@wildo-ai/saas-frontend-lib 1.1.7 → 1.1.9

package/dist/esm/components/settings/AppPage_ConnectedAccountsSettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_ConnectedAccountsSettings.js","sourceRoot":"","sources":["../../../../src/components/settings/AppPage_ConnectedAccountsSettings.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,kBAAkB,EAClB,6BAA6B,EAC7B,iCAAiC,GAGlC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EACtC,yCAAyC,EACzC,0CAA0C,EAC1C,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,+DAA+D,CAAC;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,0DAA0D,CAAC;AAClF,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,KAAK,EAAE,MAAM,mDAAmD,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,8DAA8D,CAAC;AACpI,OAAO,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AAC/E,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EACL,qCAAqC,EACrC,qCAAqC,GACtC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EACL,wBAAwB,GAEzB,MAAM,mFAAmF,CAAC;AAE3F,MAAM,SAAS,GAAG,qBAAqB,CAAC,uCAAuC,CAAC;AAEhF,sGAAsG;AACtG,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9C,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5C,wGAAwG;AACxG,MAAM,sBAAsB,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;AAC3C,mFAAmF;AACnF,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,SAA6C,EAC7C,UAAkD,EACvB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAChG,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,QAAiC,EACjC,UAAkD,EACJ,EAAE;IAChD,+FAA+F;IAC/F,8FAA8F;IAC9F,iGAAiG;IACjG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACzF,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,SAAS;QAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,UAAwD,CAAC;QAClF,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAKrC,EAKC,EAAE,CAAC,CAAC;IACJ,UAAU,EAAE,KAAK,CAAC,UAAU;IAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;IAC5B,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QACnG,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC/B,GAAG,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;QACzE,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,cAAc,EAAE;QAC3C,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,MAAyB,EACzB,OAAyC,EACzC,YAAoB,EACV,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;IAClC,MAAM,WAAW,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9G,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAN,IAAY,wBAWX;AAXD,WAAY,wBAAwB;IAClC,gHAAgH;IAChH,qDAAyB,CAAA;IACzB,6EAA6E;IAC7E,iDAAqB,CAAA;IACrB,wGAAwG;IACxG,2EAA+C,CAAA;IAC/C,8BAA8B;IAC9B,+CAAmB,CAAA;IACnB,6CAA6C;IAC7C,yDAA6B,CAAA;AAC/B,CAAC,EAXW,wBAAwB,KAAxB,wBAAwB,QAWnC;AAED,oFAAoF;AACpF,MAAM,CAAN,IAAY,iCAIX;AAJD,WAAY,iCAAiC;IAC3C,kEAA6B,CAAA;IAC7B,4GAA4G;IAC5G,sDAAiB,CAAA;AACnB,CAAC,EAJW,iCAAiC,KAAjC,iCAAiC,QAI5C;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,UAAwC,EAA4B,EAAE;IAC7G,IAAI,UAAU,CAAC,yBAAyB,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,UAAU,CAAC;IACnG,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC;IAClE,QAAQ,UAAU,CAAC,eAAe,EAAE,CAAC;QACnC,KAAK,iCAAiC,CAAC,OAAO;YAC5C,OAAO,wBAAwB,CAAC,qBAAqB,CAAC;QACxD,KAAK,iCAAiC,CAAC,KAAK;YAC1C,OAAO,wBAAwB,CAAC,OAAO,CAAC;QAC1C,KAAK,iCAAiC,CAAC,WAAW;YAChD,OAAO,wBAAwB,CAAC,YAAY,CAAC;IACjD,CAAC;AACH,CAAC,CAAC;AAEF,4GAA4G;AAC5G,MAAM,kBAAkB,GAAuD;IAC7E,CAAC,wBAAwB,CAAC,UAAU,CAAC,EAAE,kBAAkB;IACzD,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,gBAAgB;IACrD,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,4BAA4B;IAC9E,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,eAAe;IACnD,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,kBAAkB;CAC5D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,UAAwC,EACxC,KAAoD,EACyE,EAAE;IAC/H,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACzF,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3G,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,0BAA0B,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChG,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,SAA6C,EAC7C,WAAoD,EAC1C,EAAE,CAAC,uCAAuC,CAAC;IACrD,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1F,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;CACpM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAG,GAKxB,EAAE;IACF,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;QAC/C,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS;QAC3D,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QACvC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;KACtC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,2BAA2B,GAAG,GAAS,EAAE;IAC7C,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxE,CAAC,CAAC;AAgBF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,oBAAoB,GAAwC,CAAC,EACjE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,GAC1F,EAAE,EAAE;IACH,MAAM,4BAA4B,GAAG,KAAK,EAAE,CAAC;IAC7C,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAClH,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC;IAC/H,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS,IAAI,0CAA0C,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IACjH,MAAM,OAAO,GAAG,UAAU,KAAK,sCAAsC,CAAC,IAAI;WACrE,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS,IAAI,UAAU,CAAC,cAAc,KAAK,cAAc,CAAC,CAAC;IAE/F,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC3G,MAAM,EAAE,qBAAqB,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;gBAClF,SAAS,EAAE,OAAO,CAAC,iBAAiB;gBACpC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;gBACzC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC,CAAC;YACH,gGAAgG;YAChG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC;QACtC,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAEpF,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,iCAAiC,CAAC,GAAQ,EAEtE,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CACvC,MAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,aAC5C,CAAC,CAAC,6BAA6B,CAAC,EAChC,GAAG,EACH,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAChC,CACR,EACA,OAAO,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,IAAI,CAChD,MAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,aAC5C,CAAC,CAAC,oCAAoC,CAAC,EACvC,GAAG,EACH,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IACzC,CACR,EACA,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CACnD,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,iCAAiC,CAAC,GAAQ,CAC9F,EACA,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,IAAI,CAClD,8BACG,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CACzB,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAQ,EACrE,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,uBAAuB,CAAC,GAAQ,EACnF,KAAC,MAAM,IACL,IAAI,EAAE,cAAc,UAAU,CAAC,aAAa,EAAE,EAC9C,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oCAClC,KAAK,EAAE,IAAI;oCACX,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,0CAA0C,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,sBAAsB,CAAC;iCAC3H,CAAC,CAAC,EACH,KAAK,EAAE,gBAAgB,EACvB,WAAW,EAAE,CAAC,CAAC,uBAAuB,CAAC,EACvC,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;oCACzB,mBAAmB,CAAC,IAAI,CAAC,CAAC;oCAC1B,eAAe,CAAC,KAAK,CAAC,CAAC;gCACzB,CAAC,GACD,IACE,CACP,EACA,KAAK,IAAI,CACR,eAAK,SAAS,EAAC,8BAA8B,aAC3C,KAAC,QAAQ,IACP,IAAI,EAAE,mCAAmC,UAAU,CAAC,aAAa,EAAE,EACnE,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,YAAY,EACrB,eAAe,EAAE,eAAe,sBACd,4BAA4B,GAC9C,EACF,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,oCAAoC,CAAC,GAAQ,EACtF,KAAC,IAAI,IAAC,EAAE,EAAE,4BAA4B,EAAE,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,gCAAgC,CAAC,GAAQ,IAC1H,IACF,CACP,EACD,cAAK,SAAS,EAAC,kBAAkB,YAC/B,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,OAAO,gBAC3B,KAAK,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvE,QAAQ,EAAE,IAAI,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,EAC1F,OAAO,EAAE,IAAI,YAEZ,CAAC,CAAC,uBAAuB,CAAC,GACpB,GACL,IACL,CACJ,EACA,MAAM,IAAI,CACT,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,cAAc,CAAC,GAAoB,GAAQ,CAC9F,IACG,CACP,CAAC;AACJ,CAAC,CAAC;AAYF,MAAM,CAAC,MAAM,iCAAiC,GAAsD,CAAC;AACnG,uFAAuF;AACvF,oDAAoD;AACpD,UAAU,GAAG,sCAAsC,CAAC,IAAI,GACzD,EAAE,EAAE;IACH,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,WAAW,EAGlD,CAAC;IAEF,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACjF,sHAAsH;IACtH,MAAM,KAAK,GAAG,WAAW,CACvB,CAAC,GAAW,EAAE,MAA8B,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,EACnF,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,oBAAoB,GAAG,KAAK,EAAE,CAAC;IAErC;;;;;OAKG;IACH,MAAM,OAAO,GAAG,UAAU,KAAK,sCAAsC,CAAC,IAAI;QACxE,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI;QACnB,CAAC,CAAC,qBAAqB,IAAI,IAAI,CAAC;IAElC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAA4B,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAS,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,+FAA+F;IAC/F,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAS,EAAE,CAAC,CAAC;IACrE,0GAA0G;IAC1G,MAAM,CAAC,+BAA+B,EAAE,kCAAkC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9F,wFAAwF;IACxF,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAyB,EAAE,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAE1D;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,UAAU,GAAG,MAAM,CAAwC,IAAI,CAAC,CAAC;IACvE,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO;QACtD,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAChC,2BAA2B,EAAE,CAAC;YAC9B,UAAU,CAAC,OAAO,GAAG,wBAAwB,EAAE,CAAC,0BAA0B,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,UAAU,CAAC,OAAO;aACf,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;aACvE,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;YACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,oFAAoF;YACpF,IAAI,CAAC,SAAS;gBAAE,UAAU,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,4FAA4F;QAC5F,+EAA+E;QAC/E,uDAAuD;IACzD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,CAAC,KAAK,IAAI,EAAE;YACV,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,wBAAwB,EAAE,CAAC,wBAAwB,EAAE,CAAC;gBACxE,IAAI,CAAC,SAAS;oBAAE,YAAY,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YAC9C,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,SAAS;oBAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAER,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAEzG,+DAA+D;IAC/D,MAAM,EACJ,WAAW,EACX,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,iBAAiB,EACzB,UAAU,GACX,GAAG,2BAA2B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACrD,iFAAiF;IACjF,MAAM,MAAM,GAAG,qCAAqC,EAAE,CAAC;IAEvD;;;;OAIG;IACH,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5H,MAAM,EAAE,CAAC,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,WAAmB,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,EAC3G,CAAC,iBAAiB,CAAC,CACpB,CAAC;IAEF,gFAAgF;IAChF,MAAM,CAAC,uBAAuB,EAAE,0BAA0B,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC5F,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC9E,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,GAAG,QAAQ,CAA2C,IAAI,CAAC,CAAC;IAE3G;;;OAGG;IACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,EAAE,UAAwC,EAAE,EAAE;QACtF,mBAAmB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC9C,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;YAC7B,oBAAoB,CAAC,iCAAiC,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,oBAAoB,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACT,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC1B,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB;;;;OAIG;IACH,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,EAAE;QACvC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,kBAAkB,CAAC;QACtD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAC5F,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,kBAAkB,CAAC;QAC1C,OAAO,IAAI,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,uBAAuB,CAAC;IACzF,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB;;;;;;;;;;OAUG;IACH,MAAM,iBAAiB,GAAG,OAAO,CAC/B,GAAG,EAAE,CAAC,SAAS;SACZ,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SACrE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,WAAW,EAAE,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;KACjF,CAAC,CAAC,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CACtB,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,KAAK,WAAW,CAAC,EACxE,CAAC,SAAS,EAAE,WAAW,CAAC,CACzB,CAAC;IAEF,+FAA+F;IAC/F,6FAA6F;IAC7F,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,GAAW,EAAE,EAAE;QACjD,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,UAAU,CAAC,EAAE,CAAC,CAAC;QACf,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACxB,kGAAkG;QAClG,qCAAqC;QACrC,kCAAkC,CAAC,KAAK,CAAC,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;;;OAMG;IACH,MAAM,WAAW,GAAG,OAAO,CACzB,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EACzF,CAAC,UAAU,EAAE,QAAQ,CAAC,CACvB,CAAC;IACF,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC;QACzC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAChB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC;IAEpE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAEpE;;;OAGG;IACH,MAAM,0BAA0B,GAAG,UAAU,KAAK,SAAS;WACtD,0CAA0C,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAE5E;;;;;;;OAOG;IACH,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,gGAAgG;QAChG,iGAAiG;QACjG,oFAAoF;QACpF,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7G,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC1F,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,uBAAuB,CAC/E,QAAQ,CAAC,WAAW,EACpB;oBACE,MAAM;oBACN,oBAAoB,EAAE,OAAO;oBAC7B,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5G,CACF,CAAC;gBACF,6FAA6F;gBAC7F,+EAA+E;gBAC/E,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC;gBACpC,OAAO;YACT,CAAC;YAED,6FAA6F;YAC7F,8FAA8F;YAC9F,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAC7F,CAAC;YACF,8FAA8F;YAC9F,2FAA2F;YAC3F,iEAAiE;YACjE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,oBAAoB,GAAG,MAAM,CAAC,WAAW,CAC7C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAC1F,CAAC;YACF,MAAM,wBAAwB,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,WAAW,EAAE;gBAC7E,MAAM;gBACN,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;gBACnF,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G,CAAC,CAAC;YAEH,yFAAyF;YACzF,uEAAuE;YACvE,UAAU,CAAC,EAAE,CAAC,CAAC;YACf,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAEpI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnD,KAAK,EAAE,QAAQ,CAAC,WAAW;QAC3B,6GAA6G;QAC7G,kHAAkH;QAClH,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrC,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAG,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,IAAI,KAAK,CAAC;IACtG,MAAM,OAAO,GAAG,QAAQ,EAAE,mBAAmB,IAAI,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,QAAQ,EAAE,oBAAoB,IAAI,EAAE,CAAC;IACxD,MAAM,gBAAgB,GAAG,QAAQ,EAAE,0BAA0B,IAAI,EAAE,CAAC;IACpE,MAAM,gBAAgB,GAAG,QAAQ,EAAE,gBAAgB,IAAI,EAAE,CAAC;IAC1D,kGAAkG;IAClG,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;IACtC,uGAAuG;IACvG,sGAAsG;IACtG,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;SACjH,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAErD,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aAUvC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAClC,KAAC,KAAK,cAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,iBAAiB,CAAC,GAAoB,GAAQ,CAC3E,EACA,OAAO,CAAC,eAAe,KAAK,UAAU,IAAI,CACzC,KAAC,KAAK,cAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,gBAAgB,CAAC,GAAoB,GAAQ,CAC1E,EACA,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,UAAU,IAAI,CAClF,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,cAAc,CAAC,GAAoB,GAAQ,CAC9F,EACA,WAAW,IAAI,KAAC,KAAK,cAAC,KAAC,gBAAgB,cAAE,WAAW,GAAoB,GAAQ,EAChF,KAAK,IAAI,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAAC,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GAAQ,EAC1F,iBAAiB,KAAK,iCAAiC,CAAC,YAAY,IAAI,CACvE,KAAC,KAAK,cAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,oBAAoB,CAAC,GAAoB,GAAQ,CAC9E,EACA,iBAAiB,KAAK,iCAAiC,CAAC,MAAM,IAAI,CACjE,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,wBAAwB,CAAC,GAAoB,GAAQ,CACxG,EAUD,sCAA0B,oBAAoB,EAAE,SAAS,EAAC,yBAAyB,aACjF,KAAC,UAAU,IAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,oBAAoB,YAAG,CAAC,CAAC,oBAAoB,CAAC,GAAc,EACrF,kBAAkB,CAAC,CAAC,CAAC,CACpB,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,oBAAoB,CAAC,GAAQ,CACjF,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CACtB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,mBAAmB,CAAC,GAAoB,GAAQ,CACnG,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAC7B,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,kBAAkB,CAAC,GAAQ,CAC/E,CAAC,CAAC,CAAC,CACF,gCAAqB,oBAAoB,EAAE,SAAS,EAAC,yBAAyB,YAC3E,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;4BAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;4BAChD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;4BACtD,MAAM,OAAO,GAAG,QAAQ,KAAK,wBAAwB,CAAC,UAAU;gCAC9D,CAAC,CAAC,SAAS;gCACX,iGAAiG;gCACjG,CAAC,CAAC,yBAAyB,CAAC,UAAU,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qCAAqC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;4BAC3K,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,UAAU,CAAC,aAAa,CAAC,CAAC;4BACnI,MAAM,UAAU,GAAG,uBAAuB,KAAK,UAAU,CAAC,aAAa,CAAC;4BACxE,MAAM,aAAa,GAAG,gBAAgB,KAAK,UAAU,CAAC,aAAa,CAAC;4BACpE,OAAO,CACL,uBACE,KAAC,IAAI,cACH,MAAC,WAAW,IAAC,SAAS,EAAC,2BAA2B,aAChD,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,KAAK,GAAQ,EACpD,MAAC,eAAe,eACd,KAAC,eAAe,cAAE,CAAC,CAAC,aAAa,CAAC,GAAmB,EACrD,KAAC,kBAAkB,cACjB,KAAC,KAAK,IAAC,OAAO,EAAE,QAAQ,KAAK,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,YACzJ,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,GAC1B,GACW,EACpB,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CACnC,8BACE,KAAC,eAAe,cAAE,CAAC,CAAC,aAAa,CAAC,GAAmB,EACrD,KAAC,kBAAkB,cAAE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAsB,IACvF,CACJ,EACA,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAC9C,8BACE,KAAC,eAAe,cAAE,CAAC,CAAC,oBAAoB,CAAC,GAAmB,EAE5D,KAAC,kBAAkB,cAAE,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAsB,IACrF,CACJ,IACe,EAEjB,QAAQ,KAAK,wBAAwB,CAAC,UAAU,IAAI,UAAU,CAAC,yBAAyB,KAAK,SAAS,IAAI,CACzG,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAC5C,KAAK,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC,GACpF,CACR,EACA,QAAQ,KAAK,wBAAwB,CAAC,qBAAqB,IAAI,CAC9D,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,4BAA4B,CAAC,GAAQ,EACvF,cAAc,KAAK,SAAS,IAAI,CAC/B,cAAK,SAAS,EAAC,kBAAkB,YAC/B,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,OAAO,gBAC3B,KAAK,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACjE,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,WAAW,CAAC,YAExD,CAAC,CAAC,iBAAiB,CAAC,GACd,GACL,CACP,IACG,CACP,EAEA,OAAO,KAAK,SAAS,IAAI,CACxB,KAAC,oBAAoB,IACnB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EACjC,KAAK,EAAE,KAAK,EACZ,CAAC,EAAE,CAAC,EACJ,KAAK,EAAE,KAAK,GACZ,CACH,EAGA,UAAU,CAAC,CAAC,CAAC,CACZ,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,KAAK,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAQ,EAE7F,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAC5C,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAChF,EACP,eAAK,SAAS,EAAC,8BAA8B,aAC3C,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,KAAK,EACrC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,GAAG,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,YAE9C,CAAC,CAAC,wBAAwB,CAAC,GACrB,EACT,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,WAAW,gBAC/B,KAAK,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACzE,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAEpD,CAAC,CAAC,yBAAyB,CAAC,GACtB,IACL,IACF,CACP,CAAC,CAAC,CAAC,CACF,cAAK,SAAS,EAAC,kBAAkB,YAC/B,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,OAAO,gBAC3B,KAAK,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAClE,QAAQ,EAAE,gBAAgB,KAAK,IAAI,EACnC,OAAO,EAAE,GAAG,EAAE,GAAG,0BAA0B,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnG,CAAC,CAAC,kBAAkB,CAAC,GACf,GACL,CACP,IACW,GACT,IAzGA,UAAU,CAAC,aAAa,CA0G5B,CACN,CAAC;wBACJ,CAAC,CAAC,GACC,CACN,IACO,EAUT,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAC/B,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cACf,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,0BAA0B,CAAC,GAAQ,EAC5E,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,8BAA8B,CAAC,GAAQ,EACpE,aAAI,SAAS,EAAC,gBAAgB,YAC3B,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAC9B,cAA0B,SAAS,EAAC,SAAS,aAC1C,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EACxB,IAAI,EACJ,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAHpB,GAAG,CAAC,WAAW,CAInB,CACN,CAAC,GACC,IACD,GACW,GACb,CACT,EAID,KAAC,IAAI,cACH,MAAC,WAAW,IAAC,SAAS,EAAC,yBAAyB,aAC7C,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,SAAS,CAAC,GAAQ,CACtE,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACjC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,OAAO,CAAC,GAAQ,CACpE,CAAC,CAAC,CAAC,CACF,8BAGE,KAAC,MAAM,IACL,IAAI,EAAC,aAAa,EAClB,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,CAAC,mBAAmB,CAAC,EACnC,QAAQ,EAAE,cAAc,GACxB,EAED,QAAQ,KAAK,SAAS,IAAI,CACzB,eAAK,SAAS,EAAC,yBAAyB,aASrC,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CACzC,MAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,aAC5C,CAAC,CAAC,aAAa,CAAC,EAChB,GAAG,EACH,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAC/C,CACR,EAEA,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAClC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,wBAAwB,CAAC,GAAQ,CACrF,EAQA,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CACzB,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAQ,EACrE,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,uBAAuB,CAAC,GAAQ,EACnF,KAAC,MAAM,IACL,IAAI,EAAC,YAAY,EACjB,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wDAClC,KAAK,EAAE,IAAI;wDACX,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,0CAA0C,CAAC,OAAO;4DAClE,CAAC,CAAC,yBAAyB;4DAC3B,CAAC,CAAC,sBAAsB,CAAC;qDAC5B,CAAC,CAAC,EACH,KAAK,EAAE,gBAAgB,EACvB,WAAW,EAAE,CAAC,CAAC,uBAAuB,CAAC,EACvC,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;wDACzB,mBAAmB,CAAC,IAAI,CAAC,CAAC;wDAC1B,yEAAyE;wDACzE,0CAA0C;wDAC1C,kCAAkC,CAAC,KAAK,CAAC,CAAC;oDAC5C,CAAC,GACD,IACE,CACP,EAeA,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAC9B,MAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,aAC5C,CAAC,CAAC,cAAc,CAAC,EACjB,GAAG,EACH,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IACtE,CACR,EAMA,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CACtE,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAQ,EACrE,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,uBAAuB,CAAC,GAAQ,IAC/E,CACP,EAEA;4CACC,yEAAyE;4CACzE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;4CAC9J,uFAAuF;4CACvF,oFAAoF;4CACpF,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,SAA+B,EAAE,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;yCACxJ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACf,eAAqB,SAAS,EAAC,2BAA2B,aACxD,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,KAAK,CAAC,KAAK,GAAQ,EACzD,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAClC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,KAAK,CAAC,WAAW,GAAQ,CAC3E,EAKA,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAChF,KAAC,MAAM,IACL,IAAI,EAAE,KAAK,CAAC,GAAG,EACf,MAAM,EAAE,2BAA2B,EACnC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EACvE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAC/B,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAC5F,CACH,CAAC,CAAC,CAAC,CACF,8BAKG,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAC9B,MAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,aAC5C,CAAC,CAAC,8BAA8B,CAAC,EACjC,GAAG,EACH;oEACC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM;oEACvB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,KAAK,yCAAyC,CAAC,MAAM;wEACjI,CAAC,CAAC,YAAY,MAAM,EAAE;wEACtB,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;iEACnB,CAAC,IAAI,CAAC,IAAI,CAAC,IACP,CACR,EACD,KAAC,SAAS,kBACI,KAAK,CAAC,KAAK;4DACvB,8EAA8E;4DAC9E,yDAAyD;4DACzD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EACxC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAC/B,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,GACjG,IACD,CACJ,KA5CO,KAAK,CAAC,GAAG,CA6Cb,CACP,CAAC,EAMD,0BAA0B,IAAI,CAC7B,eAAK,SAAS,EAAC,8BAA8B,aAC3C,KAAC,QAAQ,IACP,IAAI,EAAC,iCAAiC,EACtC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,+BAA+B,EACxC,eAAe,EAAE,kCAAkC,sBAClC,mCAAmC,GACpD,EACF,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,oCAAoC,CAAC,GAAQ,EACtF,KAAC,IAAI,IAAC,EAAE,EAAC,mCAAmC,EAAC,SAAS,EAAC,+BAA+B,YACnF,CAAC,CAAC,gCAAgC,CAAC,GAC/B,IACH,IACF,CACP,EAED,cAAK,SAAS,EAAC,kBAAkB,YAC/B,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,QAAQ,EACN,IAAI;uDACD,OAAO,KAAK,IAAI;oDACnB,oFAAoF;oDACpF,gFAAgF;oDAChF,oEAAoE;uDACjE,CAAC,QAAQ,CAAC,qBAAqB,KAAK,SAAS;2DAC3C,QAAQ,CAAC,qBAAqB,KAAK,6BAA6B,CAAC,qBAAqB,CAAC;uDACzF,UAAU;uDACV,UAAU,KAAK,SAAS;uDACxB,CAAC,0BAA0B,IAAI,CAAC,+BAA+B,CAAC,EAErE,OAAO,EAAE,aAAa,YAErB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAC3C,GACL,IACF,CACP,IACA,CACJ,EAqBD,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAQ,IACnE,GACT,IACH,CACP,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * AppPage_ConnectedAccountsSettings — connecting a third-party account, at either owner scope.\n *\n * A bespoke `ENGINE_PANEL`, and the reason is the shape of the act rather than the shape of the data.\n * The stored credentials ARE a resource and the generic surface beside this one lists, inspects and\n * deletes them perfectly. What it cannot do is CONNECT: that is not a row somebody creates, it is a\n * flow that leaves the application, obtains consent at a vendor, and returns with a grant nobody\n * typed. A resource screen has no mechanism for an action of that shape.\n *\n * ## Nothing is typed by hand\n *\n * The provider comes from a SELECT over what the application declares; the credential fields come\n * from that provider's own secrets contract. Both were free text until this panel existed, which is\n * how somebody ends up typing `secretSlug` into a box and storing a grant in a slot nothing reads.\n *\n * So this panel is the ONLY place the application offers to add a credential. The list beside it hides\n * its resource CREATE (`actionVisibility: HIDDEN`, no empty-state call to action) — for a while it kept\n * the free-text form as a second door, and a slot the provider does not declare was refused with a\n * message naming the valid ones that the form then reduced to a generic toast (#1040).