(e)return document.addEventListener("mousedown",r),()=>document.removeEventListener("mousedown",r);function r(e){const r=e.target;r instanceof Node&&(t.current?.contains(r)||n(!1))}},[e,t,n])}(i,r,a),Ee.jsxs("div",{className:"conn-repo-field","data-testid":"github-repo-editor",ref:r,children:[Ee.jsxs("div",{className:"conn-card__repo",children:[Ee.jsx(J_,{state:e,inputId:n,listId:t,open:i,active:o,suggestions:u,skipBlur:d,setOpen:a,setActive:s,setFilter:l,choose:t=>async function(e,t,n,r){const i=F_(t);e.setIssue(null),e.setDraft(i),n(""),r(!1),await e.commit(i)}(e,t,l,a)}),Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Refresh repositories",title:"Refresh repositories","data-testid":"github-repo-refresh",disabled:!e.online||e.busy||e.loading,onClick:()=>{e.reload()},children:Ee.jsx(V,{size:16})})]}),Ee.jsx(Y_,{state:e})]})}function Y_({state:e}){return Ee.jsxs(Ee.Fragment,{children:[e.issue?Ee.jsx(Oe,{tone:"err",label:e.issue}):null,e.listError?Ee.jsx(Oe,{tone:"err",label:e.listError}):null,e.online?null:Ee.jsx(Oe,{tone:"warn",label:"Connect online to choose a repository"}),!e.online||e.loading||e.listError||0!==e.repos.length||0!==e.accounts.length?null:Ee.jsx(Oe,{tone:"warn",label:"Install the GitHub App, then choose a repository"})]})}const Q_=Ur({appId:qr().min(1).max(128),pem:qr().min(1).max(65536)}),eS=Ur({id:Vr().int().positive().safe(),name:qr().min(1).max(100),full_name:qr().min(3).max(150),private:Fr(),default_branch:qr().min(1).max(255),owner:Ur({login:qr().min(1).max(39)}),archived:Fr().optional(),disabled:Fr().optional()});function tS(){throw new oo("response","GitHub returned an unexpected repository response.")}function nS(e){return/^[1-9]\d*$/.test(e.id)&&Number.isSafeInteger(Number(e.id))||tS(),Number(e.id)}async function rS(e,t,n){const r=await Co(e.credentials.appId,e.credentials.pem,e.transport),i={metadata:"read"};n&&(i.administration="write");const a=await Ao(e.transport,`/app/installations/${nS(t)}/access_tokens`,{method:"POST",token:r,body:{permissions:i}}),o=Ur({token:qr().min(1).max(4096),expires_at:qr().datetime()}).safeParse(a);return(!o.success||Date.parse(o.data.expires_at)<=Date.now())&&tS(),_o(e.transport),o.data.token}function iS(e,t){return(e.owner.login.toLowerCase()!==t.accountLogin.toLowerCase()||e.full_name.toLowerCase()!==`${e.owner.login}/${e.name}`.toLowerCase()||e.archived||e.disabled)&&tS(),So(e.name),{fullName:e.full_name,name:e.name,private:e.private,defaultBranch:e.default_branch,installationId:t.id,accountLogin:t.accountLogin,accountType:t.accountType}}async function aS(e,t){const n=await rS(e,t,!1),r=[];let i=0;for(let a=1;a<=10;a++){const o=await Ao(e.transport,`/installation/repositories?per_page=100&page=${a}`,{method:"GET",token:n}),s=Ur({total_count:Vr().int().nonnegative().safe(),repositories:Gr(eS).max(100)}).safeParse(o);s.success||tS();for(const e of s.data.repositories){if(e.archived||e.disabled)continue;const n=iS(e,t);e.private&&r.push(n)}if(i+=s.data.repositories.length,i>s.data.total_count&&tS(),i===s.data.total_count)return r;s.data.repositories.length<100&&tS()}throw new oo("response","GitHub returned too many repositories to list in this operation.")}const oS=Ur({installationId:qr(),owner:qr().regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/),name:qr().min(1).max(100),accountType:qr()});function sS(e,t){const n=yi(e.fullName)??yi(e.full_name)??"",r=yi(e.name)??"";return n&&r?{fullName:n,name:r,private:!1!==e.private,defaultBranch:yi(e.defaultBranch)||"main",installationId:t.installationId,accountLogin:t.accountLogin,accountType:yi(e.accountType)||t.accountType}:null}const cS=function(){const e=lo(),t=e?so(e):null;return e?.id&&t&&0!==e.installations.length?{appId:e.id,pem:t,installs:e.installations.map(e=>({installationId:e.id,accountLogin:e.accountLogin,accountType:e.accountType}))}:null},lS=async function(e,t){let n=null;try{n=function(e){const t=lo();(!t||t.id!==e.appId||so(t)!==e.pem||t.installations.length>100)&&tS();const n=Bt({...t}),r=t.installations.map(e=>({...e})),i=co({binding:()=>{const t=lo();return null!==t&&Bt({...t})===n&&so(t)===e.pem}}),a=globalThis.fetch;return{transport:{signal:i.transport.signal,assertCurrent:i.transport.assertCurrent,fetch:(e,t)=>(i.transport.assertCurrent(),a.call(globalThis,e,t))},installs:r,credentials:{...e},close:i.close}}(Q_.parse(t));const r="/api/github-app/installation-repos"===e?await async function(e){const t=[];let n=null;for(const r of e.installs)try{t.push(...await aS(e,r))}catch{_o(e.transport),n="GitHub could not list every installation's repositories."}return{repositories:t,error:n}}(n):"/api/github-app/create-repo"===e?await async function(e,t){So(t.name);const{install:n,accountType:r}=await async function(e,t){const n=e.installs.find(e=>e.id===t.installationId);n&&n.accountLogin.toLowerCase()===t.owner.toLowerCase()||tS();const r=await Co(e.credentials.appId,e.credentials.pem,e.transport),i=Ur({id:Vr().int().positive().safe(),account:Ur({login:qr(),type:Mr(["User","Organization"])})}).safeParse(await Ao(e.transport,`/app/installations/${nS(n)}`,{method:"GET",token:r}));return(!i.success||i.data.id!==nS(n)||i.data.account.login.toLowerCase()!==t.owner.toLowerCase()||t.accountType&&t.accountType!==i.data.account.type)&&tS(),{install:n,accountType:i.data.account.type}}(e,t),i=await rS(e,n,!0),a="Organization"===r?`/orgs/${encodeURIComponent(t.owner)}/repos`:"/user/repos",o=eS.safeParse(await Ao(e.transport,a,{method:"POST",token:i,body:{name:t.name,private:!0,auto_init:!0}}));o.success&&o.data.private&&o.data.name===t.name||tS(),iS(o.data,n);const s=eS.safeParse(await Ao(e.transport,`/repos/${encodeURIComponent(t.owner)}/${encodeURIComponent(t.name)}`,{method:"GET",token:i}));return s.success&&s.data.id===o.data.id&&s.data.private&&s.data.name===t.name&&s.data.default_branch===o.data.default_branch||tS(),_o(e.transport),{repository:iS(s.data,{...n,accountType:r})}}(n,oS.parse(t)):tS();return _o(n.transport),{ok:!0,status:200,payload:r}}catch(r){return{ok:!1,status:r instanceof oo&&"authorization"===r.code?403:502,payload:{message:r instanceof oo?r.message:"The GitHub repository operation did not complete."}}}finally{n?.close()}};function dS(e){return/host/i.test(e)?"Could not save the repository.":e}async function uS(e,t){if(e.online){e.onBusy(!0),e.onIssue(null);try{const n=Di(t.fullName);if(!n)throw new Error("Repository name is not valid.");const r=await Oi(function(e,t,n){const r={installationId:t.installationId,owner:n.owner,repo:n.repo,branch:"main",enabled:!0};return"local-github-app"===e.connectionId?r:e.integrationId?{...r,connectionId:e.connectionId,integrationId:e.integrationId}:{...r,connectionId:e.connectionId}}(e.connection,t,n));e.onBound(r),e.onReady?.(!0),e.onFlash({tone:"ok",text:`${r.owner}/${r.repo}`})}catch(n){e.onIssue(n instanceof Error?dS(n.message):"Could not save the repository.")}finally{e.onBusy(!1)}}else e.onIssue("Connect online to save the repository.")}function pS({connection:e,online:t,onFlash:n,onReady:r,seedAccounts:i=[],seedRepos:a=[]}){const o=function(e,t,n,r,i=[],a=[]){const o=function(e){const t=JSON.stringify([e.connectionId,e.connectionRef,e.providerId,e.integrationId,e.accountLabel]),n=Ce.useRef(null),r=Ce.useMemo(()=>{const e={scope:t,draftOwned:!1,sequence:0,live:!1,flight:{current:!1},current:()=>n.current===e&&e.live};return e},[t]);return n.current=r,Ce.useLayoutEffect(()=>(r.live=!0,()=>{r.live=!1,r.sequence++}),[r]),r}(e),s=function(e,t){const[n,r]=Ce.useState(null),[i,a]=Ce.useState([]),[o,s]=Ce.useState(e),[c,l]=Ce.useState(M_),[d,u]=Ce.useState(!1),[p,h]=Ce.useState(!1),[f,m]=Ce.useState(!0),[g,w]=Ce.useState(null),[v,y]=Ce.useState(null),b=Ce.useRef(null),k=Ce.useRef(e);return k.current=e,Ce.useLayoutEffect(()=>{t.current()&&(b.current=null,r(null),a([]),s(k.current),l(M_),u(!1),h(!1),m(!0),w(null),y(null))},[t]),{target:n,setTarget:r,repos:i,setRepos:a,accounts:o,setAccounts:s,draft:c,setDraft:l,editing:d,setEditing:u,busy:p,setBusy:h,loading:f,setLoading:m,issue:g,setIssue:w,listError:v,setListError:y,targetRef:b}}(i,o),c=Ce.useRef(r);c.current=r;const l=JSON.stringify([e.connectionId,(u=i,u.map(e=>`${e.installationId}:${e.accountLogin}`).join("|")),(d=a,d.map(e=>e.toLowerCase()).join("|"))]);var d,u;const p=function(e){const t=Ce.useRef(e);t.current=e;const{owner:n,key:r}=e,i=Ce.useCallback(async()=>{const e=t.current,i=++n.sequence,a=()=>n.current()&&n.sequence===i&&t.current.owner===n&&t.current.key===r;if(a()){e.loading(!0);try{const t=await e.load();a()&&e.publish(t)}finally{a()&&e.loading(!1)}}},[n,r]);return Ce.useEffect(()=>{i()},[i]),i}({owner:o,key:l,load:()=>async function(e,t,n,r){await uc().catch(()=>null);let i=null;const a=await Ui("github").catch(()=>(i="Could not load the backup target.",null)),o=a?a.target??null:r,s=function(e,t){const n=[],r=new Set;for(const i of[...e,...t]){const e=i.installationId||i.accountLogin.toLowerCase();r.has(e)||(r.add(e),n.push(i))}return n}(function(){const e=cS();if(e)return e.installs;const t=lo();return t?t.installations.map(e=>({installationId:e.id,accountLogin:e.accountLogin,accountType:e.accountType})):[]}(),t),c=await async function(){const e=cS();if(!e)return{repositories:[],error:"Unlock the vault to list repositories for this App."};const{ok:t,payload:n}=await lS("/api/github-app/installation-repos",{appId:e.appId,pem:e.pem});if(!t)return{repositories:[],error:yi(n.message)||"Could not list repositories for the GitHub App install."};const r=[],i=new Set,a=yi(n.error)??null,o=Array.isArray(n.repositories)?n.repositories:[];for(const s of o){if(!ri(s)||null===s)continue;const t=ii(s),n=yi(t.fullName)??yi(t.full_name)??"",a=e.installs.find(e=>ni(t.installationId)?e.installationId===t.installationId:e.accountLogin.toLowerCase()===n.split("/")[0]?.toLowerCase());if(!a)continue;const o=sS(t,a);if(!o||!o.private)continue;const c=o.fullName.toLowerCase();i.has(c)||(i.add(c),r.push(o))}return{repositories:r,error:a}}().catch(()=>({repositories:[],error:"Could not list repositories for the GitHub App install."})),l=function(e,t,n,r=[]){const i=e.map(e=>({fullName:e.fullName,installationId:e.installationId,accountLogin:e.accountLogin,accountType:e.accountType}));if(function(e,t,n){for(const r of t){const t=r.fullName.toLowerCase();if(!r.fullName||e.some(e=>e.fullName.toLowerCase()===t))continue;const i=r.fullName.split("/")[0]??"",a=n.find(e=>e.accountLogin.toLowerCase()===i.toLowerCase());a&&e.push({fullName:r.fullName,installationId:a.installationId,accountLogin:a.accountLogin,accountType:a.accountType})}}(i,r.map(e=>({fullName:e})),t),n?.owner&&n.repo&&n.installationId){const e=`${n.owner}/${n.repo}`;i.some(t=>t.fullName.toLowerCase()===e.toLowerCase())||i.push({fullName:e,installationId:n.installationId,accountLogin:n.owner,accountType:""})}return V_(i)}(c.repositories,s,o,n);let d=M_;return o?d=`${o.owner}/${o.repo}`:s[0]&&(d=`${s[0].accountLogin}/${M_}`),{target:o,accounts:s,repos:l,draft:d,listError:c.error??i}}(0,[...i],[...a],s.targetRef.current),publish:e=>{s.targetRef.current=e.target,s.setTarget(e.target),s.setAccounts(e.accounts),s.setRepos(e.repos),s.setListError(e.listError),c.current?.(B_(e.target)),o.draftOwned||s.setDraft(e.draft)},loading:s.setLoading});return function(e){const t=e.target?`${e.target.owner}/${e.target.repo}`:"",n={connection:e.connection,online:e.online,onFlash:t=>{e.current()&&e.onFlash(t)},onBound:t=>{e.current()&&(e.bindTarget(t),e.setEditing(!1),e.setDraft(`${t.owner}/${t.repo}`))},onIssue:t=>{e.current()&&e.setIssue(t)},onBusy:t=>{e.current()&&e.setBusy(t)},onReady:t=>{e.current()&&e.onReady.current?.(t)}};return{accounts:e.accounts,bound:B_(e.target),busy:e.busy,connectionId:e.connection.connectionId,commit:r=>e.current()?async function(e,t,n){if(!e.handlers.online||n.current)return;const r=F_(t);if(!r||r.endsWith("/")||r.toLowerCase()===e.selected.toLowerCase())return e.setEditing(!1),void e.handlers.onIssue(null);const i=K_(r,e.repos,e.accounts);if("invalid"!==i.kind){n.current=!0,e.handlers.onIssue(null);try{if("existing"===i.kind)return void(await uS(e.handlers,i.choice));const t=await async function(e,t,n){if(t.installationId){const e=await async function(e){const t=cS();if(!t)throw new Error("Unlock the vault and install the GitHub App first.");const n=t.installs.find(t=>t.installationId===e.installationId)??null;if(!n)throw new Error("That account has no GitHub App installation.");const{ok:r,payload:i}=await lS("/api/github-app/create-repo",{appId:t.appId,pem:t.pem,installationId:e.installationId,owner:e.owner,name:e.name,accountType:e.accountType,private:!0});if(!r)throw new Error((ni(i.message)?i.message:null)||"Could not create the repository.");if(!ri(i.repository)||null===i.repository)throw new Error("Could not create the repository.");const a=sS(ii(i.repository),n);if(!a)throw new Error("Could not create the repository.");return a}({installationId:t.installationId,owner:t.accountLogin,name:n,accountType:t.accountType});return{fullName:e.fullName,installationId:e.installationId,accountLogin:e.accountLogin,accountType:e.accountType}}throw new Error("That account has no GitHub App installation.")}(0,i.account,i.name);e.setRepos(e=>V_([t,...e])),await uS(e.handlers,t)}catch(a){e.handlers.onIssue(a instanceof Error?dS(a.message):"Could not create the repository.")}finally{n.current=!1}}else e.handlers.onIssue(i.message)}({handlers:n,selected:t,repos:e.repos,accounts:e.accounts,setRepos:t=>{e.current()&&e.setRepos(t)},setEditing:t=>{e.current()&&e.setEditing(t)}},r,e.flight):Promise.resolve(),draft:e.draft,editing:e.editing,issue:e.issue,listError:e.listError,loading:e.loading,online:e.online,reload:e.reload,repos:e.repos,selected:t,beginDraft:e.beginDraft,setDraft:e.setDraft,setEditing:e.setEditing,setIssue:e.setIssue}}({...s,connection:e,online:t,onFlash:n,onReady:c,reload:p,flight:o.flight,current:o.current,setDraft:e=>{o.draftOwned=!0,s.setDraft(e)},beginDraft:()=>{o.draftOwned=!0,s.setEditing(!0)},bindTarget:e=>{o.sequence++,s.targetRef.current=e,s.setTarget(e),s.setLoading(!1)}})}(e,t,n,r,i,a);return o.bound&&!o.editing?Ee.jsxs("p",{className:"conn-card__repo",children:[Ee.jsx("span",{className:"conn-card__ref","data-testid":"github-backup-repo",children:o.selected}),Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Edit repository",title:"Edit repository","data-testid":"github-repo-edit",onClick:()=>{o.setDraft(o.selected),o.setEditing(!0),o.setIssue(null)},children:Ee.jsx(ne,{size:16})})]}):Ee.jsx(X_,{state:o})}const hS="github",fS="invoke";function mS(e){return e.filter(e=>"connection"===e.resourceKind&&e.resourceId===hS)}function gS(e,t){return e.find(e=>e.principalId===t&&e.policy===fS)}async function wS(e){const t=(await Yt(e)).entries.find(e=>"person"===e.kind&&e.enabled);return t?{id:t.id,name:t.name}:null}const vS={integrations:[],installations:[],shares:[],ownerId:null,auditEvents:[],auditReadable:!0};function yS({connection:e,onFlash:t}){const{tomb:n}=Ot(),r=Ce.useRef(t);r.current=t;const[i,a]=Ce.useState([]),[o,s]=Ce.useState([]),[c,l]=Ce.useState([]);return Ce.useEffect(()=>{let t=!1;return(async()=>{try{const r=await async function(e){if($i())return{...vS};const t=(await g().catch(()=>[])).filter(e=>e.providerId===hS&&e.enabled&&e.configured&&("organization"===e.source||"github-app"===e.source)),n=[];for(const o of t){const e=await qi(o.id).catch(()=>[]);n.push(...e)}const r=mS(await re(e)),i=await wS(e),a=await ie(e).then(e=>({events:e,readable:!0}),()=>({events:[],readable:!1}));return{integrations:t,installations:n,shares:r,ownerId:i?.id??null,auditEvents:a.events,auditReadable:a.readable}}(n);if(t)return;if(function(e,t){const{ownerId:n}=e;return null!==n&&!gS(e.shares,n)&&!!e.auditReadable&&!vs(e.auditEvents,{resourceId:hS,principalId:n,policy:fS})&&("active"===t?.status||e.integrations.length>0||e.installations.length>0)}(r,e)&&await async function(e,t,n){if($i())throw new Error("Guests cannot record member GitHub Access grants. Continue in a member vault, or end the guest session.");const r=await wS(e);if(!r)return mS(await re(e));const i=mS(await re(e));if(void 0!==n&&!n())return i;const a=await ie(e).then(e=>({events:e,readable:!0}),()=>({events:[],readable:!1}));if(!a.readable||vs(a.events,{resourceId:hS,principalId:r.id,policy:fS}))return i;if(void 0!==n&&!n())return i;const o=void 0!==gS(i,r.id);await ws(e,{principalId:r.id,resourceKind:"connection",resourceId:hS,resourceLabel:"GitHub",policy:fS});const s=await ie(e).then(e=>({events:e,readable:!0}),()=>({events:[],readable:!1}));if(void 0!==n&&!n()||!s.readable||vs(s.events,{resourceId:hS,principalId:r.id,policy:fS})){const t=gS(mS(await re(e)),r.id);return t&&await ae(e,t.id),mS(await re(e))}if(!o){const n={providerId:hS,resourceType:"connection",resourceId:hS,subject:r.id,policy:fS,action:"grant",kind:"share"};t&&(n.connectionId=t.connectionId),await oe(e,{eventType:"access.connection.granted",outcome:"succeeded",targetType:"connection",targetId:hS,metadata:n})}return mS(await re(e))}(n,e,()=>!t),t)return;const i=r.installations.map(e=>({id:e.id,login:e.accountLogin,type:e.accountType}));0===i.length&&e.accountLabel&&i.push({id:e.connectionId,login:e.accountLabel,type:""});const o=e.grantedScopes.length?e.grantedScopes:e.requestedScopes;a(i),s([...r.installations.flatMap(e=>e.permissions??[]),...o.map(e=>({name:e,access:""}))]),l(r.installations.flatMap(e=>e.repositories??[]))}catch(i){t||r.current?.({tone:"err",text:Ia(i)})}})(),()=>{t=!0}},[e,n]),Ee.jsxs(Ee.Fragment,{children:[i.map(e=>Ee.jsxs("p",{className:"conn-card__ref","data-testid":"github-install-account",children:[e.login,e.type?` · ${e.type}`:""]},e.id)),o.length>0?Ee.jsxs("details",{children:[Ee.jsx("summary",{children:"Permissions"}),Ee.jsx("ul",{className:"conn-scopes","data-testid":"github-install-permissions",children:o.map(e=>Ee.jsxs("li",{children:[Ee.jsx("code",{children:e.name}),e.access?Ee.jsx("span",{children:e.access}):null]},`${e.name}:${e.access}`))})]}):null,c.length>0?Ee.jsxs("details",{children:[Ee.jsx("summary",{children:"Repositories"}),Ee.jsx("ul",{"data-testid":"github-install-repos",children:c.map(e=>Ee.jsx("li",{children:e},e))})]}):null]})}function bS(e){}function kS({connection:e,provider:t,online:n,onFlash:r,onChanged:i,onBackupReady:a,hideRepository:o=!1}){const[s,c]=Ce.useState(null),[p,h]=Ce.useState(!1),f=Dt("connections.revoke"),m=_a[e.status],g="revoked"===e.status,v=Ye(e.connectionId),y="authorize"===s?"Waiting for consent":"pending"===e.status?"Authorize":"Re-authorize",b=e.grantedScopes.length?e.grantedScopes:e.requestedScopes,k=st(e.connectionId);return Ee.jsxs("li",{id:`connection-${e.connectionId}`,className:"conn-card"+(g?" is-revoked":""),children:[Ee.jsxs("div",{className:"conn-card__top",children:[Ee.jsxs("div",{className:"conn-card__title",children:[Ee.jsx("h3",{children:e.displayName}),"github"!==t?.id||o?null:Ee.jsx(pS,{connection:e,online:n,onFlash:r,onReady:a??bS}),Ee.jsx("p",{className:"conn-card__ref",children:e.connectionRef})]}),Ee.jsxs("div",{className:"conn-card__chips",children:[Ee.jsx(Oe,{tone:Re(m.tone),label:m.label}),t?Ee.jsx("span",{className:"chip",children:t.displayName}):null]})]}),Ee.jsx("p",{className:"conn-card__status",children:Sa(e,t)}),Object.entries(k).map(([e,t])=>Ee.jsx("p",{className:"conn-card__status","data-testid":`connector-field-${e}`,children:`${e}: ${t}`},e)),"github"===t?.id?Ee.jsx(yS,{connection:e,onFlash:r}):null,"github"===t?.id||0===b.length?null:Ee.jsxs("div",{className:"conn-card__block",children:[Ee.jsx("p",{className:"conn-card__label",children:"Allowed to"}),Ee.jsx("ul",{className:"conn-scopes",children:b.map(e=>{const n=t?.scopes.find(t=>t.name===e);return Ee.jsxs("li",{title:n?.description??void 0,children:[Ee.jsx("code",{children:e}),n?Ee.jsx("span",{children:n.description}):null,n?.sensitive?Ee.jsx(Oe,{tone:"warn",label:"Broad"}):null]},e)})})]}),"github"===t?.id||0===e.egress.authorities.length?null:Ee.jsxs("p",{className:"conn-card__egress",children:[Ee.jsx(se,{size:15}),"The credential is only ever attached to"," ",Ee.jsx("code",{children:e.egress.scheme})," requests to"," ",e.egress.authorities.map((t,n)=>Ee.jsxs("span",{children:[n>0?", ":"",Ee.jsx("code",{children:t}),n===e.egress.authorities.length-1?".":""]},t))," ","Anywhere else, it is not sent."]}),Ee.jsxs("div",{className:"conn-card__foot",children:[Ee.jsxs("div",{className:"actions",children:[g?null:Ee.jsx(Ee.Fragment,{children:"oauth2_authorization_code"===t?.authKind?Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm",disabled:null!==s||!n,"aria-label":y,title:y,onClick:()=>{!async function(){const t=l("about:blank");c("authorize");try{const{authorizationUrl:n}=await d(e.connectionId);t?t.location.href=n:window.location.href=n;const a=await u(e.connectionId,t);r("active"===a.result?{tone:"ok",text:`${e.displayName} is authorized again.`}:"failed"===a.result?{tone:"err",text:a.connection.statusDetail??"The provider refused the authorization."}:{tone:"warn",text:"Authorization was not completed."}),i()}catch(n){t?.close(),r({tone:"err",text:Ia(n)})}finally{c(null)}}()},children:Ee.jsx(M,{size:16})}):null}),g?null:Ee.jsx("button",{ref:f,type:"button",className:"icon-btn icon-btn--sm"+(p?" is-armed":""),disabled:null!==s||!n&&!v,"aria-label":p?"Revoke it":"Revoke",title:p?`Revoke ${e.displayName}. Bindings to it stop.`:"Revoke",onClick:()=>{p?(h(!1),async function(){c("revoke");try{const t=(await w(e.connectionId)).providerRevocation;r("ok"===t?{tone:"ok",text:`${e.displayName} was revoked.`}:{tone:"warn",text:`${e.displayName} was removed locally, but provider revocation was ${t}. Revoke it in the provider's security settings too.`}),i()}catch(t){r({tone:"err",text:Ia(t)})}finally{c(null)}}()):h(!0)},children:Ee.jsx(F,{size:16})}),p?Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Keep it",title:"Keep it",onClick:()=>h(!1),children:Ee.jsx(H,{size:16})}):null]}),Ee.jsx("p",{className:"conn-card__meta",children:p?`Revoke ${e.displayName}. Bindings to it stop.`:`Authorized ${Ta(e.createdAt)}${e.lastRefreshedAt?` · renewed ${Ta(e.lastRefreshedAt)}`:""}`})]})]})}function xS({forget:e=Eo}={}){return Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","data-testid":"github-app-forget","aria-label":"Remove GitHub App from this device",title:"Remove GitHub App from this device",onClick:()=>{"confirm"in globalThis&&!globalThis.confirm("Remove the GitHub App from this device? Its private key and client secret will be deleted.")||e()},children:Ee.jsx(F,{size:16})})}function IS({label:e,testId:t,rows:n}){return 0===n.length?null:Ee.jsxs("div",{className:"conn-github-fact",children:[Ee.jsx("span",{className:"conn-github-presence__k",children:e}),Ee.jsx("ul",{className:"conn-scopes","data-testid":t,children:n.map(e=>Ee.jsxs("li",{children:[Ee.jsx("code",{children:e.name}),e.access?Ee.jsx("span",{children:e.access}):null]},`${e.name}:${e.access}`))})]})}function jS({installs:e}){return Ee.jsx(Ee.Fragment,{children:e.map(e=>Ee.jsxs("div",{className:"conn-github-fact","data-testid":"github-app-install",children:[Ee.jsx("span",{className:"conn-github-presence__k",children:"Installed"}),Ee.jsxs("span",{children:[e.accountLogin,e.accountType?` · ${e.accountType}`:"",e.repositorySelection?` · repos ${e.repositorySelection}`:""]})]},e.id))})}function _S({installs:e}){const t=e.flatMap(e=>e.repositories);return 0===t.length?null:Ee.jsxs("div",{className:"conn-github-fact",children:[Ee.jsx("span",{className:"conn-github-presence__k",children:"Repositories"}),Ee.jsx("ul",{"data-testid":"github-app-repos",children:t.map(e=>Ee.jsx("li",{children:e},e))})]})}function SS(e){return ii({connectionId:"local-github-app",connectionRef:"local-github-app",logicalName:"github",displayName:"GitHub",providerId:"github",integrationId:null,status:"active",statusDetail:null,organizationId:"local",projectId:null,ownerKind:"user",shareability:"private",requestedScopes:[],grantedScopes:[],accountLabel:e,expiresAt:null,refreshable:!1,lastRefreshedAt:null,maxInvokeLevel:1,egress:{scheme:"https",authorities:["api.github.com"],pathPrefixes:[]},bindings:[],createdAt:"1970-01-01T00:00:00.000Z",updatedAt:"1970-01-01T00:00:00.000Z"})}function AS(e){return(e??[]).map(e=>({name:e,access:""}))}function CS(e){return{id:e.id,accountLogin:e.accountLogin,accountType:e.accountType,repositorySelection:null,permissions:[],repositories:[]}}function ES(e,t){if(""===t.id||""===t.accountLogin)return;const n=e.get(t.id);e.set(t.id,n?{id:t.id,accountLogin:t.accountLogin||n.accountLogin,accountType:t.accountType||n.accountType,repositorySelection:t.repositorySelection??n.repositorySelection,permissions:t.permissions.length>0?t.permissions:n.permissions,repositories:t.repositories.length>0?t.repositories:n.repositories}:t)}function TS(e){const t=new Map;for(const n of e)""!==n.name&&t.set(n.name,n);return[...t.values()]}function NS(){return v.map(e=>({name:e.name,access:e.access}))}function zS(e){return e?{appName:e.displayName,htmlUrl:e.htmlUrl,ownerLogin:e.ownerLogin,ownerType:e.ownerType,installs:e.installations.map(CS),requestedPermissions:NS(),grantedPermissions:[],backupRepo:null}:{appName:null,htmlUrl:null,ownerLogin:null,ownerType:null,installs:[],requestedPermissions:NS(),grantedPermissions:[],backupRepo:null}}function $S({connection:e=null,online:t=!0,onFlash:n,onReady:r}){const{localApp:i,state:a}=function(){const{status:e}=Ot(),t=Ce.useSyncExternalStore(bo,lo,()=>null),[n,r]=Ce.useState(()=>zS(lo()));return Ce.useEffect(()=>{let e=!1,t=0;const n=()=>{const n=++t;(async()=>{const i=await async function(e=bi()?.location.search??""){await vo();const t=Mi(e),n=await uc(lo()),r=new Map;for(const u of n?.installations??[])ES(r,CS(u));let i=n?.displayName??null,a=n?.htmlUrl??null;const o=await g().catch(()=>[]);for(const u of o){if("github"!==u.providerId)continue;if(!u.enabled||!u.configured)continue;i||(i=u.displayName),!a&&u.githubAppHtmlUrl&&(a=u.githubAppHtmlUrl);const e=await qi(u.id).catch(()=>[]);for(const t of e)ES(r,{id:t.id,accountLogin:t.accountLogin,accountType:t.accountType||t.targetType||"",repositorySelection:t.repositorySelection||null,permissions:t.permissions,repositories:t.repositories})}let s=[...r.values()];if(t){const e=s.find(e=>e.id===t);e&&(s=[e,...s.filter(e=>e.id!==t)])}const c=await Ui("github").catch(()=>null),l=c?.target,d=l&&""!==l.owner&&""!==l.repo?`${l.owner}/${l.repo}`:null;return{appName:i,htmlUrl:a,ownerLogin:n?.ownerLogin??null,ownerType:n?.ownerType??null,installs:s,requestedPermissions:NS(),grantedPermissions:TS(s.flatMap(e=>e.permissions)),backupRepo:d}}(window.location.search);e||n!==t||r(i)})()};n();const i=bo(n),a=Xt(n);return()=>{e=!0,i(),a()}},[e]),Ce.useEffect(()=>{null===t&&r(e=>null===e.appName&&null===e.ownerLogin&&null===e.ownerType&&0===e.installs.length&&null===e.backupRepo?e:zS(null))},[t]),{localApp:t,state:n}}(),o=function(e,t,n){const r=null!==e,{ownerLogin:i,ownerType:a}=function(e,t){if(null===e)return{ownerLogin:null,ownerType:null};const n=t.ownerLogin??e.ownerLogin??null;return t.ownerLogin?{ownerLogin:n,ownerType:t.ownerType}:{ownerLogin:n,ownerType:e.ownerType??t.ownerType}}(e,t),o=t.appName??e?.displayName??null,s=t.htmlUrl??e?.htmlUrl??null;return{visible:Boolean(i||t.installs.length>0||r||o||t.backupRepo),hasApp:r,appName:o,htmlUrl:s,ownerLogin:i,ownerType:a,ownerMissing:r&&null===i,installs:t.installs,backupRepo:t.backupRepo,grantedPermissions:t.grantedPermissions,oauthRequested:AS(n?.requestedScopes),oauthGranted:AS(n?.grantedScopes)}}(i,a,e),s=Ce.useMemo(()=>{if(i)return SS(i.ownerLogin??i.installedByLogin);const e=a.installs[0];return e?SS(e.accountLogin):a.backupRepo?SS(a.backupRepo.split("/")[0]??null):null},[i,a.installs,a.backupRepo]),c=Ce.useMemo(()=>a.installs.map(e=>({installationId:e.id,accountLogin:e.accountLogin,accountType:e.accountType})),[a.installs]),l=Ce.useMemo(()=>a.installs.flatMap(e=>e.repositories),[a.installs]);if(!o.visible)return null;const d=e??s,u=n??(e=>{});return Ee.jsxs("div",{className:"conn-github-presence","data-testid":"github-app-presence",children:[Ee.jsx(PS,{name:o.appName,htmlUrl:o.htmlUrl}),Ee.jsx(OS,{ownerLogin:o.ownerLogin,ownerType:o.ownerType,ownerMissing:o.ownerMissing}),Ee.jsx(jS,{installs:o.installs}),d?Ee.jsxs("div",{className:"conn-github-fact","data-testid":"github-app-repository",children:[Ee.jsx("span",{className:"conn-github-presence__k",children:"Repository"}),Ee.jsx(pS,{connection:d,online:t,onFlash:u,onReady:r,seedAccounts:c,seedRepos:l})]}):null,Ee.jsx(C_,{}),Ee.jsx(IS,{label:"Granted",testId:"github-app-granted",rows:o.grantedPermissions}),Ee.jsx(IS,{label:"OAuth asked",testId:"github-app-oauth-requested",rows:o.oauthRequested}),Ee.jsx(IS,{label:"OAuth granted",testId:"github-app-oauth-granted",rows:o.oauthGranted}),Ee.jsx(_S,{installs:o.installs})]})}function PS({name:e,htmlUrl:t}){return e?Ee.jsxs("div",{className:"conn-github-fact","data-testid":"github-app-name",children:[Ee.jsx("span",{className:"conn-github-presence__k",children:"App"}),t?Ee.jsx("a",{href:t,target:"_blank",rel:"noreferrer noopener",children:e}):Ee.jsx("span",{children:e})]}):null}function OS({ownerLogin:e,ownerType:t,ownerMissing:n}){return e?Ee.jsxs("div",{className:"conn-github-fact","data-testid":"github-app-owner",children:[Ee.jsx("span",{className:"conn-github-presence__k",children:"Registered"}),Ee.jsxs("span",{children:[e,t?` · ${t}`:""]})]}):n?Ee.jsxs("div",{className:"conn-github-fact","data-testid":"github-app-owner-missing",children:[Ee.jsx("span",{className:"conn-github-presence__k",children:"Registered"}),Ee.jsxs("span",{className:"conn-github-fact__warn",children:[Ee.jsx(Oe,{tone:"warn",label:"GitHub App registered; registrant not known yet"}),"unknown"]})]}):null}const RS=Mr(["api-key","entra-token"]),LS=Yr("api",[Ur({api:Dr("v1"),credential:RS}).strict(),Ur({api:Dr("dated-chat"),credential:RS,apiVersion:qr().max(18).regex(/^\d{4}-\d{2}-\d{2}(?:-preview)?$/).refine(function(e){const t=e.slice(0,10),n=Date.parse(t);return!Number.isNaN(n)&&new Date(n).toISOString().slice(0,10)===t})}).strict()]);function US(){throw new ys("configuration","Check the Azure endpoint, deployment, API mode and authentication.")}function DS(e){if(void 0===e.azure)return"azure-openai"===e.providerId?US():null;const t=LS.safeParse(e.azure);if(!t.success)return US();if(!["azure-openai","byo-ai"].includes(e.providerId)||!["openai_chat","openai_responses"].includes(e.family)||"api-key"!==e.authentication||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/.test(e.model))return US();const n=t.data;return"dated-chat"===n.api&&"openai_chat"!==e.family||e.apiKey.length>=4&&[e.name,e.baseUrl,e.model,JSON.stringify(n)].some(t=>t.includes(e.apiKey))?US():n}const qS=Ur({providerId:Mr(["assemblyai","byo-ai"]),baseUrl:qr().min(1).max(2048),model:qr().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/),authentication:Dr("api-key"),apiKey:qr().max(16384).regex(/^[\x21-\x7e]*$/)}).strict();function MS(e,t=!0){const n=qS.safeParse(e);if(!n.success||t&&!n.data.apiKey)throw new ys("configuration","Choose an AssemblyAI transcription target with its model and API key.");const r=n.data;if(r.apiKey&&[r.baseUrl,r.model].some(e=>e.includes(r.apiKey)))throw new ys("configuration","Keep the API key out of public transcription fields.");return r}function KS(e,t){const n=Ur({id:qr()}).safeParse(e);if(!n.success||!("assemblyai"===t.providerId?/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i:/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/).test(n.data.id)||n.data.id.includes(t.apiKey))throw new ys("response","The transcription service returned an invalid owned job ID.");return n.data.id}class FS extends ys{constructor(e){super("response",e?"Stopped waiting; transcript deletion was acknowledged. Provider processing or charges may continue.":"Stopped waiting; remote transcript removal was not confirmed."),this.deletionAcknowledged=e,this.name="AssemblyTranscriptInterrupted"}deletionAcknowledged}const GS=Ur({providerId:Mr(["deepgram","byo-ai"]),baseUrl:qr().min(1).max(2048),model:qr().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/),authentication:Dr("api-key"),apiKey:qr().max(16384).regex(/^[\x21-\x7e]*$/)}).strict();function BS(e,t=!0){const n=GS.safeParse(e);if(!n.success||t&&!n.data.apiKey)throw new ys("configuration","Choose a Deepgram transcription target with its model and API key.");const r=n.data;if(r.apiKey&&[r.baseUrl,r.model].some(e=>e.includes(r.apiKey)))throw new ys("configuration","Keep the API key out of public transcription fields.");return r}const VS=Ur({id:qr().regex(/^[A-Za-z0-9_-]{1,128}$/),status:Mr(["starting","processing","succeeded","failed","canceled"]),output:Zr().optional()});class HS extends ys{constructor(e){super("response",e?"Prediction cancellation requested.":"Stopped waiting; remote cancellation was not confirmed."),this.cancellationRequested=e,this.name="ReplicatePredictionInterrupted"}cancellationRequested}function JS(e){const t=/^(?:[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9][A-Za-z0-9_.-]*:)?([a-f0-9]{64})$/.exec(e);if(t)return{path:"predictions",version:t[1]};if(/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(e))return{path:`models/${e}/predictions`};throw new ys("configuration","Enter a Replicate owner/model, owner/model:version or 64-character version ID.")}const WS=Ur({providerId:Mr(["elevenlabs","byo-ai"]),baseUrl:qr().min(1).max(2048),model:qr().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/),authentication:Dr("api-key"),apiKey:qr().max(16384).regex(/^[\x21-\x7e]*$/)}).strict();function ZS(e){return"elevenlabs"===e||"byo-ai"===e}function XS(e,t=!0){const n=WS.safeParse(e);if(!n.success||t&&!n.data.apiKey)throw new ys("configuration","Choose a Scribe transcription target with its model and API key.");const r=n.data;if(r.apiKey&&[r.baseUrl,r.model].some(e=>e.includes(r.apiKey)))throw new ys("configuration","Keep the API key out of public transcription fields.");return r}function YS(e,t=!0){if("elevenlabs_scribe"!==e.family||e.azure||e.vertex||e.bedrock)throw new ys("configuration","Choose a single Scribe transcription target without another protocol's credentials.");return XS({providerId:e.providerId,baseUrl:e.baseUrl,model:e.model,authentication:e.authentication,apiKey:e.apiKey},t)}const QS=Ur({project:qr().refine(tm),location:qr().regex(/^(?:global|[a-z]+(?:-[a-z0-9]+)*[0-9])$/),credential:Mr(["service-account","access-token"])}).strict();function eA(){throw new ys("configuration","Check the Vertex project, location, Gemini model and authentication.")}function tA(e){if(!e.vertex)return"google-vertex"===e.providerId?eA():null;const t=QS.safeParse(e.vertex);return t.success&&["google-vertex","byo-ai"].includes(e.providerId)&&"gemini_generate_content"===e.family&&"api-key"===e.authentication&&!e.azure&&/^[A-Za-z0-9._-]+$/.test(e.model)?e.apiKey.length>=4&&[e.name,e.model,e.baseUrl,JSON.stringify(t.data)].some(t=>t.includes(e.apiKey))?eA():t.data:eA()}function nA(e){return`https://${"global"===e.location?"aiplatform.googleapis.com":`${e.location}-aiplatform.googleapis.com`}/v1`}function rA(e,t){const n=tA(e);return n?"google-vertex"===e.providerId&&t.href!==`${nA(n)}/`?eA():new URL(`projects/${n.project}/locations/${n.location}/publishers/google/models/${e.model}:generateContent`,t):eA()}const iA=Ur({providerId:qr().min(1).max(100),name:qr().trim().min(1).max(200),family:Mr(["stability_sd3","replicate_predictions","elevenlabs_scribe","deepgram_listen","assemblyai_transcript","bedrock_converse","openai_chat","openai_responses","anthropic_messages","gemini_generate_content"]),baseUrl:qr().min(1).max(2048),model:qr().trim().min(1).max(160).regex(/^[A-Za-z0-9][A-Za-z0-9._:/-]*$/),authentication:Mr(["api-key","none"]),apiKey:qr().max(16384),tokenParameter:Mr(["max_tokens","max_completion_tokens"]).default("max_completion_tokens"),azure:LS.optional(),vertex:QS.optional(),bedrock:Vl.optional()}).strict();function aA(e,t=!0){const n=iA.safeParse(e);if(!n.success)throw new ys("configuration","Check the AI connection fields.");const r=n.data;if(function(e,t){const n=od(e.providerId),r=bs(e.family),i=ks(e.family);(i||"stability"===e.providerId)&&nd(e,t),"elevenlabs_scribe"===e.family&&YS(e,t),"assemblyai_transcript"===e.family&&sA(e,t),"deepgram_listen"===e.family&&oA(e,t);const a=i||r||("replicate_predictions"===e.family?["replicate","byo-ai"].includes(e.providerId):"bedrock_converse"===e.family?["aws-bedrock","byo-ai"].includes(e.providerId):ad(e.providerId).some(t=>t.id===e.family));if(!n&&!r&&!i||!a)throw new ys("configuration","Choose a protocol supported by this provider.")}(r,t),r.baseUrl=Yl(r.baseUrl).href.replace(/\/$/,""),function(e){if("replicate_predictions"===e.family){if(!["replicate","byo-ai"].includes(e.providerId)||"api-key"!==e.authentication||e.azure||e.vertex||e.bedrock)throw new ys("configuration","Choose one Replicate prediction target with an API token.");JS(e.model)}else if("replicate"===e.providerId)throw new ys("configuration","Choose the Replicate predictions family for this provider.")}(r),DS(r),"gemini_generate_content"===r.family&&!/^[A-Za-z0-9._-]+$/.test(r.model))throw new ys("configuration","Enter a Gemini model identifier without path segments.");return function(e,t){const n=function(e){const t=cA(e);if(!t)return!1;if(e.apiKey){const n=Xl(e.apiKey),r=[e.name,e.baseUrl,e.model,JSON.stringify(t)];if([n.accessKeyId,n.secretAccessKey,n.sessionToken??""].some(e=>e.length>=4&&r.some(t=>t.includes(e))))throw new ys("configuration","Keep AWS credentials out of public connection fields.");e.apiKey=JSON.stringify(n)}return!0}(e),r=function(e){const t=tA(e);t&&rA({...e,vertex:t},Yl(e.baseUrl));const n="service-account"===t?.credential;if(n&&e.apiKey){const n=nm(e.apiKey);if([e.name,e.baseUrl,e.model,JSON.stringify(t)].some(e=>e.includes(n.privateKey)))throw new ys("configuration","Keep the private key out of public connection fields.");e.apiKey=JSON.stringify({type:"service_account",client_email:n.clientEmail,project_id:n.projectId,private_key:n.privateKey})}return n}(e)||n;if(!r&&e.apiKey&&!/^[!-~]+$/.test(e.apiKey))throw new ys("configuration","Enter an API key without spaces or control characters.");if("none"===e.authentication&&(e.apiKey=""),t&&"api-key"===e.authentication&&!e.apiKey)throw new ys("configuration","Enter an API key for this connection.");if(e.apiKey.length>=4&&[e.name,e.baseUrl,e.model].some(t=>t.includes(e.apiKey)))throw new ys("configuration","Keep the API key out of public connection fields.")}(r,t),r}function oA(e,t=!0){if("deepgram_listen"!==e.family||e.azure||e.vertex||e.bedrock)throw new ys("configuration","Choose a single Deepgram transcription target without another protocol's credentials.");return BS({providerId:e.providerId,baseUrl:e.baseUrl,model:e.model,authentication:e.authentication,apiKey:e.apiKey},t)}function sA(e,t=!0){if("assemblyai_transcript"!==e.family||e.azure||e.vertex||e.bedrock)throw new ys("configuration","Choose a single AssemblyAI transcription target without another protocol's credentials.");return MS({providerId:e.providerId,baseUrl:e.baseUrl,model:e.model,authentication:e.authentication,apiKey:e.apiKey},t)}function cA(e){if("bedrock_converse"===e.family)return Wl({...e,family:"bedrock_converse"});if(e.bedrock||"aws-bedrock"===e.providerId)throw new ys("configuration","Choose the Bedrock Converse family for this target.");return null}function lA(e){const t=[e.providerId,e.family,e.baseUrl,e.model,e.authentication,e.tokenParameter],n=DS(e),r=n?[...t,["azure-openai",n.api,"dated-chat"===n.api?n.apiVersion:null,n.credential]]:t,i=tA(e),a=i?[...r,["google-vertex",i.project,i.location,i.credential]]:r,o=cA(e);return JSON.stringify(o?[...a,["aws-bedrock",o.region,o.credential]]:a)}function dA(e){return No(zo((new TextEncoder).encode(e)))}const uA="ai-connection-v1",pA={publicParameters:["ai_contract","family","base_url","model","authentication","vault_tomb","token_parameter","azure_target","vertex_target","bedrock_target"],privateCredentials:["ai_credential_reference","ai_credential_digest"]};function hA(e){const t=an(e);return t?.configuration.parameters.ai_contract===uA?t:null}function fA(e){if(void 0===e)return{};try{if(!e||e.length>512)throw new Error("Invalid target size");const t=LS.safeParse(JSON.parse(e));if(!t.success)throw new Error("Invalid target metadata");return{azure:t.data}}catch{throw new ys("configuration","The saved Azure target is invalid. Configure and verify this connection again.")}}function mA(e){if(void 0===e)return{};try{if(!e||e.length>512)throw new Error("Invalid target size");const t=QS.safeParse(JSON.parse(e));if(!t.success)throw new Error("Invalid target metadata");return{vertex:t.data}}catch{throw new ys("configuration","The saved Vertex target is invalid. Configure and verify this connection again.")}}function gA(e){if(void 0===e)return{};try{if(!e||e.length>512)throw new Error("Invalid target size");const t=Vl.safeParse(JSON.parse(e));if(!t.success)throw new Error("Invalid target metadata");return{bedrock:t.data}}catch{throw new ys("configuration","The saved Bedrock target is invalid. Configure and verify this connection again.")}}function wA(e){const t=hA(e);if(!t)return null;const{providerId:n,displayName:r,parameters:i}=t.configuration;return aA({providerId:n,name:r,family:i.family,baseUrl:i.base_url,model:i.model,authentication:i.authentication,tokenParameter:i.token_parameter,apiKey:"",...fA(i.azure_target),...mA(i.vertex_target),...gA(i.bedrock_target)},!1)}const vA=[{id:"app",label:"GitHub App"},{id:"token",label:"Personal access token"}];function yA(e){const[t,n]=Ce.useState(()=>new URLSearchParams(window.location.search).has("github_app")||"active"!==e.connection?.status||"api-key"!==on(e.connection.connectionId)?.configuration.method?"app":"token"),r=Ce.useSyncExternalStore(bo,lo,()=>null),i=function(e){if(!e)return null;try{const t=new URL(e),n=/^\/apps\/([a-z\d-]+)\/?$/iu.exec(t.pathname)?.[1];return"https://github.com"!==t.origin||t.username||t.password||!n?null:`https://github.com/apps/${n}/installations/new`}catch{return null}}(r?.htmlUrl??null);return Ee.jsx(CI,{...e,renderConfiguration:a=>Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"panel__body cx-form",children:[Ee.jsx(Pv,{label:"Connection method",value:t,options:vA,onChange:n}),Ee.jsxs("div",{hidden:"app"!==t,children:[Ee.jsx(El,{...e}),r?Ee.jsxs(Ee.Fragment,{children:[Ee.jsx($S,{online:e.online,onFlash:t=>{t&&e.onFlash(t)}}),yo(r.id)?Ee.jsx(Oe,{tone:"warn",label:"GitHub App key pending vault storage."}):null,Ee.jsxs("div",{className:"actions",children:[i?Ee.jsx(Uv,{href:i,children:"Install GitHub App"}):null,Ee.jsx(xS,{})]})]}):null]})]}),Ee.jsx("div",{hidden:"token"!==t,children:a})]})})}const bA="https://boat.dev",kA="boat";function xA(e,t){return ai(e)?e[t]:void 0}function IA(e,t){const n=xA(e,t);return ni(n)&&n.length>0?n:null}function jA(e,t){const n=xA(e,t);return"number"==typeof n&&Number.isFinite(n)?n:null}async function _A(e){try{return await e.json()}catch{return}}function SA(e){let t;try{t=new URL(e)}catch{throw new Error("Boat returned an invalid claim link.")}if("https:"!==t.protocol||"boat.dev"!==t.host||"/api/boat/agent/identity/claim"!==t.pathname)throw new Error("Boat returned an invalid claim link.");return t.href}function AA(e,t){const n=IA(t,"user_code"),r=IA(t,"verification_uri"),i=jA(t,"expires_in"),a=jA(t,"interval");return n&&r&&null!==i&&null!==a?{claimToken:e,userCode:n,verificationUri:SA(r),expiresInSeconds:i,intervalSeconds:Math.max(1,a)}:null}async function CA(e,t,n){const r=await e(`${bA}${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(n),redirect:"error"}),i=await _A(r);if(!r.ok)throw new Error(`Boat refused the request (HTTP ${r.status}).`);return i}async function EA(e,t){const n=new URLSearchParams({grant_type:"urn:workos:agent-auth:grant-type:claim",claim_token:t}),r=await e(`${bA}/api/boat/oauth2/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:n.toString(),redirect:"error"}),i=await _A(r),a=IA(i,"error");if("authorization_pending"===a||"slow_down"===a)return{status:"pending"};const o=IA(i,"access_token"),s=IA(i,"identity_assertion");if(!r.ok||!o)throw new Error("invalid_grant"===a?"That Boat claim code has expired. Start the claim again.":`Boat refused the claim (${a??`HTTP ${r.status}`}).`);if(!s)throw new Error("Boat's claim grant carried no recovery assertion.");return{status:"claimed",accessToken:o,identityAssertion:s}}async function TA(e,t,n){const r=await e(`${bA}${t}`,{headers:{authorization:`Bearer ${n}`},redirect:"error"}),i=await _A(r);if(!r.ok)throw new Error(`Boat refused the request (HTTP ${r.status}).`);return i}async function NA(e,t){const n=await TA(e,"/api/v1/me",t),r=await TA(e,"/api/v1/limits",t),i=xA(n,"user");return{login:IA(i,"login")??"",email:IA(i,"email")??"",accessTier:IA(r,"accessTier")??"",blockedReason:IA(r,"blockedReason")}}function zA(e){const t=ct().filter(e=>e.providerId===kA&&"revoked"!==e.status);return e?t.find(t=>t.connectionId===e)??null:t.at(-1)??null}async function $A(e){return lt(()=>({providerId:kA,displayName:e.login||e.email,scopes:[],fields:{account_email:e.email,account_login:e.login},secrets:{identity_assertion:e.identityAssertion}}),e.existingId)}const PA=()=>{const e=Gt();if(e.supportsNativeOrigin&&!e.supportsNativeOrigin(bA))throw new Error("Enable External connectors with boat.dev egress to claim Boat.");return e},OA=e=>new Promise(t=>setTimeout(t,e));async function RA(e){const{fetch:t}=PA(),n=await async function(e,t){const n=function(e){const t=Ci()[e]?.identity_assertion;return t&&t.length>0?t:null}(t);if(!n)throw new Error("No Boat identity is sealed here.");const r=await async function(e,t){const n=new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:t,resource:`${bA}/api/v1/`}),r=await e(`${bA}/api/boat/oauth2/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:n.toString(),redirect:"error"}),i=await _A(r),a=IA(i,"access_token");if(!r.ok||!a)throw new Error("Boat refused the saved identity. Claim Boat again.");const o=IA(i,"identity_assertion");return o?{accessToken:a,identityAssertion:o}:{accessToken:a}}(e,n);if(r.identityAssertion&&r.identityAssertion!==n){const e=st(t);await $A({email:e.account_email??"",login:e.account_login??e.account_email??"",identityAssertion:r.identityAssertion,existingId:t})}return{accessToken:r.accessToken,account:await NA(e,r.accessToken)}}(t,e);return{accessToken:n.accessToken,current:n.account}}function LA({state:e}){return Ee.jsxs("form",{className:"cx-form panel__body","aria-label":"Claim a Boat account",onSubmit:t=>{t.preventDefault(),!e.busy&&e.email.includes("@")&&e.onStartClaim()},children:[Ee.jsx("p",{className:"hint",children:"Boat runs sandboxes only for a claimed account. Enter your email and OpenSesame will register with Boat, show you a one-time code, and wait while you claim the account on Boat's own page. The identity Boat issues is sealed on this device; no API key is ever pasted."}),Ee.jsx(O,{label:"Boat account email",type:"email",autoComplete:"email",value:e.email,onValueChange:e.onEmail,disabled:e.busy}),Ee.jsx(U,{label:"Start claim",busy:e.busy,disabled:!e.email.includes("@"),disabledReason:"Enter the email for the Boat account first."})]})}function UA({state:e}){return e.claim?Ee.jsxs("div",{className:"cx-form panel__body",children:[Ee.jsx("p",{className:"hint",children:"Open Boat's claim page and enter this code. This panel is waiting for Boat to confirm the claim."}),Ee.jsxs("dl",{className:"cx-facts",children:[Ee.jsxs("div",{className:"cx-fact",children:[Ee.jsx("dt",{children:"Claim code"}),Ee.jsx("dd",{children:e.claim.userCode})]}),Ee.jsxs("div",{className:"cx-fact",children:[Ee.jsx("dt",{children:"Claim page"}),Ee.jsx("dd",{children:Ee.jsx("a",{href:e.claim.verificationUri,target:"_blank",rel:"noopener noreferrer",children:"boat.dev — claim this account"})})]})]})]}):null}function DA({state:e}){return Ee.jsxs("div",{className:"cx-form panel__body",children:[Ee.jsx("p",{className:"hint",children:"Boat creates sandboxes only once billing is active: the 7-day trial needs a card on file at Boat's own checkout. OpenSesame never sees the card."}),Ee.jsxs("dl",{className:"cx-facts",children:[Ee.jsxs("div",{className:"cx-fact",children:[Ee.jsx("dt",{children:"Account"}),Ee.jsx("dd",{children:e.account?.login||e.savedLogin||e.savedEmail})]}),Ee.jsxs("div",{className:"cx-fact",children:[Ee.jsx("dt",{children:"Billing"}),Ee.jsx("dd",{children:e.account?.blockedReason??"not checked yet"})]})]}),Ee.jsx(U,{label:"Open Boat checkout",busy:e.busy,onClick:e.onOpenCheckout,children:Ee.jsx(B,{label:"Check billing again",disabled:e.busy,onClick:e.onCheckBilling,children:Ee.jsx(V,{size:16})})})]})}function qA({state:e}){return Ee.jsxs("div",{className:"cx-form panel__body",children:[Ee.jsx("p",{className:"hint",children:"Boat reports no billing block. Password resets can run in Boat sandboxes from this device."}),Ee.jsxs("dl",{className:"cx-facts",children:[Ee.jsxs("div",{className:"cx-fact",children:[Ee.jsx("dt",{children:"Account"}),Ee.jsx("dd",{children:e.account?.login||e.savedLogin||e.savedEmail})]}),Ee.jsxs("div",{className:"cx-fact",children:[Ee.jsx("dt",{children:"Access tier"}),Ee.jsx("dd",{children:e.account?.accessTier??"