@vm0/cli 9.230.1 → 9.230.4

package/{search-PMBMP2WF.js → search-RCTLN4DY.js}

@@ -3,20 +3,20 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   runLogsSearch
-} from "./chunk-FGQ7QX47.js";
+} from "./chunk-IYKGIKEB.js";
 import {
   formatIsoTimestamp,
   isUUID,
   parseBoundedLogCount,
   parseSearchQuery,
   parseTime
-} from "./chunk-MOKD52IX.js";
+} from "./chunk-BM47JSBX.js";
 import "./chunk-DKOCDBW4.js";
-import "./chunk-A7X7PDKM.js";
-import "./chunk-2DUDMR6E.js";
+import "./chunk-DRXISO7V.js";
+import "./chunk-X7URFQJA.js";
 import {
   searchZeroChat
-} from "./chunk-4BYCW2NN.js";
+} from "./chunk-UZWLQTHX.js";
 import "./chunk-LTDQISD7.js";
 import {
   withErrorHandler
@@ -201,4 +201,4 @@ export {
   buildSlackRecipe,
   zeroSearchCommand
 };
-//# sourceMappingURL=search-PMBMP2WF.js.map
+//# sourceMappingURL=search-RCTLN4DY.js.map

package/{secret-JPPVGIEZ.js → secret-JIHOD7IV.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   getConnectorStoredSecretDisplayInfo
-} from "./chunk-2DUDMR6E.js";
+} from "./chunk-X7URFQJA.js";
 import {
   isInteractive,
   promptConfirm,
@@ -13,7 +13,7 @@ import {
   deleteZeroSecret,
   listZeroSecrets,
   setZeroSecret
-} from "./chunk-4BYCW2NN.js";
+} from "./chunk-UZWLQTHX.js";
 import "./chunk-LTDQISD7.js";
 import {
   withErrorHandler
@@ -160,4 +160,4 @@ var zeroSecretCommand = new Command().name("secret").description("Read or write
 export {
   zeroSecretCommand
 };
-//# sourceMappingURL=secret-JPPVGIEZ.js.map
+//# sourceMappingURL=secret-JIHOD7IV.js.map

package/{slack-RQBBWCAL.js → slack-6DPIKDZ6.js}

@@ -6,7 +6,7 @@ import {
   downloadSlackFile,
   initSlackFileUpload,
   sendSlackMessage
-} from "./chunk-4BYCW2NN.js";
+} from "./chunk-UZWLQTHX.js";
 import "./chunk-LTDQISD7.js";
 import {
   withErrorHandler
@@ -220,4 +220,4 @@ Examples:
 export {
   zeroSlackCommand
 };
-//# sourceMappingURL=slack-RQBBWCAL.js.map
+//# sourceMappingURL=slack-6DPIKDZ6.js.map

package/{telegram-Y4UEQ4H2.js → telegram-46WGNRQN.js}

@@ -7,7 +7,7 @@ import {
   initTelegramFileUpload,
   listTelegramBots,
   sendTelegramMessage
-} from "./chunk-4BYCW2NN.js";
+} from "./chunk-UZWLQTHX.js";
 import "./chunk-LTDQISD7.js";
 import {
   withErrorHandler
@@ -335,4 +335,4 @@ Examples:
 export {
   zeroTelegramCommand
 };
-//# sourceMappingURL=telegram-Y4UEQ4H2.js.map
+//# sourceMappingURL=telegram-46WGNRQN.js.map

package/{variable-IXGY35RI.js → variable-Q5JJM456.js}

@@ -9,7 +9,7 @@ import {
   deleteZeroVariable,
   listZeroVariables,
   setZeroVariable
-} from "./chunk-4BYCW2NN.js";
+} from "./chunk-UZWLQTHX.js";
 import "./chunk-LTDQISD7.js";
 import {
   withErrorHandler
@@ -117,4 +117,4 @@ var zeroVariableCommand = new Command().name("variable").description("Read or wr
 export {
   zeroVariableCommand
 };
-//# sourceMappingURL=variable-IXGY35RI.js.map
+//# sourceMappingURL=variable-Q5JJM456.js.map

package/{web-ODQF2Y5H.js → web-3P6WWQD2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
-import "./chunk-4BYCW2NN.js";
+import "./chunk-UZWLQTHX.js";
 import "./chunk-LTDQISD7.js";
 import {
   downloadWebFile,
@@ -106,4 +106,4 @@ Examples:
 export {
   zeroWebCommand
 };
-//# sourceMappingURL=web-ODQF2Y5H.js.map
+//# sourceMappingURL=web-3P6WWQD2.js.map

package/{whoami-E3VSVVAB.js → whoami-SAMXOXKD.js}

@@ -4,15 +4,15 @@ const require = __createRequire(import.meta.url);
 import {
   loadConnectorPermissionInfos,
   policyIcon
-} from "./chunk-K6X64AN6.js";
+} from "./chunk-DCL3INIH.js";
 import {
   permissionGrantsToFirewallPolicies
-} from "./chunk-DV2C47TT.js";
+} from "./chunk-ZAEOJMGS.js";
 import {
   getZeroAgentUserConnectors,
   listZeroConnectors,
   listZeroUserPermissionGrants
-} from "./chunk-4BYCW2NN.js";
+} from "./chunk-UZWLQTHX.js";
 import "./chunk-LTDQISD7.js";
 import {
   getActiveOrg,
@@ -192,4 +192,4 @@ Notes:
 export {
   zeroWhoamiCommand
 };
-//# sourceMappingURL=whoami-E3VSVVAB.js.map
+//# sourceMappingURL=whoami-SAMXOXKD.js.map

package/{workflow-MLHPXBJN.js → workflow-TJSYKQYS.js}

@@ -19,7 +19,7 @@ import {
   listWorkflows,
   updateWorkflow,
   updateWorkflowTrigger
-} from "./chunk-4BYCW2NN.js";
+} from "./chunk-UZWLQTHX.js";
 import "./chunk-LTDQISD7.js";
 import {
   withErrorHandler
@@ -1753,4 +1753,4 @@ Examples:
 export {
   zeroWorkflowCommand
 };
-//# sourceMappingURL=workflow-MLHPXBJN.js.map
+//# sourceMappingURL=workflow-TJSYKQYS.js.map

package/zero.js

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   configureGlobalProxyFromEnv
-} from "./chunk-OO5JUGQM.js";
+} from "./chunk-QVBF2OFH.js";
 import {
   decodeZeroTokenPayload
 } from "./chunk-LRHXR7JT.js";
@@ -53,70 +53,70 @@ var ZERO_COMMAND_DEFINITIONS = [
     name: "org",
     description: "Manage organization settings, members, and providers",
     load: async () => {
-      return (await import("./org-RBJLKWO7.js")).zeroOrgCommand;
+      return (await import("./org-JI53X3DI.js")).zeroOrgCommand;
     }
   },
   {
     name: "model",
     description: "List available models and model-switching guidance",
     load: async () => {
-      return (await import("./model-XYLACQOK.js")).zeroModelCommand;
+      return (await import("./model-DQV6L4V3.js")).zeroModelCommand;
     }
   },
   {
     name: "model-provider",
     description: "Inspect model provider routing",
     load: async () => {
-      return (await import("./model-provider-T5BUAFTL.js")).zeroModelProviderCommand;
+      return (await import("./model-provider-OIGVYGYF.js")).zeroModelProviderCommand;
     }
   },
   {
     name: "agent",
     description: "View or manage zero agents",
     load: async () => {
-      return (await import("./agent-LB5KE3ZT.js")).zeroAgentCommand;
+      return (await import("./agent-WQXH6ARK.js")).zeroAgentCommand;
     }
   },
   {
     name: "connector",
     description: "Check third-party service connections (GitHub, Slack, etc.)",
     load: async () => {
-      return (await import("./connector-GVYZQZY5.js")).zeroConnectorCommand;
+      return (await import("./connector-EVA7XU3V.js")).zeroConnectorCommand;
     }
   },
   {
     name: "relationship",
     description: "Query relationship memory",
     load: async () => {
-      return (await import("./relationship-JU7CJMLI.js")).zeroRelationshipCommand;
+      return (await import("./relationship-KXW6PXHV.js")).zeroRelationshipCommand;
     }
   },
   {
     name: "memory",
     description: "Recall structured memory",
     load: async () => {
-      return (await import("./memory-5HHRESRW.js")).zeroMemoryCommand;
+      return (await import("./memory-233X2H7N.js")).zeroMemoryCommand;
     }
   },
   {
     name: "credit",
     description: "Create a Stripe checkout link to buy credits",
     load: async () => {
-      return (await import("./credit-DTQJ5UIY.js")).zeroCreditCommand;
+      return (await import("./credit-7YD43KT4.js")).zeroCreditCommand;
     }
   },
   {
     name: "doctor",
     description: "Diagnose runtime issues (connector health, permission denials)",
     load: async () => {
-      return (await import("./doctor-DD6XTSRQ.js")).zeroDoctorCommand;
+      return (await import("./doctor-LOMSVTSN.js")).zeroDoctorCommand;
     }
   },
   {
     name: "preference",
     description: "View or update user preferences (timezone, notifications)",
     load: async () => {
-      return (await import("./preference-OIU6AQ3D.js")).zeroPreferenceCommand;
+      return (await import("./preference-XRPJ24RY.js")).zeroPreferenceCommand;
     }
   },
   {
@@ -137,119 +137,119 @@ var ZERO_COMMAND_DEFINITIONS = [
     name: "secret",
     description: "Read or write secrets (API keys, tokens)",
     load: async () => {
-      return (await import("./secret-JPPVGIEZ.js")).zeroSecretCommand;
+      return (await import("./secret-JIHOD7IV.js")).zeroSecretCommand;
     }
   },
   {
     name: "github",
     description: "Upload and download GitHub files",
     load: async () => {
-      return (await import("./github-6CCMZ4LG.js")).zeroGithubCommand;
+      return (await import("./github-SZPXZBEQ.js")).zeroGithubCommand;
     }
   },
   {
     name: "slack",
     description: "Send messages, upload files, and download files from Slack as the bot",
     load: async () => {
-      return (await import("./slack-RQBBWCAL.js")).zeroSlackCommand;
+      return (await import("./slack-6DPIKDZ6.js")).zeroSlackCommand;
     }
   },
   {
     name: "telegram",
     description: "Inspect bots, send messages, upload files, and download files from Telegram",
     load: async () => {
-      return (await import("./telegram-Y4UEQ4H2.js")).zeroTelegramCommand;
+      return (await import("./telegram-46WGNRQN.js")).zeroTelegramCommand;
     }
   },
   {
     name: "phone",
     description: "Send AgentPhone messages, upload files, and download media",
     load: async () => {
-      return (await import("./phone-NMYRQQVE.js")).zeroPhoneCommand;
+      return (await import("./phone-EX5GABHZ.js")).zeroPhoneCommand;
     }
   },
   {
     name: "variable",
     description: "Read or write non-sensitive configuration values",
     load: async () => {
-      return (await import("./variable-IXGY35RI.js")).zeroVariableCommand;
+      return (await import("./variable-Q5JJM456.js")).zeroVariableCommand;
     }
   },
   {
     name: "logs",
     description: "View and search agent run logs",
     load: async () => {
-      return (await import("./logs-SV3GR6H4.js")).zeroLogsCommand;
+      return (await import("./logs-KS6P63MI.js")).zeroLogsCommand;
     }
   },
   {
     name: "search",
     description: "Search logs, chat, or get a recipe for external sources",
     load: async () => {
-      return (await import("./search-PMBMP2WF.js")).zeroSearchCommand;
+      return (await import("./search-RCTLN4DY.js")).zeroSearchCommand;
     }
   },
   {
     name: "chat",
     description: "Manage the current web chat thread",
     load: async () => {
-      return (await import("./chat-YH5ZJPT5.js")).zeroChatCommand;
+      return (await import("./chat-Z5RQHEOS.js")).zeroChatCommand;
     }
   },
   {
     name: "resource",
     description: "Pull registry resources from private R2-backed archives",
     load: async () => {
-      return (await import("./resource-N4PG53FX.js")).zeroResourceCommand;
+      return (await import("./resource-OGBJZOB7.js")).zeroResourceCommand;
     }
   },
   {
     name: "whoami",
     description: "Show agent identity, run ID, and capabilities",
     load: async () => {
-      return (await import("./whoami-E3VSVVAB.js")).zeroWhoamiCommand;
+      return (await import("./whoami-SAMXOXKD.js")).zeroWhoamiCommand;
     }
   },
   {
     name: "workflow",
     description: "Manage workflows",
     load: async () => {
-      return (await import("./workflow-MLHPXBJN.js")).zeroWorkflowCommand;
+      return (await import("./workflow-TJSYKQYS.js")).zeroWorkflowCommand;
     }
   },
   {
     name: "goal",
     description: "Manage the current thread goal",
     load: async () => {
-      return (await import("./goal-XQYPWGDN.js")).zeroGoalCommand;
+      return (await import("./goal-24AZP5AU.js")).zeroGoalCommand;
     }
   },
   {
     name: "developer-support",
     description: "Submit a diagnostic report to the dev team",
     load: async () => {
-      return (await import("./developer-support-VKFEXFA3.js")).zeroDeveloperSupportCommand;
+      return (await import("./developer-support-AHY2HQMG.js")).zeroDeveloperSupportCommand;
     }
   },
   {
     name: "computer-use",
     description: "Desktop app computer use through Zero CLI",
     load: async () => {
-      return (await import("./computer-use-ALW7CJA7.js")).zeroComputerUseCommand;
+      return (await import("./computer-use-5WJGBUXO.js")).zeroComputerUseCommand;
     }
   },
   {
     name: "generate",
     description: "Generate assets via vm0's built-in pipelines or get connector skill-invocation guidance",
     load: async () => {
-      return (await import("./generate-5D7TNQOU.js")).generateCommand;
+      return (await import("./generate-U2GRXN4E.js")).generateCommand;
     }
   },
   {
     name: "web",
     description: "Upload and download files via the web chat endpoint",
     load: async () => {
-      return (await import("./web-ODQF2Y5H.js")).zeroWebCommand;
+      return (await import("./web-3P6WWQD2.js")).zeroWebCommand;
     }
   },
   {
@@ -263,21 +263,21 @@ var ZERO_COMMAND_DEFINITIONS = [
     name: "host",
     description: "Publish static sites and clone owned hosted site files",
     load: async () => {
-      return (await import("./host-ARGVMZQ5.js")).zeroHostCommand;
+      return (await import("./host-S5PS7DQP.js")).zeroHostCommand;
     }
   },
   {
     name: "maps",
     description: "Use managed zero maps services",
     load: async () => {
-      return (await import("./maps-OKJMSBTE.js")).zeroMapsCommand;
+      return (await import("./maps-HLSSVYSF.js")).zeroMapsCommand;
     }
   },
   {
     name: "banking",
     description: "Use managed zero banking services",
     load: async () => {
-      return (await import("./banking-EOZMEOVX.js")).zeroBankingCommand;
+      return (await import("./banking-DYCRAHX3.js")).zeroBankingCommand;
     }
   }
 ];
@@ -386,7 +386,7 @@ function registerZeroCommands(prog, commands) {
 var program = new Command();
 program.name("zero").description(
   "Zero CLI \u2014 interact with the zero platform from inside the sandbox"
-).version("9.230.1").addHelpText("after", () => {
+).version("9.230.4").addHelpText("after", () => {
   return buildZeroHelpText();
 });
 if (process.argv[1]?.endsWith("zero.js") || process.argv[1]?.endsWith("zero.ts") || process.argv[1]?.endsWith("zero")) {