\n *\n * ## The flow follows the AUTH METHOD\n *\n * A connect surface cannot be one form. A vendor with an authorization flow gets the consent round\n * trip; a vendor whose credential is typed gets a form over the fields IT declares. One button for\n * both would be wrong for whichever it was not built around.\n *\n * ## A provider this deployment cannot connect is SHOWN, never hidden\n *\n * When the application has not registered with a vendor, the panel names the environment variables an\n * operator must set. Removing the provider would answer \"we do not support Asana\", which is false and\n * unfixable; naming `ASANA_CLIENT_ID` is true and is the thing that gets it set.\n *\n * ## One component, both scopes\n *\n * `ownerScope` decides whose account is being connected — a person's own, or the tenant's. The panel\n * is otherwise identical because the ACT is identical, and duplicating it would guarantee the two\n * drift. What must never be shared is the DATA: a person's connection and a tenant's shared\n * integration have different owners, different authorization and different readers, and the scope is\n * what keeps them apart at every call this panel makes.\n *\n * ## One row per CONNECTION, never one per ref (#1727)\n *\n * A vendor can be served by several refs — an engine part and the add-on packages beside it — declared as one shared\n * connection (`providers.sharedConnections`, #1725) that holds ONE grant (#1670). So both halves of this panel speak in\n * connections: the chooser offers one entry per connection (the catalogue folds members into their base and names\n * them in `servesRefs`), and the list above it shows one row per connection the owner holds — its vendor label, the\n * features it serves, the scopes its consent has accumulated (#1671), one health state, one \"grant more access\" when a\n * feature was refused for a missing scope, and one disconnect that says it ends access for every feature listed. A\n * vendor served by one ref is a connection of one ref and reads as it always did.\n *\n * Vendor names are the i18n tree's `providers.<ref>.displayName` (`buildProviderDisplayNameLabelKey`), owned by the\n * connection's BASE ref; a name nobody has authored renders the raw ref, so the gap looks like a gap.\n *\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the surface on which a principal\n * authorizes this application to act toward a named third party on their behalf.\n */\nimport React, { useCallback, useEffect, useId, useMemo, useRef, useState } from 'react';\nimport { z } from 'zod';\nimport { ButtonSize, FrontendComponentType } from '@wildo-ai/presets-components-models';\nimport {\n  buildProviderDisplayNameLabelKey,\n  isWildoBackendError,\n  ProviderAuthMethod,\n  ProviderConnectabilityBlocker,\n  ProviderCredentialValidationState,\n  type LinkedProviderConnectionView,\n  type ProviderScopeReauthorizationOffer,\n} from '@wildo-ai/saas-models';\nimport {\n  ExternalProvider_Connection_DelegationMode,\n  ExternalProvider_Connection_OwnerScope,\n  ProviderOAuth2EndpointPlaceholderPosition,\n  connectionLendsMemberAccountToOrganization,\n  connectionTargetNamesActingUser,\n} from '@wildo-ai/external-connectors-models';\nimport { Card, CardContent } from '~wildo-frontend-lib/components/sections/card';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Checkbox } from '~wildo-frontend-lib/components/form/controls/boolean/checkbox';\nimport { Select } from '~wildo-frontend-lib/components/form/controls/enum/select';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { Badge } from '~wildo-frontend-lib/components/data-display/badge';\nimport { DescriptionDetails, DescriptionList, DescriptionTerm } from '~wildo-frontend-lib/components/data-display/description-list';\nimport { Subheading } from '~wildo-frontend-lib/components/typography/heading';\nimport {\n  collectFrontendProviderDisplayLabelKeys,\n  resolveFrontendProviderDisplayLabel,\n} from '~wildo-frontend-lib/core/external-providers/frontend-provider-display-label.frontend.utils';\nimport {\n  findProviderScopeReauthorizationOffer,\n  useProviderScopeReauthorizationOffers,\n} from '~wildo-frontend-lib/core/external-providers/provider-scope-reauthorization-offers.frontend';\nimport { useOwnerProviderConnections } from './useOwnerProviderConnections';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport {\n  getManualCallsHttpClient,\n  type ConnectableProviderView,\n} from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\n\nconst COMPONENT = FrontendComponentType.APP_LAYOUTS_CONNECTED_ACCOUNTS_SETTINGS;\n\n/** The select's schema. A provider ref is an open identifier, so the control validates shape only. */\nconst PROVIDER_REF_SCHEMA = z.string().min(1);\n/** The chooser's own shape. Its OPTIONS are the provider's declared delegations, never this. */\nconst DELEGATION_SCHEMA = z.string().min(1);\n/** The organization-wide-use acknowledgement's shape: a statement a person either makes or does not. */\nconst ACKNOWLEDGEMENT_SCHEMA = z.boolean();\n/** A host chosen from the provider's declared values — never empty once chosen. */\nconst CONNECTION_PARAMETER_SCHEMA = z.string().min(1);\n\n/**\n * The providers connectable AT THIS SCOPE.\n *\n * Exported and named because it is the panel's one substantive claim: a provider admitting only\n * ORGANIZATION connections must never be offered on a person's screen, and vice versa — offering it\n * renders an action that answers 403 at the start leg.\n *\n * It deliberately does NOT filter on `connectable`. A provider this deployment cannot connect is\n * still offered, because the panel's answer for it is the missing configuration rather than silence.\n */\nexport const selectProvidersForScope = (\n  providers: readonly ConnectableProviderView[],\n  ownerScope: ExternalProvider_Connection_OwnerScope,\n): ConnectableProviderView[] => providers.filter((provider) => provider.admissibleConnections.some(\n  (shape) => shape.ownerScope === ownerScope,\n));\n\n/**\n * ON WHOSE BEHALF this provider admits a connection at this scope — DERIVED, never assumed.\n *\n * The panel used to send `delegation: SERVICE` for every connect, at both scopes. That is one of the\n * five declared shapes, so it worked by coincidence for the providers that happen to declare it and\n * answered `409 CONNECTION_NOT_ADMISSIBLE` for the rest — the start leg checks the exact\n * (ownerScope, delegation) PAIR against what the provider admits, and a scope does not imply a\n * delegation.\n *\n * Measured across the generated catalogue on 2026-09-10, which is why this is a derivation rather\n * than a better constant: at ORGANIZATION scope, 75 vendors declare `USER` and 39 declare `SERVICE`.\n * A hard-coded `SERVICE` was therefore wrong for the larger half — `asana` among them, which is how\n * this surfaced: the provider was listed, the button rendered, and the vendor was never reached.\n *\n * The pair is the provider's own statement, so the panel reads it rather than the person supplying\n * it. Where a provider declares BOTH delegations for one scope — 27 vendors do, `box`, `dropbox`,\n * `gmail` and `google-calendar` among them — the declaration genuinely does not decide, and only\n * then is there a question to put to anybody. See `.claude/rules/derive-before-you-ask.md`.\n */\nexport const admissibleDelegationsForScope = (\n  provider: ConnectableProviderView,\n  ownerScope: ExternalProvider_Connection_OwnerScope,\n): ExternalProvider_Connection_DelegationMode[] => {\n  // The view types both members as `string` — it is a wire record — so this is where they become\n  // the vocabulary. NARROWED rather than cast: a delegation this build does not know is dropped\n  // instead of being sent to the start leg, which would answer 409 for a value the panel invented.\n  const known = new Set<string>(Object.values(ExternalProvider_Connection_DelegationMode));\n  const delegations: ExternalProvider_Connection_DelegationMode[] = [];\n  for (const shape of provider.admissibleConnections) {\n    if (shape.ownerScope !== ownerScope || !known.has(shape.delegation)) continue;\n    const delegation = shape.delegation as ExternalProvider_Connection_DelegationMode;\n    if (!delegations.includes(delegation)) delegations.push(delegation);\n  }\n  return delegations;\n};\n\n/**\n * The target the start leg is given — assembled here so the shape is TESTABLE, not inlined.\n *\n * `ExternalProvider_ConnectionTargetSchema` decides `actingForUserId`, and it refuses in BOTH\n * directions, through the one predicate `connectionTargetNamesActingUser`:\n *\n * - an APPLICATION × USER call MUST name the person the application's identity impersonates;\n * - every other shape MUST NOT. For ORGANIZATION × USER — what 75 of the harvested vendors declare,\n *   `asana` among them — the person is whoever LINKS the account: one member lends their own vendor\n *   account to the whole organization (decision on wildo-ai/wildo-ai#18), so the grant, not the\n *   call, fixes who it acts as. A USER-owned connection already names its person in `ownerId`.