—"})]})]}),Ee.jsx(U,{label:"Check Boat again",busy:e.busy,onClick:e.onCheckBilling})]})}function MA({connection:e,onFlash:t,onChanged:n}){const r=function(e,t,n){const r=e??zA(),i=r?st(r.connectionId):{},[a,o]=Ce.useState(i.account_email??""),[s,c]=Ce.useState(r?"saved":"email"),[l,d]=Ce.useState(null),[u,p]=Ce.useState(null),[h,f]=Ce.useState(!1),[m,g]=Ce.useState(""),w=Ce.useRef(0),v=Ce.useCallback(()=>{w.current+=1},[]);Ce.useEffect(()=>v,[v]);const y=Ce.useCallback(e=>{g(e instanceof Error?e.message:"That did not work."),f(!1)},[]),b=Ce.useRef(!1);Ce.useEffect(()=>{r&&!b.current&&(b.current=!0,RA(r.connectionId).then(({current:e})=>{p(e),c(e.blockedReason?"billing":"ready")}).catch(()=>{}))},[r]);const k=Ce.useCallback(()=>{f(!0),g("");const e=++w.current;(async function(e){const t=await async function(e,t){const n=t.trim();if(!n.includes("@")||n.length>254)throw new Error("Enter the email address for the Boat account.");const r=await CA(e,"/api/boat/agent/identity",{type:"service_auth",login_hint:n}),i=IA(r,"claim_token");if(!i)throw new Error("Boat registration returned no claim.");const a=xA(r,"claim"),o=a?AA(i,a):null;if(o)return o;const s=await CA(e,"/api/boat/agent/identity/claim",{claim_token:i,email:n}),c=AA(IA(s,"claim_token")??i,s);if(!c)throw new Error("Boat did not start the claim ceremony.");return c}(PA().fetch,e.email);e.onStarted(t);const n=await async function(e,t){for(;;){if(await OA(1e3*e.intervalSeconds),!t())return null;const n=await EA(PA().fetch,e.claimToken);if(!t())return null;if("claimed"===n.status)return n}}(t,e.isCurrent);if(!n||!e.isCurrent())return null;const r=await $A({email:e.email.trim(),login:e.email.trim(),identityAssertion:n.identityAssertion,...e.existingId?{existingId:e.existingId}:{}}),i=await NA(PA().fetch,n.accessToken);return i.login&&i.login!==e.email.trim()&&await $A({email:e.email.trim(),login:i.login,identityAssertion:n.identityAssertion,existingId:r.connectionId}),i})({email:a,...r?{existingId:r.connectionId}:{},isCurrent:()=>w.current===e,onStarted:e=>{d(e),c("claiming"),f(!1)}}).then(r=>{r&&w.current===e&&(p(r),c(r.blockedReason?"billing":"ready"),f(!1),t({tone:"ok",text:"Boat claimed and saved on this device."}),n())}).catch(t=>{w.current===e&&(c(zA()?"saved":"email"),y(t))})},[a,y,n,t,r]),{onCheckBilling:x,onOpenCheckout:I,onForget:j}=function(e){const{saved:t,setBusy:n,setFailure:r,setAccount:i,setStage:a,fail:o}=e,s=Ce.useCallback(()=>zA(t?.connectionId)??t,[t]);return{onCheckBilling:Ce.useCallback(()=>{const e=s();e&&(n(!0),r(""),RA(e.connectionId).then(({current:e})=>{i(e),a(e.blockedReason?"billing":"ready"),n(!1)}).catch(o))},[s,o,i,n,r,a]),onOpenCheckout:Ce.useCallback(()=>{const e=s();if(!e)return;n(!0),r("");const t=window.open("about:blank","_blank");(async()=>{try{const{accessToken:r,current:a}=await RA(e.connectionId);i(a);const o=await async function(e,t){const n=await e(`${bA}/api/boat/billing/checkout`,{method:"POST",headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({plan:"box_20"}),redirect:"error"}),r=IA(await _A(n),"url");if(!n.ok||!r)throw new Error(`Boat refused checkout (HTTP ${n.status}).`);let i;try{i=new URL(r)}catch{throw new Error("Boat returned an invalid checkout link.")}if("https:"!==i.protocol||"checkout.stripe.com"!==i.host)throw new Error("Boat returned an invalid checkout link.");return i.href}(PA().fetch,r);t?t.location.href=o:window.open(o,"_blank","noopener,noreferrer"),n(!1)}catch(r){t?.close(),o(r)}})()},[s,o,i,n,r]),onForget:Ce.useCallback(()=>{const t=s();t&&(n(!0),r(""),e.stopPolling(),dt(t.connectionId).then(()=>{a("email"),i(null),e.setClaim(null),n(!1),e.onFlash({tone:"ok",text:"Boat connection forgotten."}),e.onChanged()}).catch(o))},[e,s,o,i,n,r,a])}}({saved:r,setBusy:f,setFailure:g,setAccount:p,setStage:c,setClaim:d,stopPolling:v,fail:y,onFlash:t,onChanged:n});return{savedId:r?.connectionId??null,savedEmail:i.account_email??"",savedLogin:i.account_login??"",email:a,onEmail:o,stage:s,claim:l,account:u,busy:h,failure:m,onStartClaim:k,onCancelClaim:Ce.useCallback(()=>{v(),d(null),c(zA()?"saved":"email")},[v]),onCheckBilling:x,onOpenCheckout:I,onForget:j}}(e,t,n);return Ee.jsxs("div",{className:"cx-setup",children:[Ee.jsxs(Nv,{step:2,label:"Boat account",title:r.savedId?"Boat account":"Claim Boat",focus:!0,actions:r.savedId?Ee.jsx(B,{label:"Forget Boat connection",disabled:r.busy,onClick:r.onForget,children:Ee.jsx(H,{size:16})}):"claiming"===r.stage?Ee.jsx(B,{label:"Cancel claim",onClick:r.onCancelClaim,children:Ee.jsx(H,{size:16})}):null,children:["email"===r.stage?Ee.jsx(LA,{state:r}):null,"claiming"===r.stage?Ee.jsx(UA,{state:r}):null,"billing"===r.stage||"saved"===r.stage?Ee.jsx(DA,{state:r}):null,"ready"===r.stage?Ee.jsx(qA,{state:r}):null]}),Ee.jsx(q,{id:"boat-connection",title:"Boat connection",message:r.failure})]})}const KA=1032192,FA=Mr(["audio/webm","audio/ogg","audio/wav","audio/mp4","audio/mpeg"]);function GA(e,t,n){return e.length>=t+n.length&&[...n].every((n,r)=>e[t+r]===n.charCodeAt(0))}const BA={"audio/wav":e=>e.length>=44&&GA(e,0,"RIFF")&&GA(e,8,"WAVE"),"audio/webm":e=>[26,69,223,163].every((t,n)=>e[n]===t),"audio/ogg":e=>GA(e,0,"OggS"),"audio/mp4":e=>e.length>=12&&GA(e,4,"ftyp"),"audio/mpeg":e=>e.length>=4&&(GA(e,0,"ID3")||255===e[0]&&!(224&~(e[1]??0)))};function VA(e){try{const t=Ur({mimeType:qr(),bytes:Qr(Uint8Array)}).strict().parse(e),n=FA.parse(t.mimeType.split(";")[0]?.trim().toLowerCase());if(!t.bytes.length||t.bytes.length>KA||!BA[n](t.bytes))throw new Error("Invalid audio");return{mimeType:n,bytes:t.bytes}}catch{throw new ys("configuration","Choose a recognized local audio file within the 1 MiB recording/upload bound.")}}const HA={},JA={openai_chat:"openai",openai_responses:"openai",anthropic_messages:"anthropic",gemini_generate_content:"gemini"};function WA(e){if(ks(e.family))throw new ys("configuration","Image generation requires its finite multipart adapter.");if(bs(e.family))throw new ys("configuration","assemblyai_transcript"===e.family?"AssemblyAI audio requires its finite upload and transcription job adapter.":"elevenlabs_scribe"===e.family?"Scribe audio requires its finite multipart transcription adapter.":"Deepgram audio requires its finite raw-audio transcription adapter.");if("replicate_predictions"===e.family)throw new ys("configuration","Replicate predictions require their finite JSON job adapter.");if("bedrock_converse"===e.family)throw new ys("configuration","Bedrock credentials must be signed, never sent as an API key.");const t=function(e){const t=DS(e);if(!t)return null;if(!/^[!-~]{1,16384}$/.test(e.apiKey))throw new ys("authentication","Enter an Azure key or Entra access token without spaces or control characters.");const n=new Headers({"content-type":"application/json"});return"api-key"===t.credential?n.set("api-key",e.apiKey):n.set("authorization",`Bearer ${e.apiKey}`),n}(e);if(t)return t;const n=new Headers({"content-type":"application/json"});if("api-key"===e.authentication){if(!e.apiKey)throw new ys("authentication","Unlock the vault containing this AI credential.");n.set("anthropic_messages"===e.family?"x-api-key":"gemini_generate_content"===e.family?"x-goog-api-key":"authorization","openai_chat"===e.family||"openai_responses"===e.family?`Bearer ${e.apiKey}`:e.apiKey)}return"anthropic_messages"===e.family&&(n.set("anthropic-version","2023-06-01"),n.set("anthropic-dangerous-direct-browser-access","true")),n}function ZA(e,t,n){if(Bf(e))throw new ys("response","The AI transport reused a live response.");Vf(e,t,n)}function XA(e,t){const{signal:n,assertCurrent:r,fetch:i}=e,a=()=>{if(n.throwIfAborted(),e.signal!==n||e.assertCurrent!==r||e.fetch!==i)throw new ys("stale","The transcription transport changed.");if(t(),r.call(e),n.throwIfAborted(),e.signal!==n||e.assertCurrent!==r||e.fetch!==i)throw new ys("stale","The transcription transport changed.")};return a(),a}function YA(e){if(401===e.status||403===e.status)throw new ys("authentication","The AI service refused the credential or its permissions.");if(!e.ok||e.redirected)throw new ys("response",`The AI service request failed (HTTP ${e.status}).`)}async function QA(e,t,n,r,i){tC(e,t,r,i);const a=AbortSignal.any([r.signal,AbortSignal.timeout(6e4)]),o={method:n.method,headers:n.headers,signal:a,credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"};let s;void 0!==n.body&&(o.body=n.body);try{s=await r.fetch(t,o)}catch{throw i(),r.assertCurrent(),r.signal.throwIfAborted(),new ys("network","Could not reach this AI endpoint. Check TLS, network permissions and CORS for this origin.")}try{return i(),r.assertCurrent(),r.signal.throwIfAborted(),YA(s),Bf(s)||Vf(s,void 0,a),HA.observe?.({phase:"request",response:s,owner:i,httpSignal:a,transportSignal:r.signal}),s}catch(c){throw await(s.body?.cancel().catch(()=>{})),Jf(s),c}}async function eC(e,t){if(!e.body)throw Jf(e),new ys("response","The AI service returned no response body.");const n=Wf(e,t,Hf(e),()=>new ys("response","The AI service returned an incomplete JSON response.")),r=[];let i=0,a=null;try{for(;;){const e=await n.read();if(e.done)break;if(i+=e.value.byteLength,i>524288)throw new ys("response","The AI response exceeds the supported size.");r.push(e.value)}const e=new Uint8Array(i);let t=0;for(const n of r)e.set(n,t),t+=n.byteLength;try{a=JSON.parse((new TextDecoder).decode(e))}catch{throw new ys("response","The AI service returned an unreadable JSON response.")}await n.finish(i)}finally{try{await n.close()}finally{Jf(e)}}return t(),HA.observe?.({phase:"body",response:e,owner:t,bytes:i,format:"json"}),a}function tC(e,t,n,r){const i=Yl(e.baseUrl);if(t.origin!==i.origin||!t.pathname.startsWith(i.pathname))throw new ys("configuration","The AI request must stay within its configured endpoint.");r(),n.assertCurrent(),n.signal.throwIfAborted()}function nC(e){if(!/^[A-Za-z0-9_-]{1,128}$/.test(e))throw new ys("configuration","Invalid prediction ID.");return`predictions/${e}`}function rC(e){try{const t=Br(qr(),Zr()).parse(e);if((new TextEncoder).encode(JSON.stringify(t)).length>32768)throw new Error("Input too large");return t}catch{throw new ys("configuration","Prediction input must be a JSON object of at most 32 KiB.")}}function iC(e){const t=new Headers({"content-type":"application/json"});if("api-key"===e.authentication){if(!e.apiKey||e.apiKey.length>16384||!/^[!-~]+$/.test(e.apiKey))throw new ys("authentication","Enter a valid Replicate API token.");if(e.apiKey.length>=4&&[e.baseUrl,e.model].some(t=>t.includes(e.apiKey)))throw new ys("configuration","Keep the API token out of public connection fields.");t.set("authorization",`Bearer ${e.apiKey}`)}return t}async function aC(e,t,n,r,i,a,o){const s=new URL(t,Yl(e.baseUrl)),c=()=>{i(),r.assertCurrent(),r.signal.throwIfAborted()},l={method:n,headers:iC(e),signal:AbortSignal.any([r.signal,AbortSignal.timeout(6e4)]),credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"};let d;void 0!==a&&(l.body=JSON.stringify(a)),c();try{d=await r.fetch(s,l)}catch{throw c(),new ys("network","Could not reach Replicate. Check TLS, network permissions and CORS for this origin.")}c(),YA(d);const u=VS.safeParse(await eC(d,c));if(!u.success||void 0!==o&&u.data.id!==o)throw new ys("response","Replicate returned an invalid prediction response.");if(e.apiKey&&JSON.stringify(u.data).includes(e.apiKey))throw new ys("response","The AI service returned credential material.");return c(),u.data}function oC(e,t,n,r){return aC(e,nC(t),"GET",n,r,void 0,t)}function sC(e,t){return t.throwIfAborted(),new Promise((n,r)=>{const i=()=>{clearTimeout(a),t.removeEventListener("abort",i),r(new DOMException("Prediction waiting stopped.","AbortError"))},a=setTimeout(()=>{t.removeEventListener("abort",i),n()},e);t.addEventListener("abort",i,{once:!0})})}const cC=Ur({model:qr().min(1).max(160),messages:Kr([Ur({role:Dr("user"),content:qr().min(1).max(32768)}).strict()]),maxOutputTokens:Vr().int().min(1).max(4096).optional()}).strict();function lC(e){try{const t=cC.parse(e),n=Br(qr(),Zr()).parse(JSON.parse(t.messages[0].content));if((new TextEncoder).encode(JSON.stringify(n)).byteLength>32768)throw new Error("Input limit");return n}catch{throw new ys("configuration","Enter one model-specific prediction input JSON object of at most 32 KiB.")}}const dC={accessKeyId:"AWS access key ID",secretAccessKey:"AWS secret access key",sessionToken:"AWS session token (optional)"},uC=Ur({accessKeyId:qr().default(""),secretAccessKey:qr().default(""),sessionToken:qr().default("")}).strict();function pC({draft:e,busy:t,saved:n,onChange:r}){const i=e.bedrock,a=function(e){try{const t=uC.safeParse(JSON.parse(e));if(t.success)return t.data}catch{}return{accessKeyId:"",secretAccessKey:"",sessionToken:""}}(e.apiKey);return i?Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(O,{label:"AWS region",value:i.region,mono:!0,disabled:t,onValueChange:e=>r("bedrock",{...i,region:e})}),["accessKeyId","secretAccessKey","sessionToken"].map(e=>Ee.jsx(O,{label:dC[e],value:a[e],type:"password",autoComplete:"new-password",disabled:t,placeholder:n?"Saved in the owning vault; enter a replacement":void 0,onValueChange:t=>function(e,t){const n={...a,[e]:t},i={accessKeyId:n.accessKeyId,secretAccessKey:n.secretAccessKey};n.sessionToken&&(i.sessionToken=n.sessionToken),r("apiKey",JSON.stringify(i))}(e,t)},e))]}):null}function hC(){return Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Connection setup"}),Ee.jsx("p",{children:"Choose a model that supports text Converse in this AWS region. Enter your AWS access key ID and secret access key. Temporary credentials also need a session token. Credentials stay sealed in the owning vault; requests use the approved PWA network transport."}),Ee.jsx("p",{children:"Credentials need permission to invoke this model. Testing and saving send a short prompt with up to 16 output tokens. Changing the endpoint, region or model requires entering the credential again. Answers appear when the Converse request completes."})]})}function fC({draft:e,busy:t,onChange:n}){const r=Ce.useId();return"byo-ai"!==e.providerId||"gemini_generate_content"!==e.family?null:Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:r,children:"Endpoint type"}),Ee.jsxs("select",{id:r,value:e.vertex?"vertex":"standard",disabled:t,onChange:e=>{"vertex"===e.target.value?n("vertex",{project:"",location:"us-central1",credential:"service-account"}):"standard"===e.target.value&&n("vertex",void 0)},children:[Ee.jsx("option",{value:"standard",children:"Standard Gemini API"}),Ee.jsx("option",{value:"vertex",children:"Google Vertex AI"})]})]})}function mC({draft:e,busy:t,onChange:n,saved:r}){const i=Ce.useId(),a=Ce.useId(),o=e.vertex;return o?Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(O,{label:"Google Cloud project",value:o.project,disabled:t,mono:!0,onValueChange:e=>n("vertex",{...o,project:e})}),Ee.jsx(O,{label:"Vertex location",value:o.location,disabled:t,mono:!0,placeholder:"us-central1 or global",onValueChange:e=>n("vertex",{...o,location:e})}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:i,children:"Vertex authentication"}),Ee.jsxs("select",{id:i,value:o.credential,disabled:t,onChange:e=>{const t=e.target.value;"service-account"!==t&&"access-token"!==t||n("vertex",{...o,credential:t})},children:[Ee.jsx("option",{value:"service-account",children:"Service account"}),Ee.jsx("option",{value:"access-token",children:"Google access token"})]})]}),"service-account"===o.credential?Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:a,children:"Service account JSON"}),Ee.jsx("textarea",{id:a,autoComplete:"off",spellCheck:!1,rows:4,value:e.apiKey,disabled:t,placeholder:r?"Saved in the owning vault; enter a replacement":"Paste service-account JSON",onChange:e=>n("apiKey",e.target.value)})]}):Ee.jsx(O,{label:"Google access token",value:e.apiKey,type:"password",autoComplete:"new-password",disabled:t,placeholder:r?"Saved in the owning vault; enter a replacement":void 0,onValueChange:e=>n("apiKey",e)})]}):null}function gC({draft:e}){return Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Connection setup"}),Ee.jsx("p",{children:"The project, location and Gemini model are added under the API prefix. Responses appear when the request completes."}),Ee.jsx("p",{children:"service-account"===e.vertex?.credential?"The private key stays in this browser and signs a short-lived assertion for Google's token endpoint. Only the issued access token reaches the configured model endpoint.":"Supply a Google access token with Vertex permissions. The supplied token is not refreshed by this form."}),Ee.jsx("p",{children:"Testing and saving send a short prompt with up to 16 output tokens. The write-only credential is saved in the owning vault. Changing project, location, model, endpoint or authentication requires entering it again."})]})}function wC(e,t){return lC({model:e.model,messages:[{role:"user",content:t}]})}function vC(e,t){try{return wC(e,t),!0}catch{return!1}}function yC({label:e,value:t,busy:n,onChange:r}){return Ee.jsx(O,{label:e,value:t,disabled:n,mono:!0,autoComplete:"off",onValueChange:r})}function bC({draft:e,busy:t,onChange:n}){const r=Ce.useId();return ks(e.family)?Ee.jsx("p",{children:"Testing and saving generate an actual PNG from the verification prompt shown below and may incur service charges. The prompt and verification image are not saved. Cancel stops waiting and closes the request; it does not confirm that provider processing or charges stopped. The API key is sealed in the owning vault. Use the configured native Tailscale HTTP transport, or permit this browser origin and request headers for a direct browser connection."}):bs(e.family)?Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Connection setup"}),Ee.jsx("p",{children:"Choose a local sample to test or save this transcription connection. Both actions send audio only to the configured endpoint and consume its transcript; service charges may apply. Audio is transient and cleared after saving or locking. The API key is saved as a Token credential in the current vault. Use the configured native Tailscale HTTP transport, or permit this browser origin and headers for a direct browser connection."}),Is(e.family)?Ee.jsx("p",{children:"Testing and saving upload audio and create a remote transcription job. The app requests deletion before accepting a result. Cancel stops waiting and attempts to delete the owned transcript. Locking or leaving may prevent deletion. A deletion acknowledgment does not confirm that provider processing or charges stopped."}):null]}):"replicate_predictions"===e.family?Ee.jsx("p",{children:"Enter the model owner/name or an immutable version and its model-specific JSON input. Testing and saving create a real prediction, which may incur charges, and wait for terminal output. Verification input is transient and is not saved. Generated URLs are displayed as text. The API token stays in the owning vault."}):"bedrock_converse"===e.family?Ee.jsx(hC,{}):e.vertex?Ee.jsx(gC,{draft:e}):Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Connection setup"}),"openai_chat"===e.family?Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:r,children:"Output token parameter"}),Ee.jsxs("select",{id:r,value:e.tokenParameter,disabled:t,onChange:e=>{const t=e.target.value;"max_tokens"!==t&&"max_completion_tokens"!==t||n("tokenParameter",t)},children:[Ee.jsx("option",{value:"max_completion_tokens",children:"max_completion_tokens"}),Ee.jsx("option",{value:"max_tokens",children:"max_tokens"})]})]}):null,Ee.jsxs("p",{children:[e.azure?"Enter the Azure resource endpoint, including any custom mount. The operation adds /openai/v1 or the dated deployment path.":"The base URL includes the API prefix."," ","Use the configured native Tailscale HTTP transport, or permit this browser origin and request headers for a direct browser connection. The credential is saved as a Token credential in the current vault and sent only to the configured endpoint."]}),"entra-token"===e.azure?.credential?Ee.jsx("p",{children:"Supply an Entra access token. This form does not sign in or refresh it."}):null,Ee.jsx("p",{children:"Testing and saving send a short prompt with up to 16 output tokens. Changing the target or authentication requires entering the credential again."})]})}function kC(){const[e,t]=Ce.useState(),[n,r]=Ce.useState(""),[i,a]=Ce.useState(""),o=Ce.useRef(0),s=Ce.useRef(null),c=Ce.useCallback(()=>{o.current++,s.current?.abort(),s.current=null,t(void 0),r(""),a("")},[]);Ce.useLayoutEffect(()=>()=>{o.current++,s.current?.abort(),s.current=null},[]);const l=Ce.useCallback(e=>{c();const n=o.current;e&&(async()=>{let i;try{if(!e.size||e.size>KA)throw new Error("Local audio size bound");i=new FileReader,s.current=i;const a=await function(e,t){return new Promise((n,r)=>{t.onload=()=>{const e=t.result;e instanceof ArrayBuffer?n(new Uint8Array(e)):r(new Error("Unreadable local audio"))},t.onerror=t.onabort=()=>r(new Error("Local audio read ended")),t.readAsArrayBuffer(e)})}(e,i);if(n!==o.current)return;const c=VA({mimeType:e.type,bytes:a});t(c),r(e.name)}catch{n===o.current&&a("Choose a recognized local audio file within the 1 MiB recording/upload bound.")}finally{s.current===i&&(s.current=null)}})()},[c]);return{clear:c,fields:{sampleAudio:e,sampleLabel:n,sampleFailure:i,onSampleAudio:l}}}function xC({busy:e,label:t,sampleLabel:n,sampleFailure:r,onSampleAudio:i}){const a=Ce.useId(),o=Ce.useRef(null);return Ce.useLayoutEffect(()=>{!n&&o.current&&(o.current.value="")},[n]),Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:a,children:t}),Ee.jsx("input",{ref:o,id:a,type:"file",accept:"audio/wav,audio/webm,audio/ogg,audio/mp4,audio/mpeg",disabled:e,onChange:e=>i?.(e.target.files?.[0])})]}),n?Ee.jsx(O,{label:"Selected audio",value:n,readOnly:!0}):null,r?Ee.jsx(Oe,{tone:"err",label:r}):null]})}function IC({draft:e,busy:t,prompt:n,onPrompt:r,audio:i}){return bs(e?.family)?Ee.jsx(xC,{...i,busy:t,label:"Audio to transcribe"}):"replicate_predictions"===e?.family?Ee.jsx(yC,{label:"Prediction input JSON",value:n,busy:t,onChange:r}):Ee.jsx(O,{label:"Prompt",value:n,disabled:t,onValueChange:r})}function jC(e){const{draft:t,busy:n,onChange:r}=e,i="replicate_predictions"===t.family,a=bs(t.family),o=ks(t.family),s=function(e,t){try{const n=aA(e,!1);return"none"===n.authentication||Boolean(n.apiKey)||t}catch{return!1}}(t,e.canRetainCredential??e.saved)&&(!i||vC(t,e.predictionInput??""))&&(!a||Boolean(e.sampleAudio))&&(!o||Boolean(e.predictionInput?.trim()));return Ee.jsxs("form",{className:"cx-form panel__body","aria-label":"AI connection configuration",onSubmit:t=>{t.preventDefault(),s&&!n&&e.onSave()},children:[Ee.jsx(O,{label:"Connection name",value:t.name,disabled:n,onValueChange:e=>r("name",e)}),Ee.jsx(SC,{draft:t,busy:n,onChange:r}),Ee.jsx(AC,{draft:t,busy:n,onChange:r}),Ee.jsx(EC,{...e}),Ee.jsx(bC,{draft:t,busy:n,onChange:r}),a?Ee.jsx(xC,{...e,busy:n,label:"Verification audio"}):null,i?Ee.jsx(yC,{label:"Prediction verification input JSON",value:e.predictionInput??"",busy:n,onChange:e.onPredictionInput}):null,o?Ee.jsx(O,{label:"Verification image prompt",value:e.predictionInput??"",maxLength:8192,disabled:n,onValueChange:e.onPredictionInput}):null,Ee.jsx(_C,{...e,ready:s})]})}function _C(e){const{busy:t,ready:n}=e,r=bs(e.draft.family),i="replicate_predictions"===e.draft.family,a=ks(e.draft.family);return Ee.jsxs(U,{label:"Save AI connection",disabled:t||!n,busy:t,children:[Ee.jsx(B,{label:"Test AI connection",disabled:t||!n,onClick:e.onTest,children:Ee.jsx(ce,{size:16})}),(i||r||a)&&t&&e.onCancel?Ee.jsx(B,{label:a?"Cancel image generation":r?"Cancel transcription":"Cancel prediction",onClick:e.onCancel,children:Ee.jsx(H,{size:16})}):null,e.failure?Ee.jsx(Oe,{tone:"err",label:e.failure}):null,e.result?Ee.jsx(Oe,{tone:"ok",label:e.result}):null]})}function SC({draft:e,busy:t,onChange:n}){const r=Ce.useId(),i=Ce.useId(),a=["openai_chat","openai_responses"].includes(e.family);return Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:r,children:"API family"}),Ee.jsx("select",{id:r,value:e.family,disabled:t,onChange:e=>{const t=e.target.value;id(t)&&n("family",t)},children:ad(e.providerId).map(t=>Ee.jsx("option",{value:t.id,disabled:"dated-chat"===e.azure?.api&&"openai_responses"===t.id,children:t.label},t.id))})]}),Ee.jsx(fC,{draft:e,busy:t,onChange:n}),"byo-ai"===e.providerId&&a?Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:i,children:"Endpoint type"}),Ee.jsxs("select",{id:i,value:e.azure?"azure":"standard",disabled:t,onChange:e=>{"azure"===e.target.value?n("azure",{api:"v1",credential:"api-key"}):"standard"===e.target.value&&n("azure",void 0)},children:[Ee.jsx("option",{value:"standard",children:"Standard API"}),Ee.jsx("option",{value:"azure",children:"Azure OpenAI"})]})]}):null]})}function AC({draft:e,busy:t,onChange:n}){return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(O,{label:e.bedrock?"Bedrock runtime endpoint":e.vertex?"Vertex API base URL":e.azure?"Azure resource endpoint":"API base URL",value:e.baseUrl,type:e.azure||e.vertex||e.bedrock?"url":void 0,readOnly:["google-vertex","aws-bedrock"].includes(e.providerId),placeholder:e.azure?"https://your-resource.openai.azure.com":"https://models.example/v1",mono:!0,disabled:t,onValueChange:e=>n("baseUrl",e)}),Ee.jsx(O,{label:e.azure?"Deployment ID":"Model ID",value:e.model,mono:!0,disabled:t,onValueChange:e=>n("model",e)})]})}function CC({draft:e,busy:t,saved:n,onChange:r}){return"none"===e.authentication?null:Ee.jsx(O,{label:e.azure?"api-key"===e.azure.credential?"Azure API key":"Entra access token":"API key",value:e.apiKey,type:"password",autoComplete:"new-password",placeholder:n?"Saved in the owning vault; enter a replacement":void 0,disabled:t,onValueChange:e=>r("apiKey",e)})}function EC(e){const t=Ce.useId();return"replicate_predictions"===e.draft.family||bs(e.draft.family)||ks(e.draft.family)?Ee.jsx(CC,{...e}):"bedrock_converse"===e.draft.family?Ee.jsx(pC,{...e}):e.draft.vertex?Ee.jsx(mC,{...e}):Ee.jsxs(Ee.Fragment,e.draft.azure?{children:[Ee.jsx(TC,{...e}),Ee.jsx(NC,{...e}),Ee.jsx(CC,{...e})]}:{children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:t,children:"Authentication"}),Ee.jsxs("select",{id:t,value:e.draft.authentication,disabled:e.busy,onChange:t=>{const n=t.target.value;"api-key"!==n&&"none"!==n||e.onChange("authentication",n)},children:[Ee.jsx("option",{value:"api-key",children:"API key"}),Ee.jsx("option",{value:"none",children:"No authentication"})]})]}),Ee.jsx(CC,{...e})]})}function TC({draft:e,busy:t,onChange:n}){const r=Ce.useId(),i=e.azure;return i?Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:r,children:"Azure API mode"}),Ee.jsxs("select",{id:r,value:i.api,disabled:t,onChange:e=>{"v1"===e.target.value?n("azure",{api:"v1",credential:i.credential}):"dated-chat"===e.target.value&&n("azure",{api:"dated-chat",credential:i.credential,apiVersion:""})},children:[Ee.jsx("option",{value:"v1",children:"Azure OpenAI v1"}),Ee.jsx("option",{value:"dated-chat",children:"Dated Chat Completions"})]})]}),"dated-chat"===i.api?Ee.jsx(O,{label:"Azure API version",value:i.apiVersion,placeholder:"YYYY-MM-DD or YYYY-MM-DD-preview",mono:!0,disabled:t,onValueChange:e=>n("azure",{...i,apiVersion:e})}):null]}):null}function NC({draft:e,busy:t,onChange:n}){const r=Ce.useId(),i=e.azure;return i?Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:r,children:"Azure authentication"}),Ee.jsxs("select",{id:r,value:i.credential,disabled:t,onChange:e=>{const t=e.target.value;"api-key"!==t&&"entra-token"!==t||n("azure",{...i,credential:t})},children:[Ee.jsx("option",{value:"api-key",children:"API key"}),Ee.jsx("option",{value:"entra-token",children:"Entra access token"})]})]}):null}const zC={invalid_request:"The request is malformed.",invalid_grant:"The subject token is not valid.",invalid_scope:"The requested scope is not permitted.",invalid_target:"The requested resource is not permitted.",invalid_authorization_details:"The requested authorization details are not permitted.",invalid_dpop_proof:"The proof of possession is not valid.",unsupported_grant_type:"This grant type is not supported.",invalid_token:"The key is not valid.",insufficient_scope:"The key does not permit this request.",access_denied:"The request was not approved.",temporarily_unavailable:"Try again."};class $C extends Error{error;reason;constructor(e,t){super(zC[e]),this.name="ModelKeyRefusal",this.error=e,this.reason=t}toWire(){return{error:this.error,error_description:this.message}}}function PC(e,t){throw new $C(e,t)}function OC(e){return e instanceof $C}function RC(e,t){if(t>10&&PC("invalid_request","body.limits"),ni(e))e.length>65536&&PC("invalid_request","body.limits");else if(Array.isArray(e)){e.length>100&&PC("invalid_request","body.limits");for(const n of e)RC(n,t+1)}else if(ai(e)){const n=Object.entries(e);n.length>100&&PC("invalid_request","body.limits");for(const[e,r]of n)e.length>4096&&PC("invalid_request","body.limits"),RC(r,t+1)}}function LC(e){RC(e,0)}const UC=["none","auto","required"],DC=["AUTO","ANY","NONE","VALIDATED"];function qC(){return PC("insufficient_scope","body.tool")}function MC(e,t){if(!ai(e))return qC();for(const n of Object.keys(e))t.includes(n)||qC();return e}function KC(e){return Array.isArray(e)?e:qC()}function FC(e){(!ni(e)||e.length<1||e.length>128)&&qC()}function GC(e){void 0===e||ni(e)||qC()}function BC(e){ai(e)||qC()}function VC(e,t,n){return void 0!==e[t]&&void 0!==e[n]&&qC(),e[t]??e[n]}const HC="urn:ietf:params:oauth:token-type:access_token",JC=/^osk_[A-Za-z0-9_-]{43}$/,WC="model_access",ZC=["model.invoke","model.list"];function XC(e){return ZC.some(t=>t===e)}const YC=["requests","input_tokens","output_tokens"],QC="max_output_tokens",eE=[...YC,QC],tE=/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$/,nE=/^\/[A-Za-z0-9._:-]+(?:\/[A-Za-z0-9._:-]+)*$/,rE=/^\/models\/([A-Za-z0-9][A-Za-z0-9._-]{0,159}):generateContent$/,iE=new Set(["model","messages","max_tokens","max_completion_tokens","temperature","top_p","stop","seed","presence_penalty","frequency_penalty","tools","tool_choice","parallel_tool_calls","response_format","user","reasoning_effort","stream","n"]),aE=new Set(["model","messages","max_tokens","system","temperature","top_p","top_k","stop_sequences","tools","tool_choice","metadata","thinking","stream"]),oE=new Set(["contents","systemInstruction","generationConfig","tools","toolConfig","safetySettings"]),sE=new Set(["maxOutputTokens","temperature","topP","topK","stopSequences","candidateCount","responseMimeType","responseSchema","thinkingConfig","seed","presencePenalty","frequencyPenalty"]);function cE(e,t){return ai(e)?Object.fromEntries(Object.entries(e)):PC("invalid_request",t)}function lE(e,t){for(const n of Object.keys(e))t.has(n)||PC("insufficient_scope","body.field")}function dE(e,t){return!si(e)||!Number.isSafeInteger(e)||e<1?PC("invalid_request",t):e}function uE(e,t){const n=e[t];Array.isArray(n)&&0!==n.length||PC("invalid_request","body.messages")}function pE(e){const t=e.model;return ni(t)&&tE.test(t)?t:PC("invalid_request","body.model")}function hE(e){void 0!==e.stream&&!1!==e.stream&&PC("insufficient_scope","body.stream")}function fE(e){return Math.ceil((new TextEncoder).encode(JSON.stringify(e)).length/3)}function mE(e){const t=function(e){if(!ni(e)||e.length>256||!nE.test(e))return PC("insufficient_scope","call.route");for(const t of e.split("/"))if("."===t||".."===t)return PC("insufficient_scope","call.route");return e}(e.path),n=`${e.baseUrl}${t}`;if("list"===e.operation)return"GET"!==e.method||"/models"!==t||null!==(e.body??null)?PC("insufficient_scope","call.route"):{action:"model.list",method:"GET",url:n,model:null,body:null,outputTokens:null,inputEstimate:0};if("POST"!==e.method)return PC("insufficient_scope","call.route");const r=function(e){let t;try{t=JSON.stringify(e)}catch{return PC("invalid_request","body.json")}if(void 0===t)return PC("invalid_request","body.json");if((new TextEncoder).encode(t).length>131072)return PC("invalid_request","body.size");const n=cE(JSON.parse(t),"body.shape");return LC(n),n}(e.body);let i;if("gemini_generate_content"===e.protocol){const e=rE.exec(t)?.[1];if(void 0===e)return PC("insufficient_scope","call.route");i=function(e,t){lE(e,oE),function(e){if(void 0!==e.tools)for(const i of KC(e.tools)){const e=MC(i,["function_declarations","functionDeclarations"]);for(const t of KC(VC(e,"function_declarations","functionDeclarations"))){const e=MC(t,["name","description","parameters"]);FC(e.name),GC(e.description),void 0!==e.parameters&&BC(e.parameters)}}if(void 0===e.toolConfig)return;const t=VC(MC(e.toolConfig,["function_calling_config","functionCallingConfig"]),"function_calling_config","functionCallingConfig");if(void 0===t)return;const n=MC(t,["mode","allowed_function_names","allowedFunctionNames"]);void 0!==n.mode&&(ni(n.mode)&&DC.includes(n.mode)||qC());const r=VC(n,"allowed_function_names","allowedFunctionNames");if(void 0!==r)for(const i of KC(r))FC(i)}(e),Array.isArray(e.contents)&&0!==e.contents.length||PC("invalid_request","body.contents");const n=cE(e.generationConfig,"body.generationConfig");lE(n,sE),void 0!==n.candidateCount&&1!==n.candidateCount&&PC("insufficient_scope","body.n");const r=dE(n.maxOutputTokens,"body.maxOutputTokens");if(void 0!==n.thinkingConfig){const e=cE(n.thinkingConfig,"body.thinking");for(const n of Object.keys(e))"thinkingBudget"!==n&&PC("insufficient_scope","body.thinking");const t=e.thinkingBudget;void 0!==t&&(!si(t)||!Number.isSafeInteger(t)||t<0||t>r)&&PC("insufficient_scope","body.thinking")}return{model:t,outputTokens:r}}(r,e)}else if("openai_chat"===e.protocol){if("/chat/completions"!==t)return PC("insufficient_scope","call.route");i=function(e){lE(e,iE),function(e){if(void 0!==e.tools)for(const r of KC(e.tools)){const e=MC(r,["type","function"]);"function"!==e.type&&qC();const t=MC(e.function,["name","description","parameters"]);FC(t.name),GC(t.description),void 0!==t.parameters&&BC(t.parameters)}const t=e.tool_choice;if(void 0===t)return;if(ni(t))return void(UC.includes(t)||qC());const n=MC(t,["type","function"]);"function"!==n.type&&qC(),FC(MC(n.function,["name"]).name)}(e),hE(e),void 0!==e.n&&1!==e.n&&PC("insufficient_scope","body.n"),uE(e,"messages");const t=[e.max_tokens,e.max_completion_tokens].filter(e=>void 0!==e).map(e=>dE(e,"body.max_tokens"));return 0===t.length?PC("insufficient_scope","tokens.required"):{model:pE(e),outputTokens:Math.max(...t)}}(r)}else{if("/messages"!==t)return PC("insufficient_scope","call.route");i=function(e){lE(e,aE),function(e){if(void 0!==e.tools)for(const i of KC(e.tools)){const e=MC(i,["name","description","input_schema","type"]);FC(e.name),GC(e.description),BC(e.input_schema),void 0!==e.type&&"custom"!==e.type&&qC()}if(void 0===e.tool_choice)return;const t=MC(e.tool_choice,["type","name","disable_parallel_tool_use"]);var n;void 0===(n=t.disable_parallel_tool_use)||ci(n)||qC();const r=t.type;"tool"===r?FC(t.name):(void 0!==t.name||"auto"!==r&&"any"!==r&&"none"!==r)&&qC()}(e),hE(e),uE(e,"messages");const t=dE(e.max_tokens,"body.max_tokens");if(void 0!==e.thinking){const n=cE(e.thinking,"body.thinking");for(const e of Object.keys(n))"type"!==e&&"budget_tokens"!==e&&PC("insufficient_scope","body.thinking");const r=n.budget_tokens;void 0!==r&&dE(r,"body.thinking")>t&&PC("insufficient_scope","body.thinking")}return{model:pE(e),outputTokens:t}}(r)}return{action:"model.invoke",method:"POST",url:n,model:i.model,body:r,outputTokens:i.outputTokens,inputEstimate:fE(r)}}function gE(e){return null!==e&&ri(e)?Object.fromEntries(Object.entries(e)):null}function wE(e){return si(e)&&Number.isSafeInteger(e)&&e>=0?e:null}function vE(e,t,n){const r=gE(e);if(null===r)return null;const i=wE(r[t]),a=wE(r[n]);return null===i||null===a?null:{input:i,output:a}}let yE=null;function bE(e){return yE=e,()=>{yE===e&&(yE=null)}}function kE(){throw new ys("stale","External connectors changed. Reconnect this AI service.")}function xE(){const e=yE;if(!e)throw new ys("stale","Enable External connectors before connecting an AI service.");return e.assertCurrent(),e.signal.throwIfAborted(),yE!==e?kE():e}function IE(e){return{fetch:e.fetch,signal:e.signal,assertCurrent:e.assertCurrent,capture:e.capture,assertEndpointAllowed:e.assertEndpointAllowed}}function jE(e,t){e.fetch===t.fetch&&e.signal===t.signal&&e.assertCurrent===t.assertCurrent&&e.capture===t.capture&&e.assertEndpointAllowed===t.assertEndpointAllowed||kE()}function _E(){const e=xE(),t=IE(e),n=()=>{yE!==e&&kE(),jE(e,t),t.assertCurrent.call(e),t.signal.throwIfAborted(),yE!==e&&kE(),jE(e,t)};n();const r=t.capture?.call(e)??e;return n(),function(e,t){const n=IE(e),r=()=>{t(),jE(e,n),n.assertCurrent.call(e),n.signal.throwIfAborted(),t(),jE(e,n)},i={signal:n.signal,assertCurrent:r,fetch:(t,i)=>(r(),n.fetch.call(e,t,i))},a=n.assertEndpointAllowed;return a&&(i.assertEndpointAllowed=t=>{r(),a.call(e,t),r()}),r(),Object.freeze(i)}(r,n)}const SE=async function(){const{vaultStore:e}=await Mo(async()=>{const{vaultStore:e}=await import("./drop-open-BjgdLxWM.js").then(e=>e.gn);return{vaultStore:e}},[]),t=at(e),n=t.current();if(n.guest)throw t.close(),new ys("configuration","Unlock a real vault before configuring an AI connection.");const r=new AbortController,i=e.onLock(()=>r.abort());let a=!1;return{tomb:n.tomb,signal:r.signal,check(){t.current(),r.signal.throwIfAborted()},close(e=!1){a||(a=!0,e||r.abort(),i(),t.close())}}};function AE(){throw new ys("authentication","Configured AI delegation requires a verified vault key and its exact canonical catalog protocol and endpoint.")}function CE(e){const t=function(e){const t=wA(e);return!t||"api-key"!==t.authentication||"openai_responses"===t.family||"bedrock_converse"===t.family||"replicate_predictions"===t.family||bs(t.family)||ks(t.family)?AE():t}(e),n=Fl(t.providerId);if(!n?.baseUrl||n.protocol!==t.family||Yl(n.baseUrl).href!==Yl(t.baseUrl).href)return AE();const r=Gn({family:"AI",accepts:e=>e===t.providerId,classification:pA},e,!0),i=r.configuration.parameters.vault_tomb,a=r.privateState.credentials.ai_credential_reference;if(!i||!a)return AE();const o=Ss(decodeURIComponent(a),lA(t),["apiKey"],i),s=o.fields.get("apiKey");return s&&dA(s)===r.privateState.credentials.ai_credential_digest?(t.apiKey=s,{draft:t,record:r,capture:o,tomb:i,baseUrl:Yl(n.baseUrl).href.replace(/\/$/,""),protocol:t.family}):AE()}function EE(e){try{return CE(e),!0}catch{return!1}}function TE(e,t){const n=WA(e.draft);for(const[r,i]of Object.entries(t.headers??{}))if(!r.toLowerCase().startsWith("anthropic-")||n.get(r)!==i)return AE();return n}function NE(e,t){try{LC(ii(e))}catch{throw new gr("response")}const n=JSON.stringify(e);if(!n||n.includes(t)||n.includes(JSON.stringify(t).slice(1,-1)))throw new gr("response")}async function zE(e,t,n,r,i){const a=_E(),o=await SE();try{a.assertCurrent();const c=AbortSignal.any([o.signal,a.signal,i.signal]),l=()=>{o.check(),a.assertCurrent(),i.assertCurrent(),c.throwIfAborted()};l(),await Ts(),l();const d=CE(e);if(o.tomb!==d.tomb)return AE();const u=()=>{Es(d.capture,o.tomb,l);const t=CE(e);if(t.record.revision!==d.record.revision||t.record.configuration.fingerprint!==d.record.configuration.fingerprint)throw new ys("stale","This delegated AI connection changed. Configure and authorize it again.")};u();const{inspected:p,headers:h}=function(e,t,n){const r=new URL(e.baseUrl);if(t.providerId!==e.draft.providerId||void 0!==t.origin&&t.origin!==r.origin)return AE();const i="/"===r.pathname?"":r.pathname;if(!t.path.startsWith(`${i}/`)||/[?#\\\r\n]/.test(t.path))return AE();if("model.inference"!==t.operationId&&"model.list"!==t.operationId)return AE();const a=mE({protocol:e.protocol,baseUrl:e.baseUrl,operation:"model.list"===t.operationId?"list":"invoke",method:t.method,path:t.path.slice(i.length),body:n});return null!==a.model&&a.model!==e.draft.model?AE():{inspected:a,headers:TE(e,t)}}(d,t,n);NE(p.body,d.draft.apiKey);const f={revision:d.record.revision,fingerprint:d.record.configuration.fingerprint};await rn(e,f),u();const m={assertCurrent:u,fetch:async(e,n)=>(u(),t.onDispatch?.(),a.fetch(p.url,n))};try{const t={url:p.url,method:p.method,headers:h,signal:c},n=await mr(null===p.body?t:{...t,body:JSON.stringify(p.body)},m);let i;u(),await rn(e,f),u(),NE(n,d.draft.apiKey);try{i=r(n)}catch{throw new gr("response")}return NE(i,d.draft.apiKey),u(),i}catch(s){throw s instanceof gr&&"authorization"===s.code&&(u(),await Bn(pA,d.record,m)),s}}finally{o.close()}}const $E="https://",PE=/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/,OE=/^[A-Za-z0-9._~!$&'()+,;=:@-]+$/;function RE(e){return""!==e&&"."!==e&&".."!==e&&OE.test(e)}function LE(e){if(!function(e){return ni(e)&&e.length>0&&e.length<=512}(e))return PC("invalid_target","resource.shape");if(function(e){for(let t=0;t<e.length;t++){const n=e.charCodeAt(t);if(n<=32||127===n||92===n||37===n)return!0}return!1}(e)||!e.startsWith($E))return PC("invalid_target","resource.scheme");const t=function(e){try{return new URL(e)}catch{return PC("invalid_target","resource.parse")}}(e),n=e.slice(8);if(function(e){return[e.username,e.password,e.search,e.hash,e.port].some(e=>""!==e)}(t)||function(e){return["?","#","@"].some(t=>e.includes(t))}(n))return PC("invalid_target","resource.parts");const{host:r,path:i}=function(e){const t=e.indexOf("/");return-1===t?{host:e,path:""}:{host:e.slice(0,t),path:e.slice(t)}}(n);return function(e,t){return e===e.toLowerCase()&&PE.test(e)&&e===t.host}(r,t)?(function(e){"/"===e&&PC("invalid_target","resource.trailing_slash"),""===e||e.slice(1).split("/").every(RE)||PC("invalid_target","resource.path")}(i),`${$E}${r}${i}`):PC("invalid_target","resource.host")}const UE=new Set(["type","locations","actions","models","budget","lifetime_seconds"]),DE=/^(?:\*|[A-Za-z0-9][A-Za-z0-9._:-]*(?:\/[A-Za-z0-9][A-Za-z0-9._:-]*)*(?:\/\*)?)$/;function qE(e){if(!ai(e))return PC("invalid_authorization_details","detail.shape");const t=Object.getPrototypeOf(e);return t!==Object.prototype&&null!==t?PC("invalid_authorization_details","detail.shape"):Object.fromEntries(Object.entries(e))}function ME(e,t,n,r){return!si(e)||!Number.isSafeInteger(e)||e<t||e>n?PC("invalid_authorization_details",r):e}function KE(e,t,n){if(!Array.isArray(e)||0===e.length||e.length>t)return PC("invalid_authorization_details",n);const r=[];for(const i of e){if(!ni(i)||r.includes(i))return PC("invalid_authorization_details",n);r.push(i)}return r}function FE(e){const t=qE(e),n={};for(const[r,i]of Object.entries(t)){if(!eE.includes(r))return PC("invalid_authorization_details","budget.key");n[r]=ME(i,r===QC?1:0,1e9,"budget.value")}return 0===Object.keys(n).length?PC("invalid_authorization_details","budget.empty"):n}function GE(e){return e.length<=160&&DE.test(e)}function BE(e){const t=KE(e,32,"models.shape");for(const n of t)if(!GE(n))return PC("invalid_authorization_details","models.entry");return t}function VE(e){const t=[];for(const n of KE(e,4,"actions.shape")){if(!XC(n))return PC("invalid_authorization_details","actions.unknown");t.push(n)}return t}function HE(e){if(1!==e.length)return PC("invalid_authorization_details","details.count");const t=qE(e[0]);if(t.type!==WC)return PC("invalid_authorization_details","detail.type");for(const n of Object.keys(t))if(!UE.has(n))return PC("invalid_authorization_details","detail.member");try{!function(e,t="$"){const n=[{value:e,path:t,depth:0}],r=new WeakSet;for(;n.length>0;){const e=n.pop();if(void 0===e)break;const t=e.value;if(ni(t)){if(Ws(t))throw new Xs(`${e.path} carries a value shaped like a primary account number`);continue}if(null===t||!ri(t))continue;if(e.depth>=64)throw new Xs(`${e.path} nests deeper than 64 levels, so it cannot be checked`);const i=ii(t);if(r.has(i))throw new Xs(`${e.path} contains a cycle, so it cannot be checked`);if(r.add(i),Array.isArray(t)){for(let r=t.length-1;r>=0;r-=1){const i=t[r];void 0!==i&&n.push({value:i,path:Ys(e.path,`[${r}]`),depth:e.depth+1})}continue}const a=Object.entries(ii(t));for(const[r,o]of a){const t=Zs(r);if(Hs.some(e=>e.test(t)))throw new Xs(`${Ys(e.path,`.${r}`)} names card data, which never enters an authorization detail`);void 0!==o&&n.push({value:o,path:Ys(e.path,`.${r}`),depth:e.depth+1})}}}(t)}catch{return PC("invalid_authorization_details","detail.payment")}return{locations:void 0===t.locations?[]:KE(t.locations,1,"locations.shape").map(LE),actions:void 0===t.actions?null:VE(t.actions),models:void 0===t.models?null:BE(t.models),budget:void 0===t.budget?null:FE(t.budget),lifetimeSeconds:void 0===t.lifetime_seconds?null:ME(t.lifetime_seconds,1,86400,"lifetime")}}const JE=[{id:"small",label:"Small",budget:{requests:25,input_tokens:25e3,output_tokens:12500,max_output_tokens:1024}},{id:"medium",label:"Medium",budget:{requests:200,input_tokens:2e5,output_tokens:1e5,max_output_tokens:4096}},{id:"large",label:"Large",budget:{requests:1e3,input_tokens:1e6,output_tokens:5e5,max_output_tokens:8192}}],WE=[{seconds:3600,label:"1 hour"},{seconds:28800,label:"8 hours"}],ZE=/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/;function XE(e){const t=`model:${e.providerId}/`;return e.models.map(e=>e.startsWith(t)?e.slice(t.length):e)}function YE(e,t){const n=e-t;return n<=0?"ended":n<6e4?"under a minute":n<36e5?`${Math.floor(n/6e4)} min`:`${Math.floor(n/36e5)} h`}function QE(e){return`${e.remaining.requests.toLocaleString("en-US")} requests left`}let eT=[];function tT(){eT=[]}const nT=new Set(["kty","crv","x","y"]),rT=/^[A-Za-z0-9._~-]{16,128}$/,iT=/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;function aT(e){return PC("invalid_dpop_proof",`dpop.${e}`)}class oT{constructor(e=4096){this.capacity=e}capacity;seen=new Map;claim(e,t,n){this.seen.size>=this.capacity/2&&this.purge(n),this.seen.has(e)&&aT("replay"),this.seen.size>=this.capacity&&aT("cache_full"),this.seen.set(e,t)}purge(e){for(const[t,n]of this.seen)n<=e&&this.seen.delete(t)}clear(){this.seen.clear()}get size(){return this.seen.size}}function sT(e){try{const t=new URL(e);return`${t.origin}${t.pathname}`}catch{return aT("htu_unparsable")}}async function cT(e){const{proof:t}=e;if(!function(e){return ni(e)&&e.length>0&&e.length<=4096&&iT.test(e)}(t))return aT("shape");!function(e){let t;try{t=Os(e)}catch{aT("header")}"dpop+jwt"!==t.typ&&aT("typ"),"ES256"!==t.alg&&aT("alg"),function(e){ri(e)&&null!==e||aT("jwk");for(const t of Object.keys(e))nT.has(t)||aT("jwk_members");"kty"in e&&"EC"===e.kty&&"crv"in e&&"P-256"===e.crv||aT("jwk_type")}(t.jwk)}(t);const n=await async function(e,t){try{const{payload:n}=await Zo(e,lc,{algorithms:["ES256"],typ:"dpop+jwt",currentDate:new Date(t)});return ii(n)}catch(n){if(n instanceof $C)throw n;return aT(n instanceof Xo?"iat"===n.claim?"iat":"claims":n instanceof Yo?"exp":"signature")}}(t,e.now),r=function(e,t){const{jti:n,htm:r,htu:i}=e;return ni(n)&&rT.test(n)?ni(r)&&r===t.method.toUpperCase()?ni(i)&&sT(i)===sT(t.url)?n:aT("htu"):aT("htm"):aT("jti")}(n,e),{iat:i,ath:a}=n;if(!function(e,t){const n=Math.floor(t/1e3);return si(e)&&Number.isInteger(e)&&e>=n-300&&e<=n+60}(i,e.now))return aT("iat");if(!ni(a)||a!==await(o=e.token,pr(o)))return aT("ath");var o;const s=await async function(e,t){const{jwk:n}=Os(e);if(!n)return aT("jwk");const r=await ts(n,"sha256");return void 0!==t&&r!==t?aT("key_mismatch"):r}(t,e.expectedJkt);return e.replay.claim(`${s}:${r}`,1e3*(i+300)+6e4,e.now),{jkt:s,jti:r}}class lT{byId=new Map;byDigest=new Map;highWater=0;clock(e){return this.highWater=Math.max(this.highWater,e),this.highWater}get size(){return this.byId.size}find(e){return this.byId.get(e)??null}findByDigest(e){const t=this.byDigest.get(e);return void 0===t?null:this.byId.get(t)??null}records(){return[...this.byId.values()]}children(e){return this.records().filter(t=>t.grant.parentGrantId===e)}liveChildren(e,t){return this.children(e).filter(e=>this.isActiveSelf(e,t))}isActive(e,t){let n=e;for(;n;){const{notBefore:e,expiresAt:r}=n.grant.constraints;if(null!==n.revokedAt||t>=r.getTime()||null!==e&&t<e.getTime())return!1;const i=n.grant.parentGrantId;if(n=null===i?null:this.find(i),null!==i&&null===n)return!1}return!0}add(e){this.byId.size>=256&&PC("temporarily_unavailable","ledger.full"),this.byId.set(e.id,e),this.byDigest.set(e.digest,e.id)}revoke(e,t){const n=this.find(e);if(!n)return[];const r=[],i=e=>{for(const t of this.children(e.id))i(t);null===e.revokedAt&&(e.revokedAt=t,r.push(e))};return i(n),this.reclaim(t),r.map(e=>e.id)}reclaim(e){const t=this.records().filter(t=>!t.returned&&!this.isActiveSelf(t,e)).sort((e,t)=>t.grant.delegationDepth-e.grant.delegationDepth);for(const n of t){const e=n.grant.parentGrantId?this.find(n.grant.parentGrantId):null;if(e&&!e.returned)for(const t of YC)e.remaining[t]+=n.remaining[t];for(const t of YC)n.remaining[t]=0;n.returned=!0}}purge(){for(const e of this.records())e.returned&&0===e.inflight&&this.children(e.id).every(e=>e.returned)&&(this.byId.delete(e.id),this.byDigest.delete(e.digest))}clear(){this.byId.clear(),this.byDigest.clear()}isActiveSelf(e,t){return null===e.revokedAt&&t<e.grant.constraints.expiresAt.getTime()}view(e,t){const{grant:n}=e,r=null!==e.revokedAt;return{id:e.id,parentId:n.parentGrantId,clientId:n.clientId??"",providerId:e.provider.providerId,connectionId:n.connectionId??"",actions:n.actions,models:n.resources,remaining:{...e.remaining},maxOutputTokens:n.constraints.budgets.max_output_tokens??0,depth:n.delegationDepth,bound:null!==n.proofKeyThumbprint,expiresAt:n.constraints.expiresAt.getTime(),status:r?"revoked":this.isActive(e,t)?"active":"expired"}}}function dT(e,t,n){try{e.ports.audit({...t,at:n})}catch{}}async function uT(e){const t=`osk_${e.ports.random(32)}`;if(!JC.test(t))throw new Error("the random port returned a malformed key");return{token:t,digest:await e.ports.sha256(t)}}function pT(e){return`mk_${e.ports.random(12)}`}function hT(e,t,n,r){let i={type:e,reason:t.reason};return n&&(i={...i,keyId:n.id,providerId:n.provider.providerId}),r&&(i={...i,clientId:r}),i}function fT(e){return OC(e)?e:null}function mT(e,t,n){const r=e.ledger.findByDigest(t);return r&&e.ledger.isActive(r,n)?r:PC("invalid_token","key.inactive")}function gT(e,t){const n=[];for(const r of t){const t=`model:${e}/${r}`;try{nc(t)}catch{return PC("invalid_authorization_details","models.selector")}n.includes(t)||n.push(t)}return n}const wT=new Set(["grant_type","subject_token","subject_token_type","requested_token_type","resource","audience","scope","authorization_details","dpop_jkt"]),vT=new Set(["actor_token","actor_token_type"]),yT=/^[A-Za-z0-9][A-Za-z0-9:._-]{0,63}$/,bT=/^[A-Za-z0-9_-]{43}$/,kT=/^urn:opensesame:model:[a-z0-9][a-z0-9-]{0,63}$/;function xT(e){if(void 0===e)return null;const t=e.split(" ");if(t.length>8||t.some(e=>!yT.test(e)))return PC("invalid_scope","scope.shape");const n=[];for(const r of t){if(!XC(r))return PC("invalid_scope","scope.unknown");if(n.includes(r))return PC("invalid_scope","scope.duplicate");n.push(r)}return n}function IT(e){if(void 0===e)return null;let t;try{t=JSON.parse(e)}catch{return PC("invalid_authorization_details","details.json")}return!Array.isArray(t)||0===t.length||t.length>4?PC("invalid_authorization_details","details.shape"):t}function jT(e,t,n,r){const i=e.ledger.findByDigest(t);if(!i)return PC("invalid_grant","subject.unknown");if(!e.ledger.isActive(i,r))return PC("invalid_grant","subject.inactive");if(i.grant.clientId!