package/chunk-2DUDMR6E.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../packages/connectors/src/connector-utils.ts"],"sourcesContent":["import {\n  CONNECTOR_TYPE_KEYS,\n  CONNECTOR_TYPES,\n  connectorAuthMethodIdSchema,\n  type ConnectorAuthMethodConfig,\n  type ConnectorAuthMethodId,\n  type ConnectorAuthCodeGrantAuthMethodId,\n  type ConnectorDeviceAuthGrantAuthMethodId,\n  type ConnectorExternalCodeGrantAuthMethodId,\n  type ConnectorAuthMethodIds,\n  type ConnectorAuthMethodIdsByAccessKind,\n  type ConnectorAuthMethodIdsByGrantKind,\n  type ConnectorAuthMethodIdsByRevokeKind,\n  type ConnectorTypesByAccessKind,\n  type ConnectorTypesByGrantKind,\n  type ConnectorTypesByRevokeKind,\n  type ConnectorAuthClientConfigForMethod,\n  type ConnectorAuthMethodConfigFor,\n  type RefreshTokenAccessConnectorType,\n  type ConnectorAccessConfig,\n  type ConnectorAccessKind,\n  type ConnectorBrowserAuthCallbackOrigin,\n  type ConnectorAuthCodeCallbackOrigin,\n  type ConnectorAuthCodeGrantConfig,\n  type ConnectorAuthClientConfig,\n  type ConnectorDeviceAuthGrantConfig,\n  type ConnectorExternalCodeGrantConfig,\n  type ConnectorOpenIdAuthGrantConfig,\n  type ConnectorDeviceAuthStartOptionConfig,\n  type ConnectorDeviceAuthStartOptions,\n  type ConnectorDeviceAuthStartOptionsConfig,\n  type ConnectorEnvBindings,\n  type ConnectorGenerationType,\n  type ConnectorGrantOutputBindings,\n  type ConnectorGrantConfig,\n  type ConnectorGrantKind,\n  type ConnectorManualGrantFieldConfig,\n  type ConnectorPlatformSecretName,\n  type ConnectorRefreshTokenInputValueRef,\n  type ConnectorRefreshTokenInputBindings,\n  type ConnectorRefreshTokenOutputBindings,\n  type ConnectorRevokeInputBindings,\n  type ConnectorRevokeKind,\n  type ConnectorSecretValueRef,\n  type ConnectorOutputValueRef,\n  type ConnectorVariableValueRef,\n  type ConnectorEnvBindingValue,\n  type ConnectorType,\n  type AuthCodeGrantConnectorType,\n  type DeviceAuthGrantConnectorType,\n  type ExternalCodeGrantConnectorType,\n  type OpenIdAuthGrantConnectorType,\n  type ConnectorOpenIdAuthGrantAuthMethodId,\n  type DynamicPublicConnectorAuthClientConfig,\n  type StaticConfidentialConnectorAuthClientConfig,\n  type StaticPublicConnectorAuthClientConfig,\n} from \"./connectors\";\nimport type { FeatureSwitchKey } from \"./feature-switch-key\";\n\nconst CONNECTOR_AUTH_METHOD_PRIORITY = {\n  oauth: 0,\n  openid: 1,\n  cli: 2,\n  \"api-token\": 3,\n  api: 4,\n} as const satisfies Record<ConnectorAuthMethodId, number>;\nconst CONNECTOR_SECRET_REF_PREFIX = \"$secrets.\";\nconst CONNECTOR_VARIABLE_REF_PREFIX = \"$vars.\";\nconst DEFAULT_AUTH_CODE_CALLBACK_ORIGIN: ConnectorAuthCodeCallbackOrigin =\n  \"web\";\n\nfunction connectorAuthMethodPriority(\n  authMethod: ConnectorAuthMethodId,\n): number {\n  return CONNECTOR_AUTH_METHOD_PRIORITY[authMethod];\n}\n\nexport function getConfiguredConnectorAuthMethodIds(\n  type: ConnectorType,\n): ConnectorAuthMethodId[] {\n  // Configured methods are raw registry entries; callers apply availability filters.\n  return Object.keys(CONNECTOR_TYPES[type].authMethods)\n    .map((authMethod) => {\n      return connectorAuthMethodIdSchema.parse(authMethod);\n    })\n    .sort((a, b) => {\n      const priorityDiff =\n        connectorAuthMethodPriority(a) - connectorAuthMethodPriority(b);\n      return priorityDiff === 0 ? a.localeCompare(b) : priorityDiff;\n    });\n}\n\n/**\n * Connector utility vocabulary:\n *\n * - Available auth methods are user-selectable connection flows after\n *   feature-switch and surface policy filtering.\n * - Runtime available connector types are connector types the current server\n *   environment can offer as connection candidates.\n * - User connected connector types come from persisted connector rows.\n * - Runtime injection happens later when a run receives environment entries, secrets,\n *   variables, and firewall context.\n */\n\n/**\n * Get one auth method config for a connector type.\n */\nexport function getConnectorAuthMethod<\n  Type extends ConnectorType,\n  Method extends ConnectorAuthMethodIds<Type>,\n>(type: Type, authMethod: Method): ConnectorAuthMethodConfigFor<Type, Method>;\nexport function getConnectorAuthMethod(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthMethodConfig | undefined;\nexport function getConnectorAuthMethod(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthMethodConfig | undefined {\n  for (const [methodId, method] of Object.entries(\n    CONNECTOR_TYPES[type].authMethods,\n  )) {\n    if (methodId === authMethod) {\n      return method;\n    }\n  }\n  return undefined;\n}\n\nexport function getConnectorAuthMethodIdsForGrantKind<\n  Type extends ConnectorType,\n  Kind extends ConnectorGrantKind,\n>(\n  type: Type,\n  grantKind: Kind,\n): ConnectorAuthMethodIdsByGrantKind<Type, Kind>[] {\n  return getConfiguredConnectorAuthMethodIds(type).filter(\n    (\n      authMethod,\n    ): authMethod is ConnectorAuthMethodIdsByGrantKind<Type, Kind> => {\n      return connectorAuthMethodHasGrantKind(type, authMethod, grantKind);\n    },\n  );\n}\n\nfunction connectorAuthMethodHasAccessKind<\n  Type extends ConnectorType,\n  Kind extends ConnectorAccessKind,\n>(\n  type: Type,\n  authMethod: string,\n  accessKind: Kind,\n): authMethod is ConnectorAuthMethodIdsByAccessKind<Type, Kind> {\n  return getConnectorAuthMethod(type, authMethod)?.access.kind === accessKind;\n}\n\nexport function getConnectorAuthMethodIdsForAccessKind<\n  Type extends ConnectorType,\n  Kind extends ConnectorAccessKind,\n>(\n  type: Type,\n  accessKind: Kind,\n): ConnectorAuthMethodIdsByAccessKind<Type, Kind>[] {\n  return getConfiguredConnectorAuthMethodIds(type).filter(\n    (\n      authMethod,\n    ): authMethod is ConnectorAuthMethodIdsByAccessKind<Type, Kind> => {\n      return connectorAuthMethodHasAccessKind(type, authMethod, accessKind);\n    },\n  );\n}\n\nfunction connectorAuthMethodHasRevokeKind<\n  Type extends ConnectorType,\n  Kind extends ConnectorRevokeKind,\n>(\n  type: Type,\n  authMethod: string,\n  revokeKind: Kind,\n): authMethod is ConnectorAuthMethodIdsByRevokeKind<Type, Kind> {\n  return getConnectorAuthMethod(type, authMethod)?.revoke.kind === revokeKind;\n}\n\nexport function getConnectorAuthMethodIdsForRevokeKind<\n  Type extends ConnectorType,\n  Kind extends ConnectorRevokeKind,\n>(\n  type: Type,\n  revokeKind: Kind,\n): ConnectorAuthMethodIdsByRevokeKind<Type, Kind>[] {\n  return getConfiguredConnectorAuthMethodIds(type).filter(\n    (\n      authMethod,\n    ): authMethod is ConnectorAuthMethodIdsByRevokeKind<Type, Kind> => {\n      return connectorAuthMethodHasRevokeKind(type, authMethod, revokeKind);\n    },\n  );\n}\n\nfunction getManualGrantFields(\n  method: ConnectorAuthMethodConfig | undefined,\n): Record<string, ConnectorManualGrantFieldConfig> | undefined {\n  if (!method || method.grant.kind !== \"manual\") {\n    return undefined;\n  }\n  return method.grant.fields;\n}\n\nexport interface ConnectorManualGrantFieldNames {\n  readonly secrets: readonly string[];\n  readonly variables: readonly string[];\n}\n\nfunction manualGrantFieldNames(\n  fields: Record<string, ConnectorManualGrantFieldConfig>,\n): ConnectorManualGrantFieldNames {\n  const secretNames: string[] = [];\n  const variableNames: string[] = [];\n  for (const [name, cfg] of Object.entries(fields)) {\n    if (cfg.storage === \"variable\") {\n      variableNames.push(name);\n    } else {\n      secretNames.push(name);\n    }\n  }\n  return { secrets: secretNames, variables: variableNames };\n}\n\nexport function getConnectorManualGrantFieldNamesForAuthMethod(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorManualGrantFieldNames | null {\n  const fields = getManualGrantFields(getConnectorAuthMethod(type, authMethod));\n  return fields ? manualGrantFieldNames(fields) : null;\n}\n\nexport function getConnectorManualGrantFieldNames(\n  type: ConnectorType,\n): ConnectorManualGrantFieldNames | null {\n  const secretNames = new Set<string>();\n  const variableNames = new Set<string>();\n  for (const authMethod of getConfiguredConnectorAuthMethodIds(type)) {\n    const fields = getConnectorManualGrantFieldNamesForAuthMethod(\n      type,\n      authMethod,\n    );\n    if (!fields) {\n      continue;\n    }\n    fields.secrets.forEach((name) => {\n      secretNames.add(name);\n    });\n    fields.variables.forEach((name) => {\n      variableNames.add(name);\n    });\n  }\n\n  if (secretNames.size === 0 && variableNames.size === 0) {\n    return null;\n  }\n  return { secrets: [...secretNames], variables: [...variableNames] };\n}\n\nfunction addValueRefPrivateName(\n  valueRef: ConnectorOutputValueRef,\n  privateNames: Set<string>,\n): void {\n  if (isConnectorSecretValueRef(valueRef)) {\n    privateNames.add(connectorSecretNameFromValueRef(valueRef));\n    return;\n  }\n\n  privateNames.add(connectorVariableNameFromValueRef(valueRef));\n}\n\nfunction addStoragePrivateNames(\n  method: ConnectorAuthMethodConfig,\n  privateNames: Set<string>,\n): void {\n  for (const secret of method.storage.secrets) {\n    privateNames.add(secret);\n  }\n  for (const variable of method.storage.variables) {\n    privateNames.add(variable);\n  }\n}\n\nfunction addGrantPrivateNames(\n  method: ConnectorAuthMethodConfig,\n  privateNames: Set<string>,\n): void {\n  if (method.grant.kind === \"manual\") {\n    for (const fieldName of Object.keys(method.grant.fields)) {\n      privateNames.add(fieldName);\n    }\n  }\n  if (\"outputs\" in method.grant) {\n    for (const valueRef of Object.values(method.grant.outputs)) {\n      addValueRefPrivateName(valueRef, privateNames);\n    }\n  }\n}\n\nfunction addAccessPrivateNames(\n  method: ConnectorAuthMethodConfig,\n  privateNames: Set<string>,\n): void {\n  if (method.access.kind === \"none\") {\n    return;\n  }\n\n  for (const [envName, binding] of Object.entries(method.access.envBindings)) {\n    privateNames.add(envName);\n    addValueRefPrivateName(\n      typeof binding === \"string\" ? binding : binding.valueRef,\n      privateNames,\n    );\n  }\n  for (const platformSecret of method.access.platformSecrets ?? []) {\n    privateNames.add(platformSecret);\n  }\n}\n\nfunction addRefreshPrivateNames(\n  method: ConnectorAuthMethodConfig,\n  privateNames: Set<string>,\n): void {\n  if (method.access.kind !== \"refresh-token\") {\n    return;\n  }\n\n  for (const valueRef of Object.values(method.access.inputs)) {\n    addValueRefPrivateName(valueRef, privateNames);\n  }\n  for (const valueRef of Object.values(method.access.outputs)) {\n    addValueRefPrivateName(valueRef, privateNames);\n  }\n  for (const refreshableSecret of method.access.refreshableSecrets) {\n    privateNames.add(refreshableSecret);\n  }\n}\n\nfunction addRevokePrivateNames(\n  method: ConnectorAuthMethodConfig,\n  privateNames: Set<string>,\n): void {\n  if (method.revoke.kind !== \"token-revoke\") {\n    return;\n  }\n\n  for (const valueRef of Object.values(method.revoke.inputs)) {\n    addValueRefPrivateName(valueRef, privateNames);\n  }\n}\n\nfunction addClientPrivateNames(\n  method: ConnectorAuthMethodConfig,\n  privateNames: Set<string>,\n): void {\n  if (!(\"client\" in method) || !method.client) {\n    return;\n  }\n\n  if (\"clientIdEnv\" in method.client) {\n    privateNames.add(method.client.clientIdEnv);\n  }\n  if (\"clientSecretEnv\" in method.client) {\n    privateNames.add(method.client.clientSecretEnv);\n  }\n}\n\nfunction addPrivateNamesForAuthMethod(\n  method: ConnectorAuthMethodConfig,\n  privateNames: Set<string>,\n): void {\n  addStoragePrivateNames(method, privateNames);\n  addGrantPrivateNames(method, privateNames);\n  addAccessPrivateNames(method, privateNames);\n  addRefreshPrivateNames(method, privateNames);\n  addRevokePrivateNames(method, privateNames);\n  addClientPrivateNames(method, privateNames);\n}\n\n/**\n * Private connector implementation names that must not appear in public\n * catalog surfaces or public form ids.\n */\nexport function getConnectorAuthMethodPrivateNames(\n  type: ConnectorType,\n  authMethod: string,\n): readonly string[] {\n  const method = getConnectorAuthMethod(type, authMethod);\n  if (!method) {\n    return [];\n  }\n  const privateNames = new Set<string>();\n  addPrivateNamesForAuthMethod(method, privateNames);\n  return [...privateNames];\n}\n\nexport function getConnectorPrivateNames(\n  type: ConnectorType,\n  authMethods: readonly string[] = getConfiguredConnectorAuthMethodIds(type),\n): readonly string[] {\n  const privateNames = new Set<string>();\n  for (const authMethod of authMethods) {\n    for (const privateName of getConnectorAuthMethodPrivateNames(\n      type,\n      authMethod,\n    )) {\n      privateNames.add(privateName);\n    }\n  }\n  return [...privateNames];\n}\n\nfunction connectorAccessEnvBindings(\n  access: ConnectorAccessConfig,\n): ConnectorEnvBindings {\n  switch (access.kind) {\n    case \"static\":\n    case \"refresh-token\":\n      return access.envBindings;\n    case \"none\":\n      return {};\n  }\n}\n\nfunction connectorAccessRuntimeEnvBindings(\n  access: ConnectorAccessConfig,\n): ConnectorRuntimeEnvBindings {\n  return connectorRuntimeEnvBindings(connectorAccessEnvBindings(access));\n}\n\nfunction connectorAccessPlatformSecrets(\n  access: ConnectorAccessConfig,\n): readonly ConnectorPlatformSecretName[] {\n  switch (access.kind) {\n    case \"static\":\n    case \"refresh-token\":\n      return access.platformSecrets ?? [];\n    case \"none\":\n      return [];\n  }\n}\n\nexport type ConnectorAuthMethodAccessMetadata =\n  | {\n      readonly kind: \"static\";\n      readonly envBindings: ConnectorRuntimeEnvBindings;\n      readonly platformSecrets: readonly ConnectorPlatformSecretName[];\n    }\n  | {\n      readonly kind: \"refresh-token\";\n      readonly inputs: Readonly<\n        Record<string, ConnectorRefreshTokenInputMetadata>\n      >;\n      readonly outputs: Readonly<\n        Record<string, ConnectorRefreshTokenOutputMetadata>\n      >;\n      readonly refreshableSecrets: readonly string[];\n      readonly envBindings: ConnectorRuntimeEnvBindings;\n      readonly platformSecrets: readonly ConnectorPlatformSecretName[];\n    }\n  | {\n      readonly kind: \"none\";\n      readonly envBindings: ConnectorRuntimeEnvBindings;\n      readonly platformSecrets: readonly ConnectorPlatformSecretName[];\n    };\n\nexport type ConnectorRefreshTokenAccessMetadata = Extract<\n  ConnectorAuthMethodAccessMetadata,\n  { readonly kind: \"refresh-token\" }\n>;\n\nexport interface ConnectorRefreshTokenInputMetadata {\n  readonly valueRef: string;\n  readonly source: Extract<\n    ConnectorRuntimeBindingSource,\n    { readonly kind: \"connector-secret\" | \"connector-variable\" }\n  >;\n}\n\nexport interface ConnectorRefreshTokenOutputMetadata {\n  readonly valueRef: string;\n  readonly target: ConnectorOutputTarget;\n}\n\nexport interface ConnectorRefreshTokenMetadata {\n  readonly inputs: Readonly<Record<string, ConnectorRefreshTokenInputMetadata>>;\n  readonly outputs: Readonly<\n    Record<string, ConnectorRefreshTokenOutputMetadata>\n  >;\n  readonly refreshableSecrets: readonly string[];\n}\n\nexport interface ConnectorGrantOutputMetadata {\n  readonly valueRef: string;\n  readonly target: ConnectorOutputTarget;\n}\n\nexport type ConnectorAuthMethodGrantMetadata =\n  | {\n      readonly kind:\n        | \"auth-code\"\n        | \"openid-auth\"\n        | \"external-code\"\n        | \"device-auth\";\n      readonly outputs: Readonly<Record<string, ConnectorGrantOutputMetadata>>;\n    }\n  | {\n      readonly kind: \"manual\" | \"managed\";\n      readonly outputs: Readonly<Record<string, ConnectorGrantOutputMetadata>>;\n    };\n\nexport interface ConnectorRevokeInputMetadata {\n  readonly valueRef: string;\n  readonly secretName: string;\n}\n\nexport type ConnectorAuthMethodRevokeMetadata =\n  | {\n      readonly kind: \"token-revoke\";\n      readonly inputs: Readonly<Record<string, ConnectorRevokeInputMetadata>>;\n    }\n  | {\n      readonly kind: \"none\";\n      readonly inputs: Readonly<Record<string, ConnectorRevokeInputMetadata>>;\n    };\n\nexport type ConnectorRuntimeBindingSource =\n  | {\n      readonly kind: \"connector-secret\";\n      readonly name: string;\n    }\n  | {\n      readonly kind: \"connector-variable\";\n      readonly name: string;\n    }\n  | {\n      readonly kind: \"platform-secret\";\n      readonly name: ConnectorPlatformSecretName;\n    };\n\nexport type ConnectorOutputTarget =\n  | {\n      readonly kind: \"connector-secret\";\n      readonly name: string;\n    }\n  | {\n      readonly kind: \"connector-variable\";\n      readonly name: string;\n    };\n\nexport interface ConnectorRuntimeBindingEntry {\n  readonly envName: string;\n  readonly valueRef: string;\n  readonly optional: boolean;\n  readonly source: ConnectorRuntimeBindingSource;\n}\n\nexport interface ConnectorAuthMethodRuntimeMetadata {\n  readonly storage: {\n    readonly secrets: readonly string[];\n    readonly variables: readonly string[];\n  };\n  readonly runtimeBindings: readonly ConnectorRuntimeBindingEntry[];\n}\n\nfunction isConnectorSecretValueRef(\n  valueRef: ConnectorOutputValueRef,\n): valueRef is ConnectorSecretValueRef {\n  return valueRef.startsWith(CONNECTOR_SECRET_REF_PREFIX);\n}\n\nfunction connectorSecretNameFromValueRef(\n  valueRef: ConnectorSecretValueRef,\n): string {\n  return valueRef.slice(CONNECTOR_SECRET_REF_PREFIX.length);\n}\n\nfunction connectorVariableNameFromValueRef(\n  valueRef: ConnectorVariableValueRef,\n): string {\n  return valueRef.slice(CONNECTOR_VARIABLE_REF_PREFIX.length);\n}\n\nfunction connectorRefreshInputMetadata(\n  valueRef: ConnectorRefreshTokenInputValueRef,\n): ConnectorRefreshTokenInputMetadata {\n  if (isConnectorSecretValueRef(valueRef)) {\n    return {\n      valueRef,\n      source: {\n        kind: \"connector-secret\",\n        name: connectorSecretNameFromValueRef(valueRef),\n      },\n    };\n  }\n\n  const variableName = connectorVariableNameFromValueRef(valueRef);\n  return {\n    valueRef,\n    source: { kind: \"connector-variable\", name: variableName },\n  };\n}\n\nfunction connectorRefreshOutputMetadata(\n  valueRef: ConnectorOutputValueRef,\n): ConnectorRefreshTokenOutputMetadata {\n  return {\n    valueRef,\n    target: connectorOutputTargetFromValueRef(valueRef),\n  };\n}\n\nfunction connectorGrantOutputMetadata(\n  valueRef: ConnectorOutputValueRef,\n): ConnectorGrantOutputMetadata {\n  return connectorRefreshOutputMetadata(valueRef);\n}\n\nfunction connectorOutputTargetFromValueRef(\n  valueRef: ConnectorOutputValueRef,\n): ConnectorOutputTarget {\n  if (isConnectorSecretValueRef(valueRef)) {\n    return {\n      kind: \"connector-secret\",\n      name: connectorSecretNameFromValueRef(valueRef),\n    };\n  }\n\n  return {\n    kind: \"connector-variable\",\n    name: connectorVariableNameFromValueRef(valueRef),\n  };\n}\n\nfunction connectorRevokeInputMetadata(\n  valueRef: ConnectorSecretValueRef,\n): ConnectorRevokeInputMetadata {\n  return { valueRef, secretName: connectorSecretNameFromValueRef(valueRef) };\n}\n\nfunction connectorRefreshMetadata(args: {\n  readonly inputs: ConnectorRefreshTokenInputBindings;\n  readonly outputs: ConnectorRefreshTokenOutputBindings;\n  readonly refreshableSecrets: readonly string[];\n}): ConnectorRefreshTokenMetadata {\n  return {\n    inputs: Object.fromEntries(\n      Object.entries(args.inputs).map(([name, valueRef]) => {\n        return [name, connectorRefreshInputMetadata(valueRef)];\n      }),\n    ),\n    outputs: Object.fromEntries(\n      Object.entries(args.outputs).map(([name, valueRef]) => {\n        return [name, connectorRefreshOutputMetadata(valueRef)];\n      }),\n    ),\n    refreshableSecrets: [...args.refreshableSecrets],\n  };\n}\n\nexport function getConnectorAuthMethodAccessMetadata<\n  Type extends RefreshTokenAccessConnectorType,\n  Method extends ConnectorAuthMethodIdsByAccessKind<Type, \"refresh-token\">,\n>(type: Type, authMethod: Method): ConnectorRefreshTokenAccessMetadata;\nexport function getConnectorAuthMethodAccessMetadata(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthMethodAccessMetadata | undefined;\nexport function getConnectorAuthMethodAccessMetadata(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthMethodAccessMetadata | undefined {\n  const method = getConnectorAuthMethod(type, authMethod);\n  if (!method) {\n    return undefined;\n  }\n\n  switch (method.access.kind) {\n    case \"static\": {\n      return {\n        kind: \"static\",\n        envBindings: connectorAccessRuntimeEnvBindings(method.access),\n        platformSecrets: method.access.platformSecrets ?? [],\n      };\n    }\n    case \"refresh-token\":\n      return {\n        kind: \"refresh-token\",\n        ...connectorRefreshMetadata(method.access),\n        envBindings: connectorAccessRuntimeEnvBindings(method.access),\n        platformSecrets: method.access.platformSecrets ?? [],\n      };\n    case \"none\":\n      return {\n        kind: \"none\",\n        envBindings: {},\n        platformSecrets: [],\n      };\n  }\n}\n\nfunction connectorGrantOutputMetadataMap(\n  outputs: ConnectorGrantOutputBindings,\n): Record<string, ConnectorGrantOutputMetadata> {\n  return Object.fromEntries(\n    Object.entries(outputs).map(([name, valueRef]) => {\n      return [name, connectorGrantOutputMetadata(valueRef)];\n    }),\n  );\n}\n\nexport function getConnectorAuthMethodGrantMetadata(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthMethodGrantMetadata | undefined {\n  const method = getConnectorAuthMethod(type, authMethod);\n  if (!method) {\n    return undefined;\n  }\n\n  switch (method.grant.kind) {\n    case \"auth-code\":\n    case \"openid-auth\":\n    case \"external-code\":\n    case \"device-auth\":\n      return {\n        kind: method.grant.kind,\n        outputs: connectorGrantOutputMetadataMap(method.grant.outputs),\n      };\n    case \"manual\":\n    case \"managed\":\n      return {\n        kind: method.grant.kind,\n        outputs: {},\n      };\n  }\n}\n\nexport function getConnectorGrantOutputTarget(\n  metadata: ConnectorAuthMethodGrantMetadata,\n  outputName: string,\n): ConnectorOutputTarget | undefined {\n  return metadata.outputs[outputName]?.target;\n}\n\nfunction connectorRevokeInputMetadataMap(\n  inputs: ConnectorRevokeInputBindings,\n): Record<string, ConnectorRevokeInputMetadata> {\n  return Object.fromEntries(\n    Object.entries(inputs).map(([name, valueRef]) => {\n      return [name, connectorRevokeInputMetadata(valueRef)];\n    }),\n  );\n}\n\nexport function getConnectorAuthMethodRevokeMetadata(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthMethodRevokeMetadata | undefined {\n  const method = getConnectorAuthMethod(type, authMethod);\n  if (!method) {\n    return undefined;\n  }\n\n  switch (method.revoke.kind) {\n    case \"token-revoke\":\n      return {\n        kind: \"token-revoke\",\n        inputs: connectorRevokeInputMetadataMap(method.revoke.inputs),\n      };\n    case \"none\":\n      return {\n        kind: \"none\",\n        inputs: {},\n      };\n  }\n}\n\nexport function getConnectorRefreshOutputTarget(\n  metadata: ConnectorAuthMethodAccessMetadata,\n  outputName: string,\n): ConnectorOutputTarget | undefined {\n  return metadata.kind === \"refresh-token\"\n    ? metadata.outputs[outputName]?.target\n    : undefined;\n}\n\nexport function getConnectorRuntimeBindingSecretName(\n  metadata: ConnectorAuthMethodRuntimeMetadata,\n  envName: string,\n): string | undefined {\n  const binding = metadata.runtimeBindings.find((entry) => {\n    return (\n      entry.envName === envName && entry.source.kind === \"connector-secret\"\n    );\n  });\n  return binding?.source.kind === \"connector-secret\"\n    ? binding.source.name\n    : undefined;\n}\n\nexport function getConnectorRuntimeBindingPlatformSecretName(\n  metadata: ConnectorAuthMethodRuntimeMetadata,\n  envName: string,\n): ConnectorPlatformSecretName | undefined {\n  const binding = metadata.runtimeBindings.find((entry) => {\n    return entry.envName === envName && entry.source.kind === \"platform-secret\";\n  });\n  return binding?.source.kind === \"platform-secret\"\n    ? binding.source.name\n    : undefined;\n}\n\nexport function connectorRefreshMetadataHasRefreshableSecret(\n  metadata: ConnectorAuthMethodAccessMetadata,\n  secretName: string,\n): boolean {\n  return (\n    metadata.kind === \"refresh-token\" &&\n    metadata.refreshableSecrets.includes(secretName)\n  );\n}\n\nfunction connectorPlatformSecretSource(\n  secretName: string,\n  platformSecrets: readonly ConnectorPlatformSecretName[],\n): ConnectorPlatformSecretName | undefined {\n  return platformSecrets.find((platformSecret) => {\n    return platformSecret === secretName;\n  });\n}\n\nexport type ConnectorRuntimeEnvBindings = Record<\n  string,\n  ConnectorRefreshTokenInputValueRef\n>;\n\nfunction connectorEnvBindingValueRef(\n  binding: ConnectorEnvBindingValue,\n): ConnectorRefreshTokenInputValueRef {\n  return typeof binding === \"string\" ? binding : binding.valueRef;\n}\n\nfunction connectorEnvBindingIsOptional(\n  binding: ConnectorEnvBindingValue,\n): boolean {\n  return typeof binding === \"string\" ? false : (binding.optional ?? false);\n}\n\nfunction connectorRuntimeEnvBindings(\n  envBindings: ConnectorEnvBindings,\n): ConnectorRuntimeEnvBindings {\n  return Object.fromEntries(\n    Object.entries(envBindings).map(([envName, binding]) => {\n      return [envName, connectorEnvBindingValueRef(binding)];\n    }),\n  );\n}\n\nfunction connectorRuntimeBindingEntries(args: {\n  readonly envBindings: ConnectorEnvBindings;\n  readonly platformSecrets: readonly ConnectorPlatformSecretName[];\n}): ConnectorRuntimeBindingEntry[] {\n  const entries: ConnectorRuntimeBindingEntry[] = [];\n  for (const [envName, binding] of Object.entries(args.envBindings)) {\n    const valueRef = connectorEnvBindingValueRef(binding);\n    const optional = connectorEnvBindingIsOptional(binding);\n    if (valueRef.startsWith(CONNECTOR_SECRET_REF_PREFIX)) {\n      const secretName = valueRef.slice(CONNECTOR_SECRET_REF_PREFIX.length);\n      const platformSecret = connectorPlatformSecretSource(\n        secretName,\n        args.platformSecrets,\n      );\n      entries.push({\n        envName,\n        valueRef,\n        optional,\n        source: platformSecret\n          ? { kind: \"platform-secret\", name: platformSecret }\n          : { kind: \"connector-secret\", name: secretName },\n      });\n      continue;\n    }\n\n    if (valueRef.startsWith(CONNECTOR_VARIABLE_REF_PREFIX)) {\n      entries.push({\n        envName,\n        valueRef,\n        optional,\n        source: {\n          kind: \"connector-variable\",\n          name: valueRef.slice(CONNECTOR_VARIABLE_REF_PREFIX.length),\n        },\n      });\n    }\n  }\n  return entries;\n}\n\nexport function getConnectorAuthMethodRuntimeMetadata(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthMethodRuntimeMetadata | undefined {\n  const method = getConnectorAuthMethod(type, authMethod);\n  if (!method) {\n    return undefined;\n  }\n  const platformSecrets = connectorAccessPlatformSecrets(method.access);\n  return {\n    storage: {\n      secrets: [...method.storage.secrets],\n      variables: [...method.storage.variables],\n    },\n    runtimeBindings: connectorRuntimeBindingEntries({\n      envBindings: connectorAccessEnvBindings(method.access),\n      platformSecrets,\n    }),\n  };\n}\n\nexport function connectorAuthMethodHasGrantKind<\n  Type extends ConnectorType,\n  Kind extends ConnectorGrantKind,\n>(\n  type: Type,\n  authMethod: string,\n  grantKind: Kind,\n): authMethod is ConnectorAuthMethodIdsByGrantKind<Type, Kind> {\n  const method = getConnectorAuthMethod(type, authMethod);\n  return method?.grant.kind === grantKind;\n}\n\nexport interface ConnectorAuthMethodRef {\n  readonly type: ConnectorType;\n  readonly authMethod: ConnectorAuthMethodId;\n}\n\nexport type ConnectorAuthMethodRefByGrantKind<Kind extends ConnectorGrantKind> =\n  {\n    readonly [Type in ConnectorTypesByGrantKind<Kind>]: {\n      readonly type: Type;\n      readonly authMethod: ConnectorAuthMethodIdsByGrantKind<Type, Kind>;\n    };\n  }[ConnectorTypesByGrantKind<Kind>];\n\nexport type ConnectorAuthMethodRefByAccessKind<\n  Kind extends ConnectorAccessKind,\n> = {\n  readonly [Type in ConnectorTypesByAccessKind<Kind>]: {\n    readonly type: Type;\n    readonly authMethod: ConnectorAuthMethodIdsByAccessKind<Type, Kind>;\n  };\n}[ConnectorTypesByAccessKind<Kind>];\n\nexport type ConnectorAuthMethodRefByRevokeKind<\n  Kind extends ConnectorRevokeKind,\n> = {\n  readonly [Type in ConnectorTypesByRevokeKind<Kind>]: {\n    readonly type: Type;\n    readonly authMethod: ConnectorAuthMethodIdsByRevokeKind<Type, Kind>;\n  };\n}[ConnectorTypesByRevokeKind<Kind>];\n\nexport function connectorAuthMethodRefHasGrantKind<\n  Kind extends ConnectorGrantKind,\n>(\n  authMethodRef: ConnectorAuthMethodRef,\n  grantKind: Kind,\n): authMethodRef is ConnectorAuthMethodRefByGrantKind<Kind> {\n  return (\n    getConnectorAuthMethod(authMethodRef.type, authMethodRef.authMethod)?.grant\n      .kind === grantKind\n  );\n}\n\nexport function connectorAuthMethodRefHasAccessKind<\n  Kind extends ConnectorAccessKind,\n>(\n  authMethodRef: ConnectorAuthMethodRef,\n  accessKind: Kind,\n): authMethodRef is ConnectorAuthMethodRefByAccessKind<Kind> {\n  return (\n    getConnectorAuthMethod(authMethodRef.type, authMethodRef.authMethod)?.access\n      .kind === accessKind\n  );\n}\n\nexport function connectorAuthMethodRefHasRevokeKind<\n  Kind extends ConnectorRevokeKind,\n>(\n  authMethodRef: ConnectorAuthMethodRef,\n  revokeKind: Kind,\n): authMethodRef is ConnectorAuthMethodRefByRevokeKind<Kind> {\n  return (\n    getConnectorAuthMethod(authMethodRef.type, authMethodRef.authMethod)?.revoke\n      .kind === revokeKind\n  );\n}\n\nexport function getConnectorAuthMethodAuthCodeGrantConfig<\n  Type extends AuthCodeGrantConnectorType,\n>(\n  type: Type,\n  authMethod: ConnectorAuthCodeGrantAuthMethodId<Type>,\n): ConnectorAuthCodeGrantConfig;\nexport function getConnectorAuthMethodAuthCodeGrantConfig(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthCodeGrantConfig | undefined;\nexport function getConnectorAuthMethodAuthCodeGrantConfig(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthCodeGrantConfig | undefined {\n  const grant = getConnectorAuthMethod(type, authMethod)?.grant;\n  return grant?.kind === \"auth-code\" ? grant : undefined;\n}\n\nexport function getConnectorAuthMethodOpenIdAuthGrantConfig<\n  Type extends OpenIdAuthGrantConnectorType,\n>(\n  type: Type,\n  authMethod: ConnectorOpenIdAuthGrantAuthMethodId<Type>,\n): ConnectorOpenIdAuthGrantConfig;\nexport function getConnectorAuthMethodOpenIdAuthGrantConfig(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorOpenIdAuthGrantConfig | undefined;\nexport function getConnectorAuthMethodOpenIdAuthGrantConfig(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorOpenIdAuthGrantConfig | undefined {\n  const grant = getConnectorAuthMethod(type, authMethod)?.grant;\n  return grant?.kind === \"openid-auth\" ? grant : undefined;\n}\n\nexport function getConnectorAuthMethodOpenIdAuthCallbackOrigin<\n  Type extends OpenIdAuthGrantConnectorType,\n>(\n  type: Type,\n  authMethod: ConnectorOpenIdAuthGrantAuthMethodId<Type>,\n): ConnectorBrowserAuthCallbackOrigin;\nexport function getConnectorAuthMethodOpenIdAuthCallbackOrigin(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorBrowserAuthCallbackOrigin | undefined;\nexport function getConnectorAuthMethodOpenIdAuthCallbackOrigin(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorBrowserAuthCallbackOrigin | undefined {\n  const grant = getConnectorAuthMethodOpenIdAuthGrantConfig(type, authMethod);\n  if (!grant) {\n    return undefined;\n  }\n  return grant.callbackOrigin ?? \"api\";\n}\n\nexport function getConnectorAuthMethodAuthCodeCallbackOrigin<\n  Type extends AuthCodeGrantConnectorType,\n>(\n  type: Type,\n  authMethod: ConnectorAuthCodeGrantAuthMethodId<Type>,\n): ConnectorAuthCodeCallbackOrigin;\nexport function getConnectorAuthMethodAuthCodeCallbackOrigin(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthCodeCallbackOrigin | undefined;\nexport function getConnectorAuthMethodAuthCodeCallbackOrigin(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthCodeCallbackOrigin | undefined {\n  const grant = getConnectorAuthMethodAuthCodeGrantConfig(type, authMethod);\n  if (!grant) {\n    return undefined;\n  }\n  return grant.callbackOrigin ?? DEFAULT_AUTH_CODE_CALLBACK_ORIGIN;\n}\n\nexport function connectorAuthCodeCallbacksUseOnlyApiOrigin(\n  type: AuthCodeGrantConnectorType,\n): boolean {\n  const authMethods = getConnectorAuthMethodIdsForGrantKind(type, \"auth-code\");\n  return authMethods.every((authMethod) => {\n    return (\n      getConnectorAuthMethodAuthCodeCallbackOrigin(type, authMethod) === \"api\"\n    );\n  });\n}\n\nexport function getConnectorAuthMethodExternalCodeGrantConfig<\n  Type extends ExternalCodeGrantConnectorType,\n>(\n  type: Type,\n  authMethod: ConnectorExternalCodeGrantAuthMethodId<Type>,\n): ConnectorExternalCodeGrantConfig;\nexport function getConnectorAuthMethodExternalCodeGrantConfig(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorExternalCodeGrantConfig | undefined;\nexport function getConnectorAuthMethodExternalCodeGrantConfig(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorExternalCodeGrantConfig | undefined {\n  const grant = getConnectorAuthMethod(type, authMethod)?.grant;\n  return grant?.kind === \"external-code\" ? grant : undefined;\n}\n\nexport function getConnectorAuthMethodDeviceAuthGrantConfig<\n  Type extends DeviceAuthGrantConnectorType,\n>(\n  type: Type,\n  authMethod: ConnectorDeviceAuthGrantAuthMethodId<Type>,\n): ConnectorDeviceAuthGrantConfig;\nexport function getConnectorAuthMethodDeviceAuthGrantConfig(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorDeviceAuthGrantConfig | undefined;\nexport function getConnectorAuthMethodDeviceAuthGrantConfig(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorDeviceAuthGrantConfig | undefined {\n  const grant = getConnectorAuthMethod(type, authMethod)?.grant;\n  return grant?.kind === \"device-auth\" ? grant : undefined;\n}\n\nexport function getConnectorAuthMethodDeviceAuthStartOptionsConfig<\n  Type extends DeviceAuthGrantConnectorType,\n>(\n  type: Type,\n  authMethod: ConnectorDeviceAuthGrantAuthMethodId<Type>,\n): ConnectorDeviceAuthStartOptionsConfig | undefined;\nexport function getConnectorAuthMethodDeviceAuthStartOptionsConfig(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorDeviceAuthStartOptionsConfig | undefined;\nexport function getConnectorAuthMethodDeviceAuthStartOptionsConfig(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorDeviceAuthStartOptionsConfig | undefined {\n  return getConnectorAuthMethodDeviceAuthGrantConfig(type, authMethod)\n    ?.startOptions;\n}\n\nexport type ConnectorDeviceAuthStartOptionsParseResult =\n  | {\n      readonly success: true;\n      readonly options: ConnectorDeviceAuthStartOptions;\n    }\n  | {\n      readonly success: false;\n      readonly message: string;\n    };\n\nfunction parseConnectorDeviceAuthStartOption(args: {\n  readonly type: ConnectorType;\n  readonly authMethod: string;\n  readonly optionName: string;\n  readonly config: ConnectorDeviceAuthStartOptionConfig;\n  readonly requestedValue: string | undefined;\n}): ConnectorDeviceAuthStartOptionsParseResult {\n  const value = args.requestedValue ?? args.config.defaultValue;\n  if (value === undefined) {\n    if (args.config.required) {\n      return {\n        success: false,\n        message: `${args.type} ${args.authMethod} device-auth start option ${args.optionName} is required`,\n      };\n    }\n    return { success: true, options: {} };\n  }\n\n  switch (args.config.kind) {\n    case \"select\": {\n      if (\n        !args.config.options.some((option) => {\n          return option.value === value;\n        })\n      ) {\n        return {\n          success: false,\n          message: `${args.type} ${args.authMethod} device-auth start option ${args.optionName} must be one of: ${args.config.options\n            .map((option) => {\n              return option.value;\n            })\n            .join(\", \")}`,\n        };\n      }\n      return { success: true, options: { [args.optionName]: value } };\n    }\n  }\n}\n\nfunction connectorDeviceAuthStartOptionValue(\n  options: ConnectorDeviceAuthStartOptions | undefined,\n  optionName: string,\n): string | undefined {\n  if (!options || !Object.hasOwn(options, optionName)) {\n    return undefined;\n  }\n  return options[optionName];\n}\n\nexport function parseConnectorDeviceAuthStartOptions(args: {\n  readonly type: ConnectorType;\n  readonly authMethod: string;\n  readonly options: ConnectorDeviceAuthStartOptions | undefined;\n}): ConnectorDeviceAuthStartOptionsParseResult {\n  const configuredOptions = getConnectorAuthMethodDeviceAuthStartOptionsConfig(\n    args.type,\n    args.authMethod,\n  );\n  const requestedOptionKeys = Object.keys(args.options ?? {});\n\n  if (!configuredOptions || Object.keys(configuredOptions).length === 0) {\n    if (requestedOptionKeys.length === 0) {\n      return { success: true, options: {} };\n    }\n    return {\n      success: false,\n      message: `${args.type} ${args.authMethod} device-auth start options are not supported: ${requestedOptionKeys.join(\", \")}`,\n    };\n  }\n\n  for (const optionName of requestedOptionKeys) {\n    if (!Object.hasOwn(configuredOptions, optionName)) {\n      return {\n        success: false,\n        message: `${args.type} ${args.authMethod} device-auth start option ${optionName} is not supported`,\n      };\n    }\n  }\n\n  const normalizedOptions: Record<string, string> = {};\n  for (const [optionName, config] of Object.entries(configuredOptions)) {\n    const parsedOption = parseConnectorDeviceAuthStartOption({\n      type: args.type,\n      authMethod: args.authMethod,\n      optionName,\n      config,\n      requestedValue: connectorDeviceAuthStartOptionValue(\n        args.options,\n        optionName,\n      ),\n    });\n    if (!parsedOption.success) {\n      return parsedOption;\n    }\n    for (const [parsedOptionName, parsedOptionValue] of Object.entries(\n      parsedOption.options,\n    )) {\n      normalizedOptions[parsedOptionName] = parsedOptionValue;\n    }\n  }\n\n  return { success: true, options: normalizedOptions };\n}\n\nfunction connectorGrantScopes(\n  grant: ConnectorGrantConfig | undefined,\n): readonly string[] {\n  switch (grant?.kind) {\n    case \"auth-code\":\n    case \"external-code\":\n    case \"device-auth\":\n      return grant.scopes;\n    case \"openid-auth\":\n    case \"manual\":\n    case \"managed\":\n    case undefined:\n      return [];\n  }\n}\n\nexport function getConnectorAuthMethodGrantScopes(\n  type: ConnectorType,\n  authMethod: string,\n): string[] {\n  return [\n    ...connectorGrantScopes(getConnectorAuthMethod(type, authMethod)?.grant),\n  ];\n}\n\nexport function getConnectorGenerationTypes(\n  type: ConnectorType,\n): readonly ConnectorGenerationType[] {\n  const config = CONNECTOR_TYPES[type];\n  return \"generation\" in config ? (config.generation ?? []) : [];\n}\n\nexport function getConnectorTags(type: ConnectorType): readonly string[] {\n  const config = CONNECTOR_TYPES[type];\n  return \"tags\" in config ? (config.tags ?? []) : [];\n}\n\nexport type ConnectorFeatureStates =\n  | Partial<Record<FeatureSwitchKey, boolean>>\n  | null\n  | undefined;\n\nexport type ApiAuthMethodPolicy =\n  | \"exclude\"\n  | \"include\"\n  | { readonly includeForTypes: readonly ConnectorType[] };\n\nexport interface AvailableConnectorAuthMethodsOptions {\n  readonly apiAuthMethodPolicy?: ApiAuthMethodPolicy;\n}\n\nexport function isConnectorAuthMethodAvailable(\n  type: ConnectorType,\n  authMethod: ConnectorAuthMethodId,\n  featureStates: ConnectorFeatureStates,\n): boolean {\n  const method = getConnectorAuthMethod(type, authMethod);\n  if (!method) {\n    return false;\n  }\n  if (method.visible === false) {\n    return false;\n  }\n  return !method.featureFlag || !!featureStates?.[method.featureFlag];\n}\n\nfunction shouldIncludeApiAuthMethod(\n  type: ConnectorType,\n  policy: ApiAuthMethodPolicy | undefined,\n): boolean {\n  switch (policy) {\n    case \"include\":\n      return true;\n    case \"exclude\":\n    case undefined:\n      return false;\n  }\n  return policy.includeForTypes.includes(type);\n}\n\n/**\n * Return user-selectable connector connection flows for a surface.\n *\n * This includes static visibility, feature-switch, and surface policy filtering.\n * It does not describe persisted connected state.\n */\nexport function getAvailableConnectorAuthMethodIds(\n  type: ConnectorType,\n  featureStates: ConnectorFeatureStates,\n  options: AvailableConnectorAuthMethodsOptions = {},\n): ConnectorAuthMethodId[] {\n  const apiAuthMethodPolicy = options.apiAuthMethodPolicy ?? \"exclude\";\n  const availableAuthMethodIds: ConnectorAuthMethodId[] = [];\n  const configuredAuthMethodIds = getConfiguredConnectorAuthMethodIds(type);\n\n  for (const authMethod of configuredAuthMethodIds) {\n    const method = getConnectorAuthMethod(type, authMethod);\n    switch (method?.grant.kind) {\n      case \"managed\": {\n        if (!shouldIncludeApiAuthMethod(type, apiAuthMethodPolicy)) {\n          continue;\n        }\n        break;\n      }\n      case \"openid-auth\":\n      case \"auth-code\":\n      case \"external-code\":\n      case \"device-auth\":\n      case \"manual\": {\n        break;\n      }\n      case undefined: {\n        continue;\n      }\n    }\n    if (isConnectorAuthMethodAvailable(type, authMethod, featureStates)) {\n      availableAuthMethodIds.push(authMethod);\n    }\n  }\n\n  return availableAuthMethodIds;\n}\n\nexport type ConnectorEnvReader = (name: string) => string | undefined;\n\nexport type StaticConfidentialConnectorAuthClient = {\n  readonly clientRegistration: \"static\";\n  readonly clientType: \"confidential\";\n  readonly clientId: string;\n  readonly clientSecret: string;\n};\n\nexport type StaticConfidentialConnectorAuthClientIdentity = {\n  readonly clientRegistration: \"static\";\n  readonly clientType: \"confidential\";\n  readonly clientId: string;\n};\n\nexport type StaticPublicConnectorAuthClient = {\n  readonly clientRegistration: \"static\";\n  readonly clientType: \"public\";\n  readonly clientId: string;\n};\n\nexport type DynamicPublicConnectorAuthClient = {\n  readonly clientRegistration: \"dynamic\";\n  readonly clientType: \"public\";\n};\n\nexport type StaticConnectorAuthClient =\n  | StaticConfidentialConnectorAuthClient\n  | StaticPublicConnectorAuthClient;\n\nexport type ConnectorAuthClient =\n  | StaticConnectorAuthClient\n  | DynamicPublicConnectorAuthClient;\n\nexport type ConnectorAuthClientIdentity =\n  | StaticConfidentialConnectorAuthClientIdentity\n  | StaticPublicConnectorAuthClient\n  | DynamicPublicConnectorAuthClient;\n\nexport type ConnectorAuthClientForConfig<\n  Client extends ConnectorAuthClientConfig,\n> = Client extends StaticConfidentialConnectorAuthClientConfig\n  ? StaticConfidentialConnectorAuthClient\n  : Client extends StaticPublicConnectorAuthClientConfig\n    ? StaticPublicConnectorAuthClient\n    : Client extends DynamicPublicConnectorAuthClientConfig\n      ? DynamicPublicConnectorAuthClient\n      : never;\n\nexport type ConnectorAuthClientForMethod<\n  Type extends ConnectorType,\n  Method extends ConnectorAuthMethodIds<Type>,\n> = ConnectorAuthClientForConfig<\n  ConnectorAuthClientConfigForMethod<Type, Method>\n>;\n\nexport type ConnectorAuthClientIdentityForConfig<\n  Client extends ConnectorAuthClientConfig,\n> = Client extends StaticConfidentialConnectorAuthClientConfig\n  ? StaticConfidentialConnectorAuthClientIdentity\n  : Client extends StaticPublicConnectorAuthClientConfig\n    ? StaticPublicConnectorAuthClient\n    : Client extends DynamicPublicConnectorAuthClientConfig\n      ? DynamicPublicConnectorAuthClient\n      : never;\n\nexport type ConnectorAuthClientIdentityForMethod<\n  Type extends ConnectorType,\n  Method extends ConnectorAuthMethodIds<Type>,\n> = ConnectorAuthClientIdentityForConfig<\n  ConnectorAuthClientConfigForMethod<Type, Method>\n>;\n\nexport type ConnectorResolvedAuthMethodClient<\n  Type extends ConnectorType,\n  Method extends ConnectorAuthMethodIds<Type>,\n> = {\n  readonly type: Type;\n  readonly authMethod: Method;\n  readonly authClient: ConnectorAuthClientForMethod<Type, Method>;\n};\n\nexport type ConnectorGrantKindWithAuthClient =\n  | \"auth-code\"\n  | \"external-code\"\n  | \"device-auth\";\n\nexport type ConnectorResolvedAuthMethodClientByGrantKind<\n  Kind extends ConnectorGrantKindWithAuthClient,\n> = {\n  readonly [Type in ConnectorTypesByGrantKind<Kind>]: {\n    readonly [Method in ConnectorAuthMethodIdsByGrantKind<\n      Type,\n      Kind\n    >]: ConnectorResolvedAuthMethodClient<Type, Method>;\n  }[ConnectorAuthMethodIdsByGrantKind<Type, Kind>];\n}[ConnectorTypesByGrantKind<Kind>];\n\nexport type ConnectorResolvedAuthMethodClientByAccessKind<\n  Kind extends \"refresh-token\",\n> = {\n  readonly [Type in ConnectorTypesByAccessKind<Kind>]: {\n    readonly [Method in ConnectorAuthMethodIdsByAccessKind<\n      Type,\n      Kind\n    >]: ConnectorResolvedAuthMethodClient<Type, Method>;\n  }[ConnectorAuthMethodIdsByAccessKind<Type, Kind>];\n}[ConnectorTypesByAccessKind<Kind>];\n\nexport function isStaticConnectorAuthClient(\n  authClient: ConnectorAuthClient,\n): authClient is StaticConnectorAuthClient {\n  return authClient.clientRegistration === \"static\";\n}\n\nexport function isStaticConfidentialConnectorAuthClient(\n  authClient: ConnectorAuthClient,\n): authClient is StaticConfidentialConnectorAuthClient {\n  return (\n    isStaticConnectorAuthClient(authClient) &&\n    authClient.clientType === \"confidential\"\n  );\n}\n\nexport function connectorAuthClientIdentity(\n  authClient: StaticConfidentialConnectorAuthClient,\n): StaticConfidentialConnectorAuthClientIdentity;\nexport function connectorAuthClientIdentity(\n  authClient: StaticPublicConnectorAuthClient,\n): StaticPublicConnectorAuthClient;\nexport function connectorAuthClientIdentity(\n  authClient: DynamicPublicConnectorAuthClient,\n): DynamicPublicConnectorAuthClient;\nexport function connectorAuthClientIdentity(\n  authClient: ConnectorAuthClient,\n): ConnectorAuthClientIdentity;\nexport function connectorAuthClientIdentity(\n  authClient: ConnectorAuthClient,\n): ConnectorAuthClientIdentity {\n  switch (authClient.clientRegistration) {\n    case \"dynamic\":\n      return authClient;\n    case \"static\":\n      return {\n        clientRegistration: \"static\",\n        clientType: authClient.clientType,\n        clientId: authClient.clientId,\n      };\n  }\n}\n\nexport function connectorAuthClientIdentityForMethod<\n  Type extends ConnectorType,\n  Method extends ConnectorAuthMethodIds<Type>,\n>(\n  authClient: ConnectorAuthClientForMethod<Type, Method>,\n): ConnectorAuthClientIdentityForMethod<Type, Method> {\n  return connectorAuthClientIdentity(\n    authClient,\n  ) as ConnectorAuthClientIdentityForMethod<Type, Method>;\n}\n\nexport function getConnectorAuthClientConfigForMethod<\n  Type extends ConnectorType,\n  Method extends ConnectorAuthMethodIds<Type>,\n>(\n  type: Type,\n  authMethod: Method,\n): ConnectorAuthClientConfigForMethod<Type, Method> | undefined;\nexport function getConnectorAuthClientConfigForMethod(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthClientConfig | undefined;\nexport function getConnectorAuthClientConfigForMethod(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorAuthClientConfig | undefined {\n  return getConnectorAuthMethod(type, authMethod)?.client;\n}\n\nexport function resolveConnectorAuthClient<\n  Client extends ConnectorAuthClientConfig,\n>(\n  client: Client,\n  readEnv: ConnectorEnvReader,\n): ConnectorAuthClientForConfig<Client> | undefined;\nexport function resolveConnectorAuthClient(\n  client: ConnectorAuthClientConfig,\n  readEnv: ConnectorEnvReader,\n): ConnectorAuthClient | undefined {\n  if (client.clientRegistration === \"dynamic\") {\n    return { clientRegistration: \"dynamic\", clientType: \"public\" };\n  }\n\n  if (\"clientId\" in client) {\n    if (client.clientType === \"confidential\") {\n      return {\n        clientRegistration: \"static\",\n        clientType: \"confidential\",\n        clientId: client.clientId,\n        clientSecret: client.clientSecret,\n      };\n    }\n    return {\n      clientRegistration: \"static\",\n      clientType: \"public\",\n      clientId: client.clientId,\n    };\n  }\n\n  const clientId = readEnv(client.clientIdEnv);\n  if (!clientId) {\n    return undefined;\n  }\n\n  if (client.clientType === \"public\") {\n    return { clientRegistration: \"static\", clientType: \"public\", clientId };\n  }\n\n  const clientSecret = readEnv(client.clientSecretEnv);\n  if (!clientSecret) {\n    return undefined;\n  }\n\n  return {\n    clientRegistration: \"static\",\n    clientType: \"confidential\",\n    clientId,\n    clientSecret,\n  };\n}\n\nexport function resolveConnectorAuthClientForMethod<\n  Type extends ConnectorType,\n  Method extends ConnectorAuthMethodIds<Type>,\n>(\n  type: Type,\n  authMethod: Method,\n  readEnv: ConnectorEnvReader,\n): ConnectorAuthClientForMethod<Type, Method> | undefined;\nexport function resolveConnectorAuthClientForMethod(\n  type: ConnectorType,\n  authMethod: string,\n  readEnv: ConnectorEnvReader,\n): ConnectorAuthClient | undefined;\nexport function resolveConnectorAuthClientForMethod(\n  type: ConnectorType,\n  authMethod: string,\n  readEnv: ConnectorEnvReader,\n): ConnectorAuthClient | undefined {\n  const clientConfig = getConnectorAuthClientConfigForMethod(type, authMethod);\n  if (!clientConfig) {\n    return undefined;\n  }\n  return resolveConnectorAuthClient(clientConfig, readEnv);\n}\n\ntype AnyConnectorResolvedAuthMethodClient = {\n  readonly type: ConnectorType;\n  readonly authMethod: ConnectorAuthMethodId;\n  readonly authClient: ConnectorAuthClient;\n};\n\nfunction resolveConnectorResolvedAuthMethodClient(\n  authMethodRef: ConnectorAuthMethodRef,\n  readEnv: ConnectorEnvReader,\n): AnyConnectorResolvedAuthMethodClient | undefined {\n  const authClient = resolveConnectorAuthClientForMethod(\n    authMethodRef.type,\n    authMethodRef.authMethod,\n    readEnv,\n  );\n  if (!authClient) {\n    return undefined;\n  }\n  return {\n    type: authMethodRef.type,\n    authMethod: authMethodRef.authMethod,\n    authClient,\n  };\n}\n\nexport function resolveConnectorResolvedAuthMethodClientByGrantKind(\n  authMethodRef: ConnectorAuthMethodRefByGrantKind<\"auth-code\">,\n  readEnv: ConnectorEnvReader,\n): ConnectorResolvedAuthMethodClientByGrantKind<\"auth-code\"> | undefined;\nexport function resolveConnectorResolvedAuthMethodClientByGrantKind(\n  authMethodRef: ConnectorAuthMethodRefByGrantKind<\"external-code\">,\n  readEnv: ConnectorEnvReader,\n): ConnectorResolvedAuthMethodClientByGrantKind<\"external-code\"> | undefined;\nexport function resolveConnectorResolvedAuthMethodClientByGrantKind(\n  authMethodRef: ConnectorAuthMethodRefByGrantKind<\"device-auth\">,\n  readEnv: ConnectorEnvReader,\n): ConnectorResolvedAuthMethodClientByGrantKind<\"device-auth\"> | undefined;\nexport function resolveConnectorResolvedAuthMethodClientByGrantKind(\n  authMethodRef: ConnectorAuthMethodRefByGrantKind<ConnectorGrantKindWithAuthClient>,\n  readEnv: ConnectorEnvReader,\n): AnyConnectorResolvedAuthMethodClient | undefined {\n  return resolveConnectorResolvedAuthMethodClient(authMethodRef, readEnv);\n}\n\nexport function resolveConnectorResolvedAuthMethodClientByAccessKind(\n  authMethodRef: ConnectorAuthMethodRefByAccessKind<\"refresh-token\">,\n  readEnv: ConnectorEnvReader,\n): ConnectorResolvedAuthMethodClientByAccessKind<\"refresh-token\"> | undefined;\nexport function resolveConnectorResolvedAuthMethodClientByAccessKind(\n  authMethodRef: ConnectorAuthMethodRefByAccessKind<\"refresh-token\">,\n  readEnv: ConnectorEnvReader,\n): AnyConnectorResolvedAuthMethodClient | undefined {\n  return resolveConnectorResolvedAuthMethodClient(authMethodRef, readEnv);\n}\n\nfunction hasRuntimeAvailableAuthMethod(\n  readEnv: ConnectorEnvReader,\n  type: ConnectorType,\n): boolean {\n  for (const authMethod of getConfiguredConnectorAuthMethodIds(type)) {\n    const method = getConnectorAuthMethod(type, authMethod);\n    switch (method?.grant.kind) {\n      case \"auth-code\":\n      case \"external-code\":\n      case \"device-auth\": {\n        if (resolveConnectorAuthClientForMethod(type, authMethod, readEnv)) {\n          return true;\n        }\n        break;\n      }\n      case \"openid-auth\": {\n        return true;\n      }\n      case \"manual\": {\n        return true;\n      }\n      case \"managed\":\n      case undefined: {\n        break;\n      }\n    }\n  }\n  return false;\n}\n\n/**\n * Return connector types the current runtime can offer as connection candidates.\n *\n * This is not user connected state and it does not evaluate feature switches.\n * It includes connectors with user-entered manual grant methods because they\n * do not require a server auth client, while auth-provider methods require\n * their runtime client env to exist unless their client config is static inline.