\n *\n * History worth keeping: the panel once sent no `actingForUserId` at all, then (2026-09-10) sent the\n * signed-in person for every USER delegation. The second fixed the connect and hid that the spend\n * path refused the same shape, so a grant could be connected that nothing could use.\n *\n * `ownerId` is omitted for APPLICATION, which the schema likewise refuses — \"an application-owned\n * connection has exactly one instance, so an ownerId here names something that does not exist\".\n * The Settings Hub renders only USER and ORGANIZATION today, so that arm is unreachable from this\n * panel; it is handled because the function is the shape's one statement, and a caller that grows\n * the third scope should not have to rediscover the rule.\n */\nexport const buildConnectionTarget = (input: {\n  ownerScope: ExternalProvider_Connection_OwnerScope;\n  ownerId: string | null;\n  delegation: ExternalProvider_Connection_DelegationMode;\n  signedInUserId: string | null;\n}): {\n  ownerScope: ExternalProvider_Connection_OwnerScope;\n  delegation: ExternalProvider_Connection_DelegationMode;\n  ownerId?: string;\n  actingForUserId?: string;\n} => ({\n  ownerScope: input.ownerScope,\n  delegation: input.delegation,\n  ...(input.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION || input.ownerId === null\n    ? {}\n    : { ownerId: input.ownerId }),\n  ...(connectionTargetNamesActingUser(input) && input.signedInUserId !== null\n    ? { actingForUserId: input.signedInUserId }\n    : {}),\n});\n\n/**\n * The scopes a connection will REQUEST, as a person reads them before consenting (#991 review F12).\n *\n * A declared scope can carry a placeholder — Dataverse's `{hostUrl}/.default`, Outlook's `{accessMode}` —\n * and shown raw the list promised the literal brace. So a placeholder the person has ANSWERED below is\n * replaced by that answer, exactly as the start route resolves it, and one not yet answered is replaced\n * by the authored `pendingLabel`. Every other scope stays VERBATIM: it is the vendor's own token and the\n * string its consent screen is about to show, and no text is invented for it.\n */\nexport const describeRequestedScopes = (\n  scopes: readonly string[],\n  answers: Readonly<Record<string, string>>,\n  pendingLabel: string,\n): string[] => scopes.map((scope) => {\n  const placeholder = /^\\{([A-Za-z_][A-Za-z0-9_]*)\\}/.exec(scope);\n  if (placeholder === null) return scope;\n  const answer = (Object.hasOwn(answers, placeholder[1]!) ? answers[placeholder[1]!] : undefined)?.trim() ?? '';\n  return answer === '' ? pendingLabel : `${answer}${scope.slice(placeholder[0].length)}`;\n});\n\n/**\n * How one CONNECTION stands, as the list shows it (#1727) — one state for the connection, never one per ref.\n *\n * Ordered by what the person must do: a superseded row serves nothing any more, a disabled one resolves as absent, a\n * refused one must be re-authorized; only then does the grant's own validation say whether it has been proven.\n */\nexport enum ConnectedAccountStanding {\n  /** Stored under a ref before that ref joined a shared connection: nothing reads it (#1670, no re-seal door). */\n  SUPERSEDED = 'SUPERSEDED',\n  /** A row of it is disabled, so every ref it serves resolves it as absent. */\n  DISABLED = 'DISABLED',\n  /** The vendor refused it: every ref it serves needs it re-authorized — said ONCE, on the connection. */\n  NEEDS_REAUTHORIZATION = 'NEEDS_REAUTHORIZATION',\n  /** The vendor accepted it. */\n  WORKING = 'WORKING',\n  /** Stored, and not yet proven either way. */\n  NOT_YET_USED = 'NOT_YET_USED',\n}\n\n/** How the last disconnect on this screen ended — the notice it owes the person. */\nexport enum ConnectedAccountDisconnectOutcome {\n  DISCONNECTED = 'DISCONNECTED',\n  /** A row could not be deleted; rows already deleted stay deleted, and the list is read again either way. */\n  FAILED = 'FAILED',\n}\n\n/** The standing of one connection, from the listing's fields. */\nexport const connectedAccountStanding = (connection: LinkedProviderConnectionView): ConnectedAccountStanding => {\n  if (connection.supersededByConnectionRef !== undefined) return ConnectedAccountStanding.SUPERSEDED;\n  if (!connection.enabled) return ConnectedAccountStanding.DISABLED;\n  switch (connection.validationState) {\n    case ProviderCredentialValidationState.INVALID:\n      return ConnectedAccountStanding.NEEDS_REAUTHORIZATION;\n    case ProviderCredentialValidationState.VALID:\n      return ConnectedAccountStanding.WORKING;\n    case ProviderCredentialValidationState.UNVALIDATED:\n      return ConnectedAccountStanding.NOT_YET_USED;\n  }\n};\n\n/** The authored words for each standing — one key per member, so a new standing is a compile error here. */\nconst STANDING_LABEL_KEY: Readonly<Record<ConnectedAccountStanding, string>> = {\n  [ConnectedAccountStanding.SUPERSEDED]: 'statusSuperseded',\n  [ConnectedAccountStanding.DISABLED]: 'statusDisabled',\n  [ConnectedAccountStanding.NEEDS_REAUTHORIZATION]: 'statusNeedsReauthorization',\n  [ConnectedAccountStanding.WORKING]: 'statusWorking',\n  [ConnectedAccountStanding.NOT_YET_USED]: 'statusNotYetUsed',\n};\n\n/**\n * What a pending re-authorization offer (#1671) still asks of THIS connection — `undefined` when nothing is left.\n *\n * The offer was composed when a call was refused; the connection may have been granted some of those scopes since\n * (another re-authorization, a reconnect). So a scope the connection already records is dropped here rather than\n * requested again — the start leg would refuse it as `SCOPES_ALREADY_GRANTED` anyway, and asking a person to consent\n * to what they already granted is noise. An offer for another connection is not this connection's.\n */\nexport const pendingReauthorizationFor = (\n  connection: LinkedProviderConnectionView,\n  offer: ProviderScopeReauthorizationOffer | undefined,\n): { requestableScopes: string[]; administratorConsentScopes: string[]; offer: ProviderScopeReauthorizationOffer } | undefined => {\n  if (offer === undefined || offer.connectionRef !== connection.connectionRef) return undefined;\n  const granted = new Set(connection.grantedScopes ?? []);\n  const requestableScopes = offer.requestableScopes.filter((scope) => !granted.has(scope));\n  const administratorConsentScopes = offer.administratorConsentScopes.filter((scope) => !granted.has(scope));\n  if (requestableScopes.length === 0 && administratorConsentScopes.length === 0) return undefined;\n  return { requestableScopes, administratorConsentScopes, offer };\n};\n\n/**\n * Every provider display-label key the panel may render (#1727): each connection's and each served ref's, from the\n * catalogue and from the listing. The i18n tree's `providers.<ref>.displayName` is the only source of a vendor's name.\n */\nexport const collectConnectedAccountLabelKeys = (\n  providers: readonly ConnectableProviderView[],\n  connections: readonly LinkedProviderConnectionView[],\n): string[] => collectFrontendProviderDisplayLabelKeys([\n  ...providers.flatMap((provider) => [provider.providerRef, ...(provider.servesRefs ?? [])]),\n  ...connections.flatMap((connection) => [connection.connectionRef, ...connection.servesRefs, ...(connection.supersededByConnectionRef === undefined ? [] : [connection.supersededByConnectionRef])]),\n].map(buildProviderDisplayNameLabelKey));\n\n/**\n * What the callback left in the URL on its way back. Read once — see the panel's mount.\n *\n * Two shapes arrive here, and they are different acts. `connectionError` is a FINISHED outcome the\n * callback already decided — a refusal at the vendor, or an attempt it could not recognise. `state`\n * and `code` are an approval that is NOT yet redeemed: the callback cannot redeem it, because a\n * vendor redirect carries no bearer token, so it hands the approval to this screen to finish.\n */\nconst readReturnOutcome = (): {\n  connected?: string;\n  connectionError?: string;\n  state?: string;\n  code?: string;\n} => {\n  if (typeof window === 'undefined') return {};\n  const params = new URLSearchParams(window.location.search);\n  return {\n    connected: params.get('connected') ?? undefined,\n    connectionError: params.get('connectionError') ?? undefined,\n    state: params.get('state') ?? undefined,\n    code: params.get('code') ?? undefined,\n  };\n};\n\n/**\n * Take the approval out of the address bar once it has been redeemed.