==n)return PC("invalid_grant","subject.foreign_client");const a=e.ports.connection(i.grant.connectionId??"");return a&&a.verified&&a.providerId===i.provider.providerId?i:PC("invalid_grant","connection.unavailable")}function _T(e,t){const n=`model:${t}/`;return e.map(e=>e.slice(n.length))}const ST=/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/;function AT(e,t){return t(function(e){return JSON.stringify(["opensesame:model-grant:v1",e.issuerPrincipalId,e.organizationId,e.clientId,e.connectionId,e.resource,[...e.actions].sort(),[...e.models].sort(),e.budget.requests,e.budget.input_tokens,e.budget.output_tokens,e.budget.max_output_tokens,e.lifetimeSeconds,e.maximumDelegationDepth,e.dpopJkt])}(e))}const CT={senderConstraint:"dpop_required",rootMaxLifetimeSeconds:28800,maxLifetimeSeconds:3600,defaultLifetimeSeconds:900,maxDelegationDepth:2,outputTokenCeiling:32768},ET={now:()=>Date.now(),random:e=>hr(e),sha256:e=>pr(e)},TT=new WeakSet;class NT{core;constructor(e,t=CT){this.core=function(e,t){return{ledger:new lT,replay:new oT,ports:e,policy:t,reservations:new Map}}(e,t)}async issueRoot(e,t){if("ModelGrantApproved"!==t.kind)return PC("access_denied","approval.missing");if(TT.has(e))return PC("access_denied","approval.spent");const{core:n}=this,r=n.ledger.clock(n.ports.now()),i=function(e,t,n){!function(e){[e.issuerPrincipalId,e.organizationId,e.clientId,e.connectionId].every(e=>ST.test(e))||PC("invalid_request","draft.identifier")}(e);const r=LE(e.resource),i=t.providerForResource(r);return i?(function(e,t,n){const r=n.connection(e.connectionId);r&&r.providerId===t.providerId&&r.verified||PC("invalid_target","draft.connection")}(e,i,t),function(e,t){const n=HE([{type:WC,locations:[t],actions:[...e.actions],models:[...e.models],budget:{...e.budget},lifetime_seconds:e.lifetimeSeconds}]).budget;n&&!YC.some(e=>void 0===n[e])||PC("invalid_authorization_details","budget.required")}(e,r),function(e,t){e.budget.max_output_tokens>t.outputTokenCeiling&&PC("invalid_authorization_details","budget.ceiling"),e.lifetimeSeconds>t.rootMaxLifetimeSeconds&&PC("invalid_authorization_details","lifetime.ceiling")}(e,n),function(e,t){const n=Math.min(t.maxDelegationDepth,3);(!Number.isInteger(e.maximumDelegationDepth)||e.maximumDelegationDepth<0||e.maximumDelegationDepth>n)&&PC("invalid_request","draft.depth")}(e,n),"dpop_required"===n.senderConstraint&&null===e.dpopJkt?PC("invalid_dpop_proof","dpop.required"):{provider:i,selectors:gT(i.providerId,e.models)}):PC("invalid_target","draft.resource")}(e.value,n.ports,n.policy);TT.add(e);const a=await uT(n),o=n.ledger.clock(n.ports.now()),s=function(e,t,n){const r={id:n.id,version:1,issuerPrincipalId:e.issuerPrincipalId,beneficiaryPrincipalId:e.issuerPrincipalId,actorId:e.clientId,clientId:e.clientId,actorInstanceId:null===e.dpopJkt?null:`jkt:${e.dpopJkt}`,proofKeyThumbprint:e.dpopJkt,organizationId:e.organizationId,projectId:null,environmentId:null,connectionId:e.connectionId,actions:[...e.actions],resources:[...t.selectors],constraints:{audiences:[t.provider.baseUrl],notBefore:null,expiresAt:new Date(n.now+1e3*e.lifetimeSeconds),requiredAssurance:"phishing-resistant",authenticationMaxAgeSeconds:300,allowedNetworks:[],parameterRulesDigest:null,budgets:{requests:e.budget.requests,input_tokens:e.budget.input_tokens,output_tokens:e.budget.output_tokens,[QC]:e.budget.max_output_tokens},maximumDelegationDepth:e.maximumDelegationDepth,offlineUse:"forbidden",rawCredentialExport:!1},parentGrantId:null,delegationDepth:0,createdAt:new Date(n.now),revokedAt:null};return{id:n.id,digest:n.digest,grant:r,provider:t.provider,rootId:n.id,actors:[{clientId:e.clientId,keyThumbprint:e.dpopJkt}],remaining:{requests:e.budget.requests,input_tokens:e.budget.input_tokens,output_tokens:e.budget.output_tokens},inflight:0,revokedAt:null,returned:!1}}(e.value,i,{id:pT(n),digest:a.digest,now:o});return n.ledger.reclaim(o),n.ledger.purge(),n.ledger.add(s),dT(n,{type:"root.issued",keyId:s.id,clientId:e.value.clientId,providerId:s.provider.providerId},r),{token:a.token,id:s.id,expiresAt:s.grant.constraints.expiresAt.getTime()}}exchange(e,t){return async function(e,t,n){const r=e.ledger.clock(e.ports.now());let i=null;try{const a=function(e){const t=function(e){if(!ai(e))return PC("invalid_request","request.shape");const t=Object.getPrototypeOf(e);if(t!==Object.prototype&&null!==t)return PC("invalid_request","request.shape");const n=Object.entries(e);if(0===n.length||n.length>16)return PC("invalid_request","request.size");const r=Object.create(null);for(const[i,a]of n){if(vT.has(i))return PC("invalid_request",`param.${i}`);if(!wT.has(i))return PC("invalid_request","param.unknown");if(!ni(a)||a.length>4096)return PC("invalid_request","param.value");r[i]=a}return r}(e);if("urn:ietf:params:oauth:grant-type:token-exchange"!==t.grant_type)return PC("unsupported_grant_type","grant_type");const n=t.subject_token;if(void 0===n||void 0===t.subject_token_type)return PC("invalid_request","subject.missing");if(t.subject_token_type!==HC)return PC("invalid_request","subject.type");if(void 0!==t.requested_token_type&&t.requested_token_type!==HC)return PC("invalid_request","requested.type");if(!JC.test(n))return PC("invalid_grant","subject.shape");const r=t.audience;if(void 0!==r&&!kT.test(r))return PC("invalid_target","audience.shape");const i=t.dpop_jkt;return void 0===i||bT.test(i)?{subjectToken:n,resource:void 0===t.resource?null:LE(t.resource),audienceProvider:r?r.slice(21):null,actions:xT(t.scope),details:IT(t.authorization_details),dpopJkt:i??null}:PC("invalid_request","dpop_jkt.shape")}(t),o=a.details?HE(a.details):null,s=await e.ports.sha256(a.subjectToken);i=jT(e,s,n.clientId,r);const c=await async function(e,t,n,r,i){const a=t.grant.proofKeyThumbprint;if(void 0===r.dpopProof)return null!==a?PC("invalid_dpop_proof","dpop.required"):null;const o={proof:r.dpopProof,method:"POST",url:r.endpoint,token:n.subjectToken,now:i,replay:e.replay};return(await cT(null===a?o:{...o,expectedJkt:a})).jkt}(e,i,a,n,r),l=a.dpopJkt??c;if(null===l&&"dpop_required"===e.policy.senderConstraint)return PC("invalid_dpop_proof","dpop.required");const d=await uT(e),u=e.ledger.clock(e.ports.now());if(i=jT(e,s,n.clientId,u),e.ledger.reclaim(u),e.ledger.liveChildren(i.id,u).length>=32)return PC("access_denied","children.limit");const p=function(e,t,n,r){const{grant:i}=e,a=i.delegationDepth+1;a>Math.min(i.constraints.maximumDelegationDepth,r.policy.maxDelegationDepth)&&PC("invalid_grant","depth.exceeded"),function(e,t,n){const r=[t.resource,n?.locations[0]??null].filter(e=>null!==e);new Set(r).size>1&&PC("invalid_target","resource.disagree"),void 0!==r[0]&&r[0]!==e.provider.baseUrl&&PC("invalid_target","escalation.resource"),null!==t.audienceProvider&&t.audienceProvider!==e.provider.providerId&&PC("invalid_target","escalation.resource")}(e,t,n);const o=function(e,t,n){const r=t.actions,i=n?.actions??null;if(r&&i&&((a=r).length!==(o=i).length||!a.every(e=>o.includes(e))))return PC("invalid_request","actions.disagree");var a,o;const s=e.grant.actions,c=i??r??s.filter(e=>"model.invoke"===e||"model.list"===e);if(0===c.length)return PC("invalid_scope","actions.empty");for(const l of c)if(!s.includes(l))return PC("invalid_scope","escalation.actions");return[...c]}(e,t,n),s=function(e,t){if(null==t?.models)return[...e.grant.resources];const n=gT(e.provider.providerId,t.models);return ac(n,e.grant.resources)?n:PC("invalid_authorization_details","escalation.models")}(e,n),{allocation:c,cap:l}=function(e,t,n){const r=t?.budget;if(!r)return PC("invalid_authorization_details","budget.required");const i=function(e){const{requests:t,input_tokens:n,output_tokens:r}=e;return void 0===t||void 0===n||void 0===r?PC("invalid_authorization_details","budget.required"):{requests:t,input_tokens:n,output_tokens:r}}(r);for(const s of YC){if(i[s]>(e.grant.constraints.budgets[s]??0))return PC("invalid_authorization_details","escalation.budget");if(i[s]>e.remaining[s])return PC("invalid_authorization_details","escalation.budget_remaining")}const a=e.grant.constraints.budgets[QC]??0,o=r[QC]??a;return o>a||o>n.outputTokenCeiling?PC("invalid_authorization_details","escalation.budget"):{allocation:i,cap:o}}(e,n,r.policy),d=function(e,t,n,r){const i=t-r;if(i<=0)return PC("invalid_grant","subject.inactive");const a=1e3*(e??n.defaultLifetimeSeconds),o=1e3*Math.min(n.maxLifetimeSeconds,86400);return Math.min(a,o,i)}(n?.lifetimeSeconds??null,i.constraints.expiresAt.getTime(),r.policy,r.now),u={...i,id:r.id,version:1,actorId:r.requesterClientId,actorInstanceId:null===r.bindTo?null:`jkt:${r.bindTo}`,proofKeyThumbprint:r.bindTo,actions:o,resources:s,constraints:{...i.constraints,notBefore:null,expiresAt:new Date(r.now+d),budgets:{...c,[QC]:l},rawCredentialExport:!1},parentGrantId:i.id,delegationDepth:a,createdAt:new Date(r.now),revokedAt:null};try{!function(e,t){t.parentGrantId!==e.id&&oc("parent_grant_id mismatch",{expected:e.id,got:t.parentGrantId}),t.organizationId!==e.organizationId&&oc("organization_id changed"),t.delegationDepth!==e.delegationDepth+1&&oc("delegation_depth not parent+1",{parent:e.delegationDepth,child:t.delegationDepth}),t.delegationDepth>e.constraints.maximumDelegationDepth&&oc("delegation_depth exceeds parent maximum",{depth:t.delegationDepth,maximum:e.constraints.maximumDelegationDepth}),ic(t.actions,e.actions)||oc("actions expanded"),ac(t.resources,e.resources)||oc("resources expanded"),e.constraints.audiences.length>0&&(0===t.constraints.audiences.length&&oc("audiences cleared under restricted parent"),ic(t.constraints.audiences,e.constraints.audiences)||oc("audiences expanded")),function(e,t){!function(e,t){t.expiresAt.getTime()>e.expiresAt.getTime()&&oc("lifetime expanded"),null!==e.notBefore&&(null===t.notBefore?oc("not_before omitted under restricted parent"):t.notBefore.getTime()<e.notBefore.getTime()&&oc("not_before earlier than parent")),null!==t.notBefore&&t.expiresAt.getTime()<=t.notBefore.getTime()&&oc("empty or inverted validity interval")}(e,t),function(e,t){if(null===e.requiredAssurance)return;null===t.requiredAssurance&&oc("required_assurance dropped");const n=sc(e.requiredAssurance),r=sc(t.requiredAssurance);(null===n||null===r||r<n)&&oc("required_assurance weakened")}(e,t),function(e,t){null!==e.authenticationMaxAgeSeconds&&(null===t.authenticationMaxAgeSeconds?oc("authentication_max_age omitted"):t.authenticationMaxAgeSeconds>e.authenticationMaxAgeSeconds&&oc("authentication_max_age expanded"))}(e,t),e.allowedNetworks.length>0&&!ic(t.allowedNetworks,e.allowedNetworks)&&oc("allowed_networks expanded"),null!==e.parameterRulesDigest&&t.parameterRulesDigest!==e.parameterRulesDigest&&oc("parameter_rules_digest changed"),cc(t.offlineUse)>cc(e.offlineUse)&&oc("offline_use relaxed"),t.rawCredentialExport&&!e.rawCredentialExport&&oc("raw_credential_export enabled"),function(e,t){for(const[n,r]of Object.entries(e.budgets)){const e=t.budgets[n];void 0===e?oc("budget key omitted",{key:n}):e>r?oc("budget expanded",{key:n}):(!Number.isInteger(e)||e<0)&&oc("budget malformed",{key:n})}}(e,t),t.maximumDelegationDepth>e.maximumDelegationDepth&&oc("maximum_delegation_depth expanded")}(e.constraints,t.constraints)}(i,u)}catch(p){return PC("invalid_authorization_details",`attenuation.${p instanceof N?String(p.details.why??""):""}`)}return{grant:u,allocation:c}}(i,a,o,{id:pT(e),now:u,policy:e.policy,requesterClientId:n.clientId,bindTo:l});e.ledger.purge(),e.ledger.add({id:p.grant.id,digest:d.digest,grant:p.grant,provider:i.provider,rootId:i.rootId,actors:[{clientId:n.clientId,keyThumbprint:l},...i.actors],remaining:{...p.allocation},inflight:0,revokedAt:null,returned:!1});for(const e of YC)i.remaining[e]-=p.allocation[e];return dT(e,{type:"exchange.issued",keyId:p.grant.id,parentId:i.id,clientId:n.clientId,providerId:i.provider.providerId},u),{access_token:d.token,issued_token_type:HC,token_type:null===l?"Bearer":"DPoP",expires_in:Math.floor((p.grant.constraints.expiresAt.getTime()-u)/1e3),scope:p.grant.actions.join(" "),resource:i.provider.baseUrl,authorization_details:[{type:"model_access",locations:[i.provider.baseUrl],actions:p.grant.actions,models:_T(p.grant.resources,i.provider.providerId),budget:p.grant.constraints.budgets}]}}catch(a){const t=fT(ii(a));throw t&&dT(e,hT("exchange.refused",t,i,n.clientId),r),a}}(this.core,e,t)}authorize(e,t){return async function(e,t,n){const r=e.ledger.clock(e.ports.now());let i=null;try{if(!ni(t.token)||!JC.test(t.token))return PC("invalid_token","key.shape");const a=await e.ports.sha256(t.token);if(i=mT(e,a,r),i.grant.clientId!==t.clientId)return PC("invalid_token","key.foreign_client");const o=mE({protocol:i.provider.protocol,baseUrl:i.provider.baseUrl,operation:n.operation,method:n.method,path:n.path,body:n.body}),s=i.grant.proofKeyThumbprint;if(null!==s){if(void 0===t.dpopProof)return PC("invalid_dpop_proof","dpop.required");await cT({proof:t.dpopProof,method:o.method,url:o.url,token:t.token,now:r,expectedJkt:s,replay:e.replay})}const c=e.ledger.clock(e.ports.now());i=mT(e,a,c),e.ledger.reclaim(c),function(e,t,n,r){const i=e.ports.connection(t.grant.connectionId??"");i&&i.verified&&i.providerId===t.provider.providerId||PC("invalid_token","connection.unavailable"),LE(n.resource)!==t.grant.constraints.audiences[0]&&PC("invalid_token","aud.mismatch"),t.grant.actions.includes(r.action)||PC("insufficient_scope","escalation.action"),null===r.model||function(e,t){const n=`model:${e.provider.providerId}/${t}`;return e.grant.resources.some(e=>rc(nc(e),n))}(t,r.model)||PC("insufficient_scope","escalation.model"),null!==r.outputTokens&&r.outputTokens>(t.grant.constraints.budgets[QC]??0)&&PC("insufficient_scope","escalation.tokens")}(e,i,n,o);const l=function(e,t,n){const r=n.inputEstimate,i=n.outputTokens??0;t.inflight>=8&&PC("insufficient_scope","inflight.limit");const{remaining:a}=t;(a.requests<1||a.input_tokens<r||a.output_tokens<i)&&PC("insufficient_scope","budget.exhausted"),a.requests-=1,a.input_tokens-=r,a.output_tokens-=i,t.inflight+=1;const o={id:e.ports.random(12),keyId:t.id,requests:1,inputTokens:r,outputTokens:i,settled:!1};return e.reservations.set(o.id,o),o}(e,i,o);let d={type:"call.authorized",keyId:i.id,clientId:t.clientId,providerId:i.provider.providerId};return o.model&&(d={...d,model:o.model}),dT(e,d,c),{keyId:i.id,providerId:i.provider.providerId,protocol:i.provider.protocol,connectionId:i.grant.connectionId??"",url:o.url,method:o.method,body:o.body,model:o.model,outputTokens:o.outputTokens,reservation:l}}catch(a){const n=fT(ii(a));throw n&&dT(e,hT("call.refused",n,i,t.clientId),r),a}}(this.core,e,t)}settle(e,t){!function(e,t,n){const r=e.reservations.get(t.id);if(!r||r.settled)return;r.settled=!0,e.reservations.delete(r.id);const i=e.ledger.clock(e.ports.now()),a=e.ledger.find(r.keyId);if(!a)return;a.inflight=Math.max(0,a.inflight-1);const o=function(e,t,n){if(!n.sent)return{input:0,output:0};const r=function(e,t){const n=gE(t);return null===n?null:"gemini_generate_content"===e?vE(n.usageMetadata,"promptTokenCount","candidatesTokenCount"):"anthropic_messages"===e?vE(n.usage,"input_tokens","output_tokens"):vE(n.usage,"prompt_tokens","completion_tokens")}(e.provider.protocol,n.answer);return{input:r?.input??t.inputTokens,output:r?.output??t.outputTokens}}(a,r,n),s=function(e,t){return t.returned&&t.grant.parentGrantId?e.ledger.find(t.grant.parentGrantId):t}(e,a);s&&!s.returned&&function(e,t,n,r){e.remaining.requests+=n?0:t.requests,e.remaining.input_tokens=Math.max(0,e.remaining.input_tokens+t.inputTokens-r.input),e.remaining.output_tokens=Math.max(0,e.remaining.output_tokens+t.outputTokens-r.output)}(s,r,n.sent,o),dT(e,{type:"call.settled",keyId:a.id,providerId:a.provider.providerId},i)}(this.core,e,t)}async revoke(e){const{core:t}=this,n=t.ledger.clock(t.ports.now());let r=[];if("token"in e){if(!JC.test(e.token))return[];const i=t.ledger.findByDigest(await t.ports.sha256(e.token));r=i?t.ledger.revoke(i.id,n):[]}else if("id"in e)r=t.ledger.revoke(e.id,n);else for(const i of t.ledger.records())null===i.grant.parentGrantId&&i.grant.clientId===e.clientId&&r.push(...t.ledger.revoke(i.id,n));for(const i of r)dT(t,{type:"key.revoked",keyId:i},n);return r}list(){const{core:e}=this,t=e.ledger.clock(e.ports.now());return e.ledger.reclaim(t),e.ledger.records().map(n=>e.ledger.view(n,t))}reset(){this.core.ledger.clear(),this.core.replay.clear(),this.core.reservations.clear()}}const zT=["openai_chat","anthropic_messages","gemini_generate_content"];function $T(e){return zT.some(t=>t===e)}function PT(e){try{return LE(e)}catch{return null}}let OT=null;function RT(e){let t;try{t=LE(e)}catch{return null}return function(){if(OT)return OT;const e=new Map;for(const t of ut()){const n=Fl(t.id);if(!n?.baseUrl||!$T(n.protocol))continue;const r=PT(n.baseUrl);null===r||e.has(r)||e.set(r,{providerId:t.id,protocol:n.protocol,baseUrl:r})}return OT=e,e}().get(t)??null}function LT(e){return{...ET,providerForResource:RT,connection:e.connection,audit:t=>{!function(e){eT=[...eT,Object.freeze({...e})].slice(-200)}(t);try{e.audit?.(t)}finally{Ns()}}}}function UT({issued:e,lifetime:t}){const n=Rt(),[r,i]=Ce.useState(""),a=Ce.useRef(null);return Ce.useEffect(()=>{a.current?.focus()},[]),Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"f",children:[Ee.jsxs("div",{className:"f__labelrow",children:[Ee.jsx("span",{className:"f__label",id:"model-key-token-label",children:"Key"}),r?Ee.jsx(Oe,{tone:"ok",label:r}):null]}),Ee.jsxs("div",{className:"f__shell mkey__token",children:[Ee.jsx("code",{className:"mkey__token-text","data-testid":"model-key-token","aria-labelledby":"model-key-token-label",children:e.token}),Ee.jsx("span",{className:"f__tail",children:Ee.jsx(B,{label:"Copy the key",keyRef:a,small:!0,onClick:()=>{n(e.token).then(e=>i("copied"===e?"Copied":"The clipboard is unavailable"))},children:Ee.jsx(G,{size:15})})})]})]}),Ee.jsx("p",{className:"vexport__marks",children:Ee.jsx(Oe,{tone:"warn",label:`Shown once. Ends in ${t}.`})})]})}function DT({label:e,options:t,value:n,disabled:r,onPick:i}){const a=Ce.useId();return Ee.jsxs("fieldset",{className:"mkey-group",disabled:r,children:[Ee.jsx("legend",{className:"f__label",children:e}),Ee.jsx("div",{className:"mkey-choices",children:t.map(e=>Ee.jsxs("label",{className:"mkey-choice",children:[Ee.jsx("input",{type:"radio",name:a,value:e.id,checked:n===e.id,onChange:()=>i(e.id)}),Ee.jsx("span",{children:e.label})]},e.id))})]})}const qT=WE.map(e=>({id:String(e.seconds),label:e.label}));function MT({form:e,clientRef:t}){const{client:n,models:r,name:i,list:a}=e;return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(O,{id:"model-key-client",inputRef:t,label:"App or agent",autoComplete:"off",placeholder:"my-agent",value:n,disabled:e.busy,onValueChange:e.setClient,status:""!==n&&null===i?Ee.jsx(Oe,{tone:"err",label:"Letters, digits and . _ : @ - only"}):null}),Ee.jsx(O,{id:"model-key-models",label:"Models",mono:!0,autoComplete:"off",placeholder:"gpt-4o, gpt-4o-mini",value:r,disabled:e.busy,onValueChange:e.setModels,fills:[{label:"Any model",value:"*",onPick:()=>e.setModels("*")}],status:""!==r&&null===a?Ee.jsx(Oe,{tone:"err",label:"Model ids, namespace/*, or *"}):null}),Ee.jsx(DT,{label:"Budget",options:JE,value:e.budgetId,disabled:e.busy,onPick:e.setBudgetId}),Ee.jsx(DT,{label:"Key lasts",options:qT,value:String(e.seconds),disabled:e.busy,onPick:t=>e.setSeconds(Number(t))})]})}const KT=ki("ModelGrantApproved");function FT(e,t){return{ok:!1,code:e,message:t}}function GT(e,t){return Number.isFinite(e)&&e<=t+5e3&&t-e<=3e5}const BT=new Map,VT=/[^A-Za-z0-9._:@-]/g;function HT(e){return`custodian:${e.replace(VT,"_")}`.slice(0,128)}function JT(e){return`local:${e.replace(VT,"_")}`.slice(0,128)}function WT(e,t){return{issuerPrincipalId:HT(e),organizationId:JT(e),clientId:t.clientId,connectionId:t.connectionId,resource:t.resource,actions:t.actions,models:t.models,budget:t.budget,lifetimeSeconds:t.lifetimeSeconds,maximumDelegationDepth:2,dpopJkt:null}}const ZT=new Map([["broker.unavailable","Turn on External connectors to create keys."],["draft.connection","Verify this provider's key before creating one."],["draft.resource","This provider cannot be given keys."],["draft.identifier","Name the app or agent with letters, digits and . _ : @ -"],["lifetime.ceiling","A key cannot last that long."],["budget.ceiling","That budget is larger than keys may carry."],["dpop.required","Keys here must be bound to the app's own key."],["models.entry","A model is its id, a namespace/*, or *."],["models.shape","List between one and thirty-two models."]]),XT="The key could not be created.",YT=JE[0]?.id??"",QT=WE[0]?.seconds??0;function eN(e,t){return[{key:"Spends",value:`${e}'s saved key`},...t?[{key:"Budget",value:`${t.budget.requests} requests`}]:[]]}function tN(e){return e.issued?{label:"Done",submit:!0,onClick:e.done}:{label:"Create a key",submit:!0,busy:e.busy,disabled:!e.ready,onClick:e.create}}function nN({providerName:e,connectionId:t,resource:n,onClose:r}){const i=function({connectionId:e,resource:t,onClose:n}){const{tomb:r}=Ot(),[i,a]=Ce.useState(""),[o,s]=Ce.useState(""),[c,l]=Ce.useState(YT),[d,u]=Ce.useState(QT),{busy:p,failure:h,issued:f,start:m,close:g,done:w}=function(e){const[t,n]=Ce.useState(!1),[r,i]=Ce.useState(""),[a,o]=Ce.useState(null),s=Ce.useRef(!0),c=Ce.useRef(!1),l=Ce.useRef(0);Ce.useEffect(()=>(s.current=!0,()=>{s.current=!1}),[]);const d=e=>{if(!s.current)return function(e){zs()?.revoke({id:e.id}).then(Ns)}(e);l.current=Date.now(),o(e)},u=()=>{c.current||(o(null),e())};return{busy:t,failure:r,issued:a,start:e=>{c.current||(c.current=!0,n(!0),i(""),e().then(d).catch(e=>{s.current&&i(function(e){return OC(e)?e.reason.startsWith("approval.")?"The approval was not accepted.":ZT.get(e.reason)??XT:e instanceof Error&&""!==e.message?e.message:XT}(e))}).finally(()=>{c.current=!1,s.current&&n(!1)}))},close:u,done:()=>{Date.now()-l.current<600||u()}}}(n),v=function(e){const t=e.trim();return ZE.test(t)?t:null}(i),y=function(e){const t=e.split(/[\s,]+/).filter(e=>""!==e);if(0===t.length||t.length>32)return null;const n=[];for(const r of t){if(!GE(r))return null;n.includes(r)||n.push(r)}return n}(o),b=JE.find(e=>e.id===c),k=WE.find(e=>e.seconds===d),x=null!==v&&null!==y&&b?{name:v,list:y,preset:b}:null,I=()=>{if(!x)return;const n=Date.now(),i={clientId:x.name,connectionId:e,resource:t,actions:["model.invoke","model.list"],models:x.list,budget:x.preset.budget,lifetimeSeconds:d};m(async()=>function(e,t,n,r=Date.now){return xi(e,async i=>{await le(i);const a=r();return xi(WT(e,t),e=>async function(e,t,n,r,i){const a=zs();if(!a)return PC("access_denied","broker.unavailable");if(i-r.pressedAt>3e4)return PC("access_denied","approval.stale");const o=await async function(e,t,n,r){if(t.approverPrincipalId!==e.value.issuerPrincipalId)return FT("not_the_issuer","only the person a grant answers to can approve it");if(!GT(t.authenticatedAt,n)||!GT(t.approvedAt,n)||t.approvedAt<t.authenticatedAt)return FT("stale","the approval is too old or from the future");const i=await AT(e.value,r);return i!==t.boundDigest?FT("digest_mismatch","the approval was for a different grant"):{ok:!0,proof:KT.prove(e),digest:i}}(t,{approverPrincipalId:HT(e),authenticatedAt:r.pressedAt,approvedAt:r.pressedAt,boundDigest:r.digest},i,pr);if(!o.ok)return PC("access_denied",`approval.${o.code}`);if(!function(e,t){for(const[n,r]of BT)t-r>3e4&&BT.delete(n);if(BT.has(e.id))return!1;BT.set(e.id,e.pressedAt);for(const n of BT.keys()){if(BT.size<=256)break;BT.delete(n)}return!0}(r,i))return PC("access_denied","approval.spent");const s=await a.issueRoot(t,o.proof);return Ns(),s}(i.value,e,0,n,a))})}(r,i,await async function(e,t,n=Date.now()){return{digest:await AT(WT(e,t),pr),pressedAt:n,id:hr(16)}}(r,i,n)))};return{client:i,models:o,budgetId:c,seconds:d,busy:p,failure:h,issued:f,name:v,list:y,preset:b,lifetime:k,ready:null!==x&&!p,setClient:a,setModels:s,setBudgetId:l,setSeconds:u,create:I,close:g,done:w,submit:e=>{e.preventDefault(),f?w():I()}}}({connectionId:t,resource:n,onClose:r}),a=Ce.useRef(null),{issued:o,failure:s}=i;return Ee.jsx(Ks,{title:"Create a key",mark:Ee.jsx(Z,{size:20}),onClose:i.close,initialFocus:a,children:Ee.jsx("form",{"aria-label":"Create a key",onSubmit:i.submit,children:Ee.jsxs(Le,{ok:""===s,top:o?"Key created":void 0,name:o?i.name??"":e,facts:eN(e,i.preset),primary:tN(i),children:[o?Ee.jsx(UT,{issued:o,lifetime:i.lifetime?.label??"its lifetime"}):Ee.jsx(MT,{form:i,clientRef:a}),s?Ee.jsx("p",{className:"vexport__marks",children:Ee.jsx(Oe,{tone:"err",label:s})}):null,Ee.jsx(q,{id:"model-keys:mint",title:"Keys",message:s})]},o?"issued":"compose")})})}const rN={active:{tone:"ok",label:"Active"},expired:{tone:"idle",label:"Ended"},revoked:{tone:"idle",label:"Revoked"}};function iN({view:e,now:t}){const n=rN[e.status],r="active"===e.status;return Ee.jsxs("li",{className:"mkey__row"+(e.depth>0?" mkey__row--child":""),"data-testid":"model-key",children:[Ee.jsxs("div",{className:"mkey__copy",children:[Ee.jsx("h3",{children:e.clientId}),Ee.jsx("p",{children:[XE(e).join(", "),QE(e),r?`ends in ${YE(e.expiresAt,t)}`:null].filter(Boolean).join(" · ")})]}),Ee.jsx(Oe,{tone:n.tone,label:n.label}),r?Ee.jsx(B,{label:`Revoke the key for ${e.clientId}`,small:!0,onClick:()=>{zs()?.revoke({id:e.id}).then(Ns)},children:Ee.jsx(F,{size:15})}):null]})}function aN({providerId:e,providerName:t,connectionId:n}){const{ready:r,keys:i,now:a}=function(e){const t=Ce.useSyncExternalStore($s,Ps,Ps),[n,r]=Ce.useState(()=>Date.now());Ce.useEffect(()=>{const e=setInterval(()=>r(Date.now()),3e4);return()=>clearInterval(e)},[]);const i=zs();return i?{ready:!0,keys:i.list().filter(t=>t.connectionId===e),now:n,version:t}:{ready:!1,keys:[],now:n,version:t}}(n),[o,s]=Ce.useState(!1),c=function(e){const t=Fl(e)?.baseUrl;return t&&RT(t)?t:null}(e);return r&&null!==c?Ee.jsxs("section",{className:"panel mkey",id:"model-keys","aria-label":"Keys",children:[Ee.jsxs("div",{className:"panel__head",children:[Ee.jsx("h2",{children:"Keys"}),Ee.jsx("div",{className:"vtree__keys",children:Ee.jsx(B,{label:"Create a key",small:!0,onClick:()=>s(!0),children:Ee.jsx(Z,{size:15})})})]}),i.length>0?Ee.jsx("ul",{className:"conn-list",children:i.map(e=>Ee.jsx(iN,{view:e,now:a},e.id))}):null,o?Ee.jsx(nN,{providerName:t,connectionId:n,resource:c,onClose:()=>s(!1)}):null]}):null}function oN({connectionId:e}){Ce.useSyncExternalStore($s,Ps,Ps);const t=wA(e);return t&&EE(e)?Ee.jsx(aN,{providerId:t.providerId,providerName:t.name,connectionId:e}):null}async function sN(e,t){if(e.configuration.parameters.vault_tomb!==t)throw new ys("authentication","Unlock the vault that saved this AI connection.");const n=wA(e.connectionId);if(!n)throw new ys("configuration","AI connection not found.");if("api-key"===n.authentication){await Ts();const r=e.privateState.credentials.ai_credential_reference;if(!r)throw new ys("authentication","Save this connection's API key in the owning vault.");const i=Ss(decodeURIComponent(r),lA(n),["apiKey"],t);if(n.apiKey=i.fields.get("apiKey")??"",dA(n.apiKey)!==e.privateState.credentials.ai_credential_digest)throw new ys("authentication","The saved AI credential changed. Verify and save its replacement before use.")}return aA(n)}async function cN(e,t){const n=wA(e.connectionId);if(!n||e.configuration.parameters.vault_tomb!==t)throw new ys("authentication","Unlock the owning AI connection vault.");const r=e.privateState.credentials.ai_credential_reference;if(!r)return{reference:"",items:[]};await Ts();const i=decodeURIComponent(r);return{reference:i,items:Ss(i,lA(n),["apiKey"],t).items}}const lN=Ur({id:qr(),status:Mr(["queued","processing","completed","error"]),text:qr().nullable().optional(),error:qr().nullable().optional(),errors:ei().optional(),is_deleted:Fr().nullable().optional(),speech_model_used:qr().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/).nullable().optional()});function dN(){throw new ys("response","The transcription service returned an invalid or unsafe response.")}function uN(e,t){const n=JSON.stringify(e),r=JSON.stringify(t).slice(1,-1);(n.includes(t)||n.includes(r))&&dN()}function pN(e,t,n){if(uN(e,t.apiKey),KS(e,t)!==n)return dN();const r=lN.safeParse(e);if(!r.success||r.data.speech_model_used&&r.data.speech_model_used!==t.model)return dN();const i=r.data;return!0===i.is_deleted||"error"!==i.status&&i.error?dN():i}function hN(e){const t=e.text?.trim();return"completed"!==e.status||e.error||!t||(new TextEncoder).encode(t).byteLength>32768?dN():t}async function fN(e,t,n,r,i,a){const o=new Headers({authorization:e.apiKey,accept:"application/json"}),s={method:n,headers:o};void 0!==a&&(o.set("content-type",a.mime),s.body=a.value);const c=await QA(e,new URL(t,Yl(e.baseUrl)),s,r,i);try{return"application/json"!==c.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase()?dN():await eC(c,i)}finally{await(c.body?.cancel().catch(()=>{}))}}function mN(e,t,n,r){return KS({id:t},e),fN(e,`transcript/${t}`,"GET",n,r)}function gN(e){return e.throwIfAborted(),new Promise((t,n)=>{const r=()=>{clearTimeout(i),e.removeEventListener("abort",r),n(new DOMException("Transcription waiting stopped.","AbortError"))},i=setTimeout(()=>{e.removeEventListener("abort",r),t()},2e3);e.addEventListener("abort",r,{once:!0})})}function wN(e,t,n){const r=e.fetch;return{signal:n,assertCurrent:t,fetch:(n,i)=>(t(),r.call(e,n,i))}}const vN=Ur({output:Ur({message:Ur({role:Dr("assistant"),content:Gr(Ur({text:qr().min(1)}).strict()).min(1)})}),stopReason:Mr(["end_turn","max_tokens","stop_sequence"])}),yN=Ur({results:Ur({channels:Gr(Ur({alternatives:Gr(Ur({transcript:qr().trim().min(1).max(32768)})).min(1).max(10)})).length(1)}),error:ei().optional(),errors:ei().optional(),err_code:ei().optional(),err_msg:ei().optional(),category:ei().optional()}),bN=Ur({text:qr().trim().min(1).max(32768),error:ei().optional(),errors:ei().optional()}),kN=3e6;function xN(){throw new ys("response","The AI service returned an invalid or unsupported raster image.")}function IN(e,t){return(!e||!t||e>2048||t>2048||e*t>4194304)&&xN(),{width:e,height:t}}function jN(e,t,n){return String.fromCharCode(...e.subarray(t,t+n))}function _N(e,t,n){const r=t.getUint32(n),i=n+12+r;i>e.length&&xN();const a=jN(e,n+4,4);return/^[A-Za-z]{4}$/.test(a)&&function(e){let t=4294967295;for(const n of e){t^=n;for(let e=0;e<8;e++)t=t>>>1^(1&t?3988292384:0)}return(4294967295^t)>>>0}(e.subarray(n+4,i-4))===t.getUint32(i-4)||xN(),(["acTL","fcTL","fdAT"].includes(a)||a[2]!==a[2].toUpperCase())&&xN(),"IHDR"===a&&8!==n&&xN(),["IHDR","PLTE","IDAT","IEND"].includes(a)||a[0]!==a[0].toUpperCase()||xN(),{length:r,end:i,type:a}}function SN(e,t,n){"PLTE"===t?((e.idatSeen||e.palette||!n||n>768||n%3||[0,4].includes(e.color))&&xN(),e.palette=!0):"IDAT"===t?((e.afterImage||3===e.color&&!e.palette)&&xN(),e.idatSeen=!0,e.image||=n>0):e.idatSeen&&(e.afterImage=!0)}function AN(e,t,n){const r=new DataView(e.buffer,e.byteOffset,e.byteLength),i=e[t+7];return(n<11||8!==e[t+2]||![1,3,4].includes(i)||n!==8+3*i)&&xN(),IN(r.getUint16(t+5),r.getUint16(t+3))}function CN(e,t){let n=t;for(255!==e[n++]&&xN();255===e[n];)n++;const r=e[n++];if(217===r)return{marker:r,offset:n,length:0};(!r||216===r||r>=208&&r<=215||n+2>e.length)&&xN();const i=256*e[n]+e[n+1];return(i<2||n+i>e.length)&&xN(),{marker:r,offset:n,length:i}}function EN(e,t){let n=t;for(;n<e.length;){if(255!==e[n]){n++;continue}const t=e[n+1];if(t&&!(t>=208&&t<=215))break;n+=2}return n}function TN(e){return e>=192&&e<=207&&![196,200,204].includes(e)}function NN(e,t,n,r){if("VP8 "===t)return(r<10||1&e[n]||"
*"!==jN(e,n+3,3))&&xN(),IN(16383&(e[n+6]|e[n+7]<<8),16383&(e[n+8]|e[n+9]<<8));(r<5||47!==e[n]||e[n+4]>>5)&&xN();const i=new DataView(e.buffer,e.byteOffset+n+1,4).getUint32(0,!0);return IN(1+(16383&i),1+(i>>>14&16383))}function zN(e,t,n){const r=jN(e,n,4),i=t.getUint32(n+4,!0),a=n+8,o=a+i;return(o+(1&i)>e.length||1&i&&0!==e[o])&&xN(),{type:r,length:i,start:a,end:o}}function $N(e,t,n,r){return(12!==t||10!==r||195&e[n]||e[n+1]||e[n+2]||e[n+3])&&xN(),IN(1+(e[n+4]|e[n+5]<<8|e[n+6]<<16),1+(e[n+7]|e[n+8]<<8|e[n+9]<<16))}class PN{constructor(e,t,n,r,i){this.mimeType=t,this.width=n,this.height=r,this.seed=i,this.#e=e}mimeType;width;height;seed;#e;copyBytes(){return this.#e?new Uint8Array(this.#e):xN()}release(){this.#e?.fill(0),this.#e=null}static fromBytes(e,t,n){void 0!==n&&(!Number.isSafeInteger(n)||n<0||n>4294967294)&&xN(),(!e.length||e.length>kN)&&xN();const r=new Uint8Array(e);try{const{width:e,height:i}=function(e,t){return(!e.length||e.length>kN)&&xN(),"image/png"===t&&"‰PNG\r\n\n"===jN(e,0,8)?function(e){const t=function(e){const t=new DataView(e.buffer,e.byteOffset,e.byteLength),n=e[24],r=e[25],i=0===r?[1,2,4,8,16]:3===r?[1,2,4,8]:[8,16];return(e.length<45||13!==t.getUint32(8)||"IHDR"!==jN(e,12,4)||![0,2,3,4,6].includes(r)||!i.includes(n)||e[26]||e[27]||e[28]>1)&&xN(),{...IN(t.getUint32(16),t.getUint32(20)),color:r}}(e),n=new DataView(e.buffer,e.byteOffset,e.byteLength),r={image:!1,palette:!1,afterImage:!1,color:t.color,idatSeen:!1};let i=8;for(;i+12<=e.length;){const{length:a,end:o,type:s}=_N(e,n,i);if(SN(r,s,a),"IEND"===s)return!a&&r.image&&o===e.length||xN(),IN(t.width,t.height);i=o}return xN()}(e):"image/jpeg"===t&&255===e[0]&&216===e[1]?function(e){let t,n=2,r=!1;for(;n<e.length;){const i=CN(e,n),{marker:a,length:o}=i;if(n=i.offset,217===a)return t&&r&&n===e.length||xN(),t;[192,193,194].includes(a)?(t&&xN(),t=AN(e,n,o)):TN(a)&&xN(),218===a?((!t||o<6||o!==6+2*e[n+2])&&xN(),r=!0,n=EN(e,n+o)):n+=o}return xN()}(e):"image/webp"===t&&"RIFF"===jN(e,0,4)&&"WEBP"===jN(e,8,4)?function(e){const t=new DataView(e.buffer,e.byteOffset,e.byteLength);(e.length<20||t.getUint32(4,!0)!==e.length-8)&&xN();let n,r,i=12;for(;i+8<=e.length;){const{type:a,length:o,start:s,end:c}=zN(e,t,i);"VP8X"===a?r=$N(e,i,s,o):"VP8 "===a||"VP8L"===a?(n&&xN(),n=NN(e,a,s,o)):r&&["ALPH","ICCP","EXIF","XMP "].includes(a)||xN(),i=c+(1&o)}return i===e.length&&n||xN(),!r||r.width===n.width&&r.height===n.height||xN(),n}(e):xN()}(r,t),a=new PN(r,t,e,i,n);return Object.freeze(a),a}catch(i){throw r.fill(0),i}}}const ON=Ur({image:qr(),finish_reason:Mr(["SUCCESS","CONTENT_FILTERED"]),seed:Vr().int().min(0).max(4294967294).optional()}).strict();async function RN(e,t,n,r,i={}){const a=XA(n,r),o=td(e),s=function(e,t){const n=Ur({model:Dr(t.model),messages:Kr([Ur({role:Dr("user"),content:qr().trim().min(1).max(8192)}).strict()])}).strict().safeParse(e);if(!n.success||(new TextEncoder).encode(n.data.messages[0].content).length>32768||n.data.messages[0].content.includes(t.apiKey))throw new ys("configuration","Enter one image prompt for the saved model without chat, audio, streaming or token parameters.");return n.data.messages[0].content}(t,o),c=i.timeoutMs??6e4;if(!Number.isInteger(c)||c<1||c>6e4)throw new ys("configuration","Image generation supports at most one 60 second operation.");const l=new AbortController,d=AbortSignal.any([n.signal,l.signal,...i.signal?[i.signal]:[]]),u=Date.now()+c,p=setTimeout(()=>l.abort(new DOMException("Image generation timed out.","TimeoutError")),c),h=()=>{a(),Date.now()>=u&&l.abort(new DOMException("Image generation timed out.","TimeoutError")),d.throwIfAborted()},f=n.fetch;let m;const g={signal:d,assertCurrent:h,async fetch(e,t){h();const r=await f.call(n,e,t);m=r;try{return h(),r}catch(i){throw r.body?.cancel().catch(()=>{}),i}}};let w;try{h();const e=await async function(e,t){const n=new URL("generate/sd3",Yl(e.baseUrl)),r=new FormData;r.set("prompt",t),r.set("model",e.model),r.set("mode","text-to-image"),r.set("aspect_ratio","1:1"),r.set("output_format","png");const i=new Request(n,{method:"POST",body:r}),a=await i.arrayBuffer();if(a.byteLength>1048576)throw new ys("configuration","The image generation request exceeds the native request bound.");const o=new Headers(i.headers);return o.set("authorization",`Bearer ${e.apiKey}`),o.set("accept","application/json"),{url:n,request:{method:"POST",headers:o,body:a}}}(o,s);return h(),m=await QA(o,e.url,e.request,g,h),h(),w=await async function(e,t,n,r){try{"application/json"!==e.headers.get("content-type")?.split(";")[0].trim().toLowerCase()&&xN();const i=await async function(e,t,n){let r;const i=[];let a=0;try{if(!e.body)throw new ys("response","The image service returned no response body.");const o=Hf(e);for(r=Wf(e,n,o?AbortSignal.any([t,o]):t,()=>new ys("response","The image service returned an incomplete JSON response."));;){n(),t.throwIfAborted();const e=await r.read();if(n(),t.throwIfAborted(),e.done)break;if(a+=e.value.byteLength,a>4194304)throw new ys("response","The generated image response exceeds the supported size.");i.push(e.value)}const s=new Uint8Array(a);let c,l=0;for(const e of i)s.set(e,l),l+=e.length;try{c=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(s))}catch{throw new ys("response","The image service returned unreadable JSON.")}return await r.finish(a),c}finally{try{r?await r.close():await(e.body?.cancel().catch(()=>{}))}finally{Jf(e)}}}(e,t,r);r();const a=ON.safeParse(i);if(a.success&&!JSON.stringify(i).includes(n)||xN(),"CONTENT_FILTERED"===a.data.finish_reason)throw new ys("response","The image service filtered this generation. Change the prompt before trying again.");return function(e,t,n,r){const i=function(e,t){const n=e.endsWith("==")?2:e.endsWith("=")?1:0;(!e.length||e.length%4||e.length>4*Math.ceil(1e6)||!/^[A-Za-z0-9+/]+={0,2}$/.test(e)||t&&e.includes(t))&&xN();const r=e.length/4*3-n;r>kN&&xN();const i="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(e[e.length-n-1]);return(2===n&&15&i||1===n&&3&i)&&xN(),r}(e,n);let a;try{a=jo(e)}catch{return xN()}try{return(a.length!==i||n&&(new TextDecoder).decode(a).includes(n))&&xN(),PN.fromBytes(a,"image/png",r)}finally{a.fill(0)}}(a.data.image,0,n,a.data.seed)}finally{try{e.bodyUsed||await(e.body?.cancel().catch(()=>{}))}finally{Jf(e)}}}(m,d,o.apiKey,h),h(),{providerId:o.providerId,model:o.model,image:w}}catch(v){throw w?.release(),v}finally{clearTimeout(p),m&&!m.bodyUsed&&await(m.body?.cancel().catch(()=>{}))}}function LN(){return new ys("response","The AI service returned an invalid or incomplete text stream.")}function UN(e){if(!ai(e)||e.error)throw LN();const t=Array.isArray(e.choices)?e.choices[0]:void 0;if(!t)return"";if(!ai(t)||!ai(t.delta))throw LN();const n=t.delta.content;if(null!=n&&!ni(n))throw LN();return ni(n)?n:""}function DN(e){if(!ai(e)||"error"===e.type)throw LN();if("content_block_delta"===e.type){if(!ai(e.delta))throw LN();return"text_delta"===e.delta.type&&ni(e.delta.text)?e.delta.text:""}return"content_block_start"===e.type&&ai(e.content_block)&&"text"===e.content_block.type&&ni(e.content_block.text)?e.content_block.text:""}async function qN(e,t,n,r,i,a={}){if(t.model!==e.model)throw new ys("configuration","Use the model saved with this connection.");if(ks(e.family))throw new ys("configuration","Use the owned image-result operation for image generation.");if(bs(e.family))return function(e,t,n,r,i,a={}){if(i)throw new ys("configuration","Transcription returns a finite transcript, not a text stream.");const{media:o,...s}=t;try{Ur({model:Dr(e.model),messages:Kr([])}).strict().parse(s)}catch{throw new ys("configuration","Supply local audio without a prompt or text-generation parameters.")}return"assemblyai_transcript"===e.family?async function(e,t,n,r,i={}){const a=XA(n,r),o=MS(e);Yl(o.baseUrl);const s=new Uint8Array(VA(t).bytes).buffer,c=i.timeoutMs??18e4;if(!Number.isInteger(c)||c<100||c>18e4)throw new ys("configuration","Choose a transcription workflow budget between 100ms and 180s.");const l=AbortSignal.timeout(c),d=AbortSignal.any([n.signal,l,...i.signal?[i.signal]:[]]),u=new AbortController,p=AbortSignal.any([d,u.signal]),h=()=>{a(),p.throwIfAborted()},f=wN(n,a,p);let m,g,w;try{h();const e=await async function(e,t,n,r){return function(e,t){uN(e,t.apiKey);const n=Ur({upload_url:qr().min(1).max(2048)}).safeParse(e);if(!n.success)return dN();const r=n.data.upload_url;try{const e=new URL(r);if("https:"!==e.protocol||!e.hostname||e.username||e.password||e.hash||!/^[\x21-\x7e]+$/.test(r)||r.includes("\\")||decodeURIComponent(r).includes(t.apiKey))return dN()}catch{return dN()}return r}(await fN(e,"upload","POST",n,r,{mime:"application/octet-stream",value:t}),e)}(o,s,f,h);h();const t=await function(e,t,n,r){return fN(e,"transcript","POST",n,r,{mime:"application/json",value:JSON.stringify({audio_url:t,speech_models:[e.model],language_code:"en"})})}(o,e,f,h);m=KS(t,o),g=await async function(e,t,n,r,i){let a=t;for(let o=0;;o++){i();const t=pN(a,e,n);if("completed"===t.status)return hN(t);if("error"===t.status)throw new ys("response","The AssemblyAI transcription failed.");if(o>=60)throw new ys("response","The transcription exceeded its finite polling bound.");await gN(r.signal),i(),a=await mN(e,n,r,i)}}(o,t,m,f,h),h()}catch(y){w=y}finally{u.abort()}a();const v=await async function(e,t,n,r){if(r(),!t)return!1;const i=new AbortController,a=AbortSignal.any([n.signal,AbortSignal.timeout(1e4),i.signal]),o=wN(n,r,a);try{return await async function(e,t,n,r){KS({id:t},e);const i=await fN(e,`transcript/${t}`,"DELETE",n,r);if(uN(i,e.apiKey),KS(i,e)!==t)return dN()}(e,t,o,()=>{r(),a.throwIfAborted()}),r(),!0}catch{return r(),!1}finally{i.abort()}}(o,m,n,a);if(a(),function(e,t,n,r,i){if(e.signal.aborted||t.signal?.aborted)throw new FS(i);if(n.aborted)throw new ys("response","The transcription exceeded its workflow deadline.");if(r.aborted)throw new FS(i)}(n,i,l,d,v),m&&!v)throw new ys("response","Remote transcript removal was not confirmed; no transcript was accepted.");if(void 0!==w)throw w;if(!g)throw new ys("response","The transcription did not complete.");return{providerId:o.providerId,model:o.model,answer:g}}(sA(e),VA(o),n,r,{signal:a.signal}):"deepgram_listen"===e.family?async function(e,t,n,r){const i=XA(n,r),a=BS(e),o=VA(t),s=new URL("listen",Yl(a.baseUrl));s.searchParams.set("model",a.model),s.searchParams.set("smart_format","true"),s.searchParams.set("language","en"),s.searchParams.set("multichannel","false");const c=await QA(a,s,{method:"POST",headers:{authorization:`Token ${a.apiKey}`,"content-type":o.mimeType,accept:"application/json"},body:new Uint8Array(o.bytes).buffer},n,i);try{if("application/json"!==c.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase())throw new ys("response","The transcription service returned an invalid content type.");const e=yN.safeParse(await eC(c,i)),t=e.success?e.data.results.channels[0]?.alternatives[0]?.transcript:void 0;if(!t||(new TextEncoder).encode(t).byteLength>32768||t.includes(a.apiKey))throw new ys("response","The transcription service returned an invalid or unsafe transcript.");return i(),{providerId:a.providerId,model:a.model,answer:t}}finally{await(c.body?.cancel().catch(()=>{}))}}(oA(e),VA(o),n,r):async function(e,t,n,r){const i=XA(n,r),a=XS(e),{url:o,request:s}=await async function(e,t){const n=VA(t),r=new URL("speech-to-text",Yl(e.baseUrl)),i=new FormData;i.set("model_id",e.model),i.set("file",new Blob([new Uint8Array(n.bytes)],{type:n.mimeType}),"recording.audio");const a=new Request(r,{method:"POST",body:i}),o=await a.arrayBuffer();if(o.byteLength>1048576)throw new ys("configuration","The transcription request exceeds the 1 MiB native request bound.");const s=new Headers(a.headers);return s.set("xi-api-key",e.apiKey),s.set("accept","application/json"),{url:r,request:{method:"POST",headers:s,body:o}}}(a,t);i();const c=await QA(a,o,s,n,i);try{if("application/json"!==c.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase())throw new ys("response","The transcription service returned an invalid content type.");const e=bN.safeParse(await eC(c,i));if(!e.success||(new TextEncoder).encode(e.data.text).byteLength>32768||e.data.text.includes(a.apiKey))throw new ys("response","The transcription service returned an invalid or unsafe transcript.");return i(),{providerId:a.providerId,model:a.model,answer:e.data.text}}finally{await(c.body?.cancel().catch(()=>{}))}}(YS(e),VA(o),n,r)}(e,t,n,r,i,a);if(void 0!==t.media)throw new ys("configuration","Local audio belongs only to the transcription protocol.");if("replicate_predictions"===e.family)return async function(e,t,n,r,i,a={}){if(r(),n.assertCurrent(),n.signal.throwIfAborted(),"replicate_predictions"!==e.family||!["byo-ai","replicate"].includes(e.providerId)||t.model!==e.model)throw new ys("configuration","Use the saved prediction protocol, endpoint and model.");const o=await async function(e,t,n,r,i={}){const{interval:a,timeout:o}=function(e){const t=e.pollIntervalMs??1e3,n=e.timeoutMs??18e4;if(!Number.isInteger(t)||t<10||t>1e4||!Number.isInteger(n)||n<100||n>3e5)throw new ys("configuration","Choose bounded prediction polling and timeout values.");return{interval:t,timeout:n}}(i),s=[n.signal,AbortSignal.timeout(o)];i.signal&&s.push(i.signal);const c=AbortSignal.any(s),l={...n,signal:c},d=()=>{r(),n.assertCurrent(),c.throwIfAborted()};let u,p=!1;try{for(u=await function(e,t,n,r){const i=JS(e.model),a={input:rC(t)};return i.version&&(a.version=i.version),aC(e,i.path,"POST",n,r,a)}(e,t,l,r);;){if(d(),p=["succeeded","failed","canceled"].includes(u.status),i.onPrediction?.(u),d(),"succeeded"===u.status){if(null==u.output)throw new ys("response","The prediction completed without output.");return d(),u}if("failed"===u.status)throw new ys("response","The Replicate prediction failed.");if("canceled"===u.status)throw new ys("response","The Replicate prediction was canceled.");await sC(a,c),u=await oC(e,u.id,l,r)}}catch(h){if(!c.aborted)throw h;r(),n.assertCurrent(),n.signal.throwIfAborted();let t=!1;if(u&&!p)try{await function(e,t,n,r){return aC(e,`${nC(t)}/cancel`,"POST",n,r,void 0,t)}(e,u.id,{...n,signal:AbortSignal.any([n.signal,AbortSignal.timeout(1e4)])},r),t=!0}catch{r(),n.assertCurrent(),n.signal.throwIfAborted()}throw new HS(t)}}(e,lC(t),n,r,a),s=ni(o.output)?o.output:JSON.stringify(o.output,null,2);if(!s?.trim()||(new TextEncoder).encode(s).byteLength>32768)throw new ys("response","The completed prediction did not return bounded output.");return r(),n.assertCurrent(),n.signal.throwIfAborted(),i?.(s),r(),{providerId:e.providerId,model:e.model,answer:s}}(e,t,n,r,i,a);if("bedrock_converse"===e.family)return async function(e,t,n,r,i){const a=()=>{r(),n.assertCurrent(),n.signal.throwIfAborted()};if(a(),Wl(e),t.model!==e.model)throw new ys("configuration","Use the model saved with this connection.");const o=Xl(e.apiKey),s=function(e){js("anthropic",e);const t=e.messages.filter(e=>"system"!==e.role).map(e=>({role:"assistant"===e.role?"assistant":"user",content:[{text:e.content}]}));if(!t.length||"user"!==t[0]?.role)throw new ys("configuration","Start the Bedrock conversation with a user question.");const n=e.messages.filter(e=>"system"===e.role).map(e=>({text:e.content})),r={messages:t,inferenceConfig:{maxTokens:e.maxOutputTokens??1024}};return n.length&&(r.system=n),JSON.stringify(r)}(t),c=function(e,t){const n=Wl(e),r=Xl(e.apiKey);return Po({method:"POST",url:Zl(e,Yl(e.baseUrl)),headers:new Headers({"content-type":"application/json"}),payloadHash:No(zo((new TextEncoder).encode(t))),region:n.region,service:"bedrock",payloadHashHeader:!1,pathEncoding:"twice",credentials:{accessKeyId:r.accessKeyId,secretAccessKey:qo(r.secretAccessKey),sessionToken:r.sessionToken?qo(r.sessionToken):void 0}})}(e,s);a();const l=AbortSignal.any([n.signal,AbortSignal.timeout(3e4)]);let d;try{d=await n.fetch(c.url,{method:"POST",headers:c.headers,body:s,signal:l,credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"})}catch{throw a(),new ys("network","Could not complete this Bedrock request.")}try{a(),YA(d)}catch(h){throw await(d.body?.cancel().catch(()=>{})),h}HA.observe?.({phase:"request",response:d,owner:r,httpSignal:l,transportSignal:n.signal});const u=vN.parse(await eC(d,a));a();const p=u.output.message.content.map(e=>e.text).join("\n").trim();if(!p||p.length>32768||[e.apiKey,o.accessKeyId,o.secretAccessKey,o.sessionToken??""].some(e=>e.length>=4&&p.includes(e)))throw new ys("response","The model did not return a safe text answer.");return a(),i?.(p),a(),{providerId:e.providerId,model:e.model,answer:p}}({...e,family:"bedrock_converse"},t,n,r,i);const o=tA(e);if(o)return async function(e,t,n,r,i){const a=function(e,t){return()=>{t(),e.assertCurrent(),e.signal.throwIfAborted()}}(n,r);if(a(),t.model!==e.model)throw new ys("configuration","Use the model saved with this connection.");const o=js("gemini",t),s=rA(e,Yl(e.baseUrl)),c=await async function(e,t,n){const r=tA(e);if(!r)throw new ys("configuration","Choose a Vertex target.");if(n(),"access-token"===r.credential){if(!/^[A-Za-z0-9._~+/=-]{20,4096}$/.test(e.apiKey))throw new ys("authentication","Enter a valid Google access token.");return{value:e.apiKey,privateMaterial:[e.apiKey]}}const i=nm(e.apiKey),a={signal:t.signal,assertCurrent:n,fetch:(e,r)=>(n(),t.fetch(String(e),{...r,signal:AbortSignal.any([t.signal,...r?.signal?