\n */\nexport function getRuntimeAvailableConnectorTypes(\n  readEnv: ConnectorEnvReader,\n): ConnectorType[] {\n  const runtimeAvailable = new Set<ConnectorType>();\n\n  for (const type of CONNECTOR_TYPE_KEYS) {\n    if (hasRuntimeAvailableAuthMethod(readEnv, type)) {\n      runtimeAvailable.add(type);\n    }\n  }\n\n  return [...runtimeAvailable].sort();\n}\n\n/**\n * Get connector-owned secret storage names for a specific auth method.\n */\nexport function getConnectorOwnedSecretNames(\n  type: ConnectorType,\n  authMethod: string,\n): string[] {\n  return connectorAuthMethodOwnedSecretNames(\n    getConnectorAuthMethod(type, authMethod),\n  );\n}\n\n/**\n * Get connector-owned variable storage names for a specific auth method.\n */\nexport function getConnectorOwnedVariableNames(\n  type: ConnectorType,\n  authMethod: string,\n): string[] {\n  return connectorAuthMethodOwnedVariableNames(\n    getConnectorAuthMethod(type, authMethod),\n  );\n}\n\nfunction connectorAuthMethodOwnedSecretNames(\n  method: ConnectorAuthMethodConfig | undefined,\n): string[] {\n  return method ? [...method.storage.secrets] : [];\n}\n\nfunction connectorAuthMethodOwnedVariableNames(\n  method: ConnectorAuthMethodConfig | undefined,\n): string[] {\n  return method ? [...method.storage.variables] : [];\n}\n\n/**\n * Get runtime environment bindings for a specific connector auth method.\n */\nexport function getConnectorAuthMethodEnvBindings(\n  type: ConnectorType,\n  authMethod: string,\n): ConnectorRuntimeEnvBindings {\n  const method = getConnectorAuthMethod(type, authMethod);\n  return method ? connectorAccessRuntimeEnvBindings(method.access) : {};\n}\n\nexport interface ConnectorEnvBindingEntry {\n  readonly authMethod: ConnectorAuthMethodId;\n  readonly envName: string;\n  readonly valueRef: string;\n}\n\n/**\n * Get all configured environment binding entries across auth methods.\n *\n * This is for discovery and reverse lookup. Runtime injection must use\n * getConnectorAuthMethodEnvBindings() with the selected auth method.\n */\nexport function getConnectorEnvBindingEntries(\n  type: ConnectorType,\n): ConnectorEnvBindingEntry[] {\n  const entries: ConnectorEnvBindingEntry[] = [];\n  for (const authMethod of getConfiguredConnectorAuthMethodIds(type)) {\n    const envBindings = getConnectorAuthMethodEnvBindings(type, authMethod);\n    for (const [envName, valueRef] of Object.entries(envBindings)) {\n      entries.push({ authMethod, envName, valueRef });\n    }\n  }\n  return entries;\n}\n\nexport interface ConnectorStoredSecretDisplayInfo {\n  readonly connectorLabel: string;\n  readonly envNames: string[];\n}\n\n/**\n * Diagnostic/display lookup for a stored connector secret name.\n *\n * This reverse-searches registry metadata to explain which runtime env aliases\n * can expose a stored secret. Runtime injection must use selected auth method\n * storage metadata instead.\n */\nexport function getConnectorStoredSecretDisplayInfo(\n  secretName: string,\n): ConnectorStoredSecretDisplayInfo | null {\n  const allTypes = CONNECTOR_TYPE_KEYS;\n\n  for (const type of allTypes) {\n    const config = CONNECTOR_TYPES[type];\n\n    const found = Object.values(config.authMethods).some((method) => {\n      return connectorAuthMethodOwnedSecretNames(method).includes(secretName);\n    });\n    if (!found) {\n      continue;\n    }\n\n    const envNames = [\n      ...new Set(\n        getConnectorEnvBindingEntries(type)\n          .filter(({ valueRef }) => {\n            return valueRef === `$secrets.${secretName}`;\n          })\n          .map(({ envName }) => {\n            return envName;\n          }),\n      ),\n    ];\n\n    if (envNames.length > 0) {\n      return { connectorLabel: config.label, envNames };\n    }\n  }\n\n  return null;\n}\n\n/**\n * Diagnostic lookup for a runtime env alias declared by connector env bindings.\n *\n * This is for human-facing commands such as CLI doctor; runtime connector\n * behavior must use selected auth method metadata.\n */\nexport function getDiagnosticConnectorTypeForRuntimeEnvName(\n  envName: string,\n): ConnectorType | null {\n  for (const type of CONNECTOR_TYPE_KEYS) {\n    const hasEnvName = getConnectorEnvBindingEntries(type).some((entry) => {\n      return entry.envName === envName;\n    });\n    if (hasEnvName) {\n      return type;\n    }\n  }\n  return null;\n}\n\nexport function hasConnectorAuthCodeGrant(\n  type: ConnectorType,\n): type is AuthCodeGrantConnectorType {\n  return getConnectorAuthMethodIdsForGrantKind(type, \"auth-code\").length > 0;\n}\n\nexport function hasConnectorOpenIdAuthGrant(\n  type: ConnectorType,\n): type is OpenIdAuthGrantConnectorType {\n  return getConnectorAuthMethodIdsForGrantKind(type, \"openid-auth\").length > 0;\n}\n\nexport function hasConnectorExternalCodeGrant(\n  type: ConnectorType,\n): type is ExternalCodeGrantConnectorType {\n  return (\n    getConnectorAuthMethodIdsForGrantKind(type, \"external-code\").length > 0\n  );\n}\n\nexport function hasConnectorDeviceAuthGrant(\n  type: ConnectorType,\n): type is DeviceAuthGrantConnectorType {\n  return getConnectorAuthMethodIdsForGrantKind(type, \"device-auth\").length > 0;\n}\n\nfunction hasRequiredGrantScopes(\n  requiredScopes: readonly string[],\n  storedScopes: string[] | null,\n): boolean {\n  if (requiredScopes.length === 0) return true;\n  if (!storedScopes) return false;\n  const storedSet = new Set(storedScopes);\n  return requiredScopes.every((s) => {\n    return storedSet.has(s);\n  });\n}\n\n/**\n * Compute the diff between currently required scopes and stored scopes for a connector.\n */\nexport interface ScopeDiff {\n  addedScopes: string[];\n  removedScopes: string[];\n  currentScopes: string[];\n  storedScopes: string[];\n}\n\nfunction scopeDiff(\n  currentScopes: readonly string[],\n  storedScopes: string[] | null,\n): ScopeDiff {\n  const stored = storedScopes ?? [];\n  const storedSet = new Set(stored);\n  const currentSet = new Set(currentScopes);\n\n  return {\n    addedScopes: currentScopes.filter((s) => {\n      return !storedSet.has(s);\n    }),\n    removedScopes: stored.filter((s) => {\n      return !currentSet.has(s);\n    }),\n    currentScopes: [...currentScopes],\n    storedScopes: stored,\n  };\n}\n\nexport function hasRequiredConnectorAuthMethodScopes(\n  connectorType: ConnectorType,\n  authMethod: string,\n  storedScopes: string[] | null,\n): boolean {\n  return hasRequiredGrantScopes(\n    getConnectorAuthMethodGrantScopes(connectorType, authMethod),\n    storedScopes,\n  );\n}\n\nexport function getConnectorAuthMethodScopeDiff(\n  connectorType: ConnectorType,\n  authMethod: string,\n  storedScopes: string[] | null,\n): ScopeDiff {\n  return scopeDiff(\n    getConnectorAuthMethodGrantScopes(connectorType, authMethod),\n    storedScopes,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;AAAA;AA2DA,IAAM,iCAAiC;AAAA,EACrC,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,KAAK;AAAA,EACL,aAAa;AAAA,EACb,KAAK;AACP;AAMA,SAAS,4BACP,YACQ;AACR,SAAO,+BAA+B,UAAU;AAClD;AAEO,SAAS,oCACd,MACyB;AAEzB,SAAO,OAAO,KAAK,gBAAgB,IAAI,EAAE,WAAW,EACjD,IAAI,CAAC,eAAe;AACnB,WAAO,4BAA4B,MAAM,UAAU;AAAA,EACrD,CAAC,EACA,KAAK,CAAC,GAAG,MAAM;AACd,UAAM,eACJ,4BAA4B,CAAC,IAAI,4BAA4B,CAAC;AAChE,WAAO,iBAAiB,IAAI,EAAE,cAAc,CAAC,IAAI;AAAA,EACnD,CAAC;AACL;AAyBO,SAAS,uBACd,MACA,YACuC;AACvC,aAAW,CAAC,UAAU,MAAM,KAAK,OAAO;AAAA,IACtC,gBAAgB,IAAI,EAAE;AAAA,EACxB,GAAG;AACD,QAAI,aAAa,YAAY;AAC3B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAiSA,SAAS,2BACP,QACsB;AACtB,UAAQ,OAAO,MAAM;AAAA,IACnB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO;AAAA,IAChB,KAAK;AACH,aAAO,CAAC;AAAA,EACZ;AACF;AAEA,SAAS,kCACP,QAC6B;AAC7B,SAAO,4BAA4B,2BAA2B,MAAM,CAAC;AACvE;AAyZA,SAAS,4BACP,SACoC;AACpC,SAAO,OAAO,YAAY,WAAW,UAAU,QAAQ;AACzD;AAQA,SAAS,4BACP,aAC6B;AAC7B,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,OAAO,MAAM;AACtD,aAAO,CAAC,SAAS,4BAA4B,OAAO,CAAC;AAAA,IACvD,CAAC;AAAA,EACH;AACF;AA84BA,SAAS,oCACP,QACU;AACV,SAAO,SAAS,CAAC,GAAG,OAAO,QAAQ,OAAO,IAAI,CAAC;AACjD;AAWO,SAAS,kCACd,MACA,YAC6B;AAC7B,QAAM,SAAS,uBAAuB,MAAM,UAAU;AACtD,SAAO,SAAS,kCAAkC,OAAO,MAAM,IAAI,CAAC;AACtE;AAcO,SAAS,8BACd,MAC4B;AAC5B,QAAM,UAAsC,CAAC;AAC7C,aAAW,cAAc,oCAAoC,IAAI,GAAG;AAClE,UAAM,cAAc,kCAAkC,MAAM,UAAU;AACtE,eAAW,CAAC,SAAS,QAAQ,KAAK,OAAO,QAAQ,WAAW,GAAG;AAC7D,cAAQ,KAAK,EAAE,YAAY,SAAS,SAAS,CAAC;AAAA,IAChD;AAAA,EACF;AACA,SAAO;AACT;AAcO,SAAS,oCACd,YACyC;AACzC,QAAM,WAAW;AAEjB,aAAW,QAAQ,UAAU;AAC3B,UAAM,SAAS,gBAAgB,IAAI;AAEnC,UAAM,QAAQ,OAAO,OAAO,OAAO,WAAW,EAAE,KAAK,CAAC,WAAW;AAC/D,aAAO,oCAAoC,MAAM,EAAE,SAAS,UAAU;AAAA,IACxE,CAAC;AACD,QAAI,CAAC,OAAO;AACV;AAAA,IACF;AAEA,UAAM,WAAW;AAAA,MACf,GAAG,IAAI;AAAA,QACL,8BAA8B,IAAI,EAC/B,OAAO,CAAC,EAAE,SAAS,MAAM;AACxB,iBAAO,aAAa,YAAY,UAAU;AAAA,QAC5C,CAAC,EACA,IAAI,CAAC,EAAE,QAAQ,MAAM;AACpB,iBAAO;AAAA,QACT,CAAC;AAAA,MACL;AAAA,IACF;AAEA,QAAI,SAAS,SAAS,GAAG;AACvB,aAAO,EAAE,gBAAgB,OAAO,OAAO,SAAS;AAAA,IAClD;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,4CACd,SACsB;AACtB,aAAW,QAAQ,qBAAqB;AACtC,UAAM,aAAa,8BAA8B,IAAI,EAAE,KAAK,CAAC,UAAU;AACrE,aAAO,MAAM,YAAY;AAAA,IAC3B,CAAC;AACD,QAAI,YAAY;AACd,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;","names":[]}