\n *\n * `replaceState` rather than a navigation: the entry is REPLACED, so the code does not sit in\n * history for a back button to return to, and no re-render is triggered. It is single-use at the\n * backend regardless — this is about not leaving it lying in the URL, in a referrer, or in whatever\n * the browser syncs.\n */\nconst clearApprovalFromAddressBar = (): void => {\n  if (typeof window === 'undefined') return;\n  const url = new URL(window.location.href);\n  url.searchParams.delete('state');\n  url.searchParams.delete('code');\n  window.history.replaceState(window.history.state, '', url.toString());\n};\n\ninterface ConnectionGrowActionProps {\n  connection: LinkedProviderConnectionView;\n  pending: NonNullable<ReturnType<typeof pendingReauthorizationFor>>;\n  /** The catalogue's entry for this connection — what it admits at this scope. Absent when it is no longer offered. */\n  catalogueEntry: ConnectableProviderView | undefined;\n  ownerScope: ExternalProvider_Connection_OwnerScope;\n  ownerId: string | null;\n  signedInUserId: string | null;\n  /** The connection's vendor label, for the button's accessible name. */\n  label: string;\n  t: (key: string) => string;\n  tWith: (key: string, params: Record<string, string>) => string;\n}\n\n/**\n * \"Grant more access\" on one connection (#1671, #1727): grow the stored grant by exactly the scopes a refused call\n * needs, through the ref that call used, naming the operation so the grant's audit row names its cause.\n *\n * ## It asks only what the declaration leaves open, like the connect form\n *\n * The start leg checks the (owner scope, delegation) pair, and the grant's audit row records the delegation, so a\n * delegation is never assumed: one admitted at this scope is the answer; several (the engine `microsoft` admits both a\n * tenant identity and a member's own account for an organization) are a question for the person, asked here with the\n * connect form's own words. A connection that lends a member's account to the organization asks for the same\n * acknowledgement the connect did.\n *\n * ## Only the member who linked an organization's account may grow it\n *\n * The start leg refuses anyone else (`NOT_THE_LINKING_MEMBER`, failing closed when no linker is recorded), so the\n * button is not offered to them: they are told who can, instead of pressing into a refusal.\n */\nconst ConnectionGrowAction: React.FC<ConnectionGrowActionProps> = ({\n  connection, pending, catalogueEntry, ownerScope, ownerId, signedInUserId, label, t, tWith,\n}) => {\n  const acknowledgementDescriptionId = useId();\n  const [delegationChoice, setDelegationChoice] = useState('');\n  const [acknowledged, setAcknowledged] = useState(false);\n  const [busy, setBusy] = useState(false);\n  const [failed, setFailed] = useState(false);\n\n  const delegations = catalogueEntry === undefined ? [] : admissibleDelegationsForScope(catalogueEntry, ownerScope);\n  const delegation = delegations.length === 1 ? delegations[0] : delegations.find((candidate) => candidate === delegationChoice);\n  const lends = delegation !== undefined && connectionLendsMemberAccountToOrganization({ ownerScope, delegation });\n  const mayGrow = ownerScope === ExternalProvider_Connection_OwnerScope.USER\n    || (connection.linkedByUserId !== undefined && connection.linkedByUserId === signedInUserId);\n\n  const grow = useCallback(async () => {\n    if (ownerId === null || delegation === undefined) return;\n    setBusy(true);\n    setFailed(false);\n    try {\n      const { authorizeUrl } = await getManualCallsHttpClient().startProviderConnection(pending.offer.providerRef, {\n        target: buildConnectionTarget({ ownerScope, ownerId, delegation, signedInUserId }),\n        addScopes: pending.requestableScopes,\n        forOperationId: pending.offer.operationId,\n        ...(lends ? { acknowledgesOrganizationWideUse: acknowledged } : {}),\n      });\n      // The browser leaves for the vendor; see the connect handler for why nothing is set afterwards.\n      window.location.href = authorizeUrl;\n    } catch (e: unknown) {\n      if (isWildoBackendError(e)) throw e;\n      setFailed(true);\n      setBusy(false);\n    }\n  }, [acknowledged, delegation, lends, ownerId, ownerScope, pending, signedInUserId]);\n\n  return (\n    <div className=\"flex flex-col gap-item-xs\">\n      <Text className=\"text-xs\">{t('reauthorizationOfferDescription')}</Text>\n      {/* Scopes VERBATIM, for the reason the connect form gives: they are the vendor's own words for the consent. */}\n      {pending.requestableScopes.length > 0 && (\n        <Text className=\"text-xs text-muted-foreground\">\n          {t('reauthorizationScopesPrefix')}\n          {' '}\n          {pending.requestableScopes.join(', ')}\n        </Text>\n      )}\n      {pending.administratorConsentScopes.length > 0 && (\n        <Text className=\"text-xs text-muted-foreground\">\n          {t('reauthorizationAdministratorPrefix')}\n          {' '}\n          {pending.administratorConsentScopes.join(', ')}\n        </Text>\n      )}\n      {pending.requestableScopes.length > 0 && !mayGrow && (\n        <Text className=\"text-xs text-muted-foreground\">{t('reauthorizationLinkerOnlyNotice')}</Text>\n      )}\n      {pending.requestableScopes.length > 0 && mayGrow && (\n        <>\n          {delegations.length > 1 && (\n            <div className=\"flex flex-col gap-item-xs\">\n              <Text className=\"text-sm font-medium\">{t('delegationHeading')}</Text>\n              <Text className=\"text-xs text-muted-foreground\">{t('delegationDescription')}</Text>\n              <Select\n                name={`delegation-${connection.connectionRef}`}\n                schema={DELEGATION_SCHEMA}\n                options={delegations.map((mode) => ({\n                  value: mode,\n                  label: t(mode === ExternalProvider_Connection_DelegationMode.SERVICE ? 'delegationServiceOption' : 'delegationUserOption'),\n                }))}\n                value={delegationChoice}\n                placeholder={t('delegationPlaceholder')}\n                onChange={(mode: string) => {\n                  setDelegationChoice(mode);\n                  setAcknowledged(false);\n                }}\n              />\n            </div>\n          )}\n          {lends && (\n            <div className=\"flex items-start gap-item-xs\">\n              <Checkbox\n                name={`organizationWideUseAcknowledged-${connection.connectionRef}`}\n                schema={ACKNOWLEDGEMENT_SCHEMA}\n                checked={acknowledged}\n                onCheckedChange={setAcknowledged}\n                aria-describedby={acknowledgementDescriptionId}\n              />\n              <div className=\"flex flex-col gap-item-xs\">\n                <Text className=\"text-sm font-medium\">{t('organizationWideUseAcknowledgement')}</Text>\n                <Text id={acknowledgementDescriptionId} className=\"text-xs text-muted-foreground\">{t('organizationWideUseDescription')}</Text>\n              </div>\n            </div>\n          )}\n          <div className=\"flex justify-end\">\n            <Button\n              size={ButtonSize.SM}\n              variant={ButtonVariants_Variant.DEFAULT}\n              aria-label={tWith('grantMoreAccessAccessibleName', { provider: label })}\n              disabled={busy || ownerId === null || delegation === undefined || (lends && !acknowledged)}\n              onClick={grow}\n            >\n              {t('grantMoreAccessButton')}\n            </Button>\n          </div>\n        </>\n      )}\n      {failed && (\n        <Alert variant=\"destructive\"><AlertDescription>{t('errorGeneric')}</AlertDescription></Alert>\n      )}\n    </div>\n  );\n};\n\nexport interface ConnectedAccountsSettingsProps {\n  /**\n   * WHOSE account is being connected.\n   *\n   * A prop rather than two components: the act is identical and duplicating it would guarantee the\n   * two screens drift. The DATA never mixes — every call this panel makes carries the scope.\n   */\n  ownerScope: ExternalProvider_Connection_OwnerScope;\n}\n\nexport const AppPage_ConnectedAccountsSettings: React.FC<Partial<ConnectedAccountsSettingsProps>> = ({\n  // Defaults to the person's own, which is the destination this panel was built for; the\n  // organization surface passes the scope explicitly.