[r.signal]:[]])}))},o=await rm(i,a);return n(),{value:o,privateMaterial:[o,i.privateKey,e.apiKey]}}(e,n,a);a();const l=AbortSignal.any([n.signal,AbortSignal.timeout(3e4)]);let d;try{d=await n.fetch(s,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${c.value}`},body:JSON.stringify(o.body),signal:l,credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"})}catch{throw a(),new ys("network","Could not complete this Vertex request.")}try{a(),YA(d)}catch(h){throw await(d.body?.cancel().catch(()=>{})),h}HA.observe?.({phase:"request",response:d,owner:r,httpSignal:l,transportSignal:n.signal});const u=await eC(d,a);a();const p=_s("gemini",u);if(c.privateMaterial.some(e=>e.length>=4&&p.includes(e)))throw new ys("response","The AI service returned credential material.");return a(),i?.(p),a(),{providerId:e.providerId,model:e.model,answer:p}}({...e,vertex:o},t,n,r,i);const s=function(e,t,n=!1){const r=xs(e.family),i=Yl(e.baseUrl),a=function(e,t){const n=DS(e);if(!n)return null;const r=new URL("dated-chat"===n.api?`openai/deployments/${e.model}/chat/completions`:"openai/v1/"+("openai_chat"===e.family?"chat/completions":"responses"),t);return"dated-chat"===n.api&&r.searchParams.set("api-version",n.apiVersion),r}(e,i),o=js("openai_chat"===r&&"max_tokens"===e.tokenParameter?"openrouter":JA[r],t),s=a??new URL("openai_responses"===r?"responses":"openai_chat"===r?"chat/completions":"anthropic_messages"===r?"messages":`models/${t.model}:${n?"streamGenerateContent":"generateContent"}`,i);return n&&"gemini_generate_content"===r&&s.searchParams.set("alt","sse"),{url:s,body:"openai_responses"===r?{model:t.model,input:t.messages,max_output_tokens:t.maxOutputTokens??1024,stream:n}:"gemini_generate_content"===r?o.body:{...o.body,stream:n}}}(e,t,void 0!==i),c=await async function(e,t,n,r,i){tC(e,t,n,r);const a={method:void 0===i?"GET":"POST",headers:WA(e)};return void 0!==i&&(a.body=JSON.stringify(i)),QA(e,t,a,n,r)}(e,s.url,n,r,s.body);let l="";const d=i?await async function(e,t,n,r,i){let a;xs(t);const o=new TextDecoder;let s="",c="",l=0,d=!1;function u(e){const i=e.split("\n").filter(e=>e.startsWith("data:")).map(e=>e.slice(5).trimStart()).join("\n");if(!i)return;if(d)throw LN();const a=function(e,t){if("[DONE]"===t&&"openai_chat"===e)return{text:"",done:!0};let n;try{n=JSON.parse(t)}catch{throw LN()}return"gemini_generate_content"===e?function(e){if(!ai(e)||e.error)throw LN();const t=Array.isArray(e.candidates)?e.candidates[0]:void 0;if(!t||!ai(t))throw LN();const n=ai(t.content)?t.content.parts:void 0;if(void 0!==n&&!Array.isArray(n))throw LN();return{text:Array.isArray(n)?n.map(e=>{if(!ai(e))throw LN();return ni(e.text)&&!e.thought?e.text:""}).join(""):"",done:ni(t.finishReason)}}(n):"openai_responses"===e?function(e){if(!ai(e)||"error"===e.type||"response.failed"===e.type||"response.incomplete"===e.type)throw LN();if("response.output_text.delta"===e.type&&!ni(e.delta))throw LN();return{text:"response.output_text.delta"===e.type&&ni(e.delta)?e.delta:"",done:"response.completed"===e.type}}(n):{text:"openai_chat"===e?UN(n):DN(n),done:"anthropic_messages"===e&&ai(n)&&"message_stop"===n.type}}(t,i);if(d=a.done,a.text){if(c+=a.text,c.length>32768)throw LN();r(),n(a.text)}}try{if(!e.headers.get("content-type")?.toLowerCase().includes("text/event-stream"))throw LN();const t=Hf(e);for(a=Wf(e,r,t?AbortSignal.any([i,t]):i,LN);;){const e=await a.read();if(e.done)break;if(l+=e.value.byteLength,l>4194304)throw LN();s=(s+o.decode(e.value,{stream:!0})).replace(/\r\n/g,"\n");let t=s.indexOf("\n\n");for(;-1!==t;)u(s.slice(0,t)),s=s.slice(t+2),t=s.indexOf("\n\n");if(s.length>262144)throw LN()}if(s+=o.decode(),s.trim()&&u(s),!d||!c.trim())throw LN();r(),await a.finish(l)}finally{try{a?await a.close():await(e.body?.cancel().catch(()=>{}))}finally{Jf(e)}}return HA.observe?.({phase:"body",response:e,owner:r,bytes:l,format:"sse"}),c}(c,e.family,t=>{if(l+=t,e.apiKey&&l.includes(e.apiKey))throw new ys("response","The AI service returned credential material.");i?.(t)},r,n.signal):function(e,t){if(ks(e))throw new ys("configuration","Read image generation through its owned raster adapter.");if(bs(e))throw new ys("configuration","Read transcription through its finite audio adapter.");if("replicate_predictions"===e)throw new ys("configuration","Read the terminal prediction through its finite JSON job adapter.");if("bedrock_converse"===e)throw new ys("configuration","Read Bedrock Converse through its finite response adapter.");if("openai_responses"===e){const e=Ur({status:Dr("completed"),output:Gr(Ur({type:qr(),content:Gr(Ur({type:qr(),text:qr().optional()})).optional()}))}).parse(t).output.filter(e=>"message"===e.type).flatMap(e=>e.content??[]).filter(e=>"output_text"===e.type).map(e=>e.text??"").join("\n").trim();if(!e||e.length>32768)throw new ys("response","The model did not return a valid text answer.");return e}return _s(JA[e],t)}(e.family,await eC(c,r));if(r(),n.assertCurrent(),n.signal.throwIfAborted(),e.apiKey&&d.includes(e.apiKey))throw new ys("response","The AI service returned credential material.");return{providerId:e.providerId,model:e.model,answer:d}}function MN(e,t,n,r,i={},a,o){if(ks(e.family)){if(void 0!==r||void 0!==a||void 0===o)throw new ys("configuration","Supply an explicit image prompt to test or save this image connection.");return async function(e,t,n,r,i){const a=await RN(nd(e),{model:e.model,messages:[{role:"user",content:t}]},n,r,{signal:i});try{return r(),"Image generation verified"}finally{a.image.release()}}(e,o,t,n,i.signal)}if(void 0!==o)throw new ys("configuration","Image verification prompts belong only to the image protocol.");if(bs(e.family)){if(void 0!==r||void 0===a)throw new ys("configuration","Supply explicit local audio to test or save this transcription connection.");return qN(e,{model:e.model,messages:[],media:a},t,n,void 0,i)}if(void 0!==a)throw new ys("configuration","Local audio belongs only to the transcription protocol.");if("replicate_predictions"===e.family){if(void 0===r)throw new ys("configuration","Supply explicit model-specific prediction input to test or save this connection.");return qN(e,{model:e.model,messages:[{role:"user",content:JSON.stringify(r)}]},t,n,void 0,i)}if(void 0!==r)throw new ys("configuration","Prediction input belongs only to the prediction protocol.");return qN(e,{model:e.model,maxOutputTokens:16,messages:[{role:"user",content:"Reply with OK."}]},t,n)}function KN(e){if(void 0===e)return;const t=VA(e);return{...t,bytes:new Uint8Array(t.bytes)}}async function FN(e){const t=e?an(e):null,n=new AbortController;let r=!0;const i=()=>{if(e&&r&&!n.signal.aborted){try{const n=an(e);if(t&&n&&n.revision===t.revision&&n.configuration.fingerprint===t.configuration.fingerprint)return}catch{}n.abort(new ys("stale","This AI connection changed. Reload before continuing."))}},a=e?Ei(i):()=>{},o=()=>{r&&(r=!1,a())};let s=()=>{},c=()=>{};try{i(),n.signal.throwIfAborted();const e=await SE();c=()=>e.close();const r=await async function(e,t,n){if(!e?.privateState.credentials.ai_credential_reference)return{check(){},release(){}};const r=await cN(e,t.tomb),{vaultStore:i}=await Mo(async()=>{const{vaultStore:e}=await import("./drop-open-BjgdLxWM.js").then(e=>e.gn);return{vaultStore:e}},[]);let a=!0;const o=()=>{a&&(t.check(),Es(r,t.tomb,()=>n.signal.throwIfAborted()))},s=i.subscribe(()=>{try{o()}catch{n.abort(new ys("stale","The saved AI credential changed. Verify its replacement before continuing."))}}),c=()=>{a&&(a=!1,s())};try{return o(),{check:o,release:c}}catch(l){throw c(),l}}(t,e,n);s=r.release,i(),n.signal.throwIfAborted();let a=!1;return{...e,signal:AbortSignal.any([e.signal,n.signal]),check(){e.check(),i(),r.check(),n.signal.throwIfAborted()},releaseSavedRow:o,releaseSavedCredentials:s,close(t=!1){a||(a=!0,o(),s(),e.close(t))}}}catch(l){throw o(),s(),c(),l}}async function GN(e,t,n){const r=aA(e,!1),i=n?an(n):null;if(n&&!i)throw new ys("configuration","Saved AI connection not found.");if(i){if(i.configuration.providerId!==r.providerId||"api-key"!==i.configuration.method)throw new ys("configuration","This connection belongs to another provider or authentication method.");if(An(i),!hA(i.connectionId)&&"api-key"===r.authentication&&!r.apiKey)throw new ys("configuration","Enter an API key to move this connection into the current vault.")}if(i&&"api-key"===r.authentication&&!r.apiKey){const e=await sN(i,t);if(lA(e)!==lA(r))throw new ys("configuration","Enter a new API key when changing the endpoint, protocol or model.");r.apiKey=e.apiKey}return{draft:aA(r),previous:i}}function BN(e,t,n){return()=>{const r=an(e);if(!r||r.revision!==t||r.configuration.fingerprint!==n)throw new ys("stale","This AI connection changed. Reload before continuing.")}}function VN(e,t,n,r){e.check(),n(),t.assertCurrent(),r?.assertCurrent(),t.signal.throwIfAborted()}function HN(e,t,n){const r=[e.signal,t];return n&&r.push(n),{...e,signal:AbortSignal.any(r)}}async function JN(e,t,n,r={}){const i=_E(),a=r.signal,o={...r.prediction},s=KN(r.audio),c=r.imagePrompt,l=await FN(t);let d,u=!1;try{i.assertCurrent(),l.check();const r=HN(i,l.signal,a),{draft:p,previous:h}=await GN(e,l.tomb,t),f=h?BN(h.connectionId,h.revision,h.configuration.fingerprint):()=>l.check(),m=()=>VN(l,r,f);return d=m,await MN(p,r,m,n,o,s,c),m(),u=!0,"Model inference verified"}finally{l.close(u),u&&d&&HA.observe?.({phase:"operation",owner:d})}}async function WN(e,t,n,r={}){const i=_E(),a=r.signal,o={...r.prediction},s=KN(r.audio),c=r.imagePrompt,l=await FN(t);let d,u=!1;try{i.assertCurrent(),l.check();const r=HN(i,l.signal,a),{draft:p,previous:h}=await GN(e,l.tomb,t),f=h&&hA(h.connectionId)?await cN(h,l.tomb):null,m=h?BN(h.connectionId,h.revision,h.configuration.fingerprint):()=>l.check(),g=()=>VN(l,r,m);d=g,await MN(p,r,g,n,o,s,c),g(),l.releaseSavedRow();const w=await As({name:p.name,targetBinding:lA(p),fields:p.apiKey?[{field:"apiKey",label:"AI API key",value:p.apiKey}]:[]},l.tomb,g),v=await async function(e,t,n,r,i){const a=i?.connectionId??`native-ai-${crypto.randomUUID()}`,o=function(e,t,n,r,i){const a=DS(e),o=a?JSON.stringify("v1"===a.api?{api:a.api,credential:a.credential}:{api:a.api,apiVersion:a.apiVersion,credential:a.credential}):void 0,s=No(zo((new TextEncoder).encode(JSON.stringify([lA(e),t])))),c=`ai-${s}`,l={ai_contract:uA,family:e.family,base_url:e.baseUrl,model:e.model,authentication:e.authentication,vault_tomb:t,token_parameter:e.tokenParameter};void 0!==o&&(l.azure_target=o);const d=tA(e);return d&&(l.vertex_target=JSON.stringify({project:d.project,location:d.location,credential:d.credential})),e.bedrock&&(l.bedrock_target=JSON.stringify({region:e.bedrock.region,credential:e.bedrock.credential})),Fn(pA,r,i,{version:1,providerId:e.providerId,method:"api-key",displayName:e.name,icon:"",parameters:l,requestedScopes:{},targetIds:{endpoint:c},fingerprint:s},n?{ai_credential_reference:encodeURIComponent(n),ai_credential_digest:dA(e.apiKey)}:{},{identity:{id:c,label:e.name,kind:"model-endpoint"},targets:[{id:c,label:e.baseUrl,kind:"model-endpoint"}],grantLabel:"Configured AI inference",target:{key:"endpoint",id:c}})}(e,t,n,a,i?.revision??1);if(!i)return hn(o,pA,r);if(i.configuration.providerId!==e.providerId)throw new ys("configuration","This connection belongs to a different provider.");return tn(a,cn(i),pA,()=>(r(),o),r)}(p,l.tomb,w.reference,()=>Es(w,l.tomb,g),h??void 0).catch(async e=>{throw await Cs(w,l.tomb,()=>l.check()).catch(()=>{}),e});l.releaseSavedCredentials(),f&&await Cs(f,l.tomb,()=>l.check()).catch(()=>{});const y=BN(v.connectionId,v.revision,v.fingerprint);return Es(w,l.tomb,()=>VN(l,r,y)),u=!0,v}finally{l.close(u),u&&d&&HA.observe?.({phase:"operation",owner:d})}}async function ZN(e,t,n,r,i={}){const a=function(e){if(!e)return;const t=e.signal,n=e.assertCurrent,r=()=>{if(e.signal!==t||e.assertCurrent!==n)throw new ys("stale","The AI caller changed. Restart the operation.")},i=()=>{r(),t.throwIfAborted(),n.call(e),r(),t.throwIfAborted()};return i(),{signal:t,assertCurrent:i}}(n),o=_E(),s={...i},c=KN(t.media),l=void 0===c?t:{...t,media:c},d=await FN(e);let u,p=!1;try{o.assertCurrent(),d.check();const t=HN(o,d.signal,a?.signal),n=hA(e);if(!n||!n.privateState.verification)throw new ys("authentication","Verify the AI connection before inference.");Gn({family:"AI",accepts:e=>null!==od(e)||ZS(e),classification:pA},e,!0);const i=BN(e,n.revision,n.configuration.fingerprint),c=()=>VN(d,t,i,a);c();const h=await cN(n,d.tomb),f=()=>Es(h,d.tomb,c);f(),u=f;const m=await sN(n,d.tomb);f();const g=await qN(m,l,t,f,r,s);return f(),p=!0,g}finally{d.close(p),p&&u&&HA.observe?.({phase:"operation",owner:u})}}async function XN(e){const t=await SE();try{const n=hA(e);if(!n)throw new ys("configuration","Saved AI connection not found.");if(n.configuration.parameters.vault_tomb!==t.tomb)throw new ys("authentication","Unlock the vault that saved this AI connection.");const r=()=>{t.check(),BN(e,n.revision,n.configuration.fingerprint)()};let i=null;try{const e=await cN(n,t.tomb);await sN(n,t.tomb),Es(e,t.tomb,r),i=e}catch{r()}await Ti(e,r,r),i&&await Cs(i,t.tomb,()=>t.check()).catch(()=>{})}finally{t.close()}}const YN=Object.freeze(Object.defineProperty({__proto__:null,deleteAiConnection:XN,performSavedAiInference:ZN,saveAiConnection:WN,testAiConnection:JN},Symbol.toStringTag,{value:"Module"}));function QN(){throw new ys("stale","The generated image's original connection ended.")}class ez{constructor(e){this.context=e,e.signal.addEventListener("abort",()=>this.release(),{once:!0})}context;#t=null;#n=!1;#r=!1;static async prepare(e,t){const{draft:n,...r}=await async function(e,t){const n=_E(),r=hA(e);r?.privateState.verification||QN(),Gn({family:"AI",accepts:e=>e===r.configuration.providerId,classification:pA},e,!0);const i=t.signal,a=new AbortController,o=AbortSignal.any([n.signal,i,a.signal]);let s=!1,c=()=>{};const l=function(e,t,n,r){const i=t.signal,a=t.assertCurrent;return()=>{r.throwIfAborted(),t.signal===i&&t.assertCurrent===a||QN(),a.call(t),n.assertCurrent();const o=an(e.connectionId);o&&o.revision===e.revision&&o.configuration.fingerprint===e.configuration.fingerprint||QN()}}(r,t,n,o),d=()=>{l(),c(),l()},u=()=>{a.abort()},p=()=>{try{d()}catch{u()}},h=Ei(p),f=setInterval(p,100);let m,g=()=>{};const w=()=>{s||(s=!0,u(),clearInterval(f),h(),g(),m?.close())};o.addEventListener("abort",w,{once:!0});try{d(),m=await SE(),s&&m.close(),d(),m.check();const e=m,t=await cN(r,e.tomb);d();const i=await sN(r,e.tomb);d(),c=()=>Es(t,e.tomb,()=>e.check());const{vaultStore:a}=await Mo(async()=>{const{vaultStore:e}=await import("./drop-open-BjgdLxWM.js").then(e=>e.gn);return{vaultStore:e}},[]);d(),g=a.subscribe(p);const l=AbortSignal.any([o,e.signal]);return l.addEventListener("abort",w,{once:!0}),d(),{draft:i,port:n,signal:l,check:d,close:w}}catch(v){throw w(),v}}(e,t),i=new ez(r);try{return i.check(),{owner:i,draft:n,transport:Object.freeze({...r.port,signal:r.signal})}}catch(a){throw i.release(),a}}get signal(){return this.context.signal}check(){if(this.#r)throw new ys("stale","The generated image was released.");try{this.context.check()}catch(e){throw this.release(),e}}complete(e){try{if(this.check(),this.#n)throw new ys("stale","This image operation already completed.");return this.#n=!0,this.#t=e,this.check(),this}catch(t){throw e.release(),this.release(),t}}metadata(){if(this.check(),!this.#t)throw new ys("response","The image has not completed.");const{mimeType:e,width:t,height:n,seed:r}=this.#t;return{mimeType:e,width:t,height:n,seed:r}}copyBytes(){if(this.check(),!this.#t)throw new ys("response","The image has not completed.");const e=this.#t.copyBytes();try{return this.check(),e}catch(t){throw e.fill(0),t}}release(){this.#r||(this.#r=!0,this.#t?.release(),this.#t=null,this.context.close())}}function tz({image:e}){const[t,n]=Ce.useState(null),[r,i]=Ce.useState(null),a=Ce.useRef(null),o=Ce.useRef(0);Ce.useEffect(()=>{const t=++o.current;a.current&&a.current!==e&&a.current.release(),a.current=e;let r,s=!0,c=!1;const l=new Image,d=()=>{r&&!c&&(c=!0,URL.revokeObjectURL(r))},u=(t=!0)=>{s&&(s=!1,l.removeAttribute("src"),d(),a.current===e&&(a.current=null),e.release(),t&&n(null))},p=()=>u();return e.signal.addEventListener("abort",p,{once:!0}),(async()=>{try{e.check();const t=e.metadata(),i=e.copyBytes();let a;try{a=new Blob([new Uint8Array(i)],{type:t.mimeType})}finally{i.fill(0)}if(e.check(),r=URL.createObjectURL(a),e.check(),l.src=r,await l.decode(),e.check(),!s)return;if(l.naturalWidth!==t.width||l.naturalHeight!==t.height)throw new Error("The decoded image dimensions do not match the response.");n({image:e,url:r})}catch{s&&!e.signal.aborted&&i(e),u()}})(),()=>{e.signal.removeEventListener("abort",p),l.removeAttribute("src"),d(),window.setTimeout(()=>{o.current===t&&(a.current===e&&(a.current=null),e.release())},0)}},[e]);const s=t?.image===e?t:null;return r===e?Ee.jsx("p",{role:"alert",children:"The generated image could not be decoded."}):s?Ee.jsxs("div",{children:[Ee.jsx("img",{src:s.url,alt:"Generated artwork",style:{maxWidth:"100%",height:"auto"}}),Ee.jsx(U,{label:"Download image",onClick:()=>{if(s)try{e.check();const t=e.metadata(),n="image/jpeg"===t.mimeType?"jpg":t.mimeType.slice(6),r=document.createElement("a");r.download=`generated-image.${n}`,r.href=s.url,e.check(),r.click()}catch{URL.revokeObjectURL(s.url),n(null)}}})]}):null}const nz={save:WN,test:JN,remove:XN};function rz(e){return"replicate_predictions"===e||bs(e)||ks(e)}function iz(e,t){if(!t)return!1;try{const n=wA(t);return Boolean(n&&lA(aA(e,!1))===lA(aA(n,!1)))}catch{return!1}}function az(){const e=Ht.getSnapshot();return JSON.stringify([e.status,e.tomb,e.guest,e.awaitingSecondStep,e.decoy])}function oz(e){const t=e?on(e):null;return JSON.stringify([t?.revision,t?.fingerprint])}function sz(e,t,n){const r=jy(e),i=Ce.useRef(null),{clear:a}=r;return Ce.useLayoutEffect(()=>{let e=az(),r=oz(n);const i=()=>{a(),t()},o=Ht.onLock(i),s=Ht.subscribe(()=>{const t=az();t!==e&&(e=t,i())}),c=Ei(()=>{if(!n)return;const e=oz(n);e!==r&&(r=e,i())});return()=>{o(),s(),c(),a()}},[a,n,t]),{...r,runAi:async function(e){return r.run(t=>async function(e,t,n){e.check();const r=new AbortController,i=()=>r.abort(e.signal.reason);e.signal.addEventListener("abort",i,{once:!0}),e.signal.aborted&&i();const a={signal:r.signal,current:e.current,check:e.check},o=new AbortController;t.current=o;try{let t;try{t=await n(a,o.signal)}catch(s){if(!(s instanceof HS&&s.cancellationRequested||s instanceof FS&&s.deletionAcknowledged))throw s;e.check(),t=s.message}return e.check(),r.signal.throwIfAborted(),t}catch(s){throw r.abort(s),s}finally{e.signal.removeEventListener("abort",i),t.current===o&&(t.current=null)}}(t,i,e))},onCancel:()=>i.current?.abort()}}function cz(e,t,n){return{...e.fields,onSampleAudio:n=>{t.clear(),e.fields.onSampleAudio(n)},onCancel:()=>{ks(n)?t.clear():bs(n)?(Is(n)?t.onCancel():t.clear(),e.clear()):t.onCancel()}}}function lz({connectionId:e}){const{prompt:t,setPrompt:n,image:r,pending:i,generate:a,cancel:o,release:s}=function(e){const[t,n]=Ce.useState(""),[r,i]=Ce.useState(null),a=Ce.useMemo(()=>({connectionId:e,current:null}),[e]),o=Ce.useCallback(()=>{a.current?.abort(),a.current=null,i(null)},[a]),s=Ce.useCallback(()=>{o(),n("")},[o]),c=sz(()=>{},s,e);return Ce.useEffect(()=>()=>{a.current?.abort(),a.current=null},[a]),{prompt:t,setPrompt:n,image:r,pending:c,generate:async function(){if(!t.trim()||c.busy)return;o();const n=new AbortController;a.current=n,await c.runAi(async r=>{let o;const s=()=>{if(n.signal.throwIfAborted(),a.current!==n)throw new Error("The image view was replaced.")};try{return o=await async function(e,t,n,r){const i=r.signal,a=r.assertCurrent,o=()=>{if(r.signal!==i||r.assertCurrent!==a)throw new ys("stale","The image request owner changed.");i.throwIfAborted(),a.call(r)};o();const s=await ez.prepare(e,n);let c;try{const e=()=>{s.owner.check(),o()};return e(),c=(await RN(nd(s.draft),{model:s.draft.model,messages:[{role:"user",content:t}]},{...s.transport,signal:AbortSignal.any([s.transport.signal,i])},e)).image,e(),s.owner.complete(c)}catch(l){throw c?.release(),s.owner.release(),l}}(e,t,{signal:n.signal,assertCurrent:s},{signal:r.signal,assertCurrent:r.check}),r.check(),s(),o.check(),void i(o)}catch(c){throw o?.release(),n.abort(),c}})},cancel:()=>{c.clear(),s()},release:o}}(e);return Ee.jsxs("section",{className:"panel","aria-label":"Image generation",children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsxs("h2",{children:[Ee.jsx("span",{className:"cx-step",children:"3"})," Generate an image"]})}),Ee.jsxs("div",{className:"panel__body cx-form",children:[Ee.jsx(q,{id:`ai-image-${e}`,title:"Image generation",message:i.failure}),Ee.jsx(O,{label:"Image prompt",value:t,maxLength:8192,disabled:i.busy,onValueChange:e=>{i.clear(),s(),n(e)}}),Ee.jsx("p",{children:"Generation sends this prompt to your configured image service and may incur charges. Cancel stops local waiting; provider work or charges may continue."}),Ee.jsxs(U,{label:"Generate image",busy:i.busy,disabled:i.busy||!t.trim(),onClick:()=>{a()},children:[i.busy?Ee.jsx(B,{label:"Cancel image generation",onClick:o,children:Ee.jsx(H,{size:16})}):null,i.failure?Ee.jsx(Oe,{tone:"err",label:i.failure}):null]}),r?Ee.jsx(tz,{image:r}):null]})]})}function dz({connectionId:e}){const{draft:t,prediction:n,speech:r,audio:i,onCancel:a,supportsStreaming:o,prompt:s,answer:c,stream:l,setStream:d,pending:u,ready:p,invoke:h,change:f}=function(e){const t=wA(e),n="replicate_predictions"===t?.family,r=bs(t?.family),i=kC(),a=i.clear,o=!t?.vertex&&"bedrock_converse"!==t?.family&&!n&&!r,[s,c]=Ce.useState(""),[l,d]=Ce.useState(""),[u,p]=Ce.useState(!0),h=sz(()=>{},Ce.useCallback(()=>{c(""),d(""),a()},[a]),e),f=Boolean(t&&(r?i.fields.sampleAudio:n?vC(t,s):s.trim()));return{draft:t,prediction:n,speech:r,audio:{...i.fields,onSampleAudio:e=>{h.clear(),d(""),i.fields.onSampleAudio(e)}},onCancel:()=>{r?(Is(t?.family)?h.onCancel():h.clear(),a(),d("")):h.onCancel()},supportsStreaming:o,prompt:s,answer:l,stream:u,setStream:p,pending:h,ready:f,invoke:async function(){if(!f)return;const t=wA(e);t&&(d(""),await h.runAi(async(n,a)=>{const c=await ZN(e,r?{model:t.model,messages:[],media:i.fields.sampleAudio}:{model:t.model,messages:[{role:"user",content:s}],maxOutputTokens:1024},{signal:n.signal,assertCurrent:n.check},u&&o?e=>{n.check(),d(t=>t+e)}:void 0,{signal:a});n.check(),d(c.answer)}))},change:e=>{h.clear(),c(e),d("")}}}(e);return Ee.jsxs("section",{className:"panel","aria-label":"Model inference",children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsxs("h2",{children:[Ee.jsx("span",{className:"cx-step",children:"3"})," ",r?"Transcribe audio":"Try this model"]})}),Ee.jsxs("div",{className:"panel__body cx-form",children:[Ee.jsx(q,{id:`ai-inference-${e}`,title:"Model inference",message:u.failure}),Ee.jsx(IC,{draft:t,busy:u.busy,prompt:s,onPrompt:f,audio:i}),o?Ee.jsxs("label",{children:[Ee.jsx("input",{type:"checkbox",checked:l,disabled:u.busy,onChange:e=>d(e.target.checked)})," ","Stream response"]}):Ee.jsx("p",{children:"Responses appear when the request completes."}),Ee.jsxs(U,{label:r?"Transcribe audio":n?"Run prediction":"Send prompt",disabled:u.busy||!p,busy:u.busy,onClick:()=>{h()},children:[(n||r)&&u.busy?Ee.jsx(B,{label:r?"Cancel transcription":"Cancel prediction",onClick:a,children:Ee.jsx(H,{size:16})}):null,u.failure?Ee.jsx(Oe,{tone:"err",label:u.failure}):null,u.result?Ee.jsx(Oe,{tone:"ok",label:u.result}):null]}),Ee.jsx("output",{"aria-label":r?"Transcript":n?"Prediction output":"Model answer","aria-live":"polite",children:c})]})]})}function uz({connectionId:e}){return ks(wA(e)?.family)?Ee.jsx(lz,{connectionId:e},e):Ee.jsx(dz,{connectionId:e},e)}function pz({providerId:e,connectionId:t,onFlash:n,onChanged:r,inSheet:i=!1}){const a=function(e,t,n,r){const[i,a]=Ce.useState(()=>function(e,t){return t?wA(t)??cd(e):cd(e)}(e,t)),[o,s]=Ce.useState(t),[c,l]=Ce.useState(""),d=kC(),u=d.clear,p=Ce.useCallback(()=>{a(e=>({...e,apiKey:""})),l(""),u()},[u]),h=sz(n,p);async function f(e){await h.runAi(async(t,n)=>{const a="replicate_predictions"===i.family?wC(i,c):void 0,l=function(e,t,n,r,i){return{signal:n.signal,prediction:{signal:r},imagePrompt:ks(e.family)?t:void 0,audio:bs(e.family)?i.fields.sampleAudio:void 0}}(i,c,t,n,d);try{if(!e)return await nz.test(i,o,a,l);const n=await nz.save(i,o,a,l);return t.check(),s(n.connectionId),p(),window.dispatchEvent(new Event("opensesame:ai-connections-changed")),r?.(),"AI connection verified and saved in this vault"}catch(u){throw function(e,t){return e instanceof HS||e instanceof FS?e:new Error(t?e.message.replaceAll(t,"[credential]"):e.message)}(u instanceof Error?u:new Error("The AI operation failed."),i.apiKey)}})}return{...h,draft:i,...cz(d,h,i.family),savedId:o,predictionInput:c,onPredictionInput:e=>{h.clear(),l(e)},hasSavedCredentials:Boolean(o&&wA(o)),canRetainCredential:iz(i,o),onChange:function(e,t){h.clear(),u(),a(n=>function(e,t,n){const r={...e,[t]:n};["openai_chat","openai_responses"].includes(r.family)||(r.azure=void 0),function(e,t,n){if("gemini_generate_content"!==t.family&&(t.vertex=void 0),t.vertex){t.authentication="api-key";const r="vertex"===n&&(!t.baseUrl||Boolean(e.vertex&&e.baseUrl===nA(e.vertex)));("google-vertex"===t.providerId||r)&&(t.baseUrl=nA(t.vertex))}(e.vertex||t.vertex)&&["vertex","family","baseUrl","model"].includes(n)&&(t.apiKey="")}(e,r,t),function(e,t,n){if("bedrock_converse"!==t.family)t.bedrock=void 0;else{t.bedrock??={region:"us-east-1",credential:"sigv4"},t.authentication="api-key";const r=!t.baseUrl||Boolean(e.bedrock&&e.baseUrl.replace(/\/+$/,"")===Jl(e.bedrock).replace(/\/$/,""));("aws-bedrock"===t.providerId||("bedrock"===n||"family"===n)&&r)&&(t.baseUrl=Jl(t.bedrock))}(e.bedrock||t.bedrock)&&["bedrock","family","baseUrl","model"].includes(n)&&(t.apiKey="")}(e,r,t);const i=rz(r.family);return i&&(r.authentication="api-key"),(rz(e.family)||i)&&["family","baseUrl","model","authentication"].includes(t)&&(r.apiKey=""),r.azure&&(r.authentication="api-key","dated-chat"===r.azure.api&&(r.family="openai_chat","dated-chat"!==e.azure?.api&&(r.tokenParameter="max_tokens"))),(e.azure||r.azure)&&["azure","family","baseUrl","model"].includes(t)&&(r.apiKey=""),r}(n,e,t)),["family","baseUrl","model","authentication"].includes(e)&&l("")},onSave:()=>{f(!0)},onTest:()=>{f(!1)},onForget:()=>{!async function(e,t,n,r){e&&await t.runAi(async t=>(await nz.remove(e),t.check(),s(void 0),p(),window.dispatchEvent(new Event("opensesame:ai-connections-changed")),r?.(),"AI connection forgotten"))}(o,h,0,r)}}}(e,t,n,r);return i?Ee.jsx(jC,{...a,saved:a.hasSavedCredentials}):Ee.jsxs("div",{className:"cx-setup",children:[Ee.jsx(Nv,{step:2,label:"AI configuration",title:a.savedId?"Configure":"Connect",focus:!0,actions:a.hasSavedCredentials?Ee.jsx(B,{label:"Forget AI connection",disabled:a.busy,onClick:a.onForget,children:Ee.jsx(H,{size:16})}):null,children:Ee.jsx(jC,{...a,saved:a.hasSavedCredentials})}),a.savedId&&a.hasSavedCredentials?Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(uz,{connectionId:a.savedId},a.savedId),Ee.jsx(oN,{connectionId:a.savedId})]}):null,Ee.jsx(q,{id:`ai-connection-${e}`,title:"AI connection",message:a.failure})]})}function hz(e,t){const n=t.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,48);return`${e.id}/${n||"default"}`}function fz(e){try{return"https:"===new URL(e).protocol}catch{return!1}}function mz(e,t){const n=[];for(const[r,i]of e)(t||i)&&(qa(i)?n.push(`${r} needs your domain.`):fz(i)||n.push(`${r} must be https.`));return n}function gz(e){if("oauth"===e.kind)return function(e){const t=[...mz([["Server URL",e.serverUrl],["Authorization endpoint",e.authorizationEndpoint],["Token endpoint",e.tokenEndpoint]],!0),...mz([["Revocation endpoint",e.revocationEndpoint],["User info endpoint",e.userinfoEndpoint]],!1)];return function(e){return"manual"!==e.registration&&!e.clientId.trim()}(e)||(e.clientId.trim()||t.push("Paste the client ID."),"none"===e.tokenAuth||e.clientSecret.trim()||t.push("Paste the client secret.")),t}(e.oauth);if("mcp"===e.kind)return"manual"!==e.registration||e.clientId.trim()?[]:["Paste the client ID."];if("api-key"!==e.kind)return[];const t=[];return"app"!==e.subject||e.key.trim()||t.push("Paste the API key."),e.serviceUrls.some(fz)||t.push("Name the https API the key is for."),t}function wz(e){const t=[];return e.name.trim()||t.push("Name the connector."),e.uid&&!/^[^\s%#]+\/[^\s%#]+$/.test(e.uid)&&t.push("A UID looks like service/name, with no spaces."),[...t,...gz(e)]}function vz(e,t,n){const r={subject:"user"===e.type?{type:"user",id:e.id}:{type:"app"}};return t.length>0&&(r.scopes=[...t]),n&&(r.returnUrl=n),r}const yz={serverUrl:"",authorizationEndpoint:"",tokenEndpoint:"",revocationEndpoint:"",userinfoEndpoint:"",tokenAuth:"client_secret_post",pkce:"S256",authorizationParams:{},scopes:[],refreshTokens:!0,clientId:"",clientSecret:"",registration:"manual"};function bz(e,t){return e.methods.find(e=>e.kind===t)}function kz(e,t){const n=bz(e,"oauth");return"oauth"===n?.kind&&n.preset?function(e,t={}){const n=e=>e?Da(e,t):"";return{serverUrl:n(e.serverUrl),authorizationEndpoint:n(e.authorizationEndpoint),tokenEndpoint:n(e.tokenEndpoint),revocationEndpoint:n(e.revocationEndpoint),userinfoEndpoint:n(e.userinfoEndpoint),tokenAuth:e.tokenAuth,pkce:e.pkce,authorizationParams:Object.fromEntries(Object.entries(e.authorizationParams).map(([e,n])=>[e,Da(n,t)])),scopes:Ua(e),refreshTokens:e.refreshTokens,clientId:"",clientSecret:"",registration:e.registration}}(n.preset,t):{...yz,authorizationParams:{}}}function xz(e){const t=bz(e,"api-key");if("api-key"!==t?.kind){const t=bz(e,"mcp");return{serviceUrls:"mcp"===t?.kind?[t.mcp.url]:[],instructions:""}}return{serviceUrls:(t.preset?.templateParams.length??0)>0||0===t.urls.length?t.preset?.serviceUrls??t.urls:t.urls,instructions:t.preset?.instructions??""}}function Iz(e){const t=bz(e,"mcp");return"mcp"===t?.kind&&"ok"===t.mcp.status?t.mcp.registration:"manual"}function jz(e,t){return{method:t??Ma(e)?.kind??"oauth",name:e.name,uid:hz(e,"default"),params:{},oauth:kz(e,{}),mcpClientId:"",mcpClientSecret:"",mcpRegistration:Iz(e),keySubject:"user",key:"",...xz(e)}}const _z=["serverUrl","authorizationEndpoint","tokenEndpoint","revocationEndpoint","userinfoEndpoint"];function Sz(e,t,n){return JSON.stringify(e)===JSON.stringify(t)?n:e}function Az(e,t,n,r){const i={...e.params,[n]:r},a=kz(t,e.params),o=kz(t,i),s={...e.oauth};for(const l of _z)s[l]=Sz(e.oauth[l],a[l],o[l]);s.authorizationParams=Sz(e.oauth.authorizationParams,a.authorizationParams,o.authorizationParams);const c=xz(t).serviceUrls;return{...e,params:i,serviceUrls:c.some(e=>e.includes("{"))?Sz(e.serviceUrls,c.map(t=>Da(t,e.params)),c.map(e=>Da(e,i))):e.serviceUrls,oauth:s}}function Cz(e,t){const n=jz(e),r="api-key"===t.type?"api-key":"oauth"===t.type?"oauth":n.method,i=(e,t)=>e||t;return{...n,method:r,name:t.name||n.name,uid:t.uid||n.uid,oauth:{serverUrl:i(t.serverUrl,n.oauth.serverUrl),authorizationEndpoint:i(t.authorizationEndpoint,n.oauth.authorizationEndpoint),tokenEndpoint:i(t.tokenEndpoint,n.oauth.tokenEndpoint),revocationEndpoint:i(t.revocationEndpoint,n.oauth.revocationEndpoint),userinfoEndpoint:i(t.userinfoEndpoint,n.oauth.userinfoEndpoint),tokenAuth:"client_secret_basic"===t.tokenAuth||"client_secret_post"===t.tokenAuth||"none"===t.tokenAuth?t.tokenAuth:n.oauth.tokenAuth,pkce:t.pkce??n.oauth.pkce,authorizationParams:Object.keys(t.authorizationParams).length>0?t.authorizationParams:n.oauth.authorizationParams,scopes:t.scopes.length>0?t.scopes:n.oauth.scopes,refreshTokens:t.refreshTokens??n.oauth.refreshTokens,clientId:t.clientId,clientSecret:"",registration:n.oauth.registration},keySubject:"app"===t.subjectType?"app":"user",serviceUrls:t.serviceUrls.length>0?t.serviceUrls:n.serviceUrls,instructions:t.instructions||n.instructions}}function Ez(e){const t={name:e.name,uid:e.uid};switch(e.method){case"managed":return{...t,kind:"managed"};case"oauth":return{...t,kind:"oauth",oauth:e.oauth};case"mcp":return{...t,kind:"mcp",clientId:e.mcpClientId,clientSecret:e.mcpClientSecret,registration:e.mcpRegistration};case"api-key":return{...t,kind:"api-key",subject:e.keySubject,key:e.key,serviceUrls:e.serviceUrls,instructions:e.instructions}}}function Tz(e,t){const n=bz(e,"oauth"),r="oauth"===n?.kind&&n.preset?n.preset.scopes:[],i=t.oauth.scopes.filter(e=>!r.some(t=>t.name===e)).map(e=>({name:e,description:""}));return[...r.map(({name:e,description:t})=>({name:e,description:t})),...i]}function Nz(e,t){const n=e.oauth.scopes.includes(t);return{...e,oauth:{...e.oauth,scopes:n?e.oauth.scopes.filter(e=>e!==t):[...e.oauth.scopes,t]}}}const zz=/^local-[0-9a-f]{32}$/;function $z(e,t,n=Ii(),r){const i=e?.trim();if(i&&/^[A-Za-z0-9_.:@-]{1,128}$/.test(i))return i;const a=t?.trim();if(!a||!n)return null;const o=r?.trim();if(!o)return null;const s=`opensesame.connect-subject.${a}.${o}`;try{const e=n.getItem(s);if(e&&zz.test(e))return e;const t=`local-${[...crypto.getRandomValues(new Uint8Array(16))].map(e=>e.toString(16).padStart(2,"0")).join("")}`;return n.setItem(s,t),n.getItem(s)===t?t:null}catch{return null}}function Pz({draft:e,busy:t,onChange:n,fields:r}){const i=Zi(e.providerId),a={issuer:i?.issuerPlaceholder,baseUrl:i?.baseUrlPlaceholder};return r.map(r=>Ee.jsx(O,{label:r.label,value:String(e[r.key]??""),placeholder:"issuer"===r.key||"baseUrl"===r.key?a[r.key]:r.placeholder,type:r.secret?"password":"text",autoComplete:r.secret?"new-password":"off",mono:!0,disabled:t,onValueChange:e=>n(r.key,e)},r.key))}const Oz=[{key:"issuer",label:"Issuer URL"},{key:"clientId",label:"Public client ID"}],Rz=[{key:"scope",label:"Scopes",placeholder:"openid profile email"},{key:"clientSecret",label:"Client secret (server client)",secret:!0}],Lz=[{key:"clientId",label:"Service provider entity ID",placeholder:"urn:your-app:identity"},{key:"samlEntityId",label:"Identity provider entity ID"},{key:"samlMetadataUrl",label:"SAML metadata URL",placeholder:"https://idp.example.com/metadata"}],Uz=[{key:"samlNameIdFormat",label:"NameID format URI"},{key:"samlAuthnContext",label:"Authentication context URI (optional)"}],Dz=[{key:"issuer",label:"Token issuer override"},{key:"audience",label:"Token audience override"},{key:"jwksUri",label:"JWKS URL override"}],qz=[{key:"ldapUrl",label:"LDAP server URL",placeholder:"ldaps://directory.example.com:636"},{key:"ldapBaseDn",label:"Search base DN",placeholder:"ou=people,dc=example,dc=com"}],Mz=[{key:"ldapBindTemplate",label:"Bind DN template",placeholder:"uid={username},ou=people,dc=example,dc=com"},{key:"ldapSearchFilter",label:"Search filter",placeholder:"(uid={username})"},{key:"ldapBindDn",label:"Service bind DN"},{key:"ldapBindPassword",label:"Service bind password",secret:!0},{key:"ldapSubjectAttribute",label:"Subject attribute",placeholder:"entryUUID"},{key:"ldapEmailAttribute",label:"Email attribute",placeholder:"mail"},{key:"ldapNameAttribute",label:"Name attribute",placeholder:"cn"}],Kz=[{id:"samlMetadataXml",label:"Metadata XML (alternative to URL)",kind:"textarea",secret:!1,required:!1,maxLength:262144,help:"Paste IdP metadata or use its URL. Saved XML is write-only; leave it blank to keep an unchanged connection."}],Fz=[{id:"samlSigningPrivateKeyPkcs8",label:"SP signing private key (PKCS8 PEM)",kind:"text",secret:!0,required:!1,help:"Optional unless the IdP requires signed requests. Leave blank to keep the key for an unchanged connection."},{id:"samlSigningCertificate",label:"SP signing certificate (PEM)",kind:"textarea",secret:!1,required:!1,maxLength:16384,help:"Use the certificate matching the private key. Changing the metadata URL or certificate requires re-entering that key."}];function Gz(e){const t=(t,n)=>{n&&"samlMetadataXml"===t&&e.onChange("samlMetadataUrl",""),n&&"samlMetadataUrl"===t&&e.onChange("samlMetadataXml",""),e.onChange(t,n)},n=(e,n)=>{const r=[...Kz,...Fz].find(t=>t.id===e);r&&t(r.id,n)};return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(Pz,{...e,onChange:t,fields:Lz}),Ee.jsxs("fieldset",{className:"cx-form",disabled:e.busy,children:[Ee.jsx(py,{fields:Kz,values:e.draft,onChange:n}),Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"SAML options"}),Ee.jsxs("div",{className:"cx-form",children:[Ee.jsx(Pz,{...e,fields:Uz}),Ee.jsx(Ov,{label:"Require fresh authentication",value:e.draft.samlForceAuthentication,options:[{id:"false",label:"No"},{id:"true",label:"Yes"}],onChange:e=>t("samlForceAuthentication",e)}),Ee.jsx(py,{fields:Fz,values:e.draft,onChange:n})]})]})]})]})}function Bz(e){return Ee.jsxs("fieldset",{className:"cx-form",disabled:e.busy,children:[Ee.jsx(Ov,{label:"Connection route",value:e.draft.oidcTransport,options:[{id:"auto",label:"Default for this client"},{id:"browser",label:"Browser HTTPS (provider CORS)"},{id:"native",label:"Tailscale browser node"}],onChange:t=>e.onChange("oidcTransport",t)}),Ee.jsx(Pz,{...e,fields:[{key:"oidcAuthorizationEndpoint",label:"Authorization endpoint (optional)"},{key:"oidcTokenEndpoint",label:"Token endpoint (optional)"},{key:"jwksUri",label:"JWKS URI (optional)"}]}),Ee.jsx(Ov,{label:"Token endpoint authentication",value:e.draft.oidcTokenAuthentication,options:[{id:"auto",label:"Provider discovery"},{id:"none",label:"Public client (PKCE)"},{id:"client_secret_basic",label:"Client secret in HTTP Basic"},{id:"client_secret_post",label:"Client secret in request body"}],onChange:t=>e.onChange("oidcTokenAuthentication",t)})]})}function Vz(e){const t="confidential"===e.draft.oidcClientType||!!e.draft.clientSecret;return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx("fieldset",{className:"cx-form",disabled:e.busy,children:Ee.jsx(Ov,{label:"OIDC client type",value:t?"confidential":"public",options:[{id:"public",label:"Public client"},{id:"confidential",label:"Confidential client"}],onChange:t=>{"public"===t&&e.onChange("clientSecret",""),e.onChange("oidcClientType",t)}})}),Ee.jsx(Pz,{...e,fields:Oz.map(e=>"clientId"===e.key&&t?{...e,label:"Client ID"}:e)}),Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Sign-in options"}),Ee.jsxs("div",{className:"cx-form",children:[Ee.jsx(Pz,{...e,onChange:(t,n)=>{"clientSecret"===t&&n&&e.onChange("oidcClientType","confidential"),e.onChange(t,n)},fields:Rz.filter(e=>"clientSecret"!==e.key||t)}),Ee.jsx(Bz,{...e}),Ee.jsx(Pz,{...e,fields:[{key:"organizationId",label:"Organization ID (optional)"},{key:"oidcOrganizationParameter",label:"Organization authorization parameter"},{key:"oidcOrganizationClaim",label:"Signed organization claim"}]})]})]})]})}function Hz(e){const t=Ce.useId();return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(Pz,{...e,fields:qz}),Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Directory options"}),Ee.jsxs("div",{className:"cx-form",children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:`${t}-bind`,children:"Bind mode"}),Ee.jsxs("select",{id:`${t}-bind`,value:e.draft.ldapBindMode,disabled:e.busy,onChange:t=>e.onChange("ldapBindMode",t.target.value),children:[Ee.jsx("option",{value:"bind_template",children:"User bind"}),Ee.jsx("option",{value:"search_then_bind",children:"Search and bind"})]})]}),Ee.jsx(Pz,{...e,fields:Mz})]})]})]})}function Jz(e){const t="supabase"===e.draft.protocol;return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(Pz,{...e,fields:[{key:"baseUrl",label:t?"Project URL":"Auth API base URL"}]}),t?Ee.jsx(Pz,{...e,fields:[{key:"publicKey",label:"Publishable / anon key"}]}):null,Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Token verification"}),Ee.jsx("div",{className:"cx-form",children:Ee.jsx(Pz,{...e,fields:Dz})})]})]})}function Wz(e){switch(e.draft.protocol){case"oidc":return Ee.jsx(Vz,{...e});case"saml":return Ee.jsx(Gz,{...e});case"ldap":return Ee.jsx(Hz,{...e});default:return Ee.jsx(Jz,{...e})}}function Zz({draft:e,busy:t,onChange:n,organizations:r,onLoadOrganizations:i}){const a=Ce.useId(),o=r.some(t=>t.id===e.organizationId);return Ee.jsxs("div",{className:"field keyed-field",children:[Ee.jsx("label",{htmlFor:`${a}-organization`,children:"Organization"}),Ee.jsxs("select",{id:`${a}-organization`,value:e.organizationId,disabled:t,onChange:e=>{const t=r.find(t=>t.id===e.target.value);n("organizationId",e.target.value),n("organizationSlug",t?.slug??"")},children:[Ee.jsx("option",{value:"",children:"Choose an organization"}),e.organizationId&&!o?Ee.jsx("option",{value:e.organizationId,children:e.organizationSlug||e.organizationId}):null,r.map(e=>Ee.jsx("option",{value:e.id,disabled:!e.owner,children:e.displayName},e.id))]}),Ee.jsx(B,{label:"Load organizations",disabled:t||!e.brokerUrl.trim(),onClick:i,children:Ee.jsx(V,{size:17})})]})}function Xz(e){return Ee.jsxs("fieldset",{className:"cx-block",children:[Ee.jsx("legend",{children:"Sign-in service"}),Ee.jsx(O,{label:"Identity service URL",value:e.draft.brokerUrl,type:"url",mono:!0,placeholder:"https://identity.example.com",disabled:e.busy,onValueChange:t=>e.onChange("brokerUrl",t),tail:Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(B,{label:"Connect sign-in service",disabled:e.busy||!e.draft.brokerUrl.trim(),onClick:e.onConnectService,children:Ee.jsx(de,{size:17})}),Ee.jsx(B,{label:"Sign in to organization service",disabled:e.busy||!e.draft.brokerUrl.trim(),onClick:e.onSignInService,children:Ee.jsx(ue,{size:17})})]})}),Ee.jsx(Zz,{...e})]})}function Yz(e){return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(Wz,{draft:e.draft,busy:e.busy,onChange:e.onChange}),Rs(e.draft)?Ee.jsx(Xz,{...e}):null]})}function Qz({draft:e,busy:t,onChange:n}){const r=Ce.useId(),i=Zi(e.providerId);return Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:`${r}-protocol`,children:"Protocol"}),Ee.jsx("select",{id:`${r}-protocol`,value:e.protocol,disabled:t,onChange:e=>n("protocol",e.target.value),children:i?.protocols.map(t=>Ee.jsx("option",{value:t,children:OI(t,e.providerId)},t))})]})}function e$({draft:e}){const t=e.protocol,n="saml"===t,r="oidc"===t,i=n?new URL("auth/native-saml",new URL(ji().BASE_URL||"/",window.location.origin)).href:r?Us(e)?Ds(window.location.origin,ji().BASE_URL):pe():window.location.origin;return Ee.jsx(O,{label:n?"SAML ACS URL to register":r?"Redirect URI to register":"Allowed browser origin",type:"url",mono:!0,readOnly:!0,value:i,tail:Ee.jsx(B,{label:n?"Copy ACS URL":r?"Copy redirect URI":"Copy browser origin",onClick:()=>{navigator.clipboard?.writeText(i).catch(()=>{})},children:Ee.jsx(G,{size:17})})})}function t$({busy:e,online:t,failure:n,saved:r,onTest:i,onReload:a}){return Ee.jsxs(U,{label:e?"Saving identity connection…":"Save identity connection",busy:e,disabled:e,children:[Ee.jsx(B,{label:"Test identity connection",disabled:e||!t,onClick:i,children:Ee.jsx(de,{size:17})}),r?Ee.jsx(B,{label:"Reload identity configuration",disabled:e,onClick:a,children:Ee.jsx(V,{size:17})}):null,n?Ee.jsx(Oe,{tone:"err",label:n}):null]})}function n$(e){const{draft:t,busy:n,onChange:r}=e,i=Zi(t.providerId);return i?Ee.jsxs("form",{className:"cx-form panel__body",onSubmit:e.onSubmit,children:[Ee.jsx(O,{label:"Connection name",value:t.name,disabled:n,onValueChange:e=>r("name",e)}),Ee.jsx(Qz,{...e}),Ee.jsx(e$,{draft:t}),Ee.jsx(Yz,{...e}),Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Setup guide"}),Ee.jsx("p",{children:"saml"===t.protocol?"Register this service provider entity ID and ACS URL with your IdP. Use its metadata URL or paste its metadata XML. Enable HTTP-POST responses with RSA-SHA256 signatures. If the IdP requires signed requests, supply your SP signing key and matching certificate under SAML options. Testing checks configuration; complete sign-in to authenticate. Your existing vault still uses its normal unlock method.":Us(t)?Ls:i.setup}),Ee.jsxs("a",{href:i.docsUrl,target:"_blank",rel:"noreferrer noopener",children:[i.label," documentation"]})]}),Ee.jsx(t$,{...e})]}):null}const r$={beginSignIn:ge,brokeredRealmUpstream:Lt,beginIdentityConnectionSignIn:ma,identityConnectionDraft:fa,listIdentityConnectionOrganizations:ha,listIdentityConnections:Ms,readIdentityConnection:qs,readInitialIdentityDraft:pa,removeIdentityConnection:ua,saveIdentityConnection:da,testIdentityConnection:la,normalizeSignInService:me,readSignInService:fe,writeSignInService:he};function i$(e){return null!==Zi(e)}function a$(e,t,n){const{draft:r,saved:i,setDraft:a,setSaved:o}=e,{run:s,setFailure:c,setResult:l}=t;return{changed:function(e,t){a(n=>({...n,[e]:t})),c(""),l("")},reload:function(){if(!i)return;const e=r$.readIdentityConnection(i.connectionId);e?(a(e),c(""),l("Identity configuration reloaded")):c("Identity configuration is no longer available. Reload connections.")},save:function(e){e.preventDefault(),s(async()=>{const e=await r$.saveIdentityConnection(r,i?.connectionId);o(e);const t=r$.readIdentityConnection(e.connectionId);t&&a(t),l("Identity configuration saved"),n.onFlash({tone:"ok",text:`${e.displayName} identity configuration saved.`}),n.onChanged()})},test:function(){s(async()=>{const e=await r$.testIdentityConnection(r,i?.connectionId);l(e.message)})}}}function o$(e,t){return{loadOrganizations:function(){t.run(async()=>{e.setOrganizations(await r$.listIdentityConnectionOrganizations(e.draft.brokerUrl))})},connectService:function(){t.run(async()=>{const n=r$.normalizeSignInService(e.draft.brokerUrl);if(!n)throw new Error("Use an HTTPS identity service URL, or HTTP loopback for development.");r$.writeSignInService(n),t.setResult("Sign-in service configured")})},signInService:function(){t.run(async()=>{const t=r$.normalizeSignInService(e.draft.brokerUrl);if(!t||t!==r$.normalizeSignInService(r$.readSignInService()))throw new Error("Connect this sign-in service before signing in to it.");const n=window.location.pathname+window.location.search+window.location.hash;await r$.beginSignIn(r$.brokeredRealmUpstream(),{prompt:"login",returnTo:n})})}}}function s$({editor:e,online:t}){return Ee.jsx(Nv,{step:2,label:"Identity configuration",title:"Configure",actions:Ee.jsxs(Ee.Fragment,{children:[e.saved?Ee.jsx(be,{label:"Reload identity connection",disabled:e.busy,onReload:e.reload}):null,e.result?Ee.jsx(Oe,{tone:"ok",label:e.result}):null]}),children:Ee.jsx(n$,{draft:e.draft,busy:e.busy,online:t,failure:e.failure,saved:!!e.saved,organizations:e.organizations,onChange:e.changed,onSubmit:e.save,onTest:e.test,onReload:e.reload,onLoadOrganizations:e.loadOrganizations,onConnectService:e.connectService,onSignInService:e.signInService})})}function c$({editor:e,online:t}){const n=Ce.useRef(null),{saved:r,confirming:i,busy:a}=e;return r?Ee.jsx(Nv,{id:"complete",step:3,label:"Identity sign-in",title:"Sign in",actions:Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(B,{label:i?"Confirm remove identity connection":"Remove identity connection",keyRef:n,armed:i,disabled:a,onClick:()=>{e.remove()},children:Ee.jsx(F,{size:17})}),i?Ee.jsx(B,{label:"Keep identity connection",disabled:a,onClick:()=>{e.setConfirming(!1),ve(n.current)},children:Ee.jsx(H,{size:17})}):null]}),children:Ee.jsx(ga,{className:"cx-form panel__body",draft:r$.readIdentityConnection(r.connectionId)??e.draft,busy:a,online:t,failure:e.failure,onSignIn:e.signIn},`${r.connectionId}/${r.updatedAt}`)}):null}function l$(e){const t=Ce.useRef(null),n=function(e){const t=function(e,t,n){const[r,i]=Ce.useState(()=>function(e,t){return t&&r$.readIdentityConnection(t.connectionId)?t:r$.listIdentityConnections().find(t=>t.providerId===e)??null}(e.id,t)),[a,o]=Ce.useState(()=>{const t=r$.readInitialIdentityDraft(e.id,r?.connectionId);return{...t,oidcTransport:r?t.oidcTransport:n??t.oidcTransport,brokerUrl:t.brokerUrl||r$.readSignInService()}}),[s,c]=Ce.useState([]);return{saved:r,setSaved:i,draft:a,setDraft:o,organizations:s,setOrganizations:c}}(e.provider,e.connection,e.initialOidcTransport),n=function(e){const[t,n]=Ce.useState(!1),[r,i]=Ce.useState(""),[a,o]=Ce.useState("");return{busy:t,failure:r,setFailure:i,result:a,setResult:o,run:async function(r){if(!t){n(!0),i(""),o("");try{await r()}catch(a){const t=Ia(a);i(t),e({tone:"err",text:t})}finally{n(!1)}}}}}(e.onFlash),r=function(e,t,n){const[r,i]=Ce.useState(!1);return{signIn:async function(r){await t.run(async()=>{e.saved&&(await r$.beginIdentityConnectionSignIn(e.saved.connectionId,{credentials:r}),t.setResult("Signed in"),n.onChanged())})},remove:async function(){e.saved&&(r?await t.run(async()=>{await r$.removeIdentityConnection(e.saved?.connectionId??""),e.setSaved(null),e.setDraft(r$.identityConnectionDraft(n.provider.id)),i(!1),t.setResult("Identity configuration removed"),n.onChanged()}):i(!0))},confirming:r,setConfirming:i}}(t,n,e);return{...t,...n,...a$(t,n,e),...o$(t,n),...r}}(e),{saved:r}=n;return Ce.useLayoutEffect(()=>{we()&&ve(r?ye(t.current):t.current?.querySelector("input"))},[r]),Ee.jsxs("div",{className:"cx-setup",ref:t,children:[Ee.jsx(s$,{editor:n,online:e.online}),Ee.jsx(c$,{editor:n,online:e.online}),Ee.jsx(q,{id:`identity-connection-${e.provider.id}`,title:"Identity connection",message:n.failure})]})}function d$(e,t,n){return[{id:"trustMode",label:e,kind:"choice",secret:!1,required:!0,choices:[{id:"public",label:"Public certificate authorities"},{id:"operator",label:"Operator certificate authority"}]},{id:"operatorCAPEM",label:t,kind:"textarea",secret:!1,required:!0,when:{fieldId:"trustMode",value:"operator"},help:n}]}const u$=d$("Tailnet service TLS trust","Tailnet service CA certificates (PEM)","Trust only these CA certificates for HTTPS services on the selected peer.");function p$(e){return{trustMode:e?.trustMode??"public",operatorCAPEM:"operator"===e?.trustMode?e.operatorCAPEM:""}}const h$=[{id:"mode",label:"Integration HTTP transport",kind:"choice",secret:!1,required:!0,choices:[{id:"browser",label:"Browser HTTPS"},{id:"native",label:"Tailscale browser node"}],help:"Choose the transport for explicitly configured integration origins."}],f$=[{id:"routeMode",label:"Native HTTPS route",kind:"choice",secret:!1,required:!0,defaultValue:"exit",choices:[{id:"peer",label:"Approved tailnet peer"},{id:"exit",label:"Approved exit node"}]},{id:"peerID",label:"Approved peer stable ID",kind:"text",secret:!1,required:!0,when:{fieldId:"routeMode",value:"peer"},help:"Use the stable node ID of the exact peer serving these HTTPS origins."},{id:"exitNodeID",label:"Approved exit node ID",when:{fieldId:"routeMode",value:"exit"},kind:"text",secret:!1,required:!0,help:"Use the stable ID of the exit node approved for this browser session."},{id:"targets",label:"Integration origins and destination CIDRs",kind:"textarea",secret:!1,required:!0,help:"One HTTPS origin per line, followed by allowed destination CIDRs. Peer example: https://byo.example.com 100.64.0.1/32. Exit example: https://api.example.com 203.0.113.0/24."},...d$("Integration TLS trust","Operator CA certificates (PEM)","Trust only the supplied CA certificates for these integration origins.")];function m$(e){return{mode:e?"native":"browser",routeMode:2===e?.version?"peer":"exit",peerID:2===e?.version?e.peerID:"",exitNodeID:1===e?.version?e.exitNodeID:"",trustMode:e?.trustMode??"public",operatorCAPEM:"operator"===e?.trustMode?e.operatorCAPEM:"",targets:e?.targets.map(e=>`${e.origin} ${e.prefixes.join(", ")}`).join("\n")??""}}function g$({values:e,onChange:t,disabled:n}){return Ee.jsxs("fieldset",{className:"cx-block",disabled:n,children:[Ee.jsx("legend",{children:"Integration HTTP connections"}),Ee.jsx(py,{fields:h$,values:e,onChange:t}),"native"===e.mode?Ee.jsx(py,{fields:f$,values:e,onChange:t}):null]})}function w$({values:e,onChange:t,disabled:n}){return Ee.jsxs("fieldset",{className:"cx-block",disabled:n,children:[Ee.jsx("legend",{children:"Tailnet service HTTPS"}),Ee.jsx(py,{fields:u$,values:e,onChange:t})]})}const v$={status:"stopped",hostname:"",controlURL:"",authURL:"",addresses:[],peerCount:0,failure:""},y$=()=>()=>{},b$=()=>v$;function k$({model:e}){const t=!e.ready||e.active||e.busy;return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(O,{label:"Browser node hostname",value:e.hostname,disabled:t,onValueChange:e.setHostname}),Ee.jsx(O,{label:"Tailscale control server",value:e.controlURL,type:"url",disabled:t,onValueChange:e.setControlURL}),Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Join with an existing auth key"}),Ee.jsx(O,{label:"Optional node auth key",value:e.authKey,type:"password",autoComplete:"off",disabled:t,onValueChange:e.setAuthKey})]}),Ee.jsx(w$,{values:e.peerTLSValues,onChange:e.setPeerTLSValue,disabled:t}),Ee.jsx(g$,{values:e.nativeHTTPValues,onChange:e.setNativeHTTPValue,disabled:t}),Ee.jsx("p",{children:"The official Tailscale client runs inside this PWA. Sign in to join this browser node, or supply a provider-issued auth key. Private node state is encrypted in this vault."})]})}function x$({model:e}){const{state:t,node:n}=e;return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(q,{id:"tailscale-browser-node",title:"Tailscale",message:e.failure||t.failure||e.probeFailure}),"login"!==t.status||t.authURL?null:Ee.jsx(U,{label:"Sign in to Tailscale",onClick:()=>n?.login()}),t.authURL?Ee.jsx("a",{href:t.authURL,target:"_blank",rel:"noreferrer noopener",children:"Continue signing in with Tailscale"}):null,"approval"===t.status?Ee.jsx(Oe,{tone:"err",label:"Approve this browser node in your Tailscale admin console."}):null,"connected"===t.status?Ee.jsx(Oe,{tone:"ok",label:`Connected: ${t.addresses.join(", ")} · ${t.peerCount} peers`}):null,e.failure||t.failure?Ee.jsx(Oe,{tone:"err",label:e.failure||t.failure}):null]})}function I$({model:e}){return"connected"!==e.state.status?null:Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(O,{label:"Tailnet service URL",value:e.peerURL,type:"url",onValueChange:e.setPeerURL}),Ee.jsx(U,{label:"Test tailnet service",disabled:!e.peerURL,onClick:e.testPeer}),e.probeFailure?Ee.jsx(Oe,{tone:"err",label:e.probeFailure}):null,e.probe?Ee.jsx(Oe,{tone:"ok",label:e.probe}):null]})}function j$({model:e}){const[t,n]=Ce.useState(!1);return e.hasSaved?Ee.jsx(B,{label:t?"Confirm forget local browser node":"Forget local browser node",armed:t,disabled:e.busy,onClick:()=>{t?(e.forget(),n(!1)):n(!0)},children:Ee.jsx(F,{size:17})}):null}function _$({ready:e,online:t}){const n=function(e){const t=Ce.useSyncExternalStore(mt,ht,()=>null),n=Ce.useSyncExternalStore(t?.subscribe??y$,t?.snapshot??b$,b$),[r,i]=Ce.useState(()=>`opensesame-${crypto.randomUUID().slice(0,12)}`),[a,o]=Ce.useState("https://controlplane.tailscale.com"),[s,c]=Ce.useState(""),[l,d]=Ce.useState(""),u=function(e){const[t,n]=Ce.useState(""),[r,i]=Ce.useState(""),[a,o]=Ce.useState(""),s=Ce.useRef(0),c=Ce.useCallback(()=>{s.current++,i(""),o("")},[]);return Ce.useEffect(()=>{const t=e?.subscribe(()=>{"connected"!==e.snapshot().status&&c()}),n=mt(()=>{ht()!==e&&c()});return()=>{t?.(),n(),s.current++}},[e,c]),{peerURL:t,probe:r,failure:a,clear:c,setPeerURL:e=>{c(),n(e)},testPeer:()=>{!async function(){c();const n=s.current,r=()=>"connected"===e?.snapshot().status&&ht()===e&&s.current===n;if(e&&r())try{const n=await e.get(t);if(!r())return;n.status>=200&&n.status<300?i(`HTTP ${n.status} · ${n.text.length} characters received through Tailscale`):o(`Tailnet service returned HTTP ${n.status}.`)}catch{r()&&o("The tailnet service request failed. Check the address and try again.")}}()}}}(t),[p,h]=Ce.useState(!1),[f,m]=Ce.useState(m$),[g,w]=Ce.useState(p$);Ce.useLayoutEffect(()=>{if(!e)return;const t=Bs();h(!!t),m(m$(t?.nativeHTTP)),w(p$(t?.peerTLS)),t&&(i(t.hostname),o(t.controlURL))},[e]),Ce.useEffect(()=>{"stopped"!==n.status&&"error"!==n.status||c("")},[n.status]);const v=function(e){const{ready:t,node:n,setAuthKey:r}=e,[i,a]=Ce.useState(!1),o=Ce.useRef(0),s=Ce.useRef(!1);async function c(i){if(!t||s.current||"save"!==i&&!n)return;const c=++o.current,l=()=>o.current===c&&ht()===n,d=()=>{if(!l())throw new Error("The browser node owner changed. Try again.")};s.current=!0,a(!0),e.setFailure(""),e.clearPeer();try{await async function(e,t,n){if("forget"===e)return await(t.node?.forget()),n(),t.setHasSaved(!1),t.setHostname(`opensesame-${crypto.randomUUID().slice(0,12)}`),t.setNativeHTTPValues(m$()),void t.setPeerTLSValues(p$());const r=ft(t),i=function(e){if("browser"===e.mode)return;if("native"!==e.mode)throw new Error("Choose an integration HTTP transport.");const t=(e.targets??"").split(/\r?\n/).filter(e=>e.trim()).map(e=>{const[t="",...n]=e.trim().split(/[\s,]+/);return{origin:t,prefixes:n}});if(e.routeMode&&!["peer","exit"].includes(e.routeMode))throw new Error("Choose an approved peer or exit route.");const n={..."peer"===e.routeMode?{version:2,routeMode:"peer",peerID:e.peerID}:{version:1,exitNodeID:e.exitNodeID},targets:t,trustMode:e.trustMode},r=Fs.safeParse("operator"===e.trustMode?{...n,operatorCAPEM:e.operatorCAPEM}:n);if(!r.success)throw new Error("Complete the approved route identity, exact HTTPS origins, allowed destination CIDRs and selected TLS trust configuration.");return r.data}(t.nativeHTTPValues),a=function(e){const t=pt.safeParse("operator"===e.trustMode?{trustMode:e.trustMode,operatorCAPEM:e.operatorCAPEM}:{trustMode:e.trustMode});if(!t.success)throw new Error("Choose peer TLS trust and provide valid CA certificates.");return"public"===t.data.trustMode?void 0:t.data}(t.peerTLSValues),o={...r,...Gs({nativeHTTP:i,peerTLS:a})},s=Bs();if(s&&(s.hostname!==r.hostname||s.controlURL!==r.controlURL))throw new Error("Forget the saved browser node before changing its hostname or control server.");"save"!==e&&JSON.stringify(s?.nativeHTTP)===JSON.stringify(i)&&JSON.stringify(s?.peerTLS)===JSON.stringify(a)||(await async function(e,t,n){const r=at(Ht),i=()=>{if(n(),r.current().guest)throw new Error("Use an unlocked persistent vault to save browser node configuration.")};try{i();const n=Bs();JSON.stringify(n?.nativeHTTP)===JSON.stringify(e.nativeHTTP)&&JSON.stringify(n?.peerTLS)===JSON.stringify(e.peerTLS)||t?.stop(),await Vs(e,r.current().tomb,i),i()}finally{r.close()}}(o,t.node,n),n(),t.setHasSaved(!0)),n(),"start"===e&&(await(t.node?.start({...o,authKey:t.authKey})),n(),t.setHasSaved(!0))}(i,e,d)}catch(u){l()&&e.setFailure(u instanceof Error?u.message:"Browser node configuration failed.")}finally{o.current===c&&(s.current=!1,a(!1),r(""))}}return Ce.useEffect(()=>()=>{o.current++},[]),Ce.useLayoutEffect(()=>{o.current++,s.current=!1,a(!1),t&&n===ht()||r("")},[t,n,r]),{busy:i,save:()=>{c("save")},start:()=>{c("start")},forget:()=>{c("forget")}}}({ready:e,node:t,hostname:r,controlURL:a,authKey:s,nativeHTTPValues:f,peerTLSValues:g,setPeerTLSValues:w,setFailure:d,setHasSaved:h,setHostname:i,setAuthKey:c,setNativeHTTPValues:m,clearPeer:u.clear});return{ready:e,node:t,state:n,hostname:r,setHostname:i,controlURL:a,setControlURL:o,authKey:s,setAuthKey:c,failure:l,probeFailure:u.failure,peerURL:u.peerURL,setPeerURL:u.setPeerURL,probe:u.probe,hasSaved:p,active:"stopped"!==n.status&&"error"!==n.status,...v,peerTLSValues:g,setPeerTLSValue:(e,t)=>{u.clear(),w(n=>function(e,t,n){return Bv(u$,e,t,n)}(n,e,t))},nativeHTTPValues:f,setNativeHTTPValue:(e,t)=>m(n=>function(e,t,n){return"mode"===t&&"browser"===n?m$():Bv([...h$,...f$],e,t,n)}(n,e,t)),testPeer:()=>{d(""),u.testPeer()}}}(e);return Ee.jsxs("section",{className:"panel","aria-label":"Tailscale browser node",children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsxs("h2",{children:[Ee.jsx("span",{className:"cx-step",children:"1"})," Connect this PWA to Tailscale"]})}),Ee.jsxs("form",{className:"cx-form panel__body",onSubmit:e=>{e.preventDefault(),n.start()},children:[Ee.jsx(k$,{model:n}),n.node?null:Ee.jsx(Oe,{tone:"err",label:"Enable Networking in Features to connect this browser node."}),Ee.jsx(U,{label:"Save browser node configuration",disabled:!e||n.busy,onClick:n.save}),Ee.jsxs(U,{label:"Connect browser node",disabled:!n.node||!e||!t||n.active||n.busy,children:[Ee.jsx(j$,{model:n}),n.active?Ee.jsx(B,{label:"Disconnect browser node",disabled:n.busy,onClick:()=>n.node?.stop(),children:Ee.jsx(H,{size:17})}):null]}),Ee.jsx(x$,{model:n}),Ee.jsx(I$,{model:n})]})]})}function S$({online:e}){const{ready:t,failure:n}=function(){const{tomb:e,status:t,guest:n,awaitingSecondStep:r}=Ot(),[i,a]=Ce.useState(null);Ce.useEffect(()=>{let t=!0;return Promise.all([Ts(),hs([...Ni])]).then(()=>{t&&a({tomb:e,failure:""})},()=>{t&&a({tomb:e,failure:"Could not load this browser node's saved configuration. Reload to try again."})}),()=>{t=!1}},[e]);const o=i?.tomb===e?i.failure:"";return{ready:i?.tomb===e&&!o&&"unlocked"===t&&!n&&!r,failure:o}}();return Ee.jsxs("div",{className:"cx-setup",children:[Ee.jsx(q,{id:"tailscale-browser-storage",title:"Tailscale",message:n}),Ee.jsx(_$,{ready:t,online:e})]})}function A$({tomb:t,onFlash:n,onForgotten:r}){const[i,a]=Ce.useState(!1);return Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Forget Vercel Connect",title:"Forget Vercel Connect",disabled:i,onClick:()=>{!async function(){a(!0);try{await async function(t){if(hc=null,e(null),t)try{await us(t,pc)}catch(n){if(n instanceof ls&&"not-found"===n.code)return;throw n}}(t||null),r(),n({tone:"ok",text:"Vercel Connect is forgotten on this device."})}catch(i){n({tone:"err",text:Ia(i)})}finally{a(!1)}}()},children:Ee.jsx(F,{size:15})})}function C$({relay:e,showForm:t,held:n,onFlash:r}){const{tomb:i}=Ot(),[a,o]=Ce.useState(0);return Ee.jsxs("section",{className:"panel",id:"connect-transport","aria-label":"Vercel Connect",children:[Ee.jsxs("div",{className:"panel__head",children:[Ee.jsx("h2",{children:"Vercel Connect"}),n?Ee.jsx(A$,{tomb:i,onFlash:r,onForgotten:()=>o(e=>e+1)}):null]}),t?Ee.jsx(ZI,{relay:e,onFlash:r},a):null]})}function E$(e){switch(e.kind){case"managed":return null;case"oauth":return function(e){const t={authorization_endpoint:e.authorizationEndpoint.trim(),token_endpoint:e.tokenEndpoint.trim()};e.revocationEndpoint.trim()&&(t.revocation_endpoint=e.revocationEndpoint.trim()),e.userinfoEndpoint.trim()&&(t.userinfo_endpoint=e.userinfoEndpoint.trim()),"none"!==e.pkce&&(t.code_challenge_methods_supported=["S256"]);const n={clientId:e.clientId.trim(),serverUrl:e.serverUrl.trim(),serverConfig:t,tokenEndpointAuthMethod:e.tokenAuth,userAuthorization:{enabled:!0,scopes:e.scopes},refreshTokens:{enabled:e.refreshTokens}};e.clientSecret.trim()&&(n.clientSecret=e.clientSecret.trim()),"none"!==e.pkce&&(n.codeChallengeMethod="S256"),n.pkceRequired="required"===e.pkce;const r=Object.entries(e.authorizationParams).filter(([e,t])=>e.trim()&&t.trim());return r.length>0&&(n.authorizationUrlParams=Object.fromEntries(r.map(([e,t])=>[e.trim(),t.trim()]))),n}(e.oauth);case"mcp":{const t={};return e.clientId.trim()&&(t.clientId=e.clientId.trim()),e.clientSecret.trim()&&(t.clientSecret=e.clientSecret.trim()),t}case"api-key":{const t={};return e.instructions.trim()&&(t.instructions=e.instructions.trim().slice(0,4e3)),"app"===e.subject&&e.key.trim()&&(t.toAdd=[{value:e.key.trim()}]),t}}}const T$=new Set(["clientSecret","toAdd"]);function N$(e){if(null!=e)return Array.isArray(e)?[]:ai(e)?{}:ni(e)?"":void 0}function z$(e,t){if(!ai(e)||!ai(t))return e;const n={...e};for(const[r,i]of Object.entries(t)){if(r in e)continue;const t=N$(i);void 0!==t&&(n[r]=t)}return n}function $$(e,t){return"api-key"!==e.kind||"api-key"!==t.kind||e.subject===t.subject&&JSON.stringify(e.serviceUrls)===JSON.stringify(t.serviceUrls)?[]:["The API and whose key are set when the connector is created; create another to change them."]}function P$(e,t=512){return ni(e)?e.trim().slice(0,t):""}function O$(e,t=64){const n=[];if(!Array.isArray(e))return n;for(const r of e)ni(r)&&n.length<t&&n.push(r.slice(0,256));return n}function R$(e){return ai(e)?e:{}}function L$(e){return Object.fromEntries(Object.entries(R$(e)).flatMap(([e,t])=>ni(t)?[[e,t.slice(0,256)]]:[]))}function U$(e){const t=_(e);if(!t)return null;const n=P$(t.id,128)||P$(t.uid,128);if(!n)return null;const r=R$(t.data),i=R$(r.serverConfig),a=R$(r.userAuthorization),o=function(e){return!0===e.pkceRequired?"required":P$(e.codeChallengeMethod)?"S256":!1===e.pkceRequired||null===e.codeChallengeMethod?"none":null}(r);return{id:n,uid:P$(t.uid,128),name:P$(t.name,128),service:P$(t.service,128),type:P$(t.type,64),clientId:P$(r.clientId),serverUrl:P$(r.serverUrl),authorizationEndpoint:P$(i.authorization_endpoint),tokenEndpoint:P$(i.token_endpoint),revocationEndpoint:P$(i.revocation_endpoint),userinfoEndpoint:P$(i.userinfo_endpoint),tokenAuth:P$(r.tokenEndpointAuthMethod,64),pkce:o,authorizationParams:L$(r.authorizationUrlParams),scopes:O$(a.scopes),refreshTokens:ai(r.refreshTokens)&&ci(r.refreshTokens.enabled)?r.refreshTokens.enabled:null,redirectUri:P$(t.redirectUri)||P$(t.redirectUrl)||P$(t.callbackUrl)||P$(r.redirectUri),serviceUrls:O$(r.serviceUrls,8),subjectType:P$(r.subjectType,16),instructions:P$(r.instructions,4e3)}}function D$({plan:e,state:t,onState:n}){const[r,i]=Ce.useState(""),a=()=>{const e=r.trim();e&&!t.oauth.scopes.includes(e)&&n(Nz(t,e)),i("")};return Ee.jsxs("fieldset",{className:"conn-scope-picker cx-block",children:[Ee.jsx("legend",{children:"User token scopes"}),Tz(e,t).map(e=>Ee.jsxs("label",{className:"check",children:[Ee.jsx("input",{type:"checkbox",checked:t.oauth.scopes.includes(e.name),onChange:()=>n(Nz(t,e.name))}),Ee.jsxs("span",{children:[Ee.jsx("code",{children:e.name}),e.description?Ee.jsx("span",{className:"hint",children:e.description}):null]})]},e.name)),Ee.jsx(O,{label:"Another scope",value:r,mono:!0,onValueChange:i,onEnter:a,tail:Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Add scope",title:"Add scope",disabled:!r.trim(),onClick:a,children:Ee.jsx(Z,{size:14})})})]})}function q$(e){const t={};for(const[n,r]of e)""===n.trim()||Object.hasOwn(t,n)||(t[n]=r);return t}function M$({params:e,onParams:t}){const[n,r]=Ce.useState(()=>Object.entries(e)),i=JSON.stringify(e),[a,o]=Ce.useState(i);i!==a&&i!==JSON.stringify(q$(n))&&(o(i),r(Object.entries(e)));const s=e=>{r(e);const n=q$(e);o(JSON.stringify(n)),t(n)},c=(e,t,r)=>s(n.map((n,i)=>i===e?[t,r]:n));return Ee.jsxs("fieldset",{className:"cx-block",children:[Ee.jsx("legend",{children:"Additional authorization params"}),n.map(([e,t],r)=>Ee.jsxs("div",{className:"cx-param",children:[Ee.jsx(O,{label:`Param ${r+1}`,value:e,mono:!0,onValueChange:e=>c(r,e,t)}),Ee.jsx(O,{label:`Param ${r+1} value`,value:t,mono:!0,onValueChange:t=>c(r,e,t)}),Ee.jsx("button",{type:"button",className:"icon-btn","aria-label":`Remove ${e||"param"}`,title:`Remove ${e||"param"}`,onClick:()=>s(n.filter((e,t)=>t!==r)),children:Ee.jsx(F,{size:16})})]},r)),Ee.jsx("div",{children:Ee.jsx("button",{type:"button",className:"icon-btn","aria-label":"Add param",title:"Add param",onClick:()=>r([...n,["",""]]),children:Ee.jsx(Z,{size:16})})})]})}const K$=[{id:"client_secret_post",label:"client_secret_post"},{id:"client_secret_basic",label:"client_secret_basic"},{id:"none",label:"none (public client)"}],F$=[{id:"S256",label:"S256 when offered"},{id:"required",label:"S256, required"},{id:"none",label:"Not used"}];function G$(e,t){e.onState({...e.state,oauth:{...e.state.oauth,...t}})}function B$(e){const{plan:t,state:n,onState:r,redirectUri:i}=e,a=bz(t,"oauth"),o="oauth"===a?.kind?a.preset:null,s="manual"!==n.oauth.registration;return Ee.jsxs("fieldset",{className:"cx-block",children:[Ee.jsx("legend",{children:"OAuth client"}),o?.templateParams.map(e=>Ee.jsx(O,{label:e.label,value:n.params[e.name]??"",placeholder:e.placeholder,mono:!0,onValueChange:i=>r(Az(n,t,e.name,i))},e.name)),Ee.jsxs("div",{className:"cx-grid",children:[Ee.jsx(O,{label:s?"Client ID (optional)":"Client ID",value:n.oauth.clientId,placeholder:s?"Registered for you":"",autoComplete:"off",mono:!0,onValueChange:t=>G$(e,{clientId:t})}),"none"===n.oauth.tokenAuth?null:Ee.jsx(O,{label:"Client secret",type:"password",value:n.oauth.clientSecret,placeholder:i?"Unchanged":"",autoComplete:"new-password",mono:!0,onValueChange:t=>G$(e,{clientSecret:t})})]}),i?Ee.jsx(Rv,{rows:[["Redirect URI",Ee.jsxs("span",{className:"cx-inline",children:[Ee.jsx("span",{children:i}),Ee.jsx(Lv,{value:i,label:"Copy redirect URI"})]},"redirect")]]}):null,Ee.jsxs("div",{className:"cx-links",children:[o?.consoleUrl?Ee.jsxs(Uv,{href:o.consoleUrl,children:[t.name," developer console"]}):null,o?.docsUrl?Ee.jsxs(Uv,{href:o.docsUrl,children:[t.name," OAuth docs"]}):null]})]})}function V$(e){const t=e.state.oauth,n=(t,n,r)=>Ee.jsx(O,{label:t,type:"url",value:r,mono:!0,onValueChange:t=>G$(e,{[n]:t})});return Ee.jsxs("fieldset",{className:"cx-block",children:[Ee.jsx("legend",{children:"OAuth server"}),n("Server URL","serverUrl",t.serverUrl),n("Authorization endpoint","authorizationEndpoint",t.authorizationEndpoint),n("Token endpoint","tokenEndpoint",t.tokenEndpoint),Ee.jsxs("div",{className:"cx-grid",children:[n("Revocation endpoint","revocationEndpoint",t.revocationEndpoint),n("User info endpoint","userinfoEndpoint",t.userinfoEndpoint)]}),Ee.jsxs("div",{className:"cx-grid",children:[Ee.jsx(Ov,{label:"Token endpoint auth method",value:t.tokenAuth,options:K$,onChange:t=>G$(e,{tokenAuth:t})}),Ee.jsx(Ov,{label:"PKCE",value:t.pkce,options:F$,onChange:t=>G$(e,{pkce:t})})]}),Ee.jsxs("label",{className:"check",children:[Ee.jsx("input",{type:"checkbox",checked:t.refreshTokens,onChange:t=>G$(e,{refreshTokens:t.target.checked})}),Ee.jsx("span",{children:"Refresh tokens"})]}),Ee.jsx(M$,{params:t.authorizationParams,onParams:t=>G$(e,{authorizationParams:t})}),!1===e.showScopes?null:Ee.jsx(D$,{plan:e.plan,state:e.state,onState:e.onState})]})}const H$={dcr:"Registers its own client (RFC 7591)",cimd:"Client ID metadata document",manual:"Needs a client you register"};function J$({plan:e,state:t,onState:n}){const r=bz(e,"mcp");if("mcp"!==r?.kind)return null;if("ok"!==r.mcp.status)return Ee.jsx(Rv,{rows:[["Server",r.mcp.url]]});const i=r.mcp;return Ee.jsxs("fieldset",{className:"cx-block",children:[Ee.jsx("legend",{children:"MCP server"}),Ee.jsx(Rv,{rows:[["Server",i.url],["Authorization",i.issuer??i.authorizationEndpoint],["Client",H$[i.registration]],["PKCE",i.pkce.join(", ")||"Not offered"],["Scopes",i.scopes.join(" ")||"Server default"]]}),"manual"===i.registration?Ee.jsxs("div",{className:"cx-grid",children:[Ee.jsx(O,{label:"Client ID",value:t.mcpClientId,autoComplete:"off",mono:!0,onValueChange:e=>n({...t,mcpClientId:e})}),Ee.jsx(O,{label:"Client secret",type:"password",value:t.mcpClientSecret,autoComplete:"new-password",mono:!0,onValueChange:e=>n({...t,mcpClientSecret:e})})]}):null]})}const W$=[{id:"user",label:"Each person pastes their own"},{id:"app",label:"One shared key"}];function Z$({plan:e,state:t,onState:n,local:r}){const i=bz(e,"api-key"),a="api-key"===i?.kind?i.preset:null;return Ee.jsxs("fieldset",{className:"cx-block",children:[Ee.jsx("legend",{children:"API key"}),a?.templateParams.map(r=>Ee.jsx(O,{label:r.label,value:t.params[r.name]??"",placeholder:r.placeholder,mono:!0,onValueChange:i=>n(Az(t,e,r.name,i))},r.name)),r?null:Ee.jsx(Ov,{label:"Whose key",value:t.keySubject,options:W$,onChange:e=>n({...t,keySubject:e})}),r||"app"===t.keySubject?Ee.jsx(O,{label:"API key",type:"password",value:t.key,placeholder:a?.keyPrefix?`${a.keyPrefix}…`:"",autoComplete:"new-password",mono:!0,onValueChange:e=>n({...t,key:e})}):null,Ee.jsx(O,{label:"API",type:"url",value:t.serviceUrls[0]??"",mono:!0,onValueChange:e=>n({...t,serviceUrls:[e,...t.serviceUrls.slice(1)]})}),Ee.jsxs("div",{className:"cx-select",children:[Ee.jsx("label",{className:"f__label",htmlFor:`${e.id}-instructions`,children:"Instructions shown while authorizing"}),Ee.jsx("textarea",{id:`${e.id}-instructions`,className:"cx-textarea",value:t.instructions,maxLength:4e3,onChange:e=>n({...t,instructions:e.target.value})})]}),Ee.jsxs("div",{className:"cx-links",children:[a?.keyUrl?Ee.jsxs(Uv,{href:a.keyUrl,children:[e.name," API keys"]}):null,a?.docsUrl?Ee.jsxs(Uv,{href:a.docsUrl,children:[e.name," API docs"]}):null]})]})}function X$(e){switch(e.state.method){case"oauth":return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(B$,{...e}),Ee.jsx(V$,{...e})]});case"mcp":return Ee.jsx(J$,{...e});case"api-key":return Ee.jsx(Z$,{...e});case"managed":return Ee.jsx(Rv,{rows:[["Client",`Vercel's ${e.plan.name} app`]]})}}function Y$({state:e,onState:t}){return Ee.jsxs("fieldset",{className:"cx-block",children:[Ee.jsx("legend",{children:"Connector details"}),Ee.jsxs("div",{className:"cx-grid",children:[Ee.jsx(O,{label:"Name",value:e.name,onValueChange:n=>t({...e,name:n})}),Ee.jsx(O,{label:"UID",value:e.uid,mono:!0,onValueChange:n=>t({...e,uid:n})})]})]})}function Q$({plan:e,connectorId:t,canManage:n,online:r,onFlash:i}){const[a,o]=Ce.useState(null),[s,c]=Ce.useState(null),[l,d]=Ce.useState(null),[u,p]=Ce.useState(""),[h,f]=Ce.useState(!1);return Ce.useEffect(()=>{if(!n)return;let r=!0;return async function(e){const t=U$(m()?await y("/api/connect/connector/read",b({connectorId:e})):await k(`/v1/connect/connectors/${encodeURIComponent(e)}${x(I())}`));if(!t)throw new j(0,"malformed","Connect did not return a connector.");return t}(t).then(t=>{if(!r)return;const n=Cz(e,t);o(t),c(n),d(n),p("")}).catch(e=>{r&&p(Ia(e))}),()=>{r=!1}},[e,t,n]),u?Ee.jsx(Oe,{tone:"err",label:u}):s&&a?Ee.jsxs("form",{className:"cx-form panel__body",onSubmit:async function(n){if(n.preventDefault(),s&&l){f(!0);try{const n=await async function(e,t,n){const r=function(e,t){const n=new Set(wz(t));return[...wz(e).filter(e=>!n.has(e)),...$$(e,t)]}(t,n);if(r.length>0)throw new j(0,"invalid_draft",r.join(" "));const i=function(e,t){const n={};e.name.trim()!==t?.name.trim()&&(n.name=e.name.trim()),e.uid.trim()&&e.uid.trim()!==t?.uid.trim()&&(n.uid=e.uid.trim());const r=E$(e);if(!r)return n;const i=function(e,t){const n={};for(const[r,i]of Object.entries(e))"clientId"===r&&""===i||null!==t&&!T$.has(r)&&JSON.stringify(i)===JSON.stringify(t[r])||(n[r]="serverConfig"===r?z$(i,t?.[r]):i);for(const[r,i]of Object.entries(t??{})){if(r in e||T$.has(r)||"clientId"===r)continue;const t=N$(i);void 0!==t&&(n[r]=t)}return n}(r,t?.kind===e.kind?E$(t):null);return Object.keys(i).length>0&&(n.data=i),n}(t,n),a=U$(m()?await y("/api/connect/connector/update",b({connectorId:e,update:i})):await k(`/v1/connect/connectors/${encodeURIComponent(e)}${x(I())}`,{method:"PATCH",body:JSON.stringify(i)}));if(!a)throw new j(0,"malformed","Connect did not return a connector.");return a}(t,Ez(s),Ez(l)),r=Cz(e,n);o(n),c(r),d(r),i({tone:"ok",text:`${n.name||e.name} saved.`})}catch(r){i({tone:"err",text:Ia(r)})}finally{f(!1)}}},children:[Ee.jsx(Rv,{rows:[["ID",a.id],["Type",a.type||s.method],["Service",a.service||e.id]]}),Ee.jsx(Y$,{state:s,onState:c}),"managed"===s.method?null:Ee.jsx(X$,{plan:e,state:s,onState:c,redirectUri:a.redirectUri}),Ee.jsx(U,{label:h?"Saving connector":"Save connector",busy:h,disabled:h||!r||!n})]}):Ee.jsx(Rv,{rows:[["Connector",t]]})}function eP(){const e=Vn(),t=e?.authorize?e.prepareAuthorization?.():void 0;let n,r=!1;try{n=e?.authorize?e.captureAuthorizationGuard?.():void 0}catch(i){throw t?.(),i}return{browser:e,assertCurrent:()=>{if(r)throw new Error("Linear sign-in was cancelled");n?.()},release:()=>{r||(r=!0,t?.())}}}function tP(){return[...crypto.getRandomValues(new Uint8Array(32))].map(e=>e.toString(16).padStart(2,"0")).join("")}function nP(e,t){const n=Ad(t).options;return[...new Set(["read",...n["app"===e?"appScopes":"userScopes"],..."app"===e&&"cleanup"===jd(t)?.recovery?.phase?["admin"]:[]])]}function rP(e,t){const n=new URL("https://linear.app/oauth/authorize");for(const[r,i]of Object.entries({response_type:"code",client_id:e.clientId,redirect_uri:e.redirectUri,state:e.state,scope:e.scopes.join(","),actor:e.actor,prompt:"consent",code_challenge:t,code_challenge_method:"S256"}))n.searchParams.set(r,i);return n.href}function iP(e,t){const n=e.trim().toLowerCase();if(n&&![t.id,t.name,t.urlKey].some(e=>e.toLowerCase()===n))throw new Error("The authorized Linear workspace does not match your selection; reconnect and select the correct workspace")}const aP=6e5;function oP(){return new URL(`${ji().BASE_URL}auth/linear.html`,_i().location.origin).href}const sP=new Set;async function cP(e,t,n){if(sP.has(e))throw new Error("Finish the current Linear sign-in first");sP.add(e);let r=n,i=n?.browser??null,a=null,o=!1;try{r?.assertCurrent();const n=await async function(e,t){if("memory"===fs())throw new Error("Linear OAuth requires durable browser storage; enable browser storage or use an API key");const n=Ad(e);if("oauth"!==n.state.method||!n.state.oauth.clientId.trim())throw new Error("Enter the registered Linear OAuth client ID first");if(await async function(e,t){const n=Ad(e);return"app"===t&&"configure"===jd(e)?.recovery?.phase&&0===n.options.appScopes.length&&!jd(e)?.webhook&&!Ci()[e]?.linear_webhook_intent&&(await c_(e,"app"),await t_(e),!0)}(e,t))return null;const r="app"===t&&await e_(e);return(jd(e)?.[t]||Ci()[e]?.[`linear_cleanup_${t}`])&&("app"!==t||r||await s_(e),await c_(e,t)),async function(e,t,n){const r=Ad(e),i=tP(),a=new Uint8Array(await crypto.subtle.digest("SHA-256",(new TextEncoder).encode(i))),o=btoa(String.fromCharCode(...a)).replaceAll("+","-").replaceAll("/","_").replaceAll("=",""),s={state:tP(),verifier:i,clientId:r.state.oauth.clientId,redirectUri:n,actor:t,scopes:nP(t,e),createdAt:Date.now(),fingerprint:Cd(r.state,r.options)};return await Pd(e,async t=>{const n=Ad(e);if(Cd(n.state,n.options)!==s.fingerprint)throw new Error("Linear configuration changed; restart consent");return{...t,secrets:{...t.secrets,[kd]:JSON.stringify(s)}}}),{pending:s,url:rP(s,o)}}(e,t,oP())}(e,t);if(!n)return;if(a=n.pending.state,r?.assertCurrent(),r||(r=eP(),i=r.browser),!i?.authorize)return o=!0,void _i().location.assign(n.url);const s=await i.authorize(n.url,{state:a,expiresAt:n.pending.createdAt+aP,redirectUri:n.pending.redirectUri});r.assertCurrent(),await pP(function(e,t){const n=new URLSearchParams(e);if(n.get("native_state")!==t||["native_state","native_code","native_error"].some(e=>n.getAll(e).length>1)||n.has("native_code")===n.has("native_error")||(n.get("native_code")?.length??0)>8192)throw new Error("This Linear authorization belongs to another sign-in request");const r=new URLSearchParams;for(const i of["state","code","error"]){const e=n.get(`native_${i}`);null!==e&&r.set(`linear_${i}`,e)}return r.toString()}(s,a),r.assertCurrent)}catch(s){throw a&&!o&&await async function(e,t){Ci()[e]?.[kd]&&await Pd(e,async e=>{const n=yd.safeParse(JSON.parse(e.secrets[kd]??"null"));if(!n.success||n.data.state!==t)return e;const r={...e.secrets};return Reflect.deleteProperty(r,kd),{...e,secrets:r}})}(e,a),s}finally{try{r?.release()}finally{sP.delete(e)}}}function lP(e){try{return yd.parse(JSON.parse(e??""))}catch{return null}}function dP(){return Boolean(Vn()?.authorize)}const uP=new Map;function pP(e,t){const n=uP.get(e);if(n)return n;const r=t??Vn()?.captureAuthorizationGuard?.(),i=async function(e,t){const n=function(e){const t=new URLSearchParams(e);if(!t.has("linear_state"))return null;const n=new URL(_i().location.href);for(const r of["linear_state","linear_code","linear_error"])n.searchParams.delete(r);if(_i().replaceUrl(n.href),["linear_state","linear_code","linear_error"].some(e=>t.getAll(e).length>1)||t.has("linear_code")===t.has("linear_error"))throw new Error("Invalid Linear authorization response; reconnect this account");return t}(e);if(!n)return null;t?.();const{id:r,transaction:i}=await async function(e){const t=Object.entries(Ci()).find(([,t])=>lP(t[kd])?.state===e);if(!t)throw new Error("Linear authorization could not be matched or was already used; reconnect this account");const n=t[0];let r=null;if(await Pd(n,async t=>{const n=lP(t.secrets[kd]);if(!n||n.state!==e)throw new Error("Linear authorization was already used");r=n;const i={...t.secrets};return Reflect.deleteProperty(i,kd),{...t,secrets:i}}),!r)throw new Error("Linear authorization could not be matched");const i=r;if(Date.now()-i.createdAt>aP||i.createdAt>Date.now()||i.redirectUri!==oP())throw new Error("Linear authorization expired; reconnect this account");const a=Ad(n);if(i.fingerprint!==Cd(a.state,a.options))throw new Error("Linear configuration changed during consent; reconnect this account");return{id:n,transaction:i}}(n.get("linear_state"));if(n.has("linear_error"))throw new Error("Linear authorization was declined; your connector is not authorized");const a=n.get("linear_code");if(!a||a.length>8192)throw new Error("Linear did not return an authorization code");t?.();const o=await async function(e){const t=gj(Rj,e),n=new URLSearchParams({grant_type:"authorization_code",client_id:t.clientId,code:t.code,code_verifier:t.verifier,redirect_uri:t.redirectUri});return t.clientSecret&&n.set("client_secret",t.clientSecret),Pj(n)}({clientId:i.clientId,code:a,verifier:i.verifier,redirectUri:i.redirectUri});return await async function(e,t,n,r){try{if(r?.(),!n.refreshToken)throw new Error("Linear did not provide a refresh token; reconnect this account");if(t.scopes.some(e=>!n.scopes.includes(e)))throw new Error("Linear did not grant the requested permissions; reconnect this account");const i=await Kj({kind:"oauth",token:n.accessToken});r?.(),iP(Ad(e).options.workspace,i.organization),await Pd(e,async(a,o)=>{r?.();const s=Ad(e);if("app"===t.actor&&"configure"===o.recovery?.phase&&!s.options.appScopes.includes("admin")&&n.scopes.includes("admin"))throw new Error("Linear retained temporary admin permission; authorize only the configured app scopes");if(t.fingerprint!==Cd(s.state,s.options))throw new Error("Linear configuration changed during authorization");const c=o["app"===t.actor?"user":"app"];if(o.recovery&&o.recovery.workspaceId!==i.organization.id)throw new Error("Reconnect the original Linear workspace to recover its webhook");if(c&&c.workspaceId!==i.organization.id)throw new Error("App and user consent must authorize the same Linear workspace");return zd({...a,secrets:{...a.secrets,[xd(t.actor)]:JSON.stringify({kind:"oauth",...n})}},{...o,[t.actor]:{accountLabel:i.viewer.name,workspaceId:i.organization.id,workspaceName:i.organization.name,workspaceKey:i.organization.urlKey,grantedScopes:n.scopes,expiresAt:n.expiresAt,kind:"oauth"}})},r)}catch(i){try{await async function(e,t,n,r){await hj(e,t,async()=>{const i={kind:"oauth",...n};try{await dj(e,t,i)}catch{return void(await Wj(n))}const a=new Set([sj(i)]);await Zj(n,r,async n=>{const r={kind:"oauth",...n};await dj(e,t,r),a.add(sj(r))}),await uj(e,t,a)})}(e,t.actor,n,t.clientId)}catch{throw new Error("Linear authorization was not saved and provider cleanup failed. Reconnect or revoke this application in Linear Settings")}throw i}}(r,i,o,t),t?.(),async function(e,t){const n="app"===t.actor?"user":"app",r=Ad(e);return Td(jd(e),r.options,n)?dP()?$d(e):(await cP(e,n),null):(await o_(e),jd(e)?.recovery&&jd(e)?.app?.needsReauth?dP()?$d(e):(await cP(e,"app"),0===r.options.appScopes.length?$d(e):null):$d(e))}(r,i)}(e,r);return uP.set(e,i),i.finally(()=>uP.delete(e)).catch(()=>{}),i}function hP(e){return JSON.stringify({row:Si().find(t=>t.connectionId===e),secrets:e?Ci()[e]:void 0})}function fP(e,t){const n=Si().find(t=>t.connectionId===e),r=new Set(["linear_authorization","linear_verified","linear_granted_scopes","linear_account","linear_expires_at","linear_refreshable"]);return JSON.stringify({row:n?{...n,updatedAt:"",fields:Object.fromEntries(Object.entries(n.fields).filter(([e])=>!r.has(e)))}:null,pending:Ci()[e]?.linear_pending,key:"api-key"===t?Sd(e,"app")?.accessToken:null})}function mP(e){return{...e,key:"",mcpClientSecret:"",oauth:{...e.oauth,clientId:e.oauth.clientId.trim(),clientSecret:"",serverUrl:"https://linear.app",authorizationEndpoint:"https://linear.app/oauth/authorize",tokenEndpoint:"https://api.linear.app/oauth/token",revocationEndpoint:"https://api.linear.app/oauth/revoke",userinfoEndpoint:"",tokenAuth:"none",pkce:"S256",registration:"manual",authorizationParams:{},refreshTokens:!0}}}function gP(e,t){if(!t.webhookEnabled)return[];const n=[];try{const e=new URL(t.webhookUrl??"");if("https:"!==e.protocol||e.username||e.password||e.hash)throw new Error}catch{n.push("Enter an HTTPS webhook delivery URL without credentials or a fragment")}return t.webhookResourceTypes.length||n.push("Select at least one webhook resource type"),"oauth"!==e.method||t.appScopes.includes("admin")||n.push("App Scopes must include admin to configure Linear webhooks"),n}function wP(e){const t=b_(Oa("linear")),n=[];for(const r of["appScopes","userScopes","webhookResourceTypes"]){const i=new Set(t?.[r].map(e=>e.name));e[r].some(e=>!i.has(e))&&n.push(`Select supported Linear ${r}`)}return n}function vP(e,t,n){const r=[];return"oauth"!==e.method&&"api-key"!==e.method&&r.push("Select Linear OAuth or an API key"),"oauth"!==e.method||/^[A-Za-z0-9_-]{1,256}$/.test(e.oauth.clientId.trim())||r.push("Enter the registered Linear OAuth client ID"),"api-key"!==e.method||e.key.trim()||n&&"api-key"===Sd(n,"app")?.kind||r.push("Enter your Linear API key"),"oauth"===e.method&&t.appScopes.length+t.userScopes.length===0&&r.push("Select app or user permissions to authorize"),r}function yP(e,t,n){return fd.safeParse(e).success&&hd.safeParse(t).success?[...e.name.trim()?[]:["Enter a connector name"],...vP(e,t,n),...wP(t),...gP(e,t)]:["Invalid Linear connector configuration"]}let bP="";function kP(e){bP=e?.trim()??""}function xP(){return bP}function IP(e,t){return!!Ci()[e]?.[`linear_cleanup_${t}`]}function jP(e,t,n){return"oauth"!==e.method?null:Td(n,t,"app")?"app":Td(n,t,"user")?"user":null}function _P({authorizing:e}){const t=Vn()?.cancelAuthorization;return e&&t?Ee.jsx("div",{className:"cx-links",children:Ee.jsx(B,{label:"Cancel sign-in",onClick:t,children:Ee.jsx(H,{size:16})})}):null}function SP({state:e,options:t,onState:n,onOptions:r}){const i=xP();return Ee.jsx(Pv,{label:"Configuration mode",legendHidden:!0,value:t.mode,options:[{id:"managed",label:"Managed"},{id:"byo",label:"Bring Your Own"}],onChange:a=>{r({...t,mode:a}),"managed"===a&&n({...e,method:"oauth",oauth:{...e.oauth,clientId:i||e.oauth.clientId}})}})}function AP({state:e,options:t,onState:n}){return"byo"!==t.mode?null:Ee.jsx(Pv,{label:"Connection method",value:e.method,options:[{id:"oauth",label:"OAuth"},{id:"api-key",label:"API key"}],onChange:t=>n({...e,method:t})})}function CP({plan:e,state:t,options:n,onState:r,onOptions:i}){const a=b_(e),o=oP(),s=xP(),c=function(e){const t=new URL(e.redirectUri),n=new URL(e.appUrl),r=new URL("https://linear.app/settings/api/applications/new"),i=r.searchParams;return i.set("distribution","private"),i.set("display.description","Connect OpenSesame to your Linear workspace with a user-authorized OAuth app."),i.set("developer.name","OpenSesame"),i.set("oauth.client_name","OpenSesame"),i.set("oauth.client_uri",n.href),i.append("oauth.redirect_uris",t.href),i.set("oauth.grant_types","authorization_code"),r.href}({redirectUri:o,appUrl:new URL("/OpenSesame/",window.location.origin).href});return Ee.jsx(Ee.Fragment,{children:Ee.jsxs(Ee.Fragment,"api-key"===t.method?{children:[Ee.jsx(O,{label:"Linear API key",type:"password",value:t.key,placeholder:"lin_api_…",autoComplete:"new-password",mono:!0,onValueChange:e=>r({...t,key:e})}),Ee.jsx(Uv,{href:"https://linear.app/settings/account/security",children:"Linear API keys"})]}:{children:[Ee.jsx(oy,{label:"App Scopes",choices:a?.appScopes??[],selected:n.appScopes,onChange:e=>i({...n,appScopes:e})}),Ee.jsx(oy,{label:"User Scopes",choices:a?.userScopes??[],selected:n.userScopes,onChange:e=>i({...n,userScopes:e})}),Ee.jsx(O,{label:"Linear OAuth client ID",value:t.oauth.clientId,autoComplete:"off",readOnly:"managed"===n.mode&&!!s,mono:!0,onValueChange:e=>r({...t,oauth:{...t.oauth,clientId:e}})}),Ee.jsx(O,{label:"Redirect URI",value:o,readOnly:!0,mono:!0,tail:Ee.jsx(Lv,{value:o,label:"Copy redirect URI"})}),Ee.jsx(Uv,{href:c,children:"Create a prefilled Linear OAuth app"}),Ee.jsx(Uv,{href:"https://linear.app/settings/api/applications/new",children:"Linear developer console"})]})})}function EP({plan:e,options:t,onOptions:n}){const r=b_(e);return Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("label",{className:"check",children:[Ee.jsx("input",{type:"checkbox",checked:t.webhookEnabled??!1,title:"Linear webhook registration requires application admin scope or an API key with workspace admin permissions.",onChange:e=>n({...t,webhookEnabled:e.target.checked})}),Ee.jsx("span",{children:"Register a Linear webhook"})]}),t.webhookEnabled?Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(O,{label:"Webhook delivery URL",type:"url",value:t.webhookUrl??"",placeholder:"https://your-service.example/webhooks/linear",mono:!0,onValueChange:e=>n({...t,webhookUrl:e})}),Ee.jsx(oy,{label:"Webhook Resource Types",choices:r?.webhookResourceTypes??[],selected:t.webhookResourceTypes,onChange:e=>n({...t,webhookResourceTypes:e})})]}):null]})}function TP(e){const{state:t,options:n,onState:r,onOptions:i,onIconBusyChange:a,onError:o}=e;return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(SP,{...e}),Ee.jsx(O,{label:"Connector Name",value:t.name,onValueChange:e=>r({...t,name:e})}),Ee.jsx(O,{label:"Expected Linear workspace (optional)",value:n.workspace,placeholder:"Workspace name, URL key or ID",onValueChange:e=>i({...n,workspace:e})}),Ee.jsx(AP,{...e}),Ee.jsx(CP,{...e}),Ee.jsx(EP,{...e}),Ee.jsx($v,{value:n.icon,onBusyChange:a,onChange:e=>i({...n,icon:e}),onError:o})]})}function NP(e){const t=Si().find(t=>t.connectionId===e);return t?"linear"===t.providerId&&j_(e)?"same-provider":"other-provider":"absent"}function zP(e,t){const n=xx({initial:e&&"same-provider"===NP(e)?e:void 0,stale:e,existing:new Set(Si().map(e=>e.connectionId)),read:NP});let r,i;return{reserve(e){const a=Ix(e.release,void 0,e.assertCurrent,()=>{const e=i;i=void 0,e?.()},n);r=a;try{return i=t?.(Object.freeze({method:"oauth",cancel:a.cancel,current:a.current,selectConnection:a.selectConnection})),a.check(),a.check}catch(o){throw a.finish(),o}},bind:e=>r?.bind(e),finish:()=>r?.finish()}}function $P(e){const{plan:t,connectorId:n,onFlash:r,onSaved:i}=e,a=n?j_(n):null,[o,s]=Ce.useState(()=>a?.options??function(e){const t=b_(e);return{mode:xP()?"managed":"byo",workspace:"",appScopes:k_(t?.appScopes??[]),userScopes:k_(t?.userScopes??[]),webhookResourceTypes:k_(t?.webhookResourceTypes??[]),webhookEnabled:!1,webhookUrl:"",icon:""}}(t)),[c,l]=Ce.useState(()=>{return e=a?.state??jz(t,"oauth"),{...e,oauth:{...e.oauth,clientId:e.oauth.clientId||xP(),clientSecret:"",tokenAuth:"none",pkce:"required"}};var e}),[d,u]=Ce.useState(null),[p,h]=Ce.useState(!1),[f,m]=Ce.useState(null),[g,w]=Ce.useState(n),v=yP(c,o,g),y=!!d?.()||!!e.authorization?.current();return{state:c,options:o,busy:y,iconBusy:p,failure:f,savedId:g,problems:v,setState:l,setOptions:s,setIconBusy:h,configure:async function(t){if(t.preventDefault(),y||p||v.length>0)return;const n=e.captureUiCurrent?.()??(()=>!0);if(!n())return;const a=zP(g,e.onAuthorization);u(()=>n),m(null);try{const e=await async function(e,t,r,i,o){const s=yP(e,t,r);if(s.length)throw new Error(s.join(". "));const c=r?Ad(r):null,l=r?jd(r)??{app:null,user:null,webhook:null}:{app:null,user:null,webhook:null};!function(e,t,n,r){if(!e)return;if(e.state.method!==t.method||e.state.oauth.clientId!==t.oauth.clientId.trim())throw new Error("Remove the existing connector before changing its authorization method or OAuth application");const i=r.app??r.user;i&&e.options.workspace.trim()!==n.workspace.trim()&&iP(n.workspace,{id:i.workspaceId,name:i.workspaceName,urlKey:i.workspaceKey})}(c,e,t,l);const d=function(e,t,n,r,i){return"oauth"===t.method&&(!!jP(t,n,r)||!!e&&(!!["appScopes","userScopes"].some(t=>JSON.stringify([...e.options[t]].sort())!==JSON.stringify([...n[t]].sort()))||Boolean(r.webhook||r.recovery||i&&Ci()[i]?.linear_webhook_intent)))}(c,e,t,l,r)?eP():null;try{const i=function(e,t){const n=e?t?.(e):void 0,r=()=>{e?.assertCurrent(),n?.()};return{assertCurrent:r,reservation:e?{...e,assertCurrent:r}:void 0}}(d,o),{assertCurrent:s}=i;s();const p=hP(r),h=await async function(e,t,n,r){if("api-key"!==e.method)return"";const i=e.key.trim()||(r?Sd(r,"app")?.accessToken??"":""),a=await Kj({kind:"api-key",token:i});return iP(t.workspace,a.organization),n.app={kind:"api-key",accountLabel:a.viewer.name,workspaceId:a.organization.id,workspaceName:a.organization.name,workspaceKey:a.organization.urlKey,grantedScopes:[],expiresAt:null},n.user=null,i}(e,t,l,r);if(s(),r&&hP(r)!==p)throw new Error("Linear configuration changed in another tab; reload before saving");const f=r&&c?await async function(e,t,n,r,i){const a=fP(e,n.method),o=()=>{if(fP(e,n.method)!==a)throw new Error("Linear configuration changed in another tab; reload before saving")},s="oauth"===n.method?["app","user"].filter(e=>{const n="app"===e?"appScopes":"userScopes";return JSON.stringify([...t.options[n]].sort())!==JSON.stringify([...r[n]].sort())}):[];await async function(e,t,n,r,i,a){if(i&&Qj(e))await e_(e,!0),a();else if(function(e,t,n,r){const i=n.webhook,a="api-key"===e.method&&!!e.key.trim()&&e.key.trim()!==Sd(r,"app")?.accessToken;if(!i){const n=Ad(r);return!!Ci()[r]?.linear_webhook_intent&&(a||Cd(n.state,n.options)!==Cd(e,t))}return a||!t.webhookEnabled||i.url!==t.webhookUrl?.trim()||JSON.stringify(i.resourceTypes)!==JSON.stringify(t.webhookResourceTypes)}(t,n,r,e)){const n=jd(e)?.app?.workspaceId,i="api-key"===t.method&&t.key.trim()&&n===r.app?.workspaceId?{kind:"api-key",token:t.key.trim()}:void 0;try{await s_(e,a,i)}catch(o){if(!("oauth"===t.method&&o instanceof Error&&function(e,t){const n=jd(e)?.app,r=Sd(e,"app");return!!n?.needsReauth||!r||"oauth"===r.kind&&null!==r.expiresAt&&r.expiresAt<=Date.now()&&!r.refreshToken||t instanceof mj&&("authorization"===t.code||"permission"===t.code)}(e,o)))throw o;await e_(e)}a()}}(e,n,r,i,s.includes("app"),o);for(const l of s)await c_(e,l,o),o(),i[l]=null;o();const c=jd(e);if(!c)throw new Error("Saved Linear connector not found");return"oauth"===n.method&&(i.app=c.app,i.user=c.user),i.webhook=c.webhook,i.recovery=c.recovery,hP(e)}(r,c,e,t,l):p;s();const m=await lt(()=>function(e,t,n,r,i,a){if(a&&hP(a)!==i)throw new Error("Linear configuration changed in another tab; reload before saving");const o=a?{...Ci()[a]}:{},s=["linear_app_grant","linear_user_grant","linear_webhook_secret","linear_webhook_intent","linear_cleanup_app","linear_cleanup_user"];for(const c of Object.keys(o))s.includes(c)||Reflect.deleteProperty(o,c);return"api-key"===e.method&&(o.linear_app_grant=JSON.stringify({kind:"api-key",accessToken:r,expiresAt:null,scopes:[]})),{providerId:"linear",displayName:e.name.trim(),scopes:[...new Set([...t.appScopes,...t.userScopes])],fields:{self_hosted_configuration:JSON.stringify({state:mP(e),options:t}),...Nd(n,t,e.method,!(!o.linear_cleanup_app&&!o.linear_cleanup_user))},secrets:o}}(e,t,l,h,f,r),r,s);s(),a.bind(u=m.connectionId),n()&&w(u),s();const g=jP(e,t,l);g?await cP(m.connectionId,g,i.reservation):await o_(m.connectionId);const v=rt(m.connectionId);if(!v)throw new Error("Saved Linear connector not found");return v}finally{d?.release()}var u}(c,o,g,0,a.reserve);if(!n())return;l({...c,key:"",oauth:{...c.oauth,clientSecret:""}}),r({tone:"active"===e.status?"ok":"warn",text:"active"===e.status?`Linear connected to ${e.accountLabel??"your workspace"}${"memory"===fs()?" for this session":""}.`:"Linear configuration saved. Complete authorization with Linear."}),i()}catch(s){if(n()){const e=Ia(s);m(e),r({tone:"err",text:e})}}finally{a.finish(),n()&&u(null)}}}}function PP({props:e,model:t}){const{state:n,options:r,busy:i,iconBusy:a,failure:o,savedId:s,problems:c,setState:l,setOptions:d,setIconBusy:u,configure:p}=t;return Ee.jsxs("form",{className:"cx-form panel__body",onSubmit:e=>{p(e)},children:[Ee.jsxs("fieldset",{className:"cx-block",disabled:i||a,children:[Ee.jsx("legend",{className:"visually-hidden",children:"Linear connector configuration"}),Ee.jsx("div",{className:"cx-form",children:Ee.jsx(TP,{plan:e.plan,state:n,options:r,onState:l,onOptions:d,onIconBusyChange:u,onError:t=>e.onFlash({tone:"err",text:t})})})]}),o?Ee.jsx(Oe,{tone:"err",label:o}):null,void 0===e.onAuthorization?Ee.jsx(_P,{authorizing:i&&"oauth"===n.method}):null,Ee.jsxs(U,{label:"api-key"===n.method?"Verify and connect Linear":s?"Save and authorize Linear":"Create and authorize Linear",busy:i,disabled:i||a||c.length>0,children:[Ee.jsx(iy,{busy:i,authorization:void 0===e.authorization?null:e.authorization,onCancel:()=>e.authorization?.cancel()}),c[0]?Ee.jsx(Oe,{tone:"warn",label:c[0]}):null]})]})}function OP(e){return Ee.jsx(PP,{props:e,model:$P(e)})}async function RP(e,t,n={},r="app"){if("active"!==$d(e).status)throw new Error("Finish Linear authorization and configuration before using this connector");const i=jd(e)?.[r];if(!i)throw new Error(`Authorize the Linear ${r} account first`);if("issue.create"===t&&"oauth"===i.kind&&!i.grantedScopes.some(e=>"write"===e||"issues:create"===e))throw new Error("Linear issue creation requires write or issues:create permission");const a=await Xj(e,r);try{return await async function(e,t,n){switch(t){case"issues.list":return await async function(e){return(await Ij(e,"query OpenSesameIssues { issues(first: 50, orderBy: updatedAt) { nodes { id identifier title url } } }",{},Ur({issues:Ur({nodes:Gr(Fj.omit({description:!0})).max(50)})}))).issues.nodes.map(e=>({...e,description:null}))}(e);case"projects.list":return await async function(e){return(await Ij(e,"query OpenSesameProjects { projects(first: 50, orderBy: updatedAt) { nodes { id name url } } }",{},Ur({projects:Ur({nodes:Gr(Vj.omit({description:!0})).max(50)})}))).projects.nodes.map(e=>({...e,description:""}))}(e);case"teams.list":return(await Kj(e)).teams;case"issue.read":return await async function(e,t){const n=gj(Tj,t);return(await Ij(e,`query OpenSesameIssue($id: String!) { issue(id: $id) { ${Gj} } }`,{id:n},Ur({issue:Fj}))).issue}(e,n.id??"");case"project.read":return await async function(e,t){const n=gj(Tj,t);return(await Ij(e,"query OpenSesameProject($id: String!) { project(id: $id) { id name description url } }",{id:n},Ur({project:Vj}))).project}(e,n.id??"");case"issue.create":{const t={teamId:n.teamId??"",title:n.title??""};return void 0!==n.description&&(t.description=n.description),await async function(e,t){const n=gj(Bj,t);return(await Ij(e,`mutation OpenSesameCreateIssue($input: IssueCreateInput!) { issueCreate(input: $input) { success issue { ${Gj} } } }`,{input:n},Ur({issueCreate:Ur({success:Dr(!0),issue:Fj})}))).issueCreate.issue}(e,t)}default:throw new Error("Unsupported Linear operation")}}(a,t,n)}catch(o){throw o instanceof mj&&"authorization"===o.code&&await async function(e,t){await Pd(e,async(e,n)=>n[t]?zd(e,{...n,[t]:{...n[t],needsReauth:!0}}):e)}(e,r),o}}const LP=Ur({id:qr(),title:qr().optional(),name:qr().optional(),identifier:qr().optional(),url:qr().optional()}),UP=Gr(Ur({id:qr(),name:qr(),key:qr()}));function DP({model:e}){const{teams:t,teamId:n,setTeamId:r,title:i,setTitle:a,description:o,setDescription:s,canCreate:c,canRead:l,run:d}=e;return Ee.jsx(Ee.Fragment,{children:Ee.jsxs("details",{className:"cx-application",children:[Ee.jsx("summary",{children:"Create a Linear issue"}),Ee.jsxs("div",{className:"cx-form",children:[Ee.jsxs("div",{className:"keyed-row",children:[Ee.jsx("span",{children:"Linear teams"}),Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Load Linear teams",title:l?"Load Linear teams":"Linear read scope required",disabled:!l,onClick:()=>{d("teams.list")},children:Ee.jsx(V,{size:16})})]}),t.length>0?Ee.jsx(Ov,{label:"Linear team",value:n,options:t.map(e=>({id:e.id,label:`${e.name} (${e.key})`})),onChange:r}):null,Ee.jsx(O,{label:"Issue title",value:i,onValueChange:a}),Ee.jsxs("label",{className:"cx-select",children:[Ee.jsx("span",{className:"f__label",children:"Issue description"}),Ee.jsx("textarea",{className:"cx-textarea",value:o,maxLength:1e5,onChange:e=>s(e.target.value)})]}),Ee.jsx(U,{label:"Create issue in Linear",icon:Ee.jsx(Z,{size:18}),disabled:!c||!n||!i.trim(),onClick:()=>{d("issue.create")}})]})]})})}function qP({model:e}){const{actor:t,setActor:n,actors:r,busy:i,setTeams:a,setTeamId:o,setItems:s,setResultLabel:c,setFailure:l,canRead:d,canCreate:u,run:p}=e;return Ee.jsx(Ee.Fragment,{children:Ee.jsxs("fieldset",{className:"cx-block cx-form",disabled:i,children:[Ee.jsx("legend",{className:"visually-hidden",children:"Linear operations"}),Ee.jsx(Ov,{label:"Act as",value:t,options:r,onChange:e=>{n(e),a([]),o(""),s([]),c(""),l(null)}}),Ee.jsxs("div",{className:"panel__head",children:[Ee.jsx("h3",{children:"Linear records"}),Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Read Linear issues",title:d?"Read Linear issues":"Linear read scope required",disabled:!d,onClick:()=>{p("issues.list")},children:Ee.jsx(ke,{size:16})}),Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Read Linear projects",title:d?"Read Linear projects":"Linear read scope required",disabled:!d,onClick:()=>{p("projects.list")},children:Ee.jsx(ke,{size:16})})]}),Ee.jsx(DP,{model:e}),d?null:Ee.jsx(Oe,{tone:"warn",label:"Linear read scope required"}),u?null:Ee.jsx(Oe,{tone:"warn",label:"Linear write or issues:create scope required"})]})})}function MP({items:e,resultLabel:t}){return Ee.jsx(Ee.Fragment,{children:t?Ee.jsxs("section",{"aria-label":t,children:[Ee.jsxs("output",{children:[t,0===e.length?": none found":""]}),Ee.jsx("ul",{children:e.map(e=>{const t=`${e.identifier?