\n  ownerScope = ExternalProvider_Connection_OwnerScope.USER,\n}) => {\n  const { tComponent, isReady } = useI18n({ component: COMPONENT });\n  const { user, currentOrganizationId } = useUserOrgs() as {\n    user?: { _id?: string };\n    currentOrganizationId?: string | null;\n  };\n\n  const t = useCallback((key: string) => tComponent(COMPONENT, key), [tComponent]);\n  /** A label whose words carry a vendor name or a list — `{provider}`, `{connection}` — declared in the labels file. */\n  const tWith = useCallback(\n    (key: string, params: Record<string, string>) => tComponent(COMPONENT, key, params),\n    [tComponent],\n  );\n  const connectionsHeadingId = useId();\n\n  /**\n   * WHOSE account, resolved for the scope in play.\n   *\n   * The backend re-checks it — a USER target must be the caller, an ORGANIZATION target goes through\n   * the membership port — so supplying it is a statement of intent rather than a decision.\n   */\n  const ownerId = ownerScope === ExternalProvider_Connection_OwnerScope.USER\n    ? user?._id ?? null\n    : currentOrganizationId ?? null;\n\n  const [providers, setProviders] = useState<ConnectableProviderView[]>([]);\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const [selectedRef, setSelectedRef] = useState<string>('');\n  const [busy, setBusy] = useState(false);\n  /** Set ONLY when the provider declares both delegations for this scope — otherwise derived. */\n  const [delegationChoice, setDelegationChoice] = useState<string>('');\n  /** The linking member's acknowledgement for a connection that lends their account to the organization. */\n  const [organizationWideUseAcknowledged, setOrganizationWideUseAcknowledged] = useState(false);\n  /** Answers keyed by the slug the PROVIDER declared — never by a name somebody typed. */\n  const [answers, setAnswers] = useState<Record<string, string>>({});\n\n  const [outcome, setOutcome] = useState(readReturnOutcome);\n\n  /**\n   * Redeem an approval the vendor just granted — the half the callback could not do.\n   *\n   * ## The in-flight request is CACHED, and both mounts subscribe to it\n   *\n   * React 18 mounts an effect, tears it down and mounts it again in StrictMode, and the attempt is\n   * consumed atomically by the backend — so a second redemption answers\n   * `CONNECTION_ATTEMPT_INVALID` and the `catch` would replace a connection that genuinely succeeded\n   * with a failure notice. That is not hypothetical: on the first real consent, 2026-09-10, the\n   * backend logged `[oauth2-connect] account connected` with `grantedScopes: [\"default\",\"identity\"]`\n   * and stored the credential, and the browser then posted a second time and showed a 400.\n   *\n   * A once-guard alone does not fix it, and the way it fails is worse than the defect — the same\n   * trap `TotpEnrollmentMethod.strict-mode-setup.test.tsx` records. A guard PLUS a cancel-on-cleanup\n   * flag means mount 1 starts the request, its cleanup cancels the only subscriber, and the guard\n   * then stops mount 2 from applying anything: the account connects and the panel says nothing at\n   * all. Caching the PROMISE instead lets the remount re-subscribe, so there is one request and the\n   * live mount is the one that renders its result.\n   *\n   * The address bar is cleared beside the request rather than after it, for its own reason: not\n   * leaving an authorization code sitting in history behind a back button.\n   */\n  const redemption = useRef<Promise<{ connected: string }> | null>(null);\n  useEffect(() => {\n    const { state, code } = outcome;\n    if (state === undefined || code === undefined) return;\n    if (redemption.current === null) {\n      clearApprovalFromAddressBar();\n      redemption.current = getManualCallsHttpClient().completeProviderConnection({ state, code });\n    }\n    let cancelled = false;\n    redemption.current\n      .then(({ connected }) => { if (!cancelled) setOutcome({ connected }); })\n      .catch((e: unknown) => {\n        if (isWildoBackendError(e)) throw e;\n        // The callback's own vocabulary, so the notices below stay one set rather than two.\n        if (!cancelled) setOutcome({ connectionError: 'failed' });\n      });\n    return () => { cancelled = true; };\n    // `outcome` is seeded once from the URL and the cached promise is what makes this issue one\n    // request, so this deliberately does not re-run on the outcome it sets itself.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, []);\n\n  useEffect(() => {\n    let cancelled = false;\n    (async () => {\n      try {\n        const res = await getManualCallsHttpClient().listConnectableProviders();\n        if (!cancelled) setProviders(res.providers ?? []);\n      } catch (e: unknown) {\n        if (isWildoBackendError(e)) throw e;\n        if (!cancelled) setError(t('errorGeneric'));\n      } finally {\n        if (!cancelled) setLoading(false);\n      }\n    })();\n    return () => { cancelled = true; };\n  }, [t]);\n\n  const available = useMemo(() => selectProvidersForScope(providers, ownerScope), [providers, ownerScope]);\n\n  /** The connections this owner HOLDS — one row each (#1727). */\n  const {\n    connections,\n    loading: connectionsLoading,\n    failed: connectionsFailed,\n    disconnect,\n  } = useOwnerProviderConnections(ownerScope, ownerId);\n  /** Re-authorization offers a refused call left behind (#1671), by connection. */\n  const offers = useProviderScopeReauthorizationOffers();\n\n  /*\n   * Vendor names come from the i18n tree, keyed on each connection's BASE ref. Loaded through their own `useI18n`\n   * rather than folded into the component's: the key set grows when the listing arrives, and gating the whole panel\n   * on it would blank the panel for that moment. An unloaded or unauthored name renders the raw ref.\n   */\n  const providerLabelKeys = useMemo(() => collectConnectedAccountLabelKeys(providers, connections), [providers, connections]);\n  const { t: translateProvider } = useI18n({ keys: providerLabelKeys });\n  const labelOf = useCallback(\n    (providerRef: string) => resolveFrontendProviderDisplayLabel({ providerRef, translate: translateProvider }),\n    [translateProvider],\n  );\n\n  /** The connection whose disconnect is awaiting confirmation — one at a time. */\n  const [confirmingDisconnectRef, setConfirmingDisconnectRef] = useState<string | null>(null);\n  const [disconnectingRef, setDisconnectingRef] = useState<string | null>(null);\n  const [disconnectOutcome, setDisconnectOutcome] = useState<ConnectedAccountDisconnectOutcome | null>(null);\n\n  /**\n   * End one connection. The confirmation above the button already said it ends access for every feature listed; this\n   * deletes every row of it through the credential resource's own DELETE (`useOwnerProviderConnections`).\n   */\n  const handleDisconnect = useCallback(async (connection: LinkedProviderConnectionView) => {\n    setDisconnectingRef(connection.connectionRef);\n    setDisconnectOutcome(null);\n    try {\n      await disconnect(connection);\n      setDisconnectOutcome(ConnectedAccountDisconnectOutcome.DISCONNECTED);\n    } catch (e: unknown) {\n      if (isWildoBackendError(e)) throw e;\n      setDisconnectOutcome(ConnectedAccountDisconnectOutcome.FAILED);\n    } finally {\n      setDisconnectingRef(null);\n      setConfirmingDisconnectRef(null);\n    }\n  }, [disconnect]);\n\n  /*\n   * WHICH disconnect notice is true here. `undefined` from an older backend counts as \"cannot be\n   * told\", which is the safe direction: it sends the person to check at the vendor, where the worst\n   * outcome is a wasted look rather than a belief that access ended when it did not.\n   */\n  const disconnectNoticeRef = useMemo(() => {\n    if (available.length === 0) return 'disconnectNotice';\n    const told = available.filter((provider) => provider.revocationTellsVendor === true).length;\n    if (told === 0) return 'disconnectNotice';\n    return told === available.length ? 'disconnectRevokesNotice' : 'disconnectMixedNotice';\n  }, [available]);\n\n  /**\n   * EVERY declared provider still missing part of its configuration — not just the selected one.\n   *\n   * A gap found by selecting a provider is a gap found one click at a time, and an operator asking\n   * \"what is not configured\" would have to walk all eighteen. This answers it once.\n   *\n   * Deliberately NOT filtered by `ownerScope`. A missing environment variable is a fact about the\n   * APPLICATION: `ASANA_CLIENT_ID` is absent for everybody, and hiding it on the person's screen\n   * because Asana also admits a tenant connection would make the same gap visible or invisible\n   * depending on which settings page somebody happened to open.\n   */\n  const configurationGaps = useMemo(\n    () => providers\n      .filter((provider) => (provider.missingRegistration ?? []).length > 0)\n      .map((provider) => ({\n        providerRef: provider.providerRef,\n        envVarNames: (provider.missingRegistration ?? []).map((slot) => slot.envVarName),\n      })),\n    [providers],\n  );\n  const selected = useMemo(\n    () => available.find((provider) => provider.providerRef === selectedRef),\n    [available, selectedRef],\n  );\n\n  // Answers belong to the provider they were typed for. Clearing on change is what stops a value\n  // meant for one vendor being submitted to another when somebody changes their mind mid-form.