`${e.identifier} · `:""}${e.title??e.name??e.id}`,n=function(e){if(e)try{const t=new URL(e);return"https:"!==t.protocol||"linear.app"!==t.hostname&&!t.hostname.endsWith(".linear.app")?void 0:t.href}catch{return}}(e.url);return Ee.jsx("li",{children:n?Ee.jsx("a",{href:n,target:"_blank",rel:"noreferrer noopener",children:t}):t},e.id)})})]}):null})}function KP({connectorId:e,onFlash:t,onChanged:n}){const r=function(e,t,n){const r=jd(e),[i,a]=Ce.useState(r?.app?"app":"user"),o=function(){const[e,t]=Ce.useState(!1),[n,r]=Ce.useState(null),[i,a]=Ce.useState([]),[o,s]=Ce.useState(""),[c,l]=Ce.useState([]),[d,u]=Ce.useState(""),[p,h]=Ce.useState(""),[f,m]=Ce.useState("");return{busy:e,setBusy:t,failure:n,setFailure:r,items:i,setItems:a,resultLabel:o,setResultLabel:s,teams:c,setTeams:l,teamId:d,setTeamId:u,title:p,setTitle:h,description:f,setDescription:m}}(),s=function(e){const t=[];return e?.app&&t.push({id:"app",label:"api-key"===e.app.kind?"API key account":"Application"}),e?.user&&t.push({id:"user",label:"User"}),t}(r),c=r?.[i],l="api-key"===c?.kind||c?.grantedScopes.includes("read"),d="api-key"===c?.kind||c?.grantedScopes.some(e=>"write"===e||"issues:create"===e);return{...o,actor:i,setActor:a,actors:s,canRead:l,canCreate:d,run:async function(r){if(!o.busy){o.setBusy(!0),o.setFailure(null),o.setResultLabel("");try{const n=await RP(e,r,"issue.create"===r?{teamId:o.teamId,title:o.title,description:o.description}:{},i);if("teams.list"===r){const e=UP.parse(n);o.setTeams(e),o.setTeamId(e[0]?.id??""),0===e.length?(o.setFailure("Linear returned no accessible teams."),t({tone:"err",text:"Linear returned no accessible teams."})):t({tone:"ok",text:"Linear teams loaded."})}else{const e="issue.create"===r?[LP.parse(n)]:Gr(LP).parse(n);o.setItems(e),o.setResultLabel("issue.create"===r?"Issue created in Linear":"issues.list"===r?"Linear issues":"Linear projects"),"issue.create"===r&&(o.setTitle(""),o.setDescription("")),t({tone:"ok",text:"Linear operation completed."})}}catch(a){const e=a instanceof Wr?"Linear returned an invalid operation result.":Ia(a);o.setFailure(e),t({tone:"err",text:e})}finally{o.setBusy(!1),n?.()}}}}}(e,t,n);return 0===r.actors.length?null:Ee.jsxs("section",{className:"cx-block cx-form","aria-label":"Use Linear",children:[Ee.jsx("h3",{children:"Use Linear"}),Ee.jsx(qP,{model:r}),r.busy?Ee.jsx("output",{children:"Waiting for Linear…"}):null,r.failure?Ee.jsx(Oe,{tone:"err",label:r.failure}):null,Ee.jsx(MP,{items:r.items,resultLabel:r.resultLabel})]})}function FP(e,t){const n=Yj(e);return n.cleanupNeeded?`${t}. Remove the previous webhook in its original workspace.${n.temporaryAdmin?" Linear requests temporary admin permission for cleanup, then authorization for selected app scopes.":" Original workspace authorization is required for webhook cleanup."}`:t}function GP({connectorId:e}){const t=Yj(e);return t.cleanupNeeded?Ee.jsx(Oe,{tone:"warn",label:t.temporaryAdmin?"Webhook cleanup pending in the original workspace; temporary admin permission required before selected app scopes.":"Webhook cleanup pending; original workspace authorization required."}):null}function BP({connectorId:e,busy:t,onFlash:n,onChanged:r}){const[i,a]=Ce.useState(!1),o=jd(e),s=j_(e);return(o?.recovery||s?.options.webhookEnabled&&!o?.webhook)&&o?.app&&!o.app.needsReauth?Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Retry webhook setup",title:"Retry webhook setup",disabled:t||i,onClick:()=>{!async function(){a(!0);try{await o_(e),r()}catch(t){n({tone:"err",text:Ia(t)}),r()}finally{a(!1)}}()},children:Ee.jsx(V,{size:16})}):null}function VP({connectorId:e,actor:t,busy:n,onFlash:r,onChanged:i}){const[a,o]=Ce.useState(!1);return Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Retry authorization cleanup",title:"Retry authorization cleanup",disabled:n||a,onClick:()=>{!async function(){o(!0);try{await async function(e,t){if(Ad(e).options["app"===t?"appScopes":"userScopes"].length>0)throw new Error("Reconnect the selected Linear account to finish its authorization cleanup");const n=JSON.stringify(Ad(e));await c_(e,t,()=>{if(JSON.stringify(Ad(e))!==n)throw new Error("Linear configuration changed during cleanup; reload before retrying")});const r=jd(e);return"app"!==t||"configure"!==r?.recovery?.phase||r.webhook||Ci()[e]?.linear_webhook_intent||await t_(e),$d(e)}(e,t)}catch(n){r({tone:"err",text:Ia(n)})}finally{o(!1),i()}}()},children:Ee.jsx(V,{size:16})})}function HP({actor:e,connectorId:t,saved:n,authorization:r,busy:i,authorize:a,onFlash:o,onChanged:s}){const c=r?.[e],l=`${c?"Reconnect":"Authorize"} ${"app"===e?"application":"user"}`;return 0===n.options["app"===e?"appScopes":"userScopes"].length&&IP(t,e)?Ee.jsx(VP,{connectorId:t,actor:e,busy:i,onFlash:o,onChanged:s}):"oauth"!==n.state.method?null:Ee.jsxs(Ee.Fragment,{children:["app"===e?Ee.jsx(GP,{connectorId:t}):null,Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":l,title:"app"===e?FP(t,l):l,disabled:i,onClick:()=>{a(e)},children:Ee.jsx(c?V:xe,{size:16})})]})}function JP(e,t){return 0===e.saved.options["app"===e.actor?"appScopes":"userScopes"].length&&IP(e.connectorId,e.actor)?`${t} cleanup pending`:`${t} required`}function WP(e){if(!function(e){const{actor:t,saved:n,authorization:r,connectorId:i}=e;return"api-key"===n.state.method?"app"===t:!!r?.[t]||IP(i,t)||"app"===t&&!!r?.recovery||n.options["app"===t?"appScopes":"userScopes"].length>0}(e))return null;const{actor:t,saved:n,authorization:r}=e,i=r?.[t],a="api-key"===n.state.method?"API key":"app"===t?"App authorization":"User authorization";return Ee.jsxs("section",{className:"cx-block","aria-label":a,children:[Ee.jsxs("div",{className:"panel__head",children:[Ee.jsx("h3",{children:a}),Ee.jsx(HP,{...e})]}),i?Ee.jsx(Rv,{rows:[["Account",i.accountLabel],["Workspace",i.workspaceName],["Workspace ID",i.workspaceId],["Granted scopes",i.grantedScopes.join(", ")||"Key permissions managed in Linear"],["Expires",(o=i.expiresAt,o?new Date(o).toLocaleString():"No expiry reported")]]}):Ee.jsx(Oe,{tone:"warn",label:JP(e,a)}),i?.needsReauth?Ee.jsx(Oe,{tone:"warn",label:`${a} needs reconnection`}):null]});var o}function ZP({connectorId:e,onFlash:t}){const n=jd(e),r=n?.webhook,i=Rt(),[a,o]=Ce.useState(!1),[s,c]=Ce.useState(null);return r?"cleanup"===n?.recovery?.phase?Ee.jsx("section",{className:"cx-block","aria-label":"Linear webhook",children:Ee.jsx(Oe,{tone:"warn",label:"Previous webhook cleanup pending in its original workspace"})}):Ee.jsxs("section",{className:"cx-block cx-form","aria-label":"Linear webhook",children:[Ee.jsxs("div",{className:"panel__head",children:[Ee.jsx("h3",{children:"Linear webhook"}),Ee.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":"Copy webhook signing secret",title:"Copy webhook signing secret; configure it in your receiver and verify the Linear-Signature header before accepting events.",disabled:a,onClick:()=>{!async function(){if(!a){o(!0),c(null);try{const r=(n=e,jd(n)?.webhook?Ci()[n]?.linear_webhook_secret??null:null);if(!r||"copied"!==await i(r))throw new Error;c({tone:"ok",text:"Signing secret copied"}),t({tone:"ok",text:"Signing secret copied"})}catch{const e="Could not copy the signing secret. Check clipboard access and try again.";c({tone:"err",text:e}),t({tone:"err",text:e})}finally{o(!1)}var n}}()},children:Ee.jsx(G,{size:16})}),s?Ee.jsx(Oe,{tone:s.tone,label:s.text}):null]}),Ee.jsx(Rv,{rows:[["Registered webhook",r.url],["Resources",r.resourceTypes.join(", ")]]}),Ee.jsx(Uv,{href:"https://linear.app/developers/webhooks",children:"Linear webhook signature verification"})]}):null}function XP({active:e,confirming:t,busy:n,remove:r}){return Ee.jsx(Ee.Fragment,{children:Ee.jsxs("div",{className:"panel__head",children:[Ee.jsxs("h2",{children:[Ee.jsx("span",{className:"cx-step",children:"3"})," ",e?"Complete":"Authorization"]}),Ee.jsx(Oe,{tone:e?"ok":"warn",label:e?"Linear connected":"Linear authorization incomplete"}),Ee.jsx("button",{type:"button",className:"icon-btn"+(t?" is-armed":""),"aria-label":t?"Confirm remove connector":"Remove connector",title:t?"Remove this local connector":"Remove connector",disabled:n,onClick:()=>{r()},children:Ee.jsx(F,{size:16})})]})})}function YP(e){const{connection:t,onFlash:n,onChanged:r}=e,i=j_(t.connectionId),a=jd(t.connectionId),{busy:o,authorizing:s,confirming:c,authorize:l,remove:d}=function(e){const{connection:{connectionId:t},onFlash:n,onChanged:r}=e,[i,a]=Ce.useState(!1),[o,s]=Ce.useState(null),[c,l]=Ce.useState(!1),d=!!o?.(),u=i||d;return{busy:u,authorizing:d,confirming:c,authorize:async function(i){if(u)return;const a=e.captureUiCurrent?.()??(()=>!0);if(!a())return;const o=zP(t,e.onAuthorization);let c;s(()=>a);try{c=eP();const e=o.reserve(c);o.bind(t),await cP(t,i,{...c,assertCurrent:e})}catch(l){a()&&n({tone:"err",text:Ia(l)})}finally{try{o.finish()}finally{c?.release()}a()&&(s(null),r())}},remove:async function(){if(c){a(!0);try{await async function(e){const t=Si().find(t=>t.connectionId===e);if("linear"!==t?.providerId||void 0===t.fields.linear_authorization){if(!(await Ti(e)))throw new Error("Saved connector not found on this device")}else await l_(e)}(t),n({tone:"ok",text:"Linear connector removed from this device."}),r()}catch(e){n({tone:"err",text:Ia(e)})}finally{a(!1),l(!1)}}else l(!0)}}}(e);return i?Ee.jsxs("section",{className:"panel",id:"complete","aria-label":"Linear connection status",children:[Ee.jsx(XP,{active:"active"===t.status,confirming:c,busy:o,remove:d}),Ee.jsxs("div",{className:"panel__body cx-form",children:[Ee.jsx("p",{children:t.displayName}),t.statusDetail?Ee.jsx(Oe,{tone:"warn",label:t.statusDetail}):null,["app","user"].map(e=>Ee.jsx(WP,{actor:e,connectorId:t.connectionId,saved:i,authorization:a,busy:o,authorize:l,onFlash:n,onChanged:r},e)),e.onAuthorization?null:Ee.jsx(_P,{authorizing:s}),a?.webhook?Ee.jsx(ZP,{connectorId:t.connectionId,onFlash:n}):i.options.webhookEnabled?Ee.jsx(Oe,{tone:"warn",label:"Webhook registration incomplete"}):null,Ee.jsx(BP,{connectorId:t.connectionId,busy:o,onFlash:n,onChanged:r}),"active"===t.status?Ee.jsx(KP,{connectorId:t.connectionId,onFlash:n,onChanged:r}):null]})]}):null}const QP={open:l,authorize:async function(e,t,n){const r=function(e){const t=To().replace(/\/+$/,"");return t?`${t}/api/connect/callback?return_to=${encodeURIComponent(A(e))}`:void 0}(e),i={connectorId:e,subject:t,scopes:[...n]};r&&(i.callbackUrl=r);const a=R$(m()?await y("/api/connect/authorize",b(i)):await k(`/v1/connect/authorize/${encodeURIComponent(e)}${x(I())}`,{method:"POST",body:JSON.stringify(vz(t,n,r))})),o=P$(a.url,4096);if(!o)throw new j(0,"malformed","Connect did not return an authorization URL.");return{authorizationUrl:o,expiresAt:a.expiresAt?S(a.expiresAt):new Date(Date.now()+6e5).toISOString()}},check:async function(e,t,n=[]){if(!m())throw new j(0,"relay_required","Proving a token needs this deployment's Connect relay.");const r=function(e){const t=R$(e),n=P$(t.fingerprint,12);if(!/^[0-9a-f]{12}$/.test(n))return null;const r=R$(t.verified);return{subject:"app"===t.subject?"app":"user",expiresAt:t.expiresAt?S(t.expiresAt):"",scopes:O$(t.scopes),fingerprint:n,verified:si(r.status)?{status:r.status,ok:!0===r.ok,account:P$(r.account,80)}:null}}(await y("/api/connect/token-check",b({connectorId:e,subject:t,scopes:[...n]})));if(!r)throw new j(0,"malformed","The relay did not prove a token.");return r}};function eO({check:e}){const t=e.verified;return Ee.jsx(Rv,{rows:[["Subject","user"===e.subject?"You":"App"],["Token",`sha256:${e.fingerprint}…`],["Expires",e.expiresAt?new Date(e.expiresAt).toLocaleString():"Not stated"],["Scopes",e.scopes.join(" ")||"As granted"],["Service",t?Ee.jsxs("span",{className:"cx-inline",children:[Ee.jsx(Oe,{tone:t.ok?"ok":"err",label:t.ok?"Token accepted":`Refused (${t.status})`}),Ee.jsx("span",{children:t.account||String(t.status)})]},"verified"):"No read-only check for this service"]]})}function tO({busy:e,wait:t,authorize:n,prove:r,onAuthorize:i,onProve:a}){return Ee.jsxs("div",{className:"actions",children:[n?Ee.jsx("button",{type:"button",className:"icon-btn","aria-label":"Authorize as you",title:"Authorize as you","aria-busy":"authorize"===e||void 0,disabled:t,onClick:i,children:Ee.jsx(ue,{size:16})}):null,r?Ee.jsx("button",{type:"button",className:"icon-btn","aria-label":"Test user token",title:"Test user token","aria-busy":"check"===e||void 0,disabled:t,onClick:a,children:Ee.jsx(de,{size:16})}):null]})}function nO({connectorId:e,subjectId:t,scopes:n,canManage:r,canProve:i,online:a,onFlash:o}){const[s,c]=Ce.useState(null),[l,d]=Ce.useState(null),u=Ce.useRef(null),p=t?{type:"user",id:t}:null;async function h(){if(p){c("check");try{d(await QP.check(e,p,n))}catch(t){d(null),o({tone:"err",text:Ia(t)})}finally{c(null)}}}Ce.useEffect(()=>()=>u.current?.abort(),[]);const f=!a||null!==s;return Ee.jsxs("section",{className:"panel",id:"user-token","aria-label":"User token",children:[Ee.jsxs("div",{className:"panel__head",children:[Ee.jsx("h2",{children:"User token"}),Ee.jsx(tO,{busy:s,wait:f,authorize:null!==p&&r,prove:null!==p&&i,onAuthorize:()=>{!async function(){if(!p)return;const t=QP.open("about:blank");c("authorize");try{const{authorizationUrl:r}=await QP.authorize(e,p,n);if(!t)return void window.location.assign(r);t.location.href=r;const a=new AbortController;u.current=a;const o=await function(e,t,n){return new Promise(r=>{if(!e||n.aborted)return void r(!1);const i=Date.now();let a=!1,o=0;const s=e=>{a||(a=!0,window.removeEventListener("message",l),n.removeEventListener("abort",c),0!==o&&window.clearInterval(o),r(e))},c=()=>s(!1),l=n=>{if(n.source!==e)return;if(n.origin!==window.location.origin)return;const r=n.data;ai(r)&&"opensesame:connection"===r.type&&r.connectionId===t&&s(!0)},d=()=>{(e.closed||Date.now()-i>6e5)&&s(!1)};n.addEventListener("abort",c,{once:!0}),window.addEventListener("message",l),d(),a||(o=window.setInterval(d,500))})}(t,e,a.signal);if(!o)return;i&&await h()}catch(r){t?.close(),o({tone:"err",text:Ia(r)})}finally{u.current=null,c(null)}}()},onProve:()=>{h()}})]}),Ee.jsx("div",{className:"panel__body",children:l?Ee.jsx(eO,{check:l}):Ee.jsx(Rv,{rows:[["Subject",t??"Unlock to authorize as you"],["Scopes",n.join(" ")||"As configured"]]})})]})}function rO(e){return!0===e?.connectionRef.startsWith("connect://")}function iO({provider:e,connection:t,online:n,onFlash:r}){const i=Oa(e.id),a=YI(),o=Ie(),s=Ot(),{tomb:c}=s,l=s.header?.protection?.vaultId??s.header?.createdAt??null;return i?Ee.jsxs("div",{className:"cx-setup",children:[Ee.jsx(C$,{relay:a.relay,showForm:!a.canManage,held:a.held,onFlash:r}),Ee.jsxs("section",{className:"panel",id:"connector","aria-label":"Connector",children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsx("h2",{children:"Connector settings"})}),Ee.jsx(Q$,{plan:i,connectorId:t.connectionId,canManage:a.canManage,online:n,onFlash:r},t.connectionId)]}),Ee.jsx(nO,{connectorId:t.connectionId,subjectId:$z(o?.principalId,c,void 0,l),scopes:t.grantedScopes,canManage:a.canManage,canProve:a.canProve,online:n,onFlash:r},t.connectionId)]}):null}function aO(e){const{provider:t,connection:n}=e,r=Oa(t.id);return r&&!r.refused&&n&&rO(n)?Ee.jsx(iO,{...e,connection:n}):Ee.jsx(oO,{...e})}function oO(e){const{provider:t,connection:n,onFlash:r,onChanged:i}=e,a=Oa(t.id);return"tailscale"===t.id?Ee.jsx(S$,{...e}):sd(t.id)?Ee.jsx(pz,{providerId:t.id,connectionId:n?.connectionId,onFlash:r,onChanged:i}):i$(t.id)?Ee.jsx(l$,{...e},`${t.id}/${n?.connectionId??"new"}`):!a||a.refused?null:"linear"!==t.id?Ee.jsx(CI,{...e}):Ee.jsx(sO,{...e,plan:a})}function sO(e){const t=kI(e.plan.id,e.connection?.connectionId),n=e.connection&&I_(e.connection)&&!ot(e.connection);return Ee.jsx(n?lO:cO,{...e,pending:t})}function cO({plan:e,pending:t,...n}){const[r,i]=Ce.useState(!1),{connection:a,onFlash:o,onChanged:s}=n;return Ee.jsx(CI,{...n,renderConfiguration:n=>Ee.jsxs(Ee.Fragment,{children:[n,a?null:Ee.jsxs("details",{className:"cx-application",onToggle:e=>i(e.currentTarget.open),children:[Ee.jsx("summary",{children:"Advanced: existing OAuth app or API key"}),r?Ee.jsxs("div",{className:"cx-form",children:[Ee.jsx("p",{className:"hint",children:"Linear MCP authorization is the default and does not need a registered OAuth application. Use this separate GraphQL connection only when your workspace requires the specialized API route; its credential is never shared with the MCP connection."}),Ee.jsx(OP,{plan:e,onFlash:o,onSaved:s,onAuthorization:t.onAuthorization,authorization:t.authorization,captureUiCurrent:t.captureUiCurrent})]}):null]})]})})}function lO({connection:e,plan:t,onFlash:n,onChanged:r,pending:i}){const a="linear"===e?.providerId&&I_(e)?e:null,o=a?.connectionId;return Ee.jsxs("div",{className:"cx-setup",children:[Ee.jsx(Nv,{step:2,title:a?"Configure":"Connect",focus:!0,children:Ee.jsx(OP,{plan:t,connectorId:o,onFlash:n,onSaved:r,onAuthorization:i.onAuthorization,authorization:i.authorization,captureUiCurrent:i.captureUiCurrent},`${t.id}/${o??"new"}`)}),a?Ee.jsxs("fieldset",{className:"cx-block",disabled:!!i.authorization,children:[Ee.jsx("legend",{className:"visually-hidden",children:"Linear saved connection actions"}),Ee.jsx(YP,{connection:a,onFlash:n,onChanged:r,onAuthorization:i.onAuthorization,captureUiCurrent:i.captureUiCurrent},o??"new")]}):null]})}function dO({onFlash:e}){const t=Ce.useId(),{container:n,items:r,selected:i,setSelected:a,status:o,clear:s,list:c,prepare:l}=function(e){const t=Ce.useRef(null),n=Ce.useRef(null),r=Ce.useRef(0),[i,a]=Ce.useState([]),[o,s]=Ce.useState(""),c=jy(e),l=Ce.useCallback(()=>{r.current+=1;const e=n.current;e?.removeAttribute("value"),e?.shadowRoot?.querySelector("[value]")?.removeAttribute("value"),e?.remove(),n.current=null,t.current?.replaceChildren()},[]);return Ce.useEffect(()=>{const e=Ht.onLock(()=>{l(),a([]),s("")});return()=>{e(),l()}},[l]),{container:t,items:i,selected:o,setSelected:s,status:c,clear:l,list:function(){c.run(async()=>{const e=Ha(),t=await e.authenticate(Va("local-vault"));try{return a((await e.listItems(t)).filter(e=>"login"===e.kind)),"Local logins loaded"}finally{await e.disconnect(t)}})},prepare:function(){l();const e=r.current;c.run(async()=>{const i=Ha(),a=await i.authenticate(Va("local-vault"));try{const s=await i.getItem(o,a),c=await async function(e){if("login"!==e.kind)throw new Error("Choose a login item.");if(e.url&&new URL(e.url).origin!==window.location.origin)throw new Error("The 1Password save button saves logins for this browser origin. Choose a login for this origin.");const t=await Mo(()=>import("./vendor-1password-save-bVqbF-cI.js"),[]),n=t.encodeOPSaveRequest({title:e.name,fields:[{autocomplete:"username",value:e.username??""},{autocomplete:"current-password",value:e.secret}],notes:e.notes});if(!n)throw new Error("1Password refused this save request.");const r=document.createElement("onepassword-save-button");return r.setAttribute("data-onepassword-type","login"),r.setAttribute("data-theme","dark"===getComputedStyle(document.documentElement).colorScheme?"dark":"light"),r.setAttribute("value",n),{button:r,activate:t.activateOPButton}}(s);if(r.current!==e||!t.current)return;return t.current.append(c.button),n.current=c.button,c.activate(),"1Password save button prepared"}finally{await i.disconnect(a)}})}}}(e);return Ee.jsxs("section",{className:"panel","aria-label":"Save in 1Password",children:[Ee.jsxs("div",{className:"panel__head",children:[Ee.jsx("h2",{children:"Save in 1Password"}),Ee.jsx(B,{label:"List local logins for 1Password",disabled:o.busy,onClick:c,children:Ee.jsx(V,{size:17})}),Ee.jsx(B,{label:"Clear 1Password save request",disabled:o.busy,onClick:s,children:Ee.jsx(H,{size:17})}),o.failure?Ee.jsx(Oe,{tone:"err",label:o.failure}):null,o.result?Ee.jsx(Oe,{tone:"ok",label:o.result}):null]}),Ee.jsxs("div",{className:"panel__body cx-form",children:[Ee.jsx(O,{label:"Saved login origin",value:window.location.origin,readOnly:!0,mono:!0}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:t,children:"Local login"}),Ee.jsxs("select",{id:t,value:i,disabled:o.busy,onChange:e=>{s(),a(e.target.value)},children:[Ee.jsx("option",{value:"",children:"—"}),r.map(e=>Ee.jsx("option",{value:e.id,children:e.name},e.id))]})]}),Ee.jsx(U,{label:"Prepare official 1Password save button",busy:o.busy,disabled:o.busy||!i,onClick:l}),Ee.jsx("div",{ref:n})]}),Ee.jsx(q,{id:"onepassword-official-save",title:"Save in 1Password",message:o.failure})]})}function uO(e){const t=Ce.useId();return Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:`${t}-format`,children:"Export format"}),Ee.jsx("select",{id:`${t}-format`,value:e.draft.fileFormat,disabled:e.busy,onChange:t=>e.onChange("fileFormat",t.target.value),children:e.formats.map(e=>Ee.jsx("option",{value:e.id,children:e.label},e.id))})]}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:`${t}-file`,children:"Export file"}),Ee.jsx("input",{id:`${t}-file`,type:"file",disabled:e.busy,onChange:t=>e.onFile(t.target.files?.[0]??null)},e.file?.name??"empty")]}),e.file?Ee.jsx(O,{label:"Selected file",value:e.file.name,readOnly:!0}):null,Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Encrypted export"}),Ee.jsx(O,{label:"Export password",value:e.password,type:"password",autoComplete:"new-password",disabled:e.busy,onValueChange:e.onPassword})]})]})}const pO={key:"baseUrl",label:"API base URL"},hO={key:"token",label:"Access token",secret:!0},fO={"encrypted-remote":[{key:"baseUrl",label:"Encrypted object HTTPS URL"},{key:"remoteStoreId",label:"Encrypted store UUID"},{key:"encryptionKey",label:"Inventory encryption key (base64, 32 bytes)",secret:!0},{key:"token",label:"Object bearer token (optional)",secret:!0}],"proton-pass":[{key:"baseUrl",label:"API base URL",placeholder:"https://pass-api.proton.me/api"},{key:"token",label:"Personal access token",secret:!0},{key:"vaultId",label:"PAT-scoped share ID"},{key:"appVersion",label:"Accepted application/version header",placeholder:"accepted-client@version"}],"onepassword-sdk":[{key:"baseUrl",label:"1Password account URL",placeholder:"https://team.1password.com"},{key:"token",label:"Service account token",secret:!0},{key:"vaultId",label:"Vault ID"}],"onepassword-connect":[pO,hO,{key:"vaultId",label:"Vault ID"}],"bitwarden-api":[pO,{key:"identityUrl",label:"Identity API URL"},{key:"accountEmail",label:"Account email"},{key:"clientId",label:"Personal API client ID",placeholder:"user.00000000-0000-0000-0000-000000000000"},{key:"clientSecret",label:"Personal API client secret",secret:!0},{key:"deviceIdentifier",label:"Device identifier"},{key:"vaultId",label:"Personal folder ID (optional)"}],"bitwarden-secrets":[pO,{key:"identityUrl",label:"Identity API URL"},hO,{key:"organizationId",label:"Organization ID"},{key:"projectId",label:"Project ID"}],infisical:[pO,hO,{key:"projectId",label:"Project ID"},{key:"environment",label:"Environment"},{key:"secretPath",label:"Secret path",placeholder:"/"}],passwordstate:[pO,{key:"token",label:"API key",secret:!0},{key:"passwordListId",label:"Password list ID"}]};function mO({draft:e,busy:t,onChange:n,fields:r}){return r.map(r=>Ee.jsx(O,{label:r.label,value:e[r.key]??"",type:r.secret?"password":"text",placeholder:r.placeholder,autoComplete:r.secret?"new-password":"off",mono:!0,disabled:t,onValueChange:e=>n(r.key,e)},r.key))}function gO(e){const t=e.draft.mode;return"local"===t||"file-import"===t?null:"credential-management"===t?Ee.jsx(O,{label:"Credential origin",value:window.location.origin,mono:!0,readOnly:!0}):Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(mO,{...e,fields:fO[t]}),"infisical"===t?Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Universal Auth"}),Ee.jsx(mO,{...e,fields:[{key:"clientId",label:"Client ID"},{key:"clientSecret",label:"Client secret",secret:!0}]})]}):null]})}function wO({draft:e,modes:t,busy:n,onChange:r}){const i=Ce.useId();return Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:i,children:"Connection method"}),Ee.jsx("select",{id:i,value:e.mode,disabled:n,onChange:t=>{const n=t.target.value;"proton-pass"!==n||e.appVersion||r("appVersion",Wa),r("mode",n)},children:t.map(e=>Ee.jsx("option",{value:e,children:Ja(e)},e))})]})}function vO(e){const{draft:t,busy:n,onChange:r}=e;return Ee.jsxs("form",{className:"cx-form panel__body",onSubmit:e.onSubmit,children:[Ee.jsx(O,{label:"Connection name",value:t.name,disabled:n,onValueChange:e=>r("name",e)}),Ee.jsx(wO,{...e}),Ee.jsx(gO,{...e}),e.children,e.setup||e.docsUrl?Ee.jsxs("details",{className:"conn-client-alt",children:[Ee.jsx("summary",{children:"Setup guide"}),e.setup?Ee.jsx("p",{children:e.setup}):null,e.docsUrl?Ee.jsx("a",{href:e.docsUrl,target:"_blank",rel:"noreferrer noopener",children:"Provider documentation"}):null]}):null,Ee.jsxs(U,{label:"Save secret backend",disabled:n,busy:n,children:[Ee.jsx(B,{label:"Test secret backend",disabled:n,onClick:e.onProbe,children:Ee.jsx(de,{size:17})}),e.saved?Ee.jsx(B,{label:"Reload secret backend configuration",disabled:n,onClick:e.onReload,children:Ee.jsx(V,{size:17})}):null,e.failure?Ee.jsx(Oe,{tone:"err",label:e.failure}):null]})]})}const yO=()=>null,bO=new Set(["local","file-import","credential-management"]);function kO({draft:e,online:t,busy:n}){const[r,i]=Ce.useState(!1),a=Ce.useSyncExternalStore(mt,ht,yO),o=function(e){if(bO.has(e.mode))return null;const t=[e.baseUrl];["bitwarden-api","bitwarden-secrets"].includes(e.mode)&&t.push(e.identityUrl);const n=new Set;let r=!0;for(const i of t)try{const t=Za(i);if("onepassword-sdk"===e.mode&&"/"!==t.pathname)throw new Error("Account URL must be an origin.");n.add(t.origin)}catch{r=!1}return{origins:[...n],complete:r}}(e);return o?Ee.jsxs("details",{className:"conn-client-alt",onToggle:e=>i(e.currentTarget.open),children:[Ee.jsx("summary",{children:"HTTPS connection route"}),Ee.jsx("p",{children:"Browser HTTPS uses this provider directly. To use the PWA's Tailscale browser node, configure its approved exit node for public endpoints or its approved peer for a tailnet service below."}),o.complete?Ee.jsxs(Ee.Fragment,{children:[Ee.jsx("p",{children:"Approve these exact origins with their destination CIDRs:"}),Ee.jsx("ul",{"aria-label":"Secret backend HTTPS origins",children:o.origins.map(e=>Ee.jsx("li",{children:Ee.jsx("code",{children:e})},e))})]}):Ee.jsx("p",{children:"Complete the provider URLs above to identify all required origins."}),Ee.jsx("p",{children:"This is the shared browser-node configuration. Choose the route and TLS trust, save it and connect the node before connecting this provider. Disconnect the provider before changing its route, then reconnect it."}),r&&!a?Ee.jsxs("p",{children:[Ee.jsx(ze,{to:"/settings/features#feature-networking",children:"Configure Networking in Features"})," ","to activate the browser node."]}):null,r&&a?Ee.jsxs("fieldset",{className:"cx-block",disabled:n,children:[Ee.jsx("legend",{children:"Shared HTTPS route configuration"}),Ee.jsx(S$,{online:t})]}):null]}):null}function xO({draft:e,editing:t,busy:n,onChange:r}){const[i,a]=Ce.useState(!1);return Ee.jsx(O,{label:"login"===e.kind?"Password":"Secret value",value:e.secret,type:i?"text":"password",autoComplete:"new-password",mono:!0,readOnly:!t,disabled:n,onValueChange:t=>r({...e,secret:t}),tail:Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(B,{label:i?"Hide backend secret":"Reveal backend secret",onClick:()=>a(e=>!e),children:Ee.jsx(i?je:ke,{size:17})}),Ee.jsx(B,{label:"Copy backend secret",onClick:()=>{navigator.clipboard?.writeText(e.secret).catch(()=>{})},children:Ee.jsx(G,{size:17})})]})})}function IO(e){const{draft:t,editing:n,busy:r,onChange:i,existing:a}=e,o=Ce.useId(),s=t=>!e.fields||e.fields.includes(t);return Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(O,{label:"Item name",value:t.name,readOnly:!n,disabled:r,onValueChange:e=>i({...t,name:e})}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:`${o}-kind`,children:"Item type"}),Ee.jsx("select",{id:`${o}-kind`,value:t.kind??"note",disabled:!n||r||a,onChange:e=>{const n=e.target.value;"login"!==n&&"secret"!==n&&"note"!==n||i({...t,kind:n})},children:(e.kinds??["note","secret","login"]).map(e=>Ee.jsx("option",{value:e,children:"note"===e?"Note":"secret"===e?"Secret":"Login"},e))})]}),"login"===t.kind?Ee.jsxs(Ee.Fragment,{children:[s("url")?Ee.jsx(O,{label:"Website",value:t.url??"",readOnly:!n,disabled:r,onValueChange:e=>i({...t,url:e}),mono:!0}):null,s("username")?Ee.jsx(O,{label:"Username",value:t.username??"",readOnly:!n,disabled:r,onValueChange:e=>i({...t,username:e})}):null]}):null,"note"!==t.kind&&s("secret")?Ee.jsx(xO,{...e}):null,s("notes")?Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:`${o}-notes`,children:"Notes"}),Ee.jsx("textarea",{id:`${o}-notes`,value:t.notes,readOnly:!n,disabled:r,onChange:e=>i({...t,notes:e.target.value}),rows:5})]}):null]})}function jO(e){const{item:t,editing:n,busy:r,onSave:i,onClose:a}=e,o=Ce.useRef(null);Ce.useLayoutEffect(()=>{(n||we())&&ve(ye(o.current))},[n]);const[s,c]=Ce.useState(()=>{return t?{name:t.name,notes:t.notes,secret:t.secret,kind:t.kind,username:t.username,url:t.url,fields:t.fields?{...t.fields}:void 0}:(n=e.itemKinds,{name:"",notes:"",secret:"",kind:n?.[0]??"note",username:"",url:""});var n});return Ee.jsxs("form",{className:"cx-form panel__body","aria-label":"Backend item",onSubmit:function(e){e.preventDefault(),i(s)},ref:o,children:[Ee.jsx(IO,{draft:s,existing:!!t,editing:n,busy:r,onChange:c,kinds:e.itemKinds,fields:e.itemFields}),n?Ee.jsx(U,{label:t?"Update backend item":"Create backend item",disabled:r,busy:r,children:Ee.jsx(B,{label:"Cancel backend item edit",disabled:r,onClick:a,children:Ee.jsx(H,{size:17})})}):null]})}async function _O({backend:e,session:t},n,r){if(r.check(),!e.capabilities.list)return;const i=await e.listItems(t);r.check(),n.setItems(i)}function SO(e,t,n){const{backend:r,session:i}=e,{selected:a,confirming:o,setConfirming:s,close:c}=t;return{save:function(o){n.run(async n=>{if(n.check(),a){if(!r.capabilities.update||!r.updateItem)throw new Error("This backend does not update items.");await r.updateItem(a.id,o,i)}else{if(!r.capabilities.create||!r.createItem)throw new Error("This backend does not create items.");await r.createItem(o,i)}return n.check(),await _O(e,t,n),n.check(),c(),"Backend item saved"})},remove:function(){a&&(o?n.run(async n=>{if(n.check(),!r.capabilities.delete||!r.deleteItem)throw new Error("This backend does not delete items.");return await r.deleteItem(a.id,i),n.check(),await _O(e,t,n),n.check(),c(),"Backend item deleted"}):s(!0))}}}function AO({state:e,handle:t}){const{capabilities:n}=t.backend,r=!n.itemFields||n.itemFields.includes("notes");return Ee.jsx("ul",{className:"conn-list","aria-label":"Backend items",children:e.items.map(t=>Ee.jsxs("li",{className:"conn-card",children:[Ee.jsx("span",{className:"conn-card__name",children:t.name}),Ee.jsx("span",{className:"conn-card__ref",children:t.kind}),n.get?Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(B,{label:`Open backend item ${t.name}`,disabled:e.busy,onClick:()=>e.read(t.id),children:Ee.jsx(ke,{size:17})}),r?Ee.jsx(B,{label:`Read notes for ${t.name}`,disabled:e.busy,onClick:()=>e.readNotes(t.id),children:Ee.jsx(J,{size:17})}):null]}):null]},t.id))})}function CO({state:e,handle:t}){if(!e.selected&&!e.creating&&null===e.notes)return null;const{capabilities:n,updateItem:r,deleteItem:i}=t.backend;return Ee.jsxs(Ee.Fragment,{children:[e.selected&&n.update&&r&&!e.editing?Ee.jsx(B,{label:"Edit backend item",disabled:e.busy,onClick:e.edit,children:Ee.jsx(ne,{size:17})}):null,e.selected&&n.delete&&i?Ee.jsx(B,{label:e.confirming?"Confirm delete backend item":"Delete backend item",armed:e.confirming,disabled:e.busy,onClick:e.remove,children:Ee.jsx(F,{size:17})}):null,e.confirming?Ee.jsx(B,{label:"Keep backend item",disabled:e.busy,onClick:()=>e.setConfirming(!1),children:Ee.jsx(H,{size:17})}):null,Ee.jsx(B,{label:"Close backend item",disabled:e.busy,onClick:e.close,children:Ee.jsx(H,{size:17})})]})}function EO({state:e,handle:t}){const n=Ce.useId(),{capabilities:r,importToLocal:i}=t.backend,a=!r.itemFields||r.itemFields.includes("notes");return Ee.jsxs("div",{className:"panel__body",children:[r.get?Ee.jsx(O,{label:"Item name or ID",value:e.lookup,disabled:e.busy,onValueChange:e.setLookup,onEnter:()=>e.read(e.lookup),tail:Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(B,{label:"Get backend item",disabled:e.busy||!e.lookup,onClick:()=>e.read(e.lookup),children:Ee.jsx(ke,{size:17})}),a?Ee.jsx(B,{label:"Get backend notes",disabled:e.busy||!e.lookup,onClick:()=>e.readNotes(e.lookup),children:Ee.jsx(J,{size:17})}):null]})}):null,r.list?Ee.jsx(AO,{state:e,handle:t}):null,null!==e.notes?Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:n,children:"Backend notes"}),Ee.jsx("textarea",{id:n,readOnly:!0,value:e.notes,rows:5})]}):null,r.import&&i?Ee.jsx(U,{label:"Import backend items into local vault",disabled:e.busy,busy:e.busy,icon:Ee.jsx(D,{size:18}),onClick:e.importItems}):null]})}function TO({handle:e,onFlash:t}){const n=function(e,t){const n=jy(t,Iy(e.backend.signal,e.session.signal)),r=function(){const[e,t]=Ce.useState([]),[n,r]=Ce.useState(null),[i,a]=Ce.useState(!1),[o,s]=Ce.useState(!1),[c,l]=Ce.useState(!1),[d,u]=Ce.useState(""),[p,h]=Ce.useState(null);function f(){r(null),a(!1),s(!1),l(!1),h(null)}return{items:e,setItems:t,selected:n,setSelected:r,editing:i,creating:o,confirming:c,setConfirming:l,lookup:d,setLookup:u,notes:p,setNotes:h,close:f,create:()=>{f(),s(!0),a(!0)},edit:()=>{a(!0),l(!1)}}}(),{setSelected:i,setNotes:a,close:o}=r,{backend:s,session:c}=e;return{...n,...r,...SO(e,r,n),list:function(){n.run(async t=>(await _O(e,r,t),t.check(),"Backend items loaded"))},read:function(e){e.trim()&&n.run(async t=>{t.check();const n=await s.getItem(e,c);return t.check(),o(),i(n),"Backend item loaded"})},readNotes:function(e){e.trim()&&n.run(async t=>{t.check();const n=await s.getNotes(e,c);return t.check(),o(),a(n),"Backend notes loaded"})},importItems:function(){n.run(async e=>{if(e.check(),!s.capabilities.import||!s.importToLocal)throw new Error("This backend does not import items.");const t=await s.importToLocal(c);return e.check(),`${t.imported} items imported; ${t.skipped} skipped${t.warnings.length?`; ${t.warnings.join("; ")}`:""}`})}}}(e,t),r=Ce.useRef(null),{selected:i,creating:a,busy:o}=n;Ce.useLayoutEffect(()=>{if(o)return;const e=i||a?r.current?.querySelector('[aria-label="Backend item"]'):r.current;we()&&ve(ye(e))},[i,a,o]);const{capabilities:s,createItem:c}=e.backend;return Ee.jsxs("section",{className:"panel","aria-label":"Secret backend items",ref:r,children:[Ee.jsxs("div",{className:"panel__head",children:[Ee.jsxs("h2",{children:[Ee.jsx("span",{className:"cx-step",children:"4"})," Items"]}),s.list?Ee.jsx(B,{label:"List backend items",disabled:n.busy,onClick:n.list,children:Ee.jsx(V,{size:17})}):null,s.create&&c?Ee.jsx(B,{label:"New backend item",disabled:n.busy,onClick:n.create,children:Ee.jsx(Z,{size:17})}):null,Ee.jsx(CO,{state:n,handle:e}),n.failure?Ee.jsx(Oe,{tone:"err",label:n.failure}):null,n.result?Ee.jsx(Oe,{tone:"ok",label:n.result}):null]}),Ee.jsx(EO,{state:n,handle:e}),n.selected||n.creating?Ee.jsx(jO,{item:n.selected,editing:n.editing,busy:n.busy,onSave:n.save,onClose:n.close,itemKinds:e.backend.capabilities.itemKinds,itemFields:e.backend.capabilities.itemFields},`${n.selected?.id??"new"}/${n.editing}`):null,Ee.jsx(q,{id:`secret-backend-items-${e.session.id}`,title:"Secret backend",message:n.failure})]})}const NO={connectSecretBackend:ro,initializeSecretBackend:no,deleteSecretBackendConnection:to,listSecretBackendConnections:eo,probeSecretBackend:Qa,readSecretBackendConnection:Xa,saveSecretBackendConnection:Ya,secretBackendDraft:Va};function zO(e,t){e.disposing.has(t)||(e.disposing.add(t),Promise.resolve().then(()=>t.backend.disconnect(t.session)).catch(()=>{}))}function $O(e,t,n=!1){if(t.closed)return;t.closed=!0;const r=e.current===t;r&&(e.current=null),t.detachPending(),t.detachHandle(),t.accepted&&e.epoch===t.epoch&&e.epoch&&e.publish(e=>e?.owner===t?null:e),t.handle&&zO(e,t.handle);try{n&&r&&t.accepted&&e.epoch===t.epoch&&e.epoch&&e.onEnded()}finally{t.controller.abort()}}function PO(e,t,n){return{changed:function(n,r){e.setDraft(e=>{const t={...e,[n]:r};return"mode"===n&&(t.token="",t.clientSecret="",t.encryptionKey="","bitwarden-api"===r&&(t.organizationId="",t.deviceIdentifier||(t.deviceIdentifier=crypto.randomUUID()))),t}),"mode"!==n&&"fileFormat"!==n&&"bitwarden-api"!==e.draft.mode||(e.setFile(null),e.setPassword("")),t.clear()},reload:function(){if(!e.saved)return;const n=NO.readSecretBackendConnection(e.saved.connectionId);n&&(e.setDraft(n),e.setPassword(""),t.clear())},save:function(r){r.preventDefault(),t.run(async()=>{const t=await NO.saveSecretBackendConnection(e.draft,e.saved?.connectionId);e.setSaved(t),"bitwarden-api"===e.draft.mode&&e.setPassword("");const r=NO.readSecretBackendConnection(t.connectionId);return r&&e.setDraft(r),n.onChanged(),"Secret backend configuration saved"})},remove:function(){t.run(async()=>{if(e.saved)return await NO.deleteSecretBackendConnection(e.saved.connectionId),e.setSaved(null),e.setDraft(NO.secretBackendDraft(n.provider.id)),n.onChanged(),"Secret backend configuration removed"})}}}function OO({editor:e}){const[t,n]=Ce.useState(!1);return e.saved?Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(B,{label:t?"Confirm remove secret backend":"Remove secret backend",armed:t,disabled:e.busy,onClick:()=>{t?(e.disconnect(),e.remove(),n(!1)):n(!0)},children:Ee.jsx(F,{size:17})}),t?Ee.jsx(B,{label:"Keep secret backend",disabled:e.busy,onClick:()=>n(!1),children:Ee.jsx(H,{size:17})}):null]}):null}function RO({editor:e,provider:t,online:n}){const r=io(t.id);return r?Ee.jsx(Nv,{step:2,label:"Secret backend configuration",title:"Configure",actions:Ee.jsxs(Ee.Fragment,{children:[e.saved?Ee.jsx(be,{label:"Reload secret backend",disabled:e.busy||!!e.active,onReload:e.reload}):null,Ee.jsx(OO,{editor:e}),e.result?Ee.jsx(Oe,{tone:"ok",label:e.result}):null]}),children:Ee.jsxs(vO,{draft:e.draft,busy:e.busy||!!e.active,saved:!!e.saved,online:n,failure:e.failure,modes:r.modes,setup:r.setup,docsUrl:r.docsUrl,onChange:e.changed,onSubmit:e.save,onProbe:e.probe,onReload:e.reload,children:["bitwarden-api"===e.draft.mode?Ee.jsx(O,{label:"Master password (this connection only)",value:e.password,type:"password",autoComplete:"off",disabled:e.busy||!!e.active,onValueChange:e.setPassword}):null,"file-import"===e.draft.mode?Ee.jsx(uO,{draft:e.draft,busy:e.busy||!!e.active,onChange:e.changed,formats:r.fileFormats,file:e.file,password:e.password,onFile:e.setFile,onPassword:e.setPassword}):null]})}):null}function LO({editor:e}){return Ee.jsx(Nv,{id:"complete",step:3,label:"Secret backend session",title:"Connect",actions:e.active?Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(Oe,{tone:"ok",label:"Secret backend session connected"}),Ee.jsx(B,{label:"Disconnect secret backend",disabled:e.busy,onClick:e.disconnect,children:Ee.jsx(_e,{size:17})})]}):null,children:e.active?null:Ee.jsxs("div",{className:"panel__body",children:[Ee.jsx(U,{label:e.saved?"Connect saved secret backend":"Connect secret backend",disabled:e.busy,busy:e.busy,onClick:e.connect}),"encrypted-remote"===e.draft.mode?Ee.jsx(U,{label:"Initialize empty encrypted remote",disabled:e.busy||!e.saved,onClick:e.initialize}):null]})})}function UO(e){const t=Ce.useRef(null),n=Ce.useRef(!1),r=function(e){const t=function(e){const[t,n]=Ce.useState(()=>{return t=e.provider.id,(n=e.connection)&&NO.readSecretBackendConnection(n.connectionId)?n:NO.listSecretBackendConnections().find(e=>e.providerId===t)??null;var t,n}),[r,i]=Ce.useState(()=>{const n=t&&NO.readSecretBackendConnection(t.connectionId)||NO.secretBackendDraft(e.provider.id);return"bitwarden-api"!==n.mode||n.deviceIdentifier?n:{...n,deviceIdentifier:crypto.randomUUID()}}),[a,o]=Ce.useState(null),[s,c]=Ce.useState("");return{saved:t,setSaved:n,draft:r,setDraft:i,file:a,setFile:o,password:s,setPassword:c}}(e),n=jy(e.onFlash),r=function(e){const[t,n]=Ce.useState(null),r=Ce.useRef({epoch:null,current:null,owners:new WeakMap,disposing:new WeakSet,sequence:0,onEnded:e,publish:n});Ce.useLayoutEffect(()=>{r.current.onEnded=e},[e]),Ce.useLayoutEffect(()=>{const e=r.current,t=Symbol("secret backend session mount");e.epoch=t,e.publish(null);const n=Ht.onLock(()=>{const t=e.current;t&&$O(e,t,!0)});return()=>{if(e.epoch!==t)return;e.epoch=null,n();const r=e.current;r&&$O(e,r)}},[]);const i=Ce.useCallback(e=>function(e,t){const n=new AbortController,r={epoch:e.epoch,controller:n,closed:!1,accepted:!1,signals:[],detachPending:()=>t?.removeEventListener("abort",i),detachHandle:()=>{},attempt:{signal:n.signal,current:()=>!!r.epoch&&e.epoch===r.epoch&&e.current===r&&!r.closed&&!n.signal.aborted&&(r.accepted||!t?.aborted)&&r.signals.every(e=>!e.aborted)}},i=()=>$O(e,r);if(e.owners.set(r.attempt,r),!e.epoch||t?.aborted)return $O(e,r),r;const a=e.current;return e.current=r,e.epoch&&e.publish(e=>e?.owner===a?null:e),a&&$O(e,a),r.attempt.current()&&t?.addEventListener("abort",i,{once:!0}),r.attempt.current()||$O(e,r),r}(r.current,e).attempt,[]),a=Ce.useCallback((e,t)=>function(e,t,n){const r=e.owners.get(t);if(r?.accepted&&r.handle===n)return!1;if(!r||!t.current()||r.handle)return zO(e,n),!1;r.handle=n,r.detachPending(),r.signals=[n.signal,n.session.signal].filter(e=>void 0!==e);const i=()=>$O(e,r,!0);r.detachHandle=()=>{for(const e of r.signals)e.removeEventListener("abort",i)};for(const a of r.signals){if(r.closed)break;a.addEventListener("abort",i,{once:!0})}return t.current()?(r.accepted=!0,e.publish({owner:r,handle:n,key:++e.sequence}),!0):($O(e,r),!1)}(r.current,e,t),[]),o=Ce.useCallback(e=>{const t=r.current.owners.get(e);t&&!t.accepted&&$O(r.current,t)},[]),s=Ce.useCallback(()=>{const e=r.current.current;e&&$O(r.current,e)},[]);return{active:t?.handle??null,activeKey:t?.key??0,begin:i,accept:a,end:o,disconnect:s}}(n.clear),i=(e=t.draft)=>({...e,file:t.file??void 0,filePassword:"file-import"===e.mode?t.password:void 0,masterPassword:"bitwarden-api"===e.mode?t.password:void 0});function a(e){n.run(async n=>{const a=r.begin(n.signal),o=()=>n.current()&&a.current();if(a.current())try{const n=t.saved?.connectionId,s=n?NO.readSecretBackendConnection(n):null,c=n&&s&&!["file-import","bitwarden-api"].includes(s.mode)?n:i(s??t.draft),l=r.accept(a,await async function(e,t,n,r){if(r){if(!t)throw new Error("Save this encrypted remote configuration first.");return NO.initializeSecretBackend(t,n)}return NO.connectSecretBackend(e,t,n)}(c,n,a.signal,e));return l&&o()?"Secret backend session connected":void 0}catch(s){if(a.current())throw s;return}finally{o()&&t.setPassword(""),r.end(a)}})}return{...t,...n,...r,...PO(t,n,e),probe:function(){n.run(async e=>{try{return await NO.probeSecretBackend(i(),t.saved?.connectionId,e.signal),e.check(),"Secret backend connection verified"}finally{e.current()&&t.setPassword("")}})},connect:()=>a(!1),initialize:()=>{t.saved&&a(!0)},disconnect:function(){r.disconnect(),n.clear(),t.setFile(null),t.setPassword("")}}}(e),{active:i,saved:a}=r;Ce.useLayoutEffect(()=>{if(we()){const e=i?t.current?.querySelector('[aria-label="Secret backend items"]'):n.current?t.current?.querySelector('[aria-label="Secret backend session"]'):a?t.current?.querySelector('[aria-label="Secret backend configuration"] form'):t.current;ve(ye(e))}n.current=!!i},[i,a]);const{setFile:o,setPassword:s,setDraft:c,clear:l}=r;return Ce.useEffect(()=>Ht.onLock(()=>{o(null),s(""),c(e=>({...e,token:"",clientSecret:"",encryptionKey:""})),l()}),[o,s,c,l]),Ee.jsxs("div",{className:"cx-setup",ref:t,children:[Ee.jsx(RO,{editor:r,provider:e.provider,online:e.online}),Ee.jsx(kO,{draft:{mode:r.draft.mode,baseUrl:r.draft.baseUrl,identityUrl:r.draft.identityUrl},online:e.online,busy:r.busy||!!r.active}),Ee.jsx(LO,{editor:r}),r.active?Ee.jsx(TO,{handle:r.active,onFlash:e.onFlash},r.active.session.id):null,r.active?Ee.jsx(Qk,{handle:r.active,onFlash:e.onFlash},`backup-${r.active.session.id}`):null,"1password"===e.provider.id?Ee.jsx(dO,{onFlash:e.onFlash}):null,Ee.jsx(q,{id:`secret-backend-${e.provider.id}`,title:e.provider.displayName,message:r.failure})]})}function DO(e){const{provider:t,connection:n}=e;return"github"===t.id?Ee.jsx(yA,{...e}):Ee.jsxs(Ee.Fragment,{children:[Ee.jsx(CI,{...e},t.id),"active"===n?.status&&Kl(t)?Ee.jsx(aN,{providerId:t.id,providerName:t.displayName,connectionId:n.connectionId}):null]})}function qO(e){const{provider:t,connection:n,nativeExperience:r,identityExperience:i}=e;if("boat"===t.id&&!rO(n))return Ee.jsx(MA,{connection:n,onFlash:e.onFlash,onChanged:e.onChanged});if("tailscale"===t.id&&!rO(n))return Ee.jsx(S$,{...e});if("linear"===t.id)return Ee.jsx(aO,{...e});const a=function(e){return e&&!rO(e)?wA(e.connectionId):null}(n);return!sd(t.id)||rO(n)||n&&!a?Ba(t.id)&&!rO(n)?Ee.jsx(UO,{...e},`${t.id}/${n?.connectionId??"new"}`):i?Ee.jsx(l$,{...e},`${t.id}/${n?.connectionId??"new"}`):Ee.jsx(r?DO:KO,{...e}):Ee.jsx(MO,{...e})}function MO({provider:e,connection:t,onFlash:n,onChanged:r}){return Ee.jsx(pz,{providerId:e.id,connectionId:t?.connectionId,onFlash:n,onChanged:r},`${e.id}/${t?.connectionId??"new"}`)}function KO(e){const{onConnect:t,deviceSeal:n,connection:r}=e;return t&&(!n||I_(r)||rO(r))?Ee.jsx(aO,{...e}):null}function FO(e,t){if("native-local"===e.configuration.method)return{tone:"ok",label:"Browser configuration verified",sentence:"Browser configuration verified on this device."};const n=e.identity;let r=`${t.displayName} access verified.`,i="Access verified";if("account-verified"===n?.assurance?(r=`Account verified: ${n.label}.`,i="Connected"):"workspace-verified"===n?.assurance&&(r=`Workspace verified: ${n.label}.`,i="Connected"),e.grants.length){const t=e.grants.flatMap(e=>null===e.expiresAt?[]:[e.expiresAt]);r+=t.length?` Next reported token expiry: ${new Date(Math.min(...t)).toISOString()}.`:" The provider did not report token expiry."}return{tone:"ok",label:i,sentence:r}}function GO(e,t){return"native-local"===e?.configuration.method?{tone:"warn",label:"Configuration validation pending",sentence:"Validate this configuration locally; provider access is not checked."}:{tone:"warn",label:"Verification pending",sentence:t??"Provider verification is required before using this connection."}}function BO(e,t){if("tailscale"===t.id)return function(e){if(e&&"tailscale"!==e.providerId)return null;const t=gt(),n=e?.connectionId??t?.connectionId,r=Si().find(e=>e.connectionId===n);return e&&e.connectionRef!==`local/connector/${e.connectionId}`||void 0!==r?.fields.native_configuration&&void 0===r.fields.tailscale_browser_node?null:{tone:(i=!!t?.connected&&t.connectionId===n&&void 0!==r?.fields.tailscale_browser_node)?"ok":"idle",label:i?"Browser node connected":"Browser node not connected",sentence:i?"This browser node is authenticated to its tailnet.":"Connect this browser node to Tailscale."};var i}(e);if(!e||!Si().some(t=>t.connectionId===e.connectionId&&void 0!==t.fields.native_configuration))return null;const n=on(e.connectionId);if(void 0!==n?.configuration.parameters.ai_contract)return function(e,t,n){const r=wt.authorization(n);return"active"===r?.status&&"connected"===e.status&&null!==e.verifiedAt?FO(e,t):{tone:"warn",label:"Verification pending",sentence:r?.statusDetail??"Verify this AI connection in its owning vault."}}(n,t,e.connectionId);if(n&&"cleanup"!==n.status){const e=In(n.providerId,n.configuration.method,n.configuration.parameters);if(!e.available)return{tone:"warn",label:"Browser route unavailable",sentence:e.reason??"This provider route is unavailable in this browser."}}return"active"!==e.status?GO(n,e.statusDetail):n&&"connected"===n.status&&null!==n.verifiedAt?FO(n,t):GO(n)}function VO(e,t,n,r,i,a=!0){if(!a&&null===t&&0===n.length)return{tone:"idle",label:"Not available here"};if("github"===e.id){if(null!==t&&!r)return{tone:"warn",label:"Needs a backup repository"};if(null!==t)return{tone:Re(Ea[Aa(t.status)]),label:Ca[Aa(t.status)]};if(i||e.configured)return{tone:"ok",label:"GitHub App ready"}}if(n.length>1&&!t)return{tone:"idle",label:`${n.length} authorizations`};const o=Na(e,t);return{tone:Re(Ea[o]),label:Ca[o]}}function HO({connection:e,provider:t,ceremonyRoot:n}){const r=_a[e.status],i=t?BO(e,t):null;return Ee.jsxs("li",{className:"conn-service",children:[Ee.jsxs("div",{className:"conn-service__copy",children:[Ee.jsx("h3",{children:e.displayName}),Ee.jsx("p",{children:i?.sentence??Sa(e,t)})]}),Ee.jsxs("div",{className:"conn-service__actions",children:[Ee.jsx(Oe,{tone:i?.tone??Re(r.tone),label:i?.label??r.label}),Ee.jsx(ze,{className:"btn btn--sm",to:ka(e.providerId,e.connectionId,n),"aria-label":`Settings for ${e.displayName}`,children:"Open"})]})]})}function JO({offer:e,onFlash:t,onDismiss:n}){const{items:r}=Ot(),i=Et(),[a,o]=Ce.useState(!1);return za(r,e.connection)?null:Ee.jsxs("output",{className:"note note--ok",children:[Ee.jsx(de,{}),Ee.jsxs("span",{children:["Saved ",e.provider.displayName,". Add a vault reminder that points at the ConnectionRef — not the token?"]}),Ee.jsx("button",{type:"button",className:"btn btn--sm btn--primary",disabled:a,onClick:()=>{!async function(){o(!0);try{await i.addItems([$a(e.provider,e.connection)]),t({tone:"ok",text:`Connection saved. Added a vault reminder for ${e.provider.displayName}. The credential itself is not stored in the vault.`}),n()}catch(r){t({tone:"err",text:Ia(r)})}finally{o(!1)}}()},children:"Remember in vault"}),Ee.jsx("button",{type:"button",className:"btn btn--sm",onClick:n,children:"Not now"})]})}const WO=()=>null,ZO=()=>()=>{};function XO(e){return e?[...e.filter(e=>e.connectionRef!==`local/connector/${e.connectionId}`),...Si().map(vt)]:null}function YO(e){const t=Ce.useSyncExternalStore(mt,ht,WO),n=Ce.useSyncExternalStore(t?.subscribe??ZO,t?.snapshot??WO,WO);Ce.useEffect(()=>{e?.(n)},[e,n]),Ce.useEffect(()=>e?Ei(()=>e(n)):void 0,[e,n])}function QO({provider:e,providers:t,providerId:n,connection:r,connections:i,loading:a,online:o,canConfigure:s,configureHint:c,flash:l,rememberOffer:d,onFlash:u,onRememberOffer:p,onChanged:h}){const f=function(e,t){return YO(),t?BO(e,t):null}(r,e),{pathname:m}=Te(),g=Ne(),w=null===e?void 0:Lc(e.id),v=function(e,t){return t?t.members.map(t=>{const n=Ve(t),r=e.find(e=>e.id===t||void 0!==n&&Ve(e.id)===n);return{id:t,label:r?.displayName??He(t)?.displayName??t}}):[]}(t??[],w),y=Pa(m),b=Dt("connections.back"),k=Dt("connections.authorize"),[x,I]=Ce.useState(!1),j=Ce.useCallback(e=>{I(e)},[]),_=Ce.useSyncExternalStore(bo,()=>"github"===n?lo():null,()=>null),S=ja(),A=null!==e&&i$(e.id)&&!rO(r),T=null!==e&&Ba(e.id)&&!rO(r),N=!e||A||T?null:function(e,t){return"linear"===e.id&&null!==t&&I_(t)&&!ot(t)?null:jI(e)}(e,r),z=null!==N&&!rO(r),$=e?jn(e.displayName,z?"github"===e.id?"https://docs.github.com/en/apps":N.docsUrl??e.docsUrl:io(e.id)?.docsUrl??e.docsUrl):null;if(Ce.useEffect(()=>{z||null===_||"err"!==l?.tone||u(null)},[z,_,l,u]),!e)return Ee.jsxs("div",{className:"section__inner",children:[Ee.jsxs(ze,{ref:b,className:"conn-back",to:y,children:[Ee.jsx(Se,{size:16})," Connections"]}),"github"===n?Ee.jsx($S,{connection:r,online:o,onFlash:u,onReady:j}):null,Ee.jsx("div",{className:"panel",children:Ee.jsxs("div",{className:"empty",children:[Ee.jsx(R,{}),Ee.jsx("h1",{children:a?"Loading connector settings…":"Connector not found"})]})})]});const P=f??(z?{tone:"idle",label:N.methods.some(e=>e.available)?"Not connected":"Not available here",sentence:`${"github"===e.id?"App or token":RI(e)} · ${ya[e.category]}`}:null),O=function(e){return e.autoConfigurable}(e),L=function(e){return C(e)?!E(e)||nt(e)?"beside":"only":null}(e.id),U="api_key"===e.authKind||"configuration"===e.authKind,D="github"===e.id&&(null!==_||e.configured);return Ee.jsxs("div",{className:"section__inner conn-settings",children:[Ee.jsxs(ze,{ref:b,className:"conn-back",to:y,children:[Ee.jsx(Se,{size:16})," Connections"]}),w&&v.length>1?Ee.jsxs("div",{className:"field conn-settings__family",children:[Ee.jsxs("label",{htmlFor:"connector-api-family",children:[w.name," API"]}),Ee.jsx("select",{id:"connector-api-family",value:Ve(e.id)??e.id,onChange:e=>g(ka(e.target.value)),children:v.map(e=>Ee.jsx("option",{value:e.id,children:e.label},e.id))})]}):null,Ee.jsxs("header",{className:"conn-settings__head",children:[Ee.jsx(Ri,{providerId:e.id,displayName:e.displayName,size:44}),Ee.jsxs("div",{className:"conn-settings__title",children:[Ee.jsxs("div",{className:"conn-settings__name",children:[Ee.jsx("h1",{children:e.displayName}),Ee.jsx(Oe,{...P??VO(e,r,i,x,null!==_,S.acts(e))}),Ki(e.id)?Ee.jsx(Fi,{providerId:e.id,displayName:e.displayName}):null,"github"!==e.id||null===_||z?null:Ee.jsx(xS,{})]}),Ee.jsx("p",{children:P?.sentence??(r?Sa(r,e):`${RI(e)} · ${ya[e.category]}`)})]}),$?Ee.jsxs("a",{className:"btn btn--sm btn--ghost",href:$.url,target:"_blank",rel:"noreferrer noopener",title:$.label,children:[$.short," ",Ee.jsx(M,{size:14})]}):null]}),l?Ee.jsx(Oe,{tone:"ok"===l.tone?"ok":"warn"===l.tone?"warn":"err",label:l.text}):null,"github"!==n||z?null:Ee.jsx($S,{connection:r,online:o,onFlash:u,onReady:j}),"github"!==n&&!z&&nt(n)?Ee.jsxs("section",{className:"panel","data-testid":"forge-backup-sync",children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsx("h2",{children:"Backup"})}),Ee.jsx("div",{className:"panel__body",children:Ee.jsx(C_,{providerId:n})})]}):null,d?Ee.jsx(JO,{offer:d,onFlash:u,onDismiss:()=>p(null)}):null,z||A||T||(q=e.id,(sd(q)||"tailscale"===q||"boat"===q)&&!rO(r))?null:O?Ee.jsxs("section",{className:"panel",id:"authorization",ref:k,children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsx("div",{children:Ee.jsx("h2",{children:"Authorization"})})}),Ee.jsx("div",{className:"panel__body",children:Ee.jsx("p",{className:"hint",children:"Built in."})})]}):I_(r)?null:r?Ee.jsxs("section",{className:"panel",id:"authorization",ref:k,children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsx("h2",{children:"Authorization"})}),Ee.jsx("ul",{className:"conn-list",children:Ee.jsx(kS,{connection:r,provider:e,online:o,onFlash:e=>u(e),onChanged:h,onBackupReady:j,hideRepository:null!==_})}),s&&nt(e.id)?Ee.jsxs("details",{className:"conn-add-authorization",children:[Ee.jsx("summary",{children:"Add another authorization"}),Ee.jsx(Rl,{provider:e,online:o,onFlash:e=>u(e),onConnected:h,onRememberOffer:t=>p({provider:e,connection:t})})]}):null]}):i.length>1?Ee.jsxs("section",{className:"panel",id:"authorization",ref:k,children:[Ee.jsx("div",{className:"panel__head",children:Ee.jsx("div",{children:Ee.jsx("h2",{children:"Authorizations"})})}),Ee.jsx("ul",{className:"conn-list",children:i.map(t=>Ee.jsx(HO,{connection:t,provider:e,ceremonyRoot:y},t.connectionId))}),s&&(e.configured||nt(e.id))&&ss(e)&&!D?Ee.jsxs("details",{className:"conn-add-authorization",children:[Ee.jsx("summary",{children:"Add another authorization"}),Ee.jsx(Rl,{provider:e,online:o,onFlash:e=>u(e),onConnected:h,onRememberOffer:t=>p({provider:e,connection:t})})]}):null]}):D||"only"===L&&!U?null:Ee.jsx(q_,{provider:e,online:o,canConfigure:s,configureHint:c,authorizeRef:k,onFlash:e=>u(e),onChanged:h,onRememberOffer:t=>p({provider:e,connection:t})}),Ee.jsx(qO,{provider:e,connection:r,online:o,onFlash:u,onChanged:h,identityExperience:A,secretBackendExperience:T,nativeExperience:z,onConnect:L,deviceSeal:U})]});var q}const eR=/^https:\/\/[^/?#]*/;function tR(e,t){return Wv(Ia(e),t.credentials)}function nR({test:e,disabled:t,onTest:n}){const r=function(e){return"passed"===e.kind?{tone:"ok",label:e.label}:"failed"===e.kind?{tone:"err",label:e.text}:null}(e);return Ee.jsxs("div",{className:"ai-sheet__test",children:[Ee.jsx(B,{label:"Test connection",disabled:t,onClick:n,children:Ee.jsx(ce,{size:16})}),r?Ee.jsx(Oe,{tone:r.tone,label:r.label}):null]})}function rR({target:e,onClose:t,onConnected:n,onFlash:r}){const{provider:i,method:a}=e,o=function({target:e,onConnected:t,onFlash:n}){const{provider:r,descriptor:i,method:a}=e,o=Ce.useMemo(()=>_x({id:r.id,refused:Oa(r.id)?.refused??!1}),[r.id]),[s,c]=Ce.useState(i.name),[l,d]=Ce.useState(()=>my(a)),[u,p]=Ce.useState(!1),[h,f]=Ce.useState({kind:"idle"}),[m,g]=Ce.useState(""),w=!u&&""!==s.trim()&&!Jv(a.fields,l),v=()=>function(e,t,n){return{method:"api-key",displayName:e.trim(),parameters:Hv(t.fields,n,!1),credentials:Hv(t.fields,n,!0),requestedScopes:{},targetIds:{}}}(s,a,l);return{name:s,values:l,busy:u,ready:w,test:h,failure:m,canTest:void 0!==o.test,setName:e=>{c(e),g("")},setValue:(e,t)=>{d(n=>Bv(a.fields,n,e,t)),f({kind:"idle"}),g("")},runTest:async function(){if(!o.test||!w)return;const e=v();p(!0),g(""),f({kind:"testing"});try{const t=await o.test(e);f({kind:"passed",label:t.label})}catch(t){const r=tR(t,e);f({kind:"failed",text:r}),n({tone:"err",text:r})}finally{p(!1)}},save:async function(){if(!w)return;const e=v();p(!0),g("");try{const a=await o.configure(e);if(a.providerId!==r.id)throw new Error("Provider returned a different connection.");const s=function(e,t){return Zv(e)?{tone:"ok",text:`${t} access verified and saved on this device.`}:{tone:"warn",text:`Verify ${t} to connect.`}}(a,i.name);Zv(a)?t(s):n(s)}catch(a){const t=tR(a,e);g(t),f({kind:"failed",text:t}),n({tone:"err",text:t})}finally{p(!1)}}}}({target:e,onConnected:n,onFlash:r}),s=Ce.useRef(null),c=Ce.useRef(null);Ce.useLayoutEffect(()=>{window.matchMedia?.("(pointer: coarse)").matches||(c.current=s.current?.querySelector("input[type=password]")??null)},[]);const l=function(e,t){try{const n=Rd(e,t),r=eR.exec(n.profile.verify?.url??"")?.[0];return r?Md(r,n,{}).host:null}catch{return null}}(i.id,Hv(a.fields,o.values,!1)),d=Gl(i.id),u=[...l?[{key:"Sent to",value:l}]:[],...d?[{key:"Speaks",value:d}]:[],{key:"Kept",value:"sealed on this device"}];return Ee.jsx(Ks,{title:"Connect a model provider",mark:Ee.jsx(R,{size:20}),onClose:t,initialFocus:c,children:Ee.jsx("form",{"aria-label":`Connect ${i.displayName}`,onSubmit:e=>{e.preventDefault(),o.save()},children:Ee.jsxs(Le,{ok:""===o.failure,name:i.displayName,facts:u,primary:{label:"Save connection",submit:!0,busy:o.busy,disabled:!o.ready,onClick:()=>{o.save()}},children:[Ee.jsx(O,{id:"ai-provider-name",label:"Name",autoComplete:"off",value:o.name,disabled:o.busy,onValueChange:o.setName}),Ee.jsx("div",{ref:s,children:Ee.jsx(py,{fields:a.fields,values:o.values,onChange:o.setValue})}),o.canTest?Ee.jsx(nR,{test:o.test,disabled:!o.ready,onTest:()=>{o.runTest()}}):null]})})})}function iR(e){return sd(e.target.provider.id)?Ee.jsx(aR,{...e}):Ee.jsx(rR,{...e})}function aR(e){const t=Ce.useRef(null),n=Ce.useRef(null);return Ce.useLayoutEffect(()=>{window.matchMedia?.("(pointer: coarse)").matches||(n.current=t.current?.querySelector('input[type="password"]')??null)},[]),Ee.jsx(Ks,{title:"Connect a model provider",mark:Ee.jsx(R,{size:20}),onClose:e.onClose,initialFocus:n,children:Ee.jsx("div",{ref:t,children:Ee.jsx(pz,{providerId:e.target.provider.id,inSheet:!0,onFlash:e.onFlash,onChanged:()=>e.onConnected({tone:"ok",text:"AI connection verified and saved in this vault."})})})})}const oR=Ur({issuer:qr().url(),authorization_endpoint:qr().url(),token_endpoint:qr().url(),token_endpoint_auth_methods_supported:Gr(qr()),code_challenge_methods_supported:Gr(qr()),client_id_metadata_document_supported:Dr(!0),revocation_endpoint:qr().url().optional()}),sR=Ur({client_id:qr().url(),client_name:qr().min(1).max(200),redirect_uris:Gr(qr().url()),token_endpoint_auth_method:Dr("none"),client_secret:Hr().optional(),jwks:Hr().optional(),jwks_uri:Hr().optional(),grant_types:Gr(qr()),response_types:Gr(qr())});function cR(e=$n()){const t=new URL(e);if("https:"!==t.protocol||t.username||t.password||t.search||t.hash)throw new Error("CIMD authorization requires a public HTTPS deployment with its registered callback");return new URL("native-client.json",t).href}async function lR(e,t,n){const r=zr(e.providerId);if("cimd"!==r.mode)return;const i=cR(t);if(e.clientId!==i)throw new _r("provider");const a=Ir(r,e),o=`${a.issuer}/.well-known/oauth-authorization-server`,s=new Headers({accept:"application/json"});try{const e=oR.parse(await mr({url:o,method:"GET",headers:s},n));if(e.issuer!==a.issuer||e.authorization_endpoint!==a.authorization||e.token_endpoint!==a.token||!e.token_endpoint_auth_methods_supported.includes("none")||!e.code_challenge_methods_supported.includes("S256"))throw new _r("provider");const r=sR.parse(await mr({url:i,method:"GET",headers:s},n));if(r.client_id!==i||!r.redirect_uris.includes(t)||!r.grant_types.includes("authorization_code")||!r.response_types.includes("code"))throw new _r("provider")}catch{throw new _r("provider")}}async function dR(e,t,n=t.transport??Gt()){if(function(e,t){if(["exchange","refresh"].includes(e.credentials?.phase??"")&&(Number(e.credentials?.deadline)>Date.now()||vn(t.connectionId,e.id)))throw new _r("cleanup")}(e,t),"discord"===e.providerId)return function(e,t){if("discord"!==e.providerId||"revoke"!==e.kind||vn(t.connectionId,e.id))throw new _r("cleanup");if(!e.grant&&!["exchange-unobserved","exchange-denied"].includes(e.credentials?.phase??""))throw new _r("cleanup");if(e.grant&&("https://discord.com"!==e.grant.issuer||"https://discord.com/api/oauth2/token"!==e.grant.endpoint||e.grant.clientId!==t.configuration.clientId||e.grant.fingerprint!==t.configuration.fingerprint))throw new _r("cleanup");return"local-credential-forgotten"}(e,t);if("databricks"===e.providerId)return async function(e,t,n){if("databricks"!==e.providerId||"revoke"!==e.kind||vn(t.connectionId,e.id))throw new _r("cleanup");const r=e.grant;if(!r){if(!["exchange-unobserved","exchange-denied"].includes(e.credentials?.phase??""))throw new _r("cleanup");return"local-credential-forgotten"}const i=$r(t.configuration.parameters.domain??"");if(r.issuer!==i.issuer||r.endpoint!==i.token||r.clientId!==t.configuration.clientId||r.fingerprint!==t.configuration.fingerprint)throw new _r("cleanup");return async function(e,t,n,r,i){const a=e.credentials?.integration_id??t.configuration.parameters.integration_id;if(a){if(!/^[A-Za-z0-9_-]{1,128}$/.test(a))throw new _r("provider");n.assertCurrent();const e=await n.fetch(`${new URL(r).origin}/api/2.0/oauth-app-integrations/${encodeURIComponent(a)}/user-consent/me`,{method:"DELETE",headers:new Headers({authorization:`Bearer ${i}`,accept:"application/json"}),mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer",signal:AbortSignal.timeout(15e3)});if(n.assertCurrent(),e.redirected||!e.ok)throw new _r("cleanup")}return"local-credential-forgotten"}(e,t,n,i.token,r.accessToken)}(e,t,n);if("twitch"===e.providerId)return Tb(e,t,n);const r=zr(e.providerId);if(!e.grant)throw new _r("cleanup");return"settings"===r.revoke?"revoke"===e.kind?"local-credential-forgotten":async function(e,t,n){const r=e.grant;if(!r)throw new _r("cleanup");const i=new Map([["microsoft","https://graph.microsoft.com/v1.0/me"],["microsoft-teams","https://graph.microsoft.com/v1.0/me"],["spotify","https://api.spotify.com/v1/me"],["openrouter","https://openrouter.ai/api/v1/key"],["codeberg","https://codeberg.org/api/v1/user"],["crowdin","https://api.crowdin.com/api/v2/user"]]).get(e.providerId);if(!i)throw new _r("cleanup");r.refreshToken&&await async function(e,t,n){const r=e.grant;if(!r?.refreshToken)throw new _r("cleanup");const i=En(t.connectionId,e.id);try{let i;try{i=await ar(t.configuration,r.refreshToken,n)}catch(a){if(a instanceof _r&&"invalid_grant"===a.oauthError)return;throw new _r("cleanup")}const o={...r,accessToken:i.accessToken,refreshToken:i.refreshToken??r.refreshToken,expiresAt:i.expiresAt,scopes:i.scopes};try{await t.persistGrantRotation(o)}catch(a){throw Jn(t.connectionId,e.id,o,Sr),a}throw new _r("cleanup")}finally{i()}}(e,t,n);try{await mr({url:i,method:"GET",headers:new Headers({authorization:`Bearer ${r.accessToken}`})},n)}catch(a){if(a instanceof gr&&"authorization"===a.code)return"provider-revoked";throw new _r("cleanup")}throw new _r("cleanup")}(e,t,n):(await async function(e,t){const n=zr(e.providerId);if("refresh-grant"===n.revoke)return void(await async function(e,t){const n=e.grant,r=zr(e.providerId);if(!n?.refreshToken)throw new _r("cleanup");const i=new URLSearchParams({client_id:n.clientId??"",token:n.refreshToken,token_type_hint:"refresh_token"}),a=await Tr(r.revocationEndpoint??"",i,t,void 0,!1);if(a.status<200||a.status>=300)throw new _r("cleanup")}(e,t));if("dropbox"!==n.revoke)return void(await async function(e,t){const n=zr(e.providerId),r=e.grant;if(!r)throw new _r("cleanup");const i=function(e){if("auth0"!==e.providerId&&"okta"!==e.providerId)return null;if(!e.issuer)throw new _r("cleanup");const t=new URL(e.issuer),n=Lr(e.providerId,t.hostname);if(e.issuer!==n.issuer||e.endpoint!==n.token||!e.clientId)throw new _r("cleanup");return n.revocation}(r)??n.revocationEndpoint;if(!i)throw new _r("cleanup");const a=[...new Set([r.refreshToken,r.accessToken].filter(e=>!!e))];for(const o of a){const e=new URLSearchParams({token:o});["gitlab","workos","vercel","auth0","okta"].includes(n.id)&&e.set("client_id",r.clientId??"");const a=await Tr(i,e,t,void 0,!1);if(a.status<200||a.status>=300)throw new _r("cleanup")}}(e,t));const r=e.grant;if(!r)throw new _r("cleanup");const i=await Tr(n.revocationEndpoint??"","null",t,r.accessToken,!1);if(200!==i.status&&401!==i.status)throw new _r("cleanup")}(e,n),"provider-revoked")}const uR={capture:()=>Gt(),classification:Sr,prepare:Hn,cleanup:dR};async function pR(e,t,n,r,i){const a=function(e,t){return{kind:"oauth",providerId:e.providerId,actor:e.actor,fingerprint:e.fingerprint,targetId:e.targetId??e.providerId,issuer:e.issuer,endpoint:e.endpoint,clientId:e.clientId,accessToken:t.accessToken,refreshToken:t.refreshToken,scopes:t.scopes,expiresAt:t.expiresAt}}(n,r);try{await zn(e,t,a,Sr,{id_token:r.idToken??"",nonce:n.state,requested_scopes:JSON.stringify(n.scopes),protocol_valid:String(r.protocolValid)})}catch{return async function(e,t,n,r){const i=Cn(e);try{await dR({id:t,kind:["databricks","discord","twitch"].includes(n.providerId)?"revoke":"configure",providerId:n.providerId,actor:n.actor,fingerprint:n.fingerprint,targetId:n.targetId??n.providerId,grant:n},{connectionId:e,configuration:i.configuration,persistGrantRotation:async()=>{throw new _r("storage")}},r)}catch{throw new _r("cleanup")}throw new _r("storage")}(e,t,a,i)}}async function hR(e,t,n,r,i,a=!1){a||await pR(e,t,n,r,i);try{i.assertCurrent();const a=Cn(e),o=a.privateState.recovery.find(e=>e.id===t)?.grant;if(!o||o.accessToken!==r.accessToken||o.fingerprint!==n.fingerprint)throw new _r("storage");if(a.configuration.fingerprint!==n.fingerprint)throw new _r("expired");const s=await Eb(a.configuration,n,r,i),c=await Tn(e,t,s,Sr,i,{revision:a.revision,grant:o});return c.recovery.length?Nn(e,i):c}catch(o){try{i.assertCurrent()}catch{throw o}throw await Nn(e,i).catch(()=>{}),o}}async function fR(e,t=Gt(),n=Ln()){const r=On(t);r.assertCurrent();let i=null;try{const t=Wn(e);n.scrubCallback();const o=Zn(t.state);if(!o||"oauth"!==o.record.configuration.method)throw new _r("callback");Kv(o.record.configuration,r),i={connectionId:o.record.connectionId,state:o.pending.state},await lR(o.record.configuration,o.pending.redirectUri,r);const s=await Xn(e,Sr(o.record.configuration));i=null;const c=En(s.record.connectionId,s.obligation.id);try{const e=await sr(s.record.configuration,s.pending,s.code,r);return await hR(s.record.connectionId,s.obligation.id,s.pending,e,r)}catch(a){throw a instanceof Error&&await pb(s.record.connectionId,s.obligation.id,a),a}finally{c()}}finally{i&&await Yn(i.connectionId,i.state),n.scrubCallback()}}async function mR(e,t){if(t.aborted)throw new _r("denied");await new Promise((n,r)=>{const i=()=>{clearTimeout(a),r(new _r("denied"))},a=setTimeout(()=>{t.removeEventListener("abort",i),n()},e);t.addEventListener("abort",i,{once:!0})})}async function gR(e,t="user",n=mR,r=Gt()){const i=Nb(e);if("user"!==t||Object.keys(i.privateState.pending).length||i.privateState.recovery.length)throw new _r("cleanup");const a=Ln();if(!a.deviceConsent)throw new Error("This browser cannot display device authorization");const o=On(r);Kv(i.configuration,o);const s=Nr(zr("twitch"),i.configuration,t),c=await cr(i.configuration.clientId??"",s,o),l=await async function(e,t,n,r,i,a){const o=Nb(e),s=Date.now(),c={providerId:"twitch",actor:"user",fingerprint:o.configuration.fingerprint,targetId:o.runtime.identity?.id,clientId:o.configuration.clientId,issuer:"https://id.twitch.tv",endpoint:"https://id.twitch.tv/oauth2/token",state:hr(32),verifier:JSON.stringify(t.device_code).padEnd(43," "),redirectUri:n,createdAt:s,expiresAt:s+1e3*t.expires_in,scopes:r};return await tn(e,i,Sr(o.configuration),e=>{if(a.assertCurrent(),Object.keys(e.privateState.pending).length||e.privateState.recovery.length)throw new _r("cleanup");return e.privateState.pending.user=c,e.privateState.verification=null,e.privateState.recovery.push({id:`oauth:${c.state}`,kind:"revoke",providerId:"twitch",actor:"user",fingerprint:c.fingerprint,targetId:c.targetId??"twitch",issuer:c.issuer,endpoint:c.endpoint,clientId:c.clientId,credentials:{phase:"device-poll",deadline:String(c.expiresAt+15e3),identity_id:o.runtime.identity?.id??""}}),e}),c}(e,c,a.redirectUri,s,cn(i),o),d=En(e,`oauth:${l.state}`);let u=null;try{u=a.deviceConsent({verificationUri:c.verification_uri,userCode:c.user_code,state:l.state,expiresAt:l.expiresAt}),await async function(e,t,n,r,i,a){let o=1e3*n,s=0;const c=t.expiresAt-t.createdAt;for(;;){if(await zb(e,t,i),r.signal.aborted)throw new _r("denied");const n=Math.min(t.expiresAt-Date.now(),c-s);if(n<=0)throw new _r("expired");const d=Math.min(o,n);if(await a(d,r.signal),s+=d,await zb(e,t,i),r.signal.aborted)throw new _r("denied");let u;try{u=await lr(t.clientId??"",t.scopes,JSON.parse(t.verifier),i)}catch(l){const n=!(l instanceof _r&&["expired","denied"].includes(l.code));throw await $b(e,t,n),l}if("slow-down"===u.kind&&(o+=5e3),"token"!==u.kind)continue;const p={...i,assertCurrent:()=>{if(i.assertCurrent(),r.signal.aborted||Date.now()>=t.expiresAt)throw new _r("expired")}};return await hR(e,`oauth:${t.state}`,t,u.token,p),void r.close()}}(e,l,c.interval,u,o,n)}catch(p){throw await $b(e,l,!1),p}finally{u?.close(),d();const t=an(e);t?.privateState.recovery.some(e=>e.id===`oauth:${l.state}`)&&await Nn(e).catch(()=>{})}}async function wR(e,t=Gt()){t.assertCurrent();const n=$n();let r=Cn(e);if(Kv(r.configuration,t),"oauth"!==r.configuration.method||r.privateState.recovery.length||Object.keys(r.privateState.pending).length)throw new _r("cleanup");let i=r.privateState.grants.user;if(!i)throw new _r("expired");if(null!==i.expiresAt&&i.expiresAt<=Date.now()&&(await Pb(r,t),r=Cn(e),i=r.privateState.grants.user,!i))throw new _r("expired");const a=zr(r.configuration.providerId),o={...i,state:"0".repeat(43),verifier:"0".repeat(43),redirectUri:n,createdAt:Date.now(),expiresAt:Date.now()+6e5,scopes:Nr(a,r.configuration,"user")},s=await Eb(r.configuration,o,{accessToken:i.accessToken,refreshToken:i.refreshToken,expiresAt:i.expiresAt,scopes:i.scopes,protocolValid:!0},t,r.runtime.identity??void 0).catch(async n=>{throw n instanceof _r&&["expired","scope"].includes(n.code)&&await tn(e,cn(r),Sr(r.configuration),e=>(e.privateState.verification=null,e.runtime.verifiedAt=null,e.runtime.grants=e.runtime.grants.map(e=>({...e,needsReauth:!0})),e),t.assertCurrent),n});if(r.runtime.identity&&r.runtime.identity.id!==s.identity.id)throw new _r("provider");return function(e,t,n,r){return tn(e.connectionId,cn(e),Sr(e.configuration),e=>{r.assertCurrent();const i=Math.max(Date.now(),(e.runtime.verifiedAt??0)+1);return e.privateState.verification={fingerprint:e.configuration.fingerprint,verifiedAt:i,kind:"provider"},e.runtime={verifiedAt:i,identity:n.identity,targets:n.targets,grants:[{actor:"user",label:"Authorized user",permissionState:null===t.scopes?"provider-managed":"known",grantedScopes:t.scopes??[],expiresAt:t.expiresAt,needsReauth:!1}]},e},r.assertCurrent)}(r,i,s,t)}function vR(e,t){const n=AbortSignal.any([...e.signal?[e.signal]:[],...t?[t]:[]]),r=()=>{e.assertCurrent(),n.throwIfAborted()};return r(),Object.freeze({...e,signal:n,assertCurrent:r,fetch:(t,i)=>(r(),e.fetch(t,{...i,signal:AbortSignal.any([n,...t instanceof Request?[t.signal]:[],...i?.signal?[i.signal]:[]])}))})}function yR(e=Vt()){return{supports:e=>null!==xr(e),cleanup:{...uR,capture:()=>vR(e.capture())},configure:async t=>async function(e,t=Gt()){t.assertCurrent();const n=function(e){const t=zr(e.providerId),{client_id:n,...r}=e.parameters,i="cimd"===t.mode?cR():n?.trim()??"";if("cimd"===t.mode&&n&&n!==i)throw new Error("Use this deployment's public client metadata URL");if("oauth"!==e.method||Object.keys(e.credentials).length||!i&&"openrouter-key"!==t.mode)throw new Error("Register a public browser client; confidential credentials are not supported");if(Object.keys(r).some(e=>!t.publicParameters.includes(e)))throw new Error("Unknown browser provider parameter");if(Object.keys(e.requestedScopes).some(e=>"user"!==e))throw new Error("This provider supports delegated user permissions only");!function(e,t){"codeberg"===e&&ub(t)}(t.id,r);const a={version:1,providerId:e.providerId,method:"oauth",displayName:e.displayName.trim(),icon:e.icon??"",parameters:r,clientId:i||void 0,requestedScopes:e.requestedScopes,targetIds:e.targetIds,fingerprint:"0".repeat(64)};return a.requestedScopes={user:Nr(t,a,"user")},a}(e);Kv(n,t),n.fingerprint=await async function(e){const t=zr(e.providerId),n=(new TextEncoder).encode(JSON.stringify({providerId:t.id,method:"oauth",clientId:e.clientId,endpoints:Ir(t,e),scopes:e.requestedScopes,integrationId:e.parameters.integration_id,targetIds:e.targetIds}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",n))].map(e=>e.toString(16).padStart(2,"0")).join("")}(n),t.assertCurrent();const r=function(e,t){const n=e.connectionId?an(e.connectionId):null;if(e.connectionId&&(!n||n.configuration.providerId!==e.providerId||n.revision!==e.revision))throw new Error("Connector changed; reload before saving");if(n&&"oauth"!==n.configuration.method)throw new Error("Create a separate connector for a different authentication method");return n&&n.configuration.fingerprint!==t.fingerprint&&function(e){if(Object.keys(e.privateState.grants).length||Object.keys(e.privateState.pending).length||e.privateState.recovery.length)throw new Error("Finish provider authorization cleanup before changing this connector binding")}(n),n}(e,n),i=Sr(n);return r?tn(r.connectionId,cn(r),i,e=>(t.assertCurrent(),e.configuration=n,e),t.assertCurrent):hn({connectionId:`devconn_${crypto.randomUUID()}`,configuration:n,runtime:br(),privateState:kr()},i,t.assertCurrent)}(t,vR(e.capture())),authorize:async(t,n)=>async function(e,t="user",n=Gt()){const r=Cn(e);return Kv(r.configuration,n),"discord"===r.configuration.providerId?async function(e,t="user",n=Gt()){n.assertCurrent();const r=Cn(e),i=Ln();if("discord"!==r.configuration.providerId||"oauth"!==r.configuration.method||!r.configuration.clientId||!i.prepareImplicitAuthorization)throw new _r("provider");if(r.privateState.recovery.length)throw new _r("cleanup");const a=On(n),o=await i.prepareImplicitAuthorization("discord");try{const n=Date.now(),i={providerId:"discord",actor:t,fingerprint:r.configuration.fingerprint,targetId:r.runtime.identity?.id,clientId:r.configuration.clientId,issuer:"https://discord.com",endpoint:"https://discord.com/api/oauth2/token",state:o.state,verifier:hr(32),redirectUri:o.redirectUri,createdAt:n,expiresAt:n+6e5,scopes:Nr(zr("discord"),r.configuration,t)},c=Qn(i,r.runtime.identity?.id);await tn(e,cn(r),Sr(r.configuration),e=>(a.assertCurrent(),e.privateState.recovery.push(c),e.privateState.verification=null,e));const l=En(e,c.id),d=new URL("https://discord.com/oauth2/authorize");d.search=new URLSearchParams({response_type:"token",client_id:i.clientId??"",redirect_uri:i.redirectUri,state:i.state,scope:i.scopes.join(" "),prompt:"consent"}).toString();try{const t=await o.authorize(d.href,{expiresAt:i.expiresAt,retain:async t=>{await pR(e,c.id,i,t,a)}});await hR(e,c.id,i,t,a,!0)}catch(s){throw s instanceof Error&&await pb(e,c.id,s),s}finally{l()}}finally{o.close()}}(e,t,n):"twitch"===r.configuration.providerId?gR(e,t,void 0,n):"google"===r.configuration.providerId?async function(e,t="user",n=Gt()){n.assertCurrent();const r=Cn(e),i=r.configuration.clientId,a=Ln().googleToken;if("google"!==r.configuration.providerId||"oauth"!==r.configuration.method||!i||!a)throw new _r("provider");if(r.privateState.recovery.length)throw new _r("cleanup");const o=On(n),s=function(e,t,n){const r=Nr(zr("google"),e.configuration,t),i=Date.now();return{providerId:"google",actor:t,fingerprint:e.configuration.fingerprint,targetId:e.runtime.identity?.id,clientId:n,issuer:"https://accounts.google.com",endpoint:"https://oauth2.googleapis.com/token",state:hr(32),verifier:hr(32),redirectUri:$n(),createdAt:i,expiresAt:i+6e5,scopes:r}}(r,t,i),c=Qn(s,r.runtime.identity?.id);await tn(e,cn(r),Sr(r.configuration),e=>(o.assertCurrent(),e.privateState.recovery.push(c),e.privateState.verification=null,e));const l=En(e,c.id),d={};try{if(await a(i,s.scopes,async t=>{await pR(e,c.id,s,t,o),d.token=t},o.assertCurrent),!d.token)throw new _r("provider");await hR(e,c.id,s,d.token,o,!0)}catch(u){if(u instanceof _r&&"denied"===u.code&&!d.token){o.assertCurrent();const t=Cn(e);await tn(e,cn(t),Sr(t.configuration),e=>(e.privateState.recovery=e.privateState.recovery.filter(e=>e.id!==c.id||!!e.grant),e))}throw u}finally{l()}}(e,t,n):async function(e,t="user",n=Gt()){const r=Cn(e);if("oauth"!==r.configuration.method||r.privateState.recovery.length)throw new _r("cleanup");const i=On(n);Kv(r.configuration,i);const a=Ln(),o=zr(r.configuration.providerId);if("google-token"===o.mode)throw new Error("Use the Google browser token authorization popup");const s=Ir(o,r.configuration),c=Nr(o,r.configuration,t);await lR(r.configuration,a.redirectUri,i);const l=hr(32),d=hr(32),u=await pr(l),p=Date.now(),h={providerId:o.id,actor:t,fingerprint:r.configuration.fingerprint,targetId:r.runtime.identity?.id,issuer:s.issuer,endpoint:s.token,clientId:r.configuration.clientId,state:d,verifier:l,redirectUri:a.redirectUri,createdAt:p,expiresAt:p+6e5,scopes:c},f=new URL(s.authorization),m="openrouter-key"===o.mode?{callback_url:h.redirectUri,state:d,code_challenge:u,code_challenge_method:"S256"}:{response_type:"code",client_id:h.clientId??"",redirect_uri:h.redirectUri,state:d,code_challenge:u,code_challenge_method:"S256",scope:c.join(" ")};for(const[w,v]of Object.entries(m))f.searchParams.set(w,v);"dropbox"===o.id&&f.searchParams.set("token_access_type","online"),["microsoft","microsoft-teams","vercel","auth0","okta"].includes(o.id)&&f.searchParams.set("nonce",d),await tn(e,cn(r),Sr(r.configuration),e=>(i.assertCurrent(),e.privateState.pending[t]=h,e.privateState.verification=null,e),i.assertCurrent);const g=await async function(e,t,n,r,i){try{r.assertCurrent();const e="vercel"===t.providerId?await async function(e){!function(e){if(Ar.parse(e),"vercel"!==e.providerId||"user"!==e.actor||e.issuer!==xb||"https://api.vercel.com/login/oauth/token"!==e.endpoint||!e.clientId||!e.scopes.includes("openid")||e.scopes.some(e=>!Ib.some(t=>t===e)))throw new _r("provider")}(e);const t=function(e){const t=new URL(e);if("https:"!==t.protocol&&("http:"!==t.protocol||!["localhost","127.0.0.1","[::1]"].includes(t.hostname))||t.username||t.password||t.search||t.hash)throw new _r("callback");return t}(e.redirectUri),n=new URL("https://vercel.com/oauth/authorize"),r={response_type:"code",response_mode:"query",client_id:e.clientId??"",redirect_uri:t.href,state:e.state,nonce:e.state,code_challenge:await pr(e.verifier),code_challenge_method:"S256",scope:e.scopes.join(" ")};for(const[i,a]of Object.entries(r))n.searchParams.set(i,a);return n.href}(t):n;return i.authorize?await i.authorize(e,{state:t.state,expiresAt:t.expiresAt,signal:r.signal}):(i.navigate(e),null)}catch(a){throw await Yn(e,t.state),a}}(e,h,f.href,i,a);g&&await fR(g,i,a)}(e,t,n)}(t,n,vR(e.capture())),verify:async t=>wR(t,vR(e.capture())),invoke:async(t,n,r,i)=>async function(e,t,n={},r=Gt()){if(r.assertCurrent(),!["provider.read","provider.repositories.read","provider.guilds.read"].includes(t)||Object.keys(n).length)throw new Error("Select a supported provider operation");const i=on(e);if(!i||!["connected","reauthorize"].includes(i.status))throw new _r("expired");!function(e,t){if("provider.repositories.read"===t&&"codeberg"!==e)throw new _r("provider");if("provider.guilds.read"===t&&"discord"!==e)throw new _r("provider")}(i.providerId,t);const a=await wR(e,r);if("provider.guilds.read"===t){const t=Cn(e).privateState.grants.user;if(!t)throw new _r("expired");return async function(e,t){if("discord"!==e.providerId||"oauth"!==e.kind||"user"!==e.actor||"https://discord.com"!==e.issuer||"https://discord.com/api/oauth2/token"!==e.endpoint)throw new _r("provider");if(!e.scopes?.includes("guilds"))throw new _r("scope");return{label:"Discord servers (up to 200)",items:Gr(Ur({id:qr().regex(/^\d{1,32}$/),name:qr().min(1).max(1024)})).max(200).parse(await mr({url:"https://discord.com/api/v10/users/@me/guilds?limit=200",method:"GET",headers:new Headers({authorization:`Bearer ${e.accessToken}`,accept:"application/json"})},t)).map(t=>(wr(t.name,{access:e.accessToken}),{id:t.id,label:t.name,url:`https://discord.com/channels/${t.id}`}))}}(t,r)}if("provider.repositories.read"===t){const t=Cn(e).privateState.grants.user;if(!t)throw new _r("expired");return async function(e,t){if("codeberg"!==e.providerId||"oauth"!==e.kind||"user"!==e.actor||"https://codeberg.org"!==e.issuer||"https://codeberg.org/login/oauth/access_token"!==e.endpoint||null!==e.expiresAt&&e.expiresAt<=Date.now())throw new _r("provider");return{label:"Codeberg repositories (up to 100)",items:mb.parse(await wb("https://codeberg.org/api/v1/user/repos?limit=100",e,t)).map(t=>{const n=new URL(t.html_url);if("https://codeberg.org"!==n.origin||n.username||n.password||n.search||n.hash)throw new _r("provider");return wr(t.full_name,gb(e)),wr(n.href,gb(e)),{id:String(t.id),label:t.full_name,url:n.href}})}}(t,r)}return{label:a.identity?.label??"Provider account verified",items:[]}}(t,n,r,vR(e.capture(),i))}}async function bR(e){const t=await e.json();return ai(t)?t:{}}function kR(e){const t=e.access_token,n=e.token_type;if(!ni(t)||!ni(n))return null;const r={accessToken:t,tokenType:n};return ni(e.id_token)&&(r.idToken=e.id_token),ni(e.refresh_token)&&(r.refreshToken=e.refresh_token),si(e.expires_in)&&(r.expiresAt=new Date(Date.now()+1e3*e.expires_in).toISOString()),r}function xR(e,t){let n;try{n=new URL(e)}catch{throw new Error(`${t} must be an absolute URL`)}if("https:"!==n.protocol||n.username||n.password||n.hash)throw new Error(`${t} must be an HTTPS URL without credentials or fragment`);return n.href}function IR(e){let t="";for(const n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/u,"")}async function jR(e,t,n,r){const i=r.jwks?Qo(r.jwks):(await Mo(async()=>{const{createRemoteJWKSet:e}=await import("./index-B6LVfIPY.js").then(e=>e.i);return{createRemoteJWKSet:e}},__vite__mapDeps([0]))).createRemoteJWKSet(new URL(xR(e.jwksUri,"JWKS URI"))),a=await Zo(t,i,{issuer:e.issuer,audience:e.clientId});if(void 0!==n&&a.payload.nonce!==n)throw new Error("OIDC ID token nonce does not match")}function _R(e){return""!==e.tokenRelayUrl.trim()?xR(e.tokenRelayUrl,"Token relay URL"):xR(e.tokenEndpoint,"Token endpoint")}const SR="application/x-www-form-urlencoded";function AR(e,t,n){""===e.tokenRelayUrl.trim()&&("client_secret_post"===e.tokenAuth&&t.set("client_secret",e.clientSecret),"client_secret_basic"===e.tokenAuth&&(n.set("authorization",`Basic ${btoa(`${e.clientId}:${e.clientSecret}`)}`),t.delete("client_id")))}async function CR(e,t,n={}){if(Date.now()>=t.expiresAt)throw new Error("OIDC device code expired");const r=new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:t.deviceCode,client_id:e.clientId}),i=new Headers({"content-type":SR});AR(e,r,i);const a=await(n.fetchImpl??fetch)(_R(e),{method:"POST",redirect:"error",credentials:"omit",headers:i,body:r}),o=await bR(a);if("authorization_pending"===o.error)return{status:"pending",intervalSeconds:t.intervalSeconds};if("slow_down"===o.error)return{status:"pending",intervalSeconds:Math.min(t.intervalSeconds+5,60)};const s=a.ok?kR(o):null;if(!s)throw new Error(ni(o.error)?`OIDC device authorization failed: ${o.error}`:"OIDC device token response is invalid");return void 0!==s.idToken&&await jR(e,s.idToken,void 0,n),{status:"tokens",tokens:s}}function ER(e,t){return{...Qt("secret",e.name),value:JSON.stringify({...e,tokens:t??null}),fields:[{id:"issuer",name:"Issuer",value:e.issuer,hidden:!1},{id:"client_id",name:"Client ID",value:e.clientId,hidden:!1},{id:"callback",name:"Callback URL",value:e.callbackUrl,hidden:!1}]}}const TR={name:"",issuer:"",authorizationEndpoint:"",tokenEndpoint:"",jwksUri:"",deviceAuthorizationEndpoint:"",clientId:"",clientSecret:"",callbackUrl:"",tokenRelayUrl:"",scopes:["openid","profile","email"],tokenAuth:"client_secret_post"};function NR({editor:e}){const{config:t,set:n,busy:r,discover:i}=e;return Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-issuer",children:"Issuer URL"}),Ee.jsx("input",{id:"oidc-issuer",value:t.issuer,placeholder:"https://accounts.example.com",onChange:e=>n("issuer",e.target.value)})]}),Ee.jsx("button",{type:"button",className:"btn btn--sm",disabled:r,onClick:()=>{i()},children:"Discover endpoints"}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-authorization",children:"Authorization endpoint"}),Ee.jsx("input",{id:"oidc-authorization",value:t.authorizationEndpoint,onChange:e=>n("authorizationEndpoint",e.target.value)})]}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-token",children:"Token endpoint"}),Ee.jsx("input",{id:"oidc-token",value:t.tokenEndpoint,onChange:e=>n("tokenEndpoint",e.target.value)})]}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-jwks",children:"JWKS URI"}),Ee.jsx("input",{id:"oidc-jwks",value:t.jwksUri,onChange:e=>n("jwksUri",e.target.value)})]}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-device",children:"Device authorization endpoint"}),Ee.jsx("input",{id:"oidc-device",value:t.deviceAuthorizationEndpoint??"",onChange:e=>n("deviceAuthorizationEndpoint",e.target.value)})]})]})}function zR({editor:e}){const{config:t,set:n}=e;return Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-client",children:"Client ID"}),Ee.jsx("input",{id:"oidc-client",value:t.clientId,onChange:e=>n("clientId",e.target.value)})]}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-secret",children:"Client secret"}),Ee.jsx("input",{id:"oidc-secret",type:"password",value:t.clientSecret,onChange:e=>n("clientSecret",e.target.value)})]}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-callback",children:"Callback URL"}),Ee.jsx("input",{id:"oidc-callback",value:t.callbackUrl,placeholder:"https://your-tunnel.example/oidc/callback",onChange:e=>n("callbackUrl",e.target.value)})]}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-relay",children:"Token relay URL (optional)"}),Ee.jsx("input",{id:"oidc-relay",value:t.tokenRelayUrl,placeholder:"https://relay.example/oidc/token",onChange:e=>n("tokenRelayUrl",e.target.value)}),Ee.jsx("p",{className:"hint",children:"Use a relay you control to keep the client secret off this device. The relay receives the same authorization-code form and performs the exchange at the token endpoint."})]}),Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-scopes",children:"Scopes"}),Ee.jsx("input",{id:"oidc-scopes",value:t.scopes.join(" "),onChange:e=>n("scopes",e.target.value.split(/\s+/u).filter(Boolean))})]})]})}function $R({editor:e}){const{config:t,set:n}=e;return Ee.jsx(Ee.Fragment,{children:Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-auth",children:"Token endpoint authentication"}),Ee.jsxs("select",{id:"oidc-auth",value:t.tokenAuth,onChange:e=>{const t=e.target.value;"none"!==t&&"client_secret_basic"!==t&&"client_secret_post"!==t||n("tokenAuth",t)},children:[Ee.jsx("option",{value:"none",children:"Public client (PKCE)"}),Ee.jsx("option",{value:"client_secret_basic",children:"Client secret in HTTP Basic"}),Ee.jsx("option",{value:"client_secret_post",children:"Client secret in request body"})]})]})})}function PR({editor:e}){const{config:t,busy:n,start:r,device:i,startDevice:a,save:o,pending:s,callback:c,setCallback:l,finish:d,failure:u,saved:p}=e;return Ee.jsxs(Ee.Fragment,{children:[Ee.jsxs("div",{className:"button-row",children:[Ee.jsxs("button",{type:"button",className:"btn btn--sm btn--primary",disabled:n,onClick:()=>{r()},children:[Ee.jsx(Z,{size:14})," Start sign-in"]}),Ee.jsx("button",{type:"button",className:"btn btn--sm",disabled:n,onClick:()=>{o()},children:"Save encrypted"})]}),t.deviceAuthorizationEndpoint?Ee.jsx("button",{type:"button",className:"btn btn--sm",disabled:n,onClick:()=>{a()},children:"Use device code"}):null,i?Ee.jsxs("output",{className:"note note--ok",children:["Open ",i.verificationUri," and enter"," ",Ee.jsx("strong",{children:i.userCode}),". Waiting for approval…"]}):null,s?Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-callback-result",children:"Paste the callback URL"}),Ee.jsx("input",{id:"oidc-callback-result",value:c,onChange:e=>l(e.target.value)}),Ee.jsx("button",{type:"button",className:"btn btn--sm",disabled:n||!c,onClick:()=>{d()},children:"Complete exchange"})]}):null,u?Ee.jsx(Oe,{tone:"err",label:u}):null,p?Ee.jsx(Oe,{tone:"ok",label:"Sealed in the vault"}):null]})}function OR(){const e=function(){const e=Et(),{config:t,set:n,setConfig:r}=function(){const[e,t]=Ce.useState(TR);return{config:e,set:(e,n)=>t(t=>({...t,[e]:n})),setConfig:t}}(),[i,a]=Ce.useState(null),[o,s]=Ce.useState(null),[c,l]=Ce.useState(""),[d,u]=Ce.useState(null),[p,h]=Ce.useState(null),[f,m]=Ce.useState(!1),[g,w]=Ce.useState(!1);return{config:t,set:n,pending:i,device:o,startDevice:()=>async function(e,t,n){const{setBusy:r,setFailure:i,setDevice:a,setTokens:o,setSaved:s}=n;r(!0),i(null);try{const n=await async function(e,t=fetch){if(!e.deviceAuthorizationEndpoint)throw new Error("This issuer does not advertise device authorization");const n=new URLSearchParams({client_id:e.clientId,scope:e.scopes.join(" ")}),r=new Headers({"content-type":SR}),i=await t(xR(e.deviceAuthorizationEndpoint,"Device authorization endpoint"),{method:"POST",redirect:"error",credentials:"omit",headers:r,body:n});if(!i.ok)throw new Error(`OIDC device authorization failed (${i.status})`);const a=await bR(i),{device_code:o,user_code:s}=a,{verification_uri:c,expires_in:l,interval:d}=a;if(!(ni(o)&&ni(s)&&ni(c)&&si(l)))throw new Error("OIDC device authorization response is invalid");const u={deviceCode:o,userCode:s,verificationUri:xR(c,"Verification URI"),expiresAt:Date.now()+1e3*l,intervalSeconds:si(d)&&d>0?Math.min(d,60):5},p=a.verification_uri_complete;return ni(p)&&(u.verificationUriComplete=xR(p,"Verification URI complete")),u}(e);a(n),window.open(n.verificationUriComplete??n.verificationUri,"_blank","noopener,noreferrer");let r=n.intervalSeconds;for(;;){await new Promise(e=>setTimeout(e,1e3*r));const i=await CR(e,n);if("pending"!==i.status){o(i.tokens),await t.addItems([ER(e,i.tokens)]),s(!0),a(null);break}r=i.intervalSeconds}}catch(c){i(c instanceof Error?c.message:"Device authorization failed")}finally{r(!1)}}(t,e,{setBusy:m,setFailure:h,setDevice:s,setTokens:u,setSaved:w}),callback:c,setCallback:l,failure:p,busy:f,saved:g,discover:async function(){m(!0),h(null);try{const e=await async function(e,t=fetch){const n=xR(e,"Issuer").replace(/\/+$/u,""),r=await t(`${n}/.well-known/openid-configuration`,{redirect:"error",credentials:"omit"});if(!r.ok)throw new Error(`OIDC discovery failed (${r.status})`);const i=await bR(r);if(i.issuer!==n)throw new Error("OIDC discovery issuer does not match the configured issuer");const a=i.authorization_endpoint,o=i.token_endpoint,s=i.jwks_uri;if(!ni(a)||!ni(o)||!ni(s))throw new Error("OIDC discovery is missing an endpoint");const c={issuer:n,authorizationEndpoint:xR(a,"Authorization endpoint"),tokenEndpoint:xR(o,"Token endpoint"),jwksUri:xR(s,"JWKS URI")},l=i.device_authorization_endpoint;return ni(l)&&(c.deviceAuthorizationEndpoint=xR(l,"Device authorization endpoint")),c}(t.issuer);r(t=>({...t,...e}))}catch(e){h(e instanceof Error?e.message:"Discovery failed")}finally{m(!1)}},start:async function(){m(!0),h(null);try{const e=await async function(e){const{verifier:t,challenge:n}=await async function(){const e=IR(crypto.getRandomValues(new Uint8Array(32))),t=await crypto.subtle.digest("SHA-256",(new TextEncoder).encode(e));return{verifier:e,challenge:IR(new Uint8Array(t))}}(),r=IR(crypto.getRandomValues(new Uint8Array(16))),i=IR(crypto.getRandomValues(new Uint8Array(16))),a=new URL(xR(e.authorizationEndpoint,"Authorization endpoint"));return a.searchParams.set("response_type","code"),a.searchParams.set("client_id",e.clientId),a.searchParams.set("redirect_uri",e.callbackUrl),a.searchParams.set("scope",e.scopes.join(" ")),a.searchParams.set("state",r),a.searchParams.set("nonce",i),a.searchParams.set("code_challenge",n),a.searchParams.set("code_challenge_method","S256"),{url:a.href,pending:{state:r,nonce:i,codeVerifier:t,config:e}}}(t);a(e.pending),l(""),window.open(e.url,"_blank","noopener,noreferrer")}catch(e){h(e instanceof Error?e.message:"Could not start OIDC")}finally{m(!1)}},finish:async function(){if(i){m(!0),h(null);try{const n=await async function(e,t,n={}){const r=e.config,i=function(e,t){const n=new URL(e);if(n.searchParams.get("state")!==t)throw new Error("OIDC callback state does not match");const r=n.searchParams.get("error");if(r)throw new Error(`OIDC authorization failed: ${r}`);const i=n.searchParams.get("code");if(!i)throw new Error("OIDC callback has no authorization code");return i}(t,e.state),a=new URLSearchParams({grant_type:"authorization_code",code:i,redirect_uri:r.callbackUrl,client_id:r.clientId,code_verifier:e.codeVerifier}),o=new Headers({"content-type":SR});AR(r,a,o);const s=await(n.fetchImpl??fetch)(_R(r),{method:"POST",redirect:"error",credentials:"omit",headers:o,body:a});if(!s.ok)throw new Error(`OIDC token exchange failed (${s.status})`);const c=kR(await bR(s));if(!c)throw new Error("OIDC token response is invalid");return void 0!==c.idToken&&await jR(r,c.idToken,e.nonce,n),c}(i,c);u(n),await e.addItems([ER(t,n)]),w(!0),a(null)}catch(n){h(n instanceof Error?n.message:"OIDC exchange failed")}finally{m(!1)}}},save:async function(){m(!0),h(null);try{await e.addItems([ER(t,d??void 0)]),w(!0)}catch(n){h(n instanceof Error?n.message:"Could not save")}finally{m(!1)}}}}(),{config:t,set:n}=e;return Ee.jsxs("div",{className:"section__inner conn-settings",children:[Ee.jsxs(ze,{className:"conn-back",to:"/connections",children:[Ee.jsx(Se,{size:16})," Connections"]}),Ee.jsx("header",{className:"conn-settings__head",children:Ee.jsxs("div",{className:"conn-settings__title",children:[Ee.jsx("h1",{children:"Custom OIDC connector"}),Ee.jsx("p",{children:"Register an OIDC application with your provider, then keep its configuration sealed in this vault."})]})}),Ee.jsx("div",{className:"panel",children:Ee.jsxs("div",{className:"panel__body",children:[Ee.jsxs("div",{className:"field",children:[Ee.jsx("label",{htmlFor:"oidc-name",children:"Connection name"}),Ee.jsx("input",{id:"oidc-name",value:t.name,onChange:e=>n("name",e.target.value)})]}),Ee.jsx(NR,{editor:e}),Ee.jsx(zR,{editor:e}),Ee.jsx($R,{editor:e}),Ee.jsx(PR,{editor:e})]})})]})}function RR(e){const[t,n]=Ce.useState(null),r=t?.scope===e?t.value:null,i=Ce.useCallback(t=>n(null===t?null:{scope:e,value:t}),[e]);return Ce.useEffect(()=>{n(t=>t&&t.scope!==e?null:t)},[e]),[r,i]}function LR({connectionId:e,...t}){if("custom-oidc"===t.providerId)return Ee.jsx(OR,{});const n=e?t.connections.find(t=>t.connectionId===e)??null:1===t.connections.length?t.connections[0]??null:null;return Ee.jsx(QO,{...t,connection:n})}function UR(){const{providerId:e,connectionId:t}=$e(),{hash:i,search:a,pathname:o}=Te(),s=Ae(),c=Ce.useSyncExternalStore(f,T,T),l=Ie(),{tomb:d}=Ot(),u=function(e){const[t,n]=Ce.useState(null),[r,i]=Ce.useState(!1),a=Ce.useCallback(async()=>{if(e&&nj.tombUnlocked(e))try{n(await nj.readConnectorDirectory(e))}catch{n(null)}else n(null)},[e]);return Ce.useEffect(()=>(a(),fr(()=>{a()})),[a]),{record:t,busy:r,reload:a,resync:async function(n){if(t&&!r){i(!0);try{const r=await nj.syncConnectorDirectory({endpoint:t.endpoint,key:t.key,tomb:e}),i=r.connections.length;n({tone:"ok",text:`${i} ${1===i?"connector":"connectors"} imported from ${St(r.endpoint)}.`}),await a()}catch(o){n({tone:"err",text:o instanceof Error?o.message:"The directory did not answer."})}finally{i(!1)}}}}}(d),p=YI(),[h,m]=Ce.useState(!1),[g,w]=Ce.useState(null),[v,y]=function(){const e=Ce.useState(null),[,t]=e;return YO(Ce.useCallback(()=>t(XO),[t])),e}();Ce.useEffect(()=>{if((i.startsWith("#connected-")?null!==v:null!==g)&&!e&&/^#(?:attention|connected|catalog)(?:-|$)/.test(i)){const e=Vi("#catalog-more"===i?"#catalog":i);e&&Hi(e)}},[i,e,g,v]),function(e,t){Ce.useEffect(()=>{Ac({providers:e,connections:t})},[e,t]),Ce.useEffect(()=>()=>Ac(jc),[])}(g,v),Ge();const[b,k]=Ce.useState(null),[x,I]=Ce.useState(null),[j,_]=Ce.useState(!1),S=e??"connections",[A,C]=RR(S),[E,N]=RR(S);!function(e,t,n){Ce.useEffect(()=>{e&&"ok"!==e.tone?Pl(t,n,e.text,e.tone):Ol(t)},[e,t,n]),Ce.useEffect(()=>()=>Ol(t),[t])}(A,S,ql(g,e)?.displayName??"Connections");const z=Ce.useRef(0),$=Ce.useRef(0),P=Dt("connections.reload");Ce.useEffect(()=>{if(!window.opener)return;const e=new URLSearchParams(a).get("connection");e&&(window.opener.postMessage({type:"opensesame:connection",connectionId:e},window.location.origin),window.close())},[a]),Ce.useEffect(()=>(qt((v??[]).some(e=>"revoked"!==e.status)),()=>qt(!1)),[v]);const O=Ce.useCallback(async()=>{const e=++z.current;w(r.providers(Mt())),z.current===e&&k(null)},[]),R=b&&0===(g?.length??0)?b.message:null,L=Ce.useRef(!1);Ce.useEffect(()=>{R?(L.current=!0,Kt({id:"connections:catalog",tone:"err",title:"Built-in connector catalog unavailable",body:R,retry:()=>{O()},retryLabel:"Try catalog again"})):L.current&&(L.current=!1,Ft("connections:catalog"))},[R,O]);const U=Ce.useCallback(async()=>{const e=++$.current;_(!0);try{const t=await n();if($.current!==e)return;y(XO(t)),I(null)}catch(t){if($.current!==e)return;y(XO(Be([]))),I({message:Ia(t),unreachable:!1,setupRequired:!1})}finally{$.current===e&&_(!1)}},[y]);(function(e,t,n){const r=new URLSearchParams(e),i=r.has("linear_state"),a=r.has("native_state"),o=i&&a;!function(e,t,n){const r=Ne(),i=Ce.useRef(null);Ce.useEffect(()=>{new URLSearchParams(e).has("linear_state")&&i.current!==e&&(i.current=e,pP(e).then(async e=>{e&&(await t(),r(`/connections/linear/${e.connectionId}`,{replace:!0}),n({tone:"active"===e.status?"ok":"warn",text:"active"===e.status?`Linear connected to ${e.accountLabel??"your workspace"}.`:e.statusDetail??"Complete the remaining Linear authorization."}))}).catch(e=>{n({tone:"err",text:Ia(e)}),t()}))},[e,t,r,n])}(i&&!o?e:"",t,n),function(e,t,n){const r=Ne(),i=Ce.useRef(null),a=Ce.useRef(e);a.current=e;const o=Ce.useRef(!0);Ce.useEffect(()=>(o.current=!0,()=>{o.current=!1}),[]),Ce.useEffect(()=>{new URLSearchParams(e).has("native_state")&&i.current!==e&&(i.current=e,(async()=>{const i=er(e);if(!i)throw new Error("This provider callback has expired or was already used");if("mcp"!==i.method&&"oauth"!==i.method)throw new Error("This callback does not match a provider authorization method");const s="mcp"===i.method?tr:fR,c=await s(e);o.current&&a.current===e&&(await t(),o.current&&a.current===e&&(r(`/connections/${encodeURIComponent(i.providerId)}/${encodeURIComponent(i.connectionId)}`,{replace:!0}),n({tone:"connected"===c?.status?"ok":"warn",text:"connected"===c?.status?"Provider access verified and saved on this device.":"Complete provider authorization or recovery for this connection."})))})().catch(i=>{o.current&&a.current===e&&(r("/connections",{replace:!0}),n({tone:"err",text:Ia(i)}),t())}))},[e,t,r,n])}(a&&!o?e:"",t,n);const s=Ne(),c=Ce.useRef(null);Ce.useEffect(()=>{o&&c.current!==e&&(c.current=e,s("/connections",{replace:!0}),n({tone:"err",text:"This callback contains conflicting provider authorization states. Start authorization again."}))},[o,e,s,n])})(a,U,C),Ce.useEffect(()=>{O()},[O,l,e]),Ce.useEffect(()=>{U()},[U,p.held]);const D=function({providerId:e,connectionId:t,pathname:n,providers:r,connections:i,reload:a,onFlash:o}){const s=Ne(),c=ql(r,e),l=(i??[]).filter(t=>function(e,t){if(e===t)return!0;if(!t)return!1;const n=Ve(t);return void 0!==n&&Ve(e)===n}(t.providerId,e)&&"revoked"!==t.status),[d,u]=Ce.useState(null);!e&&d?u(null):e&&null!==i&&d?.providerId!==e&&u({providerId:e,onPage:l.length>0});const[p,h]=Ce.useState(null);Ce.useEffect(()=>{p&&(e?e!==p.providerId&&h(null):(o(p.flash),h(null)))},[p,e,o]);const f=e&&null!==i&&!0!==d?.onPage?function(e){const{provider:t}=e;if(!t||!Kl(t))return null;if(e.connectionId)return null;if(!e.pathname.startsWith("/connections/"))return null;if(e.connections.some(e=>"revoked"!==e.status))return null;const n=jI(t),r=n?.methods.find(e=>"api-key"===e.id&&e.available);return n&&r?{provider:t,descriptor:n,method:r}:null}({provider:c,connections:l,connectionId:t,pathname:n}):null;return{provider:c,providerConnections:l,target:f,close:()=>s("/connections"),connected:t=>{e&&h({providerId:e,flash:t}),a(),s("/connections")}}}({providerId:e,connectionId:t,pathname:o,providers:g,connections:v,reload:U,onFlash:C}),{provider:M,providerConnections:K}=D;return!e||"custom-oidc"!==e&&D.target?Ee.jsxs("div",{className:"section__inner",children:[Ee.jsx("header",{className:"section__head conn-head",children:Ee.jsxs("div",{className:"conn-head__titlerow",children:[Ee.jsx("h1",{children:"Connections"}),Ee.jsx("button",{ref:P,type:"button",className:"icon-btn",onClick:()=>{U()},disabled:j||!s,title:j?"Loading…":"Reload connections","aria-label":"Reload connections",children:Ee.jsx(V,{size:16})})]})}),Ee.jsx(Gi,{entries:il(g,v).flatMap(e=>"catalog"===e.id?[e,...e.sections??[]]:[e])}),A?Ee.jsx(Oe,{tone:"ok"===A.tone?"ok":"warn"===A.tone?"warn":"err",label:A.text}):null,Ee.jsx(q,{id:"connections:offline",title:"Offline",tone:"warn",message:s?null:"This browser is offline. Nothing on this page can be read or changed until it reconnects."}),Ee.jsx(ij,{connections:v??[],providers:g??[],onFlash:C,onChanged:()=>{U()}}),E?Ee.jsx(JO,{offer:E,onFlash:C,onDismiss:()=>N(null)}):null,Ee.jsx(VI,{connections:v,providers:g??[],loading:j,setupRequired:!0===x?.setupRequired,tools:Ee.jsx(ej,{open:h,onToggle:()=>m(e=>!e)}),sheet:h?Ee.jsx(tj,{tomb:d,onFlash:C,onImported:()=>{u.reload(),U()},onClose:()=>{m(!1),document.getElementById("connectors-import")?.focus()}}):null,imported:u.record?Ee.jsx(rj,{record:u.record,busy:u.busy,onResync:()=>{u.resync(C)}}):null}),Ee.jsx(DI,{providers:g,connections:v??[]}),D.target?Ee.jsx(iR,{target:D.target,onFlash:C,onClose:D.close,onConnected:D.connected}):null]}):Ee.jsx(LR,{provider:M,providers:g??[],providerId:e,connectionId:t,connections:K,loading:null===g||null!==l&&null===v,online:s,canConfigure:!0!==x?.setupRequired,configureHint:c?"Authorize this connector to use it from this device.":"This deployment has no Connect relay — set VITE_CONNECT_CALLBACK_BASE to enable OAuth.",flash:A,rememberOffer:E,onFlash:C,onRememberOffer:N,onChanged:()=>{U()}})}const DR={items:[]},qR={family:"AI",accepts:e=>sd(e)||ZS(e),classification:pA};function MR(e){try{const t=an(e);if(void 0===t?.configuration.parameters.ai_contract)return"ordinary";if(t.configuration.parameters.ai_contract!==uA)return"pending";const n=Gn(qR,e,!0),r=wA(e),i=n.configuration.parameters.vault_tomb;if(!r||!i)return"pending";const a=dA(JSON.stringify([lA(r),i]));if(a!==n.configuration.fingerprint||n.configuration.targetIds.endpoint!==`ai-${a}`||n.privateState.grants.app?.targetId!==`ai-${a}`)return"pending";const o=xE();let s=DR;const c=o.assertEndpointAllowed;if(!c)return"pending";const l=()=>{if(xE()!==o)throw new Error("The current AI connection authority changed.")},d=()=>{l(),o.signal.throwIfAborted(),o.assertCurrent(),c(r.baseUrl),l(),Es(s,i,()=>{o.signal.throwIfAborted(),o.assertCurrent()}),l()};d(),s=function(e,t,n){if("api-key"!==t.authentication)return DR;const r=e.privateState.credentials.ai_credential_reference;if(!r)throw new Error("The AI vault credential is missing.");const i=Ss(decodeURIComponent(r),lA(t),["apiKey"],n);if(t.apiKey=i.fields.get("apiKey")??"",dA(t.apiKey)!==e.privateState.credentials.ai_credential_digest)throw new Error("The AI vault credential changed.");return i}(n,r,i),aA(r),d();const u=Gn(qR,e,!0);return u.revision===n.revision&&u.configuration.fingerprint===a?"verified":"pending"}catch{return"pending"}}const KR={classification:e=>{if("api-key"!==e.method)throw new Error("API-key cleanup belongs to an API-key connection");return Rd(e.providerId,e.parameters).classification},cleanup:async(e,t)=>{if("api-key"!==t.configuration.method||e.providerId!==t.configuration.providerId||e.fingerprint!==t.configuration.fingerprint||"revoke"!==e.kind||!e.grant||"api-key"!==e.grant.kind||e.grant.providerId!==e.providerId||e.grant.actor!==e.actor||e.grant.fingerprint!==e.fingerprint||e.grant.targetId!==e.targetId)throw new Error("This API-key connection has an unsupported provider cleanup obligation");return"local-credential-forgotten"}};function FR(e){const t=an(e);if(!t||"api-key"!==t.configuration.method)throw new Error("Saved API-key connector not found");return t}function GR(e,t,n,r,i,a,o=0){const s=Math.max(Date.now(),o+1),c=kr();return c.credentials=r,c.grants.app={kind:"api-key",providerId:n.providerId,actor:"app",fingerprint:n.fingerprint,targetId:a,accessToken:r.api_key??"",expiresAt:null,scopes:null},c.verification={fingerprint:n.fingerprint,verifiedAt:s,kind:"provider"},{connectionId:e,revision:t,configuration:n,privateState:c,runtime:{verifiedAt:s,identity:{id:`${n.providerId}:credential`,label:i,kind:"api-credential",assurance:"credential-valid"},targets:[{id:a,label:a,kind:"api"}],grants:[{actor:"app",label:"API key",permissionState:"provider-managed",grantedScopes:[],expiresAt:null,needsReauth:!1}]}}}async function BR(e,t,n){Hd(e),await Ik(e,t,n),await Zy(e,t,n);const r=Gd(e,t),i=await mr(r,n);if(function(e,t){"linq"===e&&Zu(t),"agentcard"===e&&uu(t),"marqeta"===e&&Gu(t),"privacy"===e&&ap(t),"lithic"===e&&Mu(t),"razorpay"===e&&sp(t),"stripe"===e&&bp(t),"stripe-issuing"===e&&wp(t)}(e.providerId,i),!e.profile.verify)throw new Error("Provider verification is unavailable");return{result:jr(e.providerName,e.profile.verify,i,Kd(e,t)),origin:new URL(r.url).origin}}async function VR(e,t=Gt()){t.assertCurrent();const n=Rd(e.providerId,e.parameters);Hd(n);const r=function(e){const t=e.connectionId?FR(e.connectionId):null;if(t&&(t.configuration.providerId!==e.providerId||e.revision!==t.revision))throw new Error("Connector changed; reload before saving");if(t&&(t.privateState.recovery.length||Object.keys(t.privateState.pending).length))throw new Error("Finish provider authorization cleanup before editing");if(Object.values(e.requestedScopes??{}).some(e=>e.length)||Object.keys(e.targetIds??{}).length>0&&(!t||JSON.stringify(e.targetIds)!==JSON.stringify(t.configuration.targetIds)))throw new Error("API-key permissions and targets are verified by this provider");return t}(e);r&&await rn(r.connectionId,{revision:r.revision,fingerprint:r.configuration.fingerprint});const i=await Od(n),a=Ud(n,e.credentials,r?.configuration.fingerprint===i?r.privateState.credentials:{});wr(e.displayName,a),vr(e.icon??"",a);for(const u of Object.values(n.parameters))wr(u,a);const{result:o,origin:s}=await async function(e,t,n,r,i){try{return await BR(e,t,n)}catch(a){throw a instanceof gr&&"authorization"===a.code&&r&&r.configuration.fingerprint===i&&JSON.stringify(r.privateState.credentials)===JSON.stringify(t)&&await Wd(r,e,n),a}}(n,a,t,r,i);t.assertCurrent();const c={version:1,providerId:e.providerId,method:"api-key",displayName:e.displayName.trim(),icon:e.icon??"",parameters:n.parameters,requestedScopes:{},targetIds:{api:s},fingerprint:i},l=r?.connectionId??`conn_local_${crypto.randomUUID()}`,d=GR(l,r?.revision??1,c,a,o.label,s,r?.runtime.verifiedAt??0);return r?tn(l,{revision:r.revision,fingerprint:r.configuration.fingerprint},n.classification,()=>(t.assertCurrent(),d),()=>t.assertCurrent()):hn(d,n.classification,()=>t.assertCurrent())}async function HR(e,t=Gt()){t.assertCurrent();const n=Rd(e.providerId,e.parameters);Hd(n);const r=Ud(n,e.credentials,{});for(const a of Object.values(n.parameters))wr(a,r);const{result:i}=await BR(n,r,t);return t.assertCurrent(),{label:i.label}}async function JR(e,t=Gt()){t.assertCurrent();const n=FR(e);An(n);const r=Rd(n.configuration.providerId,n.configuration.parameters);if(await Jd(n,r,t),await Od(r)!==n.configuration.fingerprint)throw new Error("Provider contract changed; configure this connection again");let i;await rn(e,{revision:n.revision,fingerprint:n.configuration.fingerprint});try{i=await BR(r,n.privateState.credentials,t)}catch(s){throw(s instanceof Vd||s instanceof gr&&"authorization"===s.code)&&await Wd(n,r,t),s}const{result:a,origin:o}=i;return t.assertCurrent(),tn(e,{revision:n.revision,fingerprint:n.configuration.fingerprint},r.classification,()=>(t.assertCurrent(),GR(e,n.revision,n.configuration,n.privateState.credentials,a.label,o,n.runtime.verifiedAt??0)),()=>t.assertCurrent())}async function WR(e,t,n={},r=Gt()){if(r.assertCurrent(),"provider.read"!==t||Object.keys(n).length)throw new Error("Unsupported provider API operation");const i=FR(e),a=Rd(i.configuration.providerId,i.configuration.parameters);if(await Jd(i,a,r),nn(i),await Od(a)!==i.configuration.fingerprint)throw new Error("Provider contract changed; configure this connection again");await rn(e,{revision:i.revision,fingerprint:i.configuration.fingerprint});try{const{result:t}=await BR(a,i.privateState.credentials,r);return await rn(e,{revision:i.revision,fingerprint:i.configuration.fingerprint}),r.assertCurrent(),t}catch(o){throw(o instanceof Vd||o instanceof gr&&"authorization"===o.code)&&await Wd(i,a,r),o}}async function ZR(e,t,n){if(!e)return;const r=`/repos/${encodeURIComponent(e.owner)}/${encodeURIComponent(e.repo)}/git/ref/heads/${e.branch.split("/").map(encodeURIComponent).join("/")}`,i=await mr({url:`${Jb}${r}`,method:"GET",headers:new Headers({Authorization:`Bearer ${t}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28"}),signal:n.signal},n);if(!ai(i)||i.ref!==`refs/heads/${e.branch}`||!ai(i.object)||"commit"!==i.object.type||!/^[a-f0-9]{40}$/.test(yi(i.object.sha)??""))throw new gr("response")}async function XR(e,t){if(Xb(),e.configuration.fingerprint!==await rk())throw new Error("GitHub authorization contract changed; configure again");await rn(e.connectionId,cn(e));try{const n=await ek(e.privateState.credentials.api_key??"",t);if(e.runtime.identity&&n.id!==e.runtime.identity.id)throw new gr("authorization");return await rn(e.connectionId,cn(e)),t.assertCurrent(),n}catch(n){throw n instanceof gr&&"authorization"===n.code&&await ak(e,t),n}}async function YR(e,t=Gt()){t.assertCurrent(),Xb();const{saved:n,token:r,target:i,parameters:a}=function(e){!function(e){if("github"!==e.providerId||Object.keys(e.parameters).some(e=>!tk.publicParameters.includes(e))||Object.keys(e.credentials).some(e=>"api_key"!==e)||Object.keys(e.requestedScopes??{}).length||Object.keys(e.targetIds??{}).length)throw new Error("Configure only a GitHub personal access token");if(!e.displayName.trim()||e.displayName.trim().length>256)throw new Error("Enter a valid connection name")}(e);const t=e.connectionId?nk(e.connectionId):null;if(t&&e.revision!==t.revision)throw new Error("Connector changed; reload before saving");const n=Yb(e.credentials.api_key||t?.privateState.credentials.api_key||"");wr(e.displayName,{api_key:n}),vr(e.icon??"",{api_key:n});const r=gk(e.parameters),i={};r&&(i.backup_owner=r.owner,i.backup_repo=r.repo,i.backup_branch=r.branch);for(const a of Object.values(i))wr(a,{api_key:n});return{saved:t,token:n,target:r,parameters:i}}(e);n&&await rn(n.connectionId,cn(n));const o=await async function(e,t,n,r){try{const e=await ek(t,n);return await ZR(r,t,n),e}catch(i){throw e&&e.privateState.credentials.api_key===t&&i instanceof gr&&"authorization"===i.code&&await ak(e,n),i}}(n,r,t,i),s=await rk();t.assertCurrent();const c=n?.connectionId??`conn_github_${crypto.randomUUID()}`,l=ik(c,n?.revision??1,{version:1,providerId:"github",method:"api-key",displayName:e.displayName.trim(),icon:e.icon??"",parameters:a,requestedScopes:{},targetIds:{api:Jb},fingerprint:s},r,o,n?.runtime.verifiedAt??0);return n?tn(c,cn(n),tk,()=>(t.assertCurrent(),l),()=>t.assertCurrent()):hn(l,tk,()=>t.assertCurrent())}async function QR(e,t=Gt()){const n=nk(e),r=await XR(n,t);return await ZR(gk(n.configuration.parameters),n.privateState.credentials.api_key??"",t),tn(e,cn(n),tk,()=>(t.assertCurrent(),ik(e,n.revision,n.configuration,n.privateState.credentials.api_key??"",r,n.runtime.verifiedAt??0)),()=>t.assertCurrent())}async function eL(e,t,n={},r=Gt()){if(r.assertCurrent(),!["provider.read","provider.repositories.read"].includes(t)||Object.keys(n).length)throw new Error("Unsupported GitHub personal-token operation");const i=nk(e,!0),a=await XR(i,r);if("provider.read"===t)return{label:a.label,items:[]};try{const t=await async function(e,t){Xb();const n=await mr(Qb("/user/repos?per_page=100&sort=updated",e),t),r=Gr(Zb).max(100).safeParse(n);if(!r.success)throw new gr("response");return r.data.map(t=>{const n=wr(t.full_name,{api_key:e}),r=`https://github.com/${n}`;if(t.html_url!==r)throw new gr("response");return{id:String(t.id),label:n,url:r}})}(i.privateState.credentials.api_key??"",r);return r.assertCurrent(),await rn(e,cn(i)),{label:"Recently updated repositories (up to 100)",items:t}}catch(o){throw o instanceof gr&&"authorization"===o.code&&await ak(i,r),o}}function tL(e){return{verifiedAt:e.verifiedAt,identity:e.entityId?{id:e.entityId,label:e.entityId,kind:"entity",assurance:"account-verified"}:null,targets:[],grants:[{actor:"user",label:`${e.tokenLabel} (${e.policies.length} provider policies)`,permissionState:"provider-managed",grantedScopes:[],expiresAt:e.expiresAt,needsReauth:!1}]}}function nL(e){return{revision:e.revision,fingerprint:e.configuration.fingerprint}}async function rL(e,t){const n=(new TextEncoder).encode(JSON.stringify({providerId:e.providerId,endpoint:t,namespace:e.namespace,credential:e.apiKey}));return[...new Uint8Array(await crypto.subtle.digest("SHA-256",n))].map(e=>e.toString(16).padStart(2,"0")).join("")}function iL(e,t,n,r){return{configuration:{version:1,providerId:e.providerId,method:"api-key",displayName:e.displayName,icon:e.icon,parameters:{endpoint:t,namespace:e.namespace},requestedScopes:{},targetIds:{},fingerprint:n},privateState:{...kr(),credentials:{api_key:e.apiKey},grants:{user:{providerId:e.providerId,actor:"user",fingerprint:n,kind:"api-key",accessToken:e.apiKey,expiresAt:r.expiresAt,scopes:null,endpoint:t,targetId:r.entityId??e.providerId}},verification:{fingerprint:n,verifiedAt:r.verifiedAt,kind:"provider"}},runtime:tL(r)}}const aL={publicParameters:["endpoint","namespace"],privateCredentials:["api_key"]};function oL(e){const t=an(e);if(!t||!["vault","openbao"].includes(t.configuration.providerId)||"api-key"!==t.configuration.method)throw new Error("Saved provider instance not found");return t}async function sL(e,t=Gt()){if(!["vault","openbao"].includes(e.providerId))throw new Error("This is not a supported provider instance");const n=ox(e.endpoint),r=e.connectionId?oL(e.connectionId):null;!function(e,t){if(t&&t.configuration.providerId!==e.providerId)throw new Error("The saved connector belongs to another provider");if(t&&(t.privateState.recovery.length>0||Object.keys(t.privateState.pending).length>0))throw new Error("Complete provider cleanup before replacing this token");if(t&&void 0!==e.revision&&e.revision!==t.revision)throw new Error("Connector changed; reload the saved configuration")}(e,r),r&&await rn(r.connectionId,nL(r));const i=function(e,t,n){let r=e.apiKey;if(!r){if(!n||n.configuration.parameters.endpoint!==t||n.configuration.parameters.namespace!==e.namespace)throw new Error("Enter a provider token for the selected instance and namespace");const i=n.privateState.credentials.api_key;if(!i)throw new Error("Enter a provider token");r=i}return r}(e,n,r);wr(e.displayName,{api_key:i}),vr(e.icon,{api_key:i});const a={...e,apiKey:i},o=await cx(n,e.namespace,i,t);o.verifiedAt=Math.max(o.verifiedAt,(r?.privateState.verification?.verifiedAt??0)+1),t.assertCurrent();const s=iL(a,n,await rL(a,n),o);return t.assertCurrent(),r?(await tn(r.connectionId,nL(r),aL,e=>(t.assertCurrent(),s.privateState.recovery=Object.values(e.privateState.grants).map(t=>{const n=t.targetId??e.configuration.providerId;return{id:`replace:${t.actor}:${e.revision}`,kind:"revoke",providerId:t.providerId,actor:t.actor,fingerprint:t.fingerprint,targetId:n,grant:{...t,targetId:n}}}),{...e,...s}),()=>t.assertCurrent()),Nn(r.connectionId)):hn({connectionId:`conn_local_${crypto.randomUUID()}`,...s},aL,()=>t.assertCurrent())}async function cL(e,t=Gt()){const n=oL(e);await rn(e,nL(n));const r=n.privateState.credentials.api_key;if(!r)throw new Error("Verify this provider token again");let i;try{i=await cx(n.configuration.parameters.endpoint??"",n.configuration.parameters.namespace??"",r,t)}catch(a){throw a instanceof gr&&[401,403].includes(a.status)&&await async function(e,t){await tn(e,nL(t),aL,e=>(e.privateState.verification=null,e.runtime.verifiedAt=null,e.runtime.grants=e.runtime.grants.map(e=>({...e,needsReauth:!0})),e))}(e,n),a}return t.assertCurrent(),await rn(e,nL(n)),i}async function lL(e,t=Gt()){const n=oL(e);if(n.privateState.recovery.length||Object.keys(n.privateState.pending).length)throw new Error("Complete provider cleanup before verifying this token");const r=await cL(e,t);return r.verifiedAt=Math.max(r.verifiedAt,(n.privateState.verification?.verifiedAt??0)+1),tn(e,nL(n),aL,e=>{t.assertCurrent();const n=e.privateState.credentials.api_key;if(!n)throw new Error("Enter a provider token");const i=iL({providerId:"vault"===e.configuration.providerId?"vault":"openbao",displayName:e.configuration.displayName,icon:e.configuration.icon,endpoint:e.configuration.parameters.endpoint??"",namespace:e.configuration.parameters.namespace??"",apiKey:n},e.configuration.parameters.endpoint??"",e.configuration.fingerprint,r);return{...e,...i}},()=>t.assertCurrent())}function dL(e,t=Gt()){return{classification:()=>aL,credentialSlots:["api_key"],cleanup:async(n,r)=>{if(t.assertCurrent(),"revoke"!==n.kind||n.providerId!==e||"api-key"!==n.grant?.kind)throw new Error("This provider cleanup requires its own recovery operation");return n.id.startsWith("provider-self-revoke:")?(await lx(n.grant.endpoint??"",n.credentials?.namespace??"",n.grant.accessToken,t),await async function(e,t){const n=oL(e);await tn(e,nL(n),aL,e=>{const n=e.privateState.grants[t.actor];return n?.accessToken!==t.accessToken||n.fingerprint!==t.fingerprint||(delete e.privateState.grants[t.actor],e.privateState.credentials.api_key===t.accessToken&&(e.privateState.credentials=Object.fromEntries(Object.entries(e.privateState.credentials).filter(([e])=>"api_key"!==e))),e.privateState.verification=null,e.runtime.verifiedAt=null,e.runtime.grants=e.runtime.grants.map(e=>e.actor===t.actor?{...e,needsReauth:!0}:e)),e})}(r.connectionId,n.grant),"provider-revoked"):"local-credential-forgotten"}}}function uL(e){return{accessKeyId:e.parameters.access_key_id??"",secretAccessKey:qo(e.credentials.secret_access_key??""),sessionToken:e.credentials.session_token?qo(e.credentials.session_token):void 0}}function pL(e,t){const n=[...e.matchAll(new RegExp(`<${t}(?:>([\\s\\S]*?)<\\/${t}>|\\s*\\/>)`,"g"))];if(1!==n.length)throw new gr("response");return Do(`<Contents><Key>${n[0]?.[1]??""}</Key></Contents>`)[0]??""}async function hL(e,t){t.assertCurrent();const n=new URL(`${e.parameters.endpoint}/${e.parameters.bucket}/`);n.searchParams.set("list-type","2"),n.searchParams.set("max-keys","100"),n.searchParams.set("prefix",e.parameters.prefix??"");const r=Lo({method:"GET",url:n,payloadHash:Uo,region:e.parameters.region??"",credentials:uL(e)}),i=new AbortController,a=setTimeout(()=>i.abort(),15e3);try{const n=await t.fetch(r.url,{method:"GET",headers:r.headers,signal:i.signal,mode:"cors",credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer"});if(t.assertCurrent(),401===n.status)throw new gr("authorization",401);if(403===n.status)throw new gr("permission",403);if(!n.ok||n.redirected)throw new gr("response",n.status);const a=function(e,t){if(!/^\s*(?:<\?xml[^?]*\?>\s*)?<ListBucketResult(?:\s+xmlns="https?:\/\/s3.amazonaws.com\/doc\/2006-03-01\/"|\s+xmlns="")?\s*>[\s\S]*<\/ListBucketResult>\s*$/.test(e)||/<!|<Error\b/.test(e))throw new gr("response");if(pL(e,"Name")!==t.parameters.bucket||pL(e,"Prefix")!==t.parameters.prefix||!["true","false"].includes(pL(e,"IsTruncated")))throw new gr("response");const n=Do(e);if(n.length>100||n.some(e=>!e.startsWith(t.parameters.prefix??"")||e.length>1024||!/^[^\p{Cc}]*$/u.test(e)))throw new gr("response");return n.map(e=>({id:e,label:wr(e,t.credentials)}))}(await async function(e){const t=e.body?.getReader();if(!t)throw new gr("response");const n=[];let r=0;try{for(;;){const e=await t.read();if(e.done)break;if(r+=e.value.byteLength,r>262144)throw new gr("response");n.push(e.value)}const e=new Uint8Array(r);let i=0;for(const t of n)e.set(t,i),i+=t.length;return new TextDecoder("utf-8",{fatal:!0}).decode(e)}finally{await t.cancel().catch(()=>{}),t.releaseLock()}}(n),e);if(t.assertCurrent(),i.signal.aborted)throw new gr("network");return a}catch(o){if(o instanceof gr)throw o;if(o instanceof di)throw new gr("deployment");throw new gr("network")}finally{clearTimeout(a)}}async function fL(e,t,n=!1){const r=qk(e,n);await rn(e,cn(r));try{if(r.configuration.fingerprint!==await Uk(r.configuration.parameters))throw new Error("S3 binding changed; configure again");const n=await hL({parameters:r.configuration.parameters,credentials:r.privateState.credentials},t);return await rn(e,cn(r)),{saved:r,items:n}}catch(i){throw i instanceof gr&&["authorization","permission"].includes(i.code)&&await Kk(r,t),i}}async function mL(e,t=Gt()){t.assertCurrent();const n=e.connectionId?qk(e.connectionId):null;if(n&&n.revision!==e.revision)throw new Error("S3 connection changed; reload before saving");if(!e.displayName.trim()||e.displayName.trim().length>256)throw new Error("Enter a valid S3 connection name");const r=function(e,t){if("s3"!==e.providerId||Object.keys(e.requestedScopes??{}).length||Object.keys(e.targetIds??{}).length)throw new Error("Configure only an S3 bucket and its credentials");if(Object.keys(e.parameters).some(e=>!Lk.publicParameters.includes(e))||Object.keys(e.credentials).some(e=>!Lk.privateCredentials.includes(e)))throw new Error("Unsupported S3 configuration field");const n=Object.fromEntries(Lk.publicParameters.map(t=>[t,(e.parameters[t]??"").trim()]));n.prefix=e.parameters.prefix??"",function(e){if(e.endpoint=function(e){const t=new URL(e);if("https:"!==t.protocol||t.username||t.password||t.search||t.hash||"/"!==t.pathname||t.origin.length>180)throw new Error("Enter an HTTPS S3 service origin without credentials or a path");return t.origin}(e.endpoint??""),!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(e.bucket??"")||!/^[a-z0-9-]{1,64}$/.test(e.region??"")||!/^[!-~]{1,256}$/.test(e.access_key_id??""))throw new Error("Enter a valid S3 bucket, region and access key ID");const t=e.prefix??"";if(t.length>512||!/^[^\p{Cc}]*$/u.test(t)||t.split("/").some(e=>"."===e||".."===e))throw new Error("Enter a valid S3 object prefix")}(n);const r=Object.fromEntries(Lk.privateCredentials.map(n=>[n,e.credentials[n]||t?.privateState.credentials[n]||""]));e.credentials.secret_access_key&&!e.credentials.session_token&&(r.session_token=""),function(e){if(!e.secret_access_key||Object.values(e).some(e=>e.length>16384||e&&!/^[!-~]+$/.test(e)))throw new Error("Enter valid S3 signing credentials")}(r),wr(e.displayName,r),vr(e.icon??"",r);for(const i of Object.values(n))wr(i,r);return{parameters:n,credentials:r}}(e,n);n&&await rn(n.connectionId,cn(n));const i=await Uk(r.parameters);await async function(e,t,n,r){try{return await hL(t,r)}catch(i){throw e&&i instanceof gr&&["authorization","permission"].includes(i.code)&&e.configuration.fingerprint===n&&Dk(e.privateState.credentials)===Dk(t.credentials)&&await Kk(e,r),i}}(n,r,i,t),t.assertCurrent();const a=n?.connectionId??`conn_s3_${crypto.randomUUID()}`,o=function(e,t,n,r,i){return Mk(e,t?.revision??1,{version:1,providerId:"s3",method:"api-key",displayName:n.displayName.trim(),icon:n.icon??"",parameters:r.parameters,requestedScopes:{},targetIds:{bucket:r.parameters.bucket??""},fingerprint:i},r.credentials,t?.runtime.verifiedAt??0)}(a,n,e,r,i);return n?tn(a,cn(n),Lk,()=>(t.assertCurrent(),o),()=>t.assertCurrent()):hn(o,Lk,()=>t.assertCurrent())}async function gL(e,t=Gt()){const{saved:n}=await fL(e,t);return tn(e,cn(n),Lk,()=>(t.assertCurrent(),Mk(e,n.revision,n.configuration,n.privateState.credentials,n.runtime.verifiedAt??0)),()=>t.assertCurrent())}async function wL(e,t,n={},r=Gt()){if(!["provider.read","provider.objects.read"].includes(t)||Object.keys(n).length)throw new Error("Select a supported S3 bucket operation");const{saved:i,items:a}=await fL(e,r,!0);return{label:"provider.read"===t?`${i.configuration.parameters.bucket} list access verified`:"First 100 object keys under the configured prefix",items:"provider.read"===t?[]:a}}function vL(e){const t=/^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*$/;if(!t.test(e.mount)||!t.test(e.path)||e.mount.length>256||e.path.length>1024||[...e.mount.split("/"),...e.path.split("/")].some(e=>[".",".."].includes(e)))throw new Error("Enter a KV mount and secret path without traversal");if(void 0!==e.version&&(!Number.isSafeInteger(e.version)||e.version<1))throw new Error("Select a positive KV version");return`${e.mount}/data/${e.path}`}async function yL(e,t,n,r,i){const a=vL(r),o=new URL(`${ox(e)}/v1/${a}`);void 0!==r.version&&o.searchParams.set("version",String(r.version));const s=await mr({url:o,method:"GET",headers:sx(n,t)},i),c=Ur({data:Ur({data:Br(qr(),ti()),metadata:Ur({version:Vr().int().positive()})})}).safeParse(s);if(!c.success)throw new gr("response");return i.assertCurrent(),{data:ii(c.data.data.data),metadata:c.data.data.metadata}}const bL={publicParameters:["endpoint","namespace"],privateCredentials:["api_key"]};async function kL(e,t,n=Gt()){vL(t);const{record:r,token:i,endpoint:a,namespace:o}=await async function(e,t){t.assertCurrent();const{record:n,token:r,grant:i}=function(e){const t=an(e);if(!t||!["vault","openbao"].includes(t.configuration.providerId)||"api-key"!==t.configuration.method)throw new Error("Saved Vault or OpenBao token connection not found");const n=t.privateState.grants.user,r=t.privateState.credentials.api_key;if("connected"!==on(e)?.status||!n||"api-key"!==n.kind||!r||n.accessToken!==r||n.fingerprint!==t.configuration.fingerprint||t.privateState.recovery.length||Object.keys(t.privateState.pending).length)throw new Error("Verify this provider token before reading a secret");return{record:t,token:r,grant:n}}(e),a=n.configuration.parameters.endpoint??"",o=n.configuration.parameters.namespace??"";if(await rL({providerId:"vault"===n.configuration.providerId?"vault":"openbao",displayName:n.configuration.displayName,icon:n.configuration.icon,namespace:o,apiKey:r},a)!==n.configuration.fingerprint||i.endpoint!==a)throw new Error("Provider token does not match this instance and namespace");return await rn(e,cn(n)),await cL(e,t),{record:n,token:r,endpoint:a,namespace:o}}(e,n);try{const s=await yL(a,o,i,t,n);return await rn(e,cn(r)),n.assertCurrent(),s}catch(s){throw s instanceof gr&&401===s.status&&await tn(e,cn(r),bL,e=>(n.assertCurrent(),e.privateState.verification=null,e.runtime.verifiedAt=null,e.runtime.grants=e.runtime.grants.map(e=>({...e,needsReauth:!0})),e)),s}}function xL(e,t){const n=async(e,n)=>{t.assertCurrent(),n?.throwIfAborted();const r=await e();return n?.throwIfAborted(),t.assertCurrent(),r},r=e.cleanup;return{supports:e.supports,configure:t=>n(()=>e.configure(t)),verify:t=>n(()=>e.verify(t)),invoke:(t,r,i,a)=>n(()=>void 0===a?e.invoke(t,r,i):e.invoke(t,r,i,a),a),authorize:e.authorize?(t,r)=>n(()=>e.authorize?e.authorize(t,r):Promise.reject(new Error("Provider authorization is unavailable"))):void 0,cleanup:{capture:r.capture?e=>{t.assertCurrent();const n=r.capture?.(e);if(t.assertCurrent(),!n)throw new Error("Provider cleanup capture changed");return n}:void 0,classification:e=>(t.assertCurrent(),r.classification(e)),credentialSlots:(e,n)=>{t.assertCurrent();const i=r.credentialSlots;return i&&"call"in i?i(e,n):i??[]},prepare:r.prepare?(e,t)=>n(()=>r.prepare?void 0===t?r.prepare(e):r.prepare(e,t):Promise.resolve()):void 0,cleanup:(e,t)=>n(()=>r.cleanup(e,t))}}}function IL(e){const t=an(e);if(!t||!Bw(t.configuration))throw new un("target");return t}function jL(e,t){Vw(e),Kv(t,e.transport),Vw(e)}async function _L(e,t){const n=IL(e),r=n.configuration;if(r.fingerprint!==await Jw(r)||Object.values(r.requestedScopes).some(e=>e.length))throw new un("target");const i=Gw(r.parameters);if(r.targetIds.mcp!==i.mcp_resource)throw new un("target");const a=function(e){if("mcp"!==e.method||!Fw(e.providerId))throw new un("target");const t=Gw(e.parameters);return{providerId:e.providerId,fingerprint:e.fingerprint,endpoint:t.mcp_url,resource:t.mcp_resource,issuer:null,transport:t.mcp_transport,ssePostEndpoint:t.mcp_post_endpoint}}(r),o=Hw(r,n.privateState.credentials,t),s=o.fields.get("mcpToken");if("anonymous"!==i.mcp_authentication&&!s)throw new un("authorization");if("anonymous"===i.mcp_authentication&&o.fields.size)throw new un("target");const c=new AbortController,l=AbortSignal.any([c.signal,t.transport.signal??AbortSignal.abort()]),d=()=>{l.throwIfAborted(),jL(t,r);const i=IL(e);if(i.revision!==n.revision||i.configuration.fingerprint!==a.fingerprint)throw new un("disposed");Es(o,t.tomb,()=>Vw(t))};d();const u=()=>{try{d()}catch{c.abort()}},p=Ei(u),h=Ht.subscribe(u),f=new rr(a,{assertCurrent:d,accessGrant:async()=>null,authorizationRequired:async()=>{d(),await tn(e,cn(n),Kw(),e=>(d(),e.privateState.verification=null,e.runtime.verifiedAt=null,e),d)},fetch:(m={binding:a,target:i,owner:t,token:s,signal:l,check:d},(e,t)=>{m.check();const n=new Request(e,t);ir(m.binding,dn(n.url),n.method);const r=new Headers(n.headers);return r.delete("authorization"),"bearer"===m.target.mcp_authentication&&r.set("authorization",`Bearer ${m.token}`),"header"===m.target.mcp_authentication&&m.target.mcp_header&&m.token&&r.set(m.target.mcp_header,m.token),m.check(),m.owner.transport.fetch(n,{headers:r,signal:AbortSignal.any([m.signal,n.signal])})})});var m;return{record:n,binding:a,session:f,check:d,privateResult(e){if(d(),s&&JSON.stringify(e).includes(JSON.stringify(s).slice(1,-1)))throw new un("response")},async close(){c.abort(),p(),h(),await f.dispose()}}}async function SL(e,t){const n=await _L(e,t);try{const e=await n.session.connect();n.privateResult(e),n.check()}finally{await n.close()}jL(t,n.record.configuration);const r=Hw(n.record.configuration,n.record.privateState.credentials,t),i=()=>Es(r,t.tomb,()=>jL(t,n.record.configuration));return tn(e,cn(n.record),Kw(),e=>{i();const t=Math.max(Date.now(),(e.runtime.verifiedAt??0)+1);return e.privateState.verification={fingerprint:n.binding.fingerprint,verifiedAt:t,kind:"provider"},e.runtime={verifiedAt:t,identity:null,targets:[{id:n.binding.resource,label:n.binding.resource,kind:"mcp-resource"}],grants:[]},e},i)}function AL(e){const t=function(e){return async(t,n,r)=>{n?.throwIfAborted();const i=e.capture(n,r),a=await i;try{n?.throwIfAborted();const e=a.transport;if(!e.signal)throw new un("disposed");const r=AbortSignal.any([...e.signal?[e.signal]:[],...n?[n]:[]]),i=Object.freeze({...a,transport:Object.freeze({...e,signal:r,assertCurrent:()=>{r.throwIfAborted(),e.assertCurrent(),r.throwIfAborted()}})});return Vw(i),await Ts(),Vw(i),await t(i)}finally{a.close()}}}(e);return{supports:Fw,configure:e=>t(async t=>SL((await async function(e,t,n){Vw(t);const{parameters:r,target:i,secret:a}=function(e){if("mcp"!==e.method||!Fw(e.providerId)||Object.keys(e.targetIds).length||Object.values(e.requestedScopes).some(e=>e.length))throw new un("target");const t=Object.fromEntries(Object.entries(e.parameters).filter(([e,t])=>""!==t||!["mcp_header","mcp_post_endpoint"].includes(e))),n=Gw(t),r=Ur({mcp_token:qr().optional()}).strict().parse(e.credentials).mcp_token||void 0;if(r&&Dw.parse(r),"anonymous"===n.mcp_authentication&&r)throw new un("target");if(r&&Object.values(t).some(e=>e.includes(r)))throw new un("target");return{parameters:t,target:n,secret:r}}(e),o=await Jw({providerId:e.providerId,method:"mcp",parameters:r}),s={version:1,providerId:e.providerId,method:"mcp",displayName:e.displayName,icon:e.icon??"",parameters:r,requestedScopes:{},targetIds:{mcp:i.mcp_resource},fingerprint:o};n(s);const c=function(e){const t=e.connectionId?an(e.connectionId):null;if(e.connectionId&&(!t||t.revision!==e.revision||t.configuration.providerId!==e.providerId||!Bw(t.configuration)))throw new un("disposed");if(t&&(t.privateState.recovery.length||Object.keys(t.privateState.grants).length||Object.keys(t.privateState.pending).length))throw new un("authorization");return t}(e);if(!a&&"anonymous"!==i.mcp_authentication){if(!c||c.configuration.fingerprint!==o)throw new un("authorization");return function(e,t,n,r){const i=Hw(e.configuration,e.privateState.credentials,n);return Dw.parse(i.fields.get("mcpToken")),tn(e.connectionId,cn(e),Kw(),e=>(Es(i,n.tomb,()=>r(t)),e.configuration=t,e.privateState.verification=null,e.runtime=br(),e),()=>Es(i,n.tomb,()=>r(t)))}(c,s,t,n)}const l=await As({name:e.displayName,targetBinding:o,fields:a?[{field:"mcpToken",label:"MCP credential",value:a}]:[]},t.tomb,()=>n(s)),d=kr();d.credentials={mcp_configured_reference:l.reference,mcp_configured_vault:t.tomb};const u=()=>Es(l,t.tomb,()=>n(s));try{return c?await tn(c.connectionId,cn(c),Kw(),e=>(u(),e.configuration=s,e.privateState=d,e.runtime=br(),e),u):await hn({connectionId:`devconn_${crypto.randomUUID()}`,configuration:s,runtime:br(),privateState:d},Kw(),u)}catch(p){throw await Cs(l,t.tomb,()=>Vw(t)),p}}(e,t,e=>jL(t,e))).connectionId,t)),verify:e=>t(t=>SL(e,t)),invoke:(e,n,r,i)=>t(async t=>{const i=IL(e);if(!i.privateState.verification||null===i.runtime.verifiedAt||i.privateState.recovery.length||Object.keys(i.privateState.grants).length||Object.keys(i.privateState.pending).length)throw new un("authorization");const a=await _L(e,t);try{return await nr(n,r,{list:async()=>{const e=await a.session.connect();return a.privateResult(e),e},call:async(e,n)=>{const r=await a.session.connect();a.privateResult(r);const i=await a.session.callTool(e,n,t.transport.signal);return a.privateResult(i),i}})}finally{await a.close()}},i),cleanup:{classification:Kw,prepare:(e,n)=>t(async t=>{const n=IL(e);jL(t,n.configuration),Hw(n.configuration,n.privateState.credentials,t)},void 0,n),cleanup:(e,n)=>t(async e=>{const t=IL(n.connectionId);return jL(e,t.configuration),Hw(t.configuration,t.privateState.credentials,e),"local-credential-forgotten"},void 0,n.transport)}}}const CL=Ur({client_id:qr().min(1).max(256),user_id:qr().min(1).max(256),login:qr().min(1).max(256),scopes:Gr(qr().min(1).max(512)).max(256),expires_in:Vr().finite().positive().max(31536e3)});function EL(e){const t=e.privateState.grants.user,n=e.runtime.grants.find(e=>"user"===e.actor),r=t?.expiresAt;return"twitch"===e.configuration.providerId&&"oauth"===e.configuration.method&&e.configuration.clientId&&t&&"oauth"===t.kind&&r&&!(r<=Date.now())&&n&&!n.needsReauth&&function(e){return Boolean("account-verified"===e.runtime.identity?.assurance&&e.privateState.verification?.fingerprint===e.configuration.fingerprint&&!Object.keys(e.privateState.pending).length&&!e.privateState.recovery.length)}(e)?t:null}function TL(){return Si().flatMap(e=>"twitch"===e.providerId?function(e){try{const t=an(e),n=t?EL(t):null;return t&&n?.expiresAt?[{connectionId:t.connectionId,revision:t.revision,expiresAt:n.expiresAt}]:[]}catch{return[]}}(e.connectionId):[])}async function NL(e,t,n){await tn(e.connectionId,cn(e),Sr(e.configuration),e=>(t.assertCurrent(),n?.throwIfAborted(),e.privateState.verification=null,e.runtime.verifiedAt=null,e.runtime.grants=e.runtime.grants.map(e=>({...e,needsReauth:!0})),e))}async function zL(e,t,n){t.assertCurrent(),n?.throwIfAborted();const r=an(e),i=r?EL(r):null;if(!r||!i?.expiresAt)return null;await rn(e,cn(r));try{const a=CL.safeParse(await mr({url:"https://id.twitch.tv/oauth2/validate",method:"GET",headers:new Headers({authorization:`OAuth ${i.accessToken}`}),signal:n},t));return t.assertCurrent(),n?.throwIfAborted(),a.success&&function(e,t){const n=e.privateState.grants.user,r=n?.scopes,i=e.configuration.requestedScopes.user??[];return Boolean(n&&r&&t.client_id===e.configuration.clientId&&(!n.clientId||t.client_id===n.clientId)&&t.user_id===e.runtime.identity?.id&&i.every(e=>t.scopes.includes(e))&&r.every(e=>t.scopes.includes(e))&&t.scopes.every(e=>r.includes(e)))}(r,a.data)?(await rn(e,cn(r)),t.assertCurrent(),n?.throwIfAborted(),{connectionId:e,revision:r.revision,expiresAt:Math.min(i.expiresAt,Date.now()+1e3*a.data.expires_in)}):(await NL(r,t,n),null)}catch(a){if(a instanceof gr&&"authorization"===a.code)return await NL(r,t,n),null;throw a}}async function $L(e,t){return t.assertCurrent(),Nn(e)}async function PL(e,t,n=Gt()){const r=await async function(e,t,n){try{const e=On(n);return e.assertCurrent(),e}catch(r){throw await yx(e,t),r}}(e,t.state,n),i=mx(e);if(i.privateState.pending.user?.state!==t.state)throw new Error("This authorization belongs to another browser connection");const a=i.privateState.credentials.oidc_nonce;if(!a)throw new Error("The authorization request is no longer available");const o=new URLSearchParams({native_state:t.state,native_code:t.code}).toString(),s=await Xn(o,fx);await async function(e,t){const n=mx(e);await tn(e,cn(n),fx,e=>{const n=e.privateState.recovery.find(e=>e.id===t);if(!n||n.grant)throw new Error("The authorization exchange changed");return n.kind="revoke",e})}(e,s.obligation.id);let c=!1;const l=En(e,s.obligation.id);try{const t=gx(e),n=await async function(e,t,n){const r=dx(e),i=new URL(`${r.endpoint}/v1/auth/${r.authMount}/oidc/callback`);i.search=new URLSearchParams({state:t.state,code:t.code,nonce:t.nonce,client_nonce:t.clientNonce}).toString(),n.assertCurrent();const a=AbortSignal.timeout(15e3);try{const e=await(n.settleCredentialMutation??n.fetch)(i,{method:"GET",headers:ux(r.namespace),signal:a,credentials:"omit",redirect:"error",cache:"no-store",referrerPolicy:"no-referrer",mode:"cors"});if(!e.ok||e.redirected)throw new gr("authorization",e.status);const t=e.body?.getReader();if(!t)throw new gr("response");const o=()=>{t.cancel()};a.addEventListener("abort",o,{once:!0});const s=[];let c=0;try{for(;;){a.throwIfAborted();const e=await t.read();if(e.done)break;if(c+=e.value.byteLength,c>262144)throw new gr("response");s.push(e.value)}const e=new Uint8Array(c);let n=0;for(const t of s)e.set(t,n),n+=t.byteLength;const r=hx.safeParse(JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(e)));if(!r.success)throw new gr("response");return{accessToken:r.data.auth.client_token,expiresAt:0===r.data.auth.lease_duration?null:Date.now()+1e3*r.data.auth.lease_duration}}finally{a.removeEventListener("abort",o),await t.cancel().catch(()=>{}),t.releaseLock()}}catch(o){if(o instanceof gr)throw o;throw new gr("network")}}(t,{state:s.pending.state,code:s.code,nonce:a,clientNonce:s.pending.verifier},r);c=!0;const i={providerId:t.providerId,actor:"user",fingerprint:s.pending.fingerprint,kind:"oidc",accessToken:n.accessToken,expiresAt:n.expiresAt,scopes:null,endpoint:t.endpoint};await zn(e,s.obligation.id,i,()=>fx,{namespace:t.namespace}),r.assertCurrent();const o=await cx(t.endpoint,t.namespace,n.accessToken,r),l=await async function(e,t,n,r,i,a,o){const s=mx(e);return tn(e,cn(s),fx,e=>{o.assertCurrent();const s=e.privateState.recovery.find(e=>e.id===t);if(!s?.grant||s.grant.accessToken!==r.accessToken||s.fingerprint!==e.configuration.fingerprint)throw new Error("The authorization changed before verification completed");const c=e.privateState.grants.user;c&&e.privateState.recovery.push({id:`vault-replace:${n}`,kind:"revoke",providerId:c.providerId,actor:c.actor,fingerprint:c.fingerprint,targetId:c.targetId??a.providerId,grant:{...c,targetId:c.targetId??a.providerId},credentials:{namespace:a.namespace}}),e.configuration.parameters=Object.fromEntries(Object.entries(e.configuration.parameters).filter(([e])=>"authorization_outcome"!==e)),e.privateState.grants.user={...r,targetId:i.entityId??a.providerId,expiresAt:i.expiresAt},e.privateState.credentials.api_key=r.accessToken,e.privateState.credentials=Object.fromEntries(Object.entries(e.privateState.credentials).filter(([e])=>"oidc_nonce"!==e)),e.privateState.recovery=e.privateState.recovery.filter(e=>e.id!==t);const l=Math.max(i.verifiedAt,(e.runtime.verifiedAt??0)+1);return e.privateState.verification={fingerprint:e.configuration.fingerprint,verifiedAt:l,kind:"provider"},e.runtime={verifiedAt:l,identity:i.entityId?{id:i.entityId,label:i.tokenLabel,kind:"entity",assurance:"account-verified"}:null,targets:[],grants:[{actor:"user",label:i.tokenLabel,permissionState:"provider-managed",grantedScopes:[],expiresAt:i.expiresAt,needsReauth:!1}]},e},()=>o.assertCurrent())}(e,s.obligation.id,s.pending.state,i,o,t,r);return l.recovery.length?$L(e,r):l}catch(d){throw c||await async function(e,t,n){const r=mx(e);await tn(e,cn(r),fx,e=>{const r=e.privateState.recovery.find(e=>e.id===t);if(!r||r.grant)throw new Error("The authorization exchange changed");return r.credentials={...r.credentials,phase:n?"exchange-denied":"exchange-unobserved",deadline:"0"},e.configuration.parameters.authorization_outcome=n?"denied":"exchange-unobserved",e})}(e,s.obligation.id,d instanceof Error&&function(e){return e instanceof gr&&e.status>=400&&e.status<500}(d)),l(),await $L(e,r).catch(()=>{}),d}finally{l()}}function OL(e,t=Gt()){const n=dL(e,t);return{classification:e=>"oidc"===e.method?fx:n.classification(e),credentialSlots:e=>"oidc"===e.method?[]:["api_key"],prepare:Hn,cleanup:async(r,i)=>{if("oidc"!==i.configuration.method)return n.cleanup(r,i);if(r.providerId!==e||!["configure","revoke"].includes(r.kind))throw new Error("This cleanup belongs to another provider");if(vn(i.connectionId,r.id)||!r.grant&&Number(r.credentials?.deadline)>Date.now())throw new Error("The authorization exchange is still settling");const a=r.grant;if(!a)return await async function(e,t){const n=mx(e);await tn(e,cn(n),fx,e=>(e.configuration.parameters.authorization_outcome=t?"denied":"exchange-unobserved",e.privateState.credentials=Object.fromEntries(Object.entries(e.privateState.credentials).filter(([e])=>"oidc_nonce"!==e)),e))}(i.connectionId,"exchange-denied"===r.credentials?.phase),"local-credential-forgotten";if("oidc"!==a.kind)throw new Error("This cleanup belongs to another authorization method");return await async function(e,t,n,r){try{await lx(e,t,n,r)}catch(i){if(!(i instanceof gr&&[401,403].includes(i.status)))throw i;try{await cx(e,t,n,r)}catch(a){if(a instanceof gr&&401===a.status)return;throw a}throw i}}(a.endpoint??"",r.credentials?.namespace??i.configuration.parameters.namespace??"",a.accessToken,t),"provider-revoked"}}}async function RL(e,t,n=!1){const r=mx(e);await rn(e,cn(r));const i=r.privateState.grants.user;if(!i||"oidc"!==i.kind||r.privateState.recovery.length>0||Object.keys(r.privateState.pending).length>0||!n&&"connected"!==on(e)?.status||null!==i.expiresAt&&i.expiresAt<=Date.now())throw new Error("Sign in to this instance again");return t.assertCurrent(),{record:r,grant:i,input:gx(e)}}async function LL(e,t,n){[401,403].includes(t.status)&&await tn(e,n,fx,e=>(e.privateState.verification=null,e.runtime.verifiedAt=null,e.runtime.grants=e.runtime.grants.map(e=>({...e,needsReauth:!0})),e))}async function UL(e,t=Gt()){const{record:n,grant:r,input:i}=await RL(e,t);try{const a=await cx(i.endpoint,i.namespace,r.accessToken,t);return await rn(e,cn(n)),t.assertCurrent(),a}catch(a){throw a instanceof gr&&await LL(e,a,cn(n)),a}}async function DL(e,t=Gt()){const{record:n,grant:r,input:i}=await RL(e,t,!0);try{const a=await cx(i.endpoint,i.namespace,r.accessToken,t);return tn(e,cn(n),fx,e=>{t.assertCurrent();const n=Math.max(a.verifiedAt,(e.runtime.verifiedAt??0)+1);return e.privateState.verification={fingerprint:e.configuration.fingerprint,verifiedAt:n,kind:"provider"},e.privateState.grants.user={...r,expiresAt:a.expiresAt},e.runtime.verifiedAt=n,e.runtime.identity=a.entityId?{id:a.entityId,label:a.tokenLabel,kind:"entity",assurance:"account-verified"}:null,e.runtime.grants=e.runtime.grants.map(e=>({...e,label:a.tokenLabel,expiresAt:a.expiresAt,needsReauth:!1})),e})}catch(a){throw a instanceof gr&&await LL(e,a,cn(n)),a}}async function qL(e,t,n=Gt()){vL(t);const{record:r,grant:i,input:a}=await RL(e,n);try{const o=await yL(a.endpoint,a.namespace,i.accessToken,t,n);return await rn(e,cn(r)),n.assertCurrent(),o}catch(o){throw o instanceof gr&&401===o.status&&await LL(e,o,cn(r)),o}}const ML=["issues.list","projects.list","teams.list"];function KL(e){const{providerId:t,configuration:n}=e;if("mcp"===n.method)return["mcp.tools.list"];const r=["provider.read"];"github"!==t&&"codeberg"!==t||r.push("provider.repositories.read"),"s3"===t&&r.push("provider.objects.read");const i=e.grants.some(e=>"user"===e.actor&&e.grantedScopes.includes("guilds"));return"discord"===t&&i&&r.push("provider.guilds.read"),r}function FL(e,t,n){return n?{id:e,label:t,url:n}:{id:e,label:t}}function GL(e){return e.map(({id:e,label:t,url:n})=>FL(e,t,n))}const BL={connections:ct,native:on,allowed:e=>In(e.providerId,e.configuration.method,e.configuration.parameters).available,invokeNative:(e,t)=>Lw(e.configuration.method,e.providerId).invoke(e.connectionId,t,{}),invokeLinear:async function(e,t){if("issues.list"===t){const t=await RP(e,"issues.list");return{label:"Linear issues",items:GL((Array.isArray(t)?t:[]).map(e=>"identifier"in e?FL(e.identifier,e.title,e.url):FL(e.id,e.id)))}}if("projects.list"===t){const t=await RP(e,"projects.list");return{label:"Linear projects",items:GL((Array.isArray(t)?t:[]).map(e=>"name"in e&&"url"in e?FL(e.id,e.name,e.url):FL(e.id,e.id)))}}const n=await RP(e,"teams.list");return{label:"Linear teams",items:GL((Array.isArray(n)?n:[]).map(e=>({id:"key"in e?e.key:e.id,label:"name"in e?e.name:e.id})))}}};function VL(e=BL){const t=()=>e.connections().flatMap(t=>{const n={id:t.connectionId,label:t.displayName,provider:t.providerId},r=e.native(t.connectionId);return r?"connected"===r.status&&e.allowed(r)?[{...n,operations:KL(r),run:async t=>{const n=await e.invokeNative(r,t);return{label:n.label,items:GL(n.items)}}}]:[]:"linear"!==t.providerId||"active"!==t.status||ot(t)?[]:[{...n,operations:ML,run:t=>e.invokeLinear(n.id,t)}]});return{list:()=>t().map(({run:e,...t})=>t),invoke:async({connection:e,operation:n,input:r,signal:i})=>{const a=t().find(t=>t.id===e);if(!a||!a.operations.includes(n))throw new Error("Select a supported operation");if(Object.keys(r).length>0)throw new Ji;return function(e,t){return new Promise((n,r)=>{const i=()=>r(new Error("aborted"));if(t.aborted)return i();t.addEventListener("abort",i,{once:!0}),e.then(n,r).finally(()=>t.removeEventListener("abort",i))})}(a.run(n),i)}}}export{yR as $,KR as A,Ep as B,wL as C,eL as D,WR as E,kL as F,cL as G,xL as H,Fx as I,Mx as J,qx as K,Lx as L,Ax as M,Rw as N,Lw as O,tT as P,NT as Q,LT as R,CT as S,EE as T,wA as U,zE as V,Yd as W,Bw as X,AL as Y,Fw as Z,Kw as _,HA as a,wI as a0,TL as a1,zL as a2,DL as a3,OL as a4,UL as a5,qL as a6,vx as a7,yx as a8,PL as a9,wx as aa,VL as ab,MR as ac,Mv as ad,wc as ae,yc as af,kc as ag,bc as ah,xc as ai,Ic as aj,al as ak,UR as al,ml as am,Dl as an,cl as ao,ll as ap,Tc as aq,lc as ar,YN as as,bE as b,ZA as c,lv as d,gv as e,kv as f,Cv as g,kP as h,l_ as i,Pw as j,QR as k,fj as l,lL as m,Ew as n,JR as o,Nw as p,dL as q,yv as r,mL as s,HR as t,YR as u,gL as v,VR as w,sL as x,ok as y,Fk as z};