\n  const chooseProvider = useCallback((ref: string) => {\n    setSelectedRef(ref);\n    setAnswers({});\n    setDelegationChoice('');\n    // An acknowledgement is about ONE provider's account; carrying it to the next would be consent to\n    // something the person has not read.\n    setOrganizationWideUseAcknowledged(false);\n    setError(null);\n  }, []);\n\n  /**\n   * What this provider admits at the scope in play, and the one the connect will carry.\n   *\n   * `delegationChoice` is only ever set by the chooser below, which renders solely when the provider\n   * declares more than one. For the ordinary provider `delegations` has a single member and that\n   * member IS the answer — nothing is asked and nothing is assumed.\n   */\n  const delegations = useMemo(\n    () => (selected === undefined ? [] : admissibleDelegationsForScope(selected, ownerScope)),\n    [ownerScope, selected],\n  );\n  const delegation = delegations.length === 1\n    ? delegations[0]\n    : delegations.find((candidate) => candidate === delegationChoice);\n\n  const [savedNotice, setSavedNotice] = useState<string | null>(null);\n\n  /**\n   * Whether connecting lends the signed-in member's OWN account to the whole organization — and so\n   * owes their acknowledgement before the connect may run. Same predicate the connect leg enforces.\n   */\n  const lendsAccountToOrganization = delegation !== undefined\n    && connectionLendsMemberAccountToOrganization({ ownerScope, delegation });\n\n  /**\n   * The two acts behind one button, branching on the provider's own auth method.\n   *\n   * An authorization flow ENDS THE PAGE — the browser leaves for the vendor and returns to a fresh\n   * load. A typed credential ends in a stored row and the person stays here. Sharing a handler is\n   * right because the person's intent is the same (\"connect this\"); sharing the OUTCOME would not be,\n   * which is why only one of the branches navigates.\n   */\n  const handleConnect = useCallback(async () => {\n    // `delegation` undefined means the provider declares several and none is chosen yet. The button\n    // is disabled in that state; the guard is here because a disabled control is a courtesy and this\n    // is the statement that a target is never assembled with a delegation nobody chose.\n    if (selected === undefined || ownerId === null || delegation === undefined) return;\n    setBusy(true);\n    setError(null);\n    setSavedNotice(null);\n    const target = buildConnectionTarget({ ownerScope, ownerId, delegation, signedInUserId: user?._id ?? null });\n    try {\n      if (selected.authMethods?.includes(ProviderAuthMethod.OAUTH2_AUTHORIZATION_CODE) ?? false) {\n        const { authorizeUrl } = await getManualCallsHttpClient().startProviderConnection(\n          selected.providerRef,\n          {\n            target,\n            connectionParameters: answers,\n            ...(lendsAccountToOrganization ? { acknowledgesOrganizationWideUse: organizationWideUseAcknowledged } : {}),\n          },\n        );\n        // The browser leaves. No state is set afterwards: this component is about to be unmounted by\n        // a navigation, and a `setState` here would be a React warning on the way out.\n        window.location.href = authorizeUrl;\n        return;\n      }\n\n      // Only the values the provider DECLARED, so a stale answer left over from a field that is no\n      // longer offered cannot be posted. The route re-checks this; sending less is still the honest\n      // thing for the screen to do.\n      const declared = new Set((selected.credentialFields ?? []).map((field) => field.slug));\n      const values = Object.fromEntries(\n        Object.entries(answers).filter(([slug, value]) => declared.has(slug) && value.trim() !== ''),\n      );\n      // The REST base URL's own answers, apart from the credential (#1097) — which subdomain, which\n      // workspace host. Not secrets; the route admits each against the provider's host allowance\n      // before anything is written, and refuses a missing one by name.\n      const asked = new Set(selected.connectionParameters ?? []);\n      const connectionParameters = Object.fromEntries(\n        Object.entries(answers).filter(([name, value]) => asked.has(name) && value.trim() !== ''),\n      );\n      await getManualCallsHttpClient().storeProviderCredential(selected.providerRef, {\n        target,\n        values,\n        ...(Object.keys(connectionParameters).length === 0 ? {} : { connectionParameters }),\n        ...(lendsAccountToOrganization ? { acknowledgesOrganizationWideUse: organizationWideUseAcknowledged } : {}),\n      });\n\n      // The typed values are cleared once stored. They are secrets, and a form that keeps them\n      // on screen after they have been sealed is holding them for no reason.\n      setAnswers({});\n      setSavedNotice(t('credentialStoredNotice'));\n      setBusy(false);\n    } catch (e: unknown) {\n      if (isWildoBackendError(e)) throw e;\n      setError(t('errorGeneric'));\n      setBusy(false);\n    }\n  }, [answers, delegation, lendsAccountToOrganization, organizationWideUseAcknowledged, ownerId, ownerScope, selected, t, user?._id]);\n\n  if (!isReady) return null;\n\n  const providerOptions = available.map((provider) => ({\n    value: provider.providerRef,\n    // The CONNECTION's vendor name from the i18n tree (`providers.<ref>.displayName`), one option per connection\n    // (#1727). It used to be the ref verbatim; an unauthored name still renders the ref, never words derived from it.\n    label: labelOf(provider.providerRef),\n  }));\n\n  const oauth2 = selected?.authMethods?.includes(ProviderAuthMethod.OAUTH2_AUTHORIZATION_CODE) ?? false;\n  const missing = selected?.missingRegistration ?? [];\n  const parameters = selected?.connectionParameters ?? [];\n  const parameterChoices = selected?.connectionParameterChoices ?? {};\n  const credentialFields = selected?.credentialFields ?? [];\n  /** What the authorization will REQUEST — rendered before the button, never only after consent. */\n  const scopes = selected?.scopes ?? [];\n  // Every asked connection parameter is required on BOTH paths (#1097): a base-URL placeholder is a hole\n  // in the address every call dials, exactly as an endpoint placeholder is a hole in the vendor's URLs.\n  const unanswered = [...parameters, ...(oauth2 ? [] : credentialFields.filter((f) => f.required).map((f) => f.slug))]\n    .some((key) => (answers[key] ?? '').trim() === '');\n\n  return (\n    <div className=\"flex flex-col gap-section\">\n      {/*\n        * No heading of the panel's own. It sat under a tab already named for this act (\"Connect\") inside\n        * a destination already named for the subject (\"Integrations\"), and said a third thing — \"Connected\n        * accounts\", over a form that lists none. The sentence under it promised \"act on your behalf\" on the\n        * organization screen too, where the account is the tenant's. The tab and the chooser say it.\n        */}\n\n      {/* The return leg's own report. `declined` is NOT destructive — somebody who pressed \"Deny\"\n          made a decision, and dressing it in red tells them they did something wrong. */}\n      {outcome.connected !== undefined && (\n        <Alert><AlertDescription>{t('connectedNotice')}</AlertDescription></Alert>\n      )}\n      {outcome.connectionError === 'declined' && (\n        <Alert><AlertDescription>{t('declinedNotice')}</AlertDescription></Alert>\n      )}\n      {outcome.connectionError !== undefined && outcome.connectionError !== 'declined' && (\n        <Alert variant=\"destructive\"><AlertDescription>{t('failedNotice')}</AlertDescription></Alert>\n      )}\n      {savedNotice && <Alert><AlertDescription>{savedNotice}</AlertDescription></Alert>}\n      {error && <Alert variant=\"destructive\"><AlertDescription>{error}</AlertDescription></Alert>}\n      {disconnectOutcome === ConnectedAccountDisconnectOutcome.DISCONNECTED && (\n        <Alert><AlertDescription>{t('disconnectedNotice')}</AlertDescription></Alert>\n      )}\n      {disconnectOutcome === ConnectedAccountDisconnectOutcome.FAILED && (\n        <Alert variant=\"destructive\"><AlertDescription>{t('disconnectFailedNotice')}</AlertDescription></Alert>\n      )}\n\n      {/*\n        * WHAT THIS OWNER HOLDS — one row per CONNECTION (#1727).\n        *\n        * A labelled list, so a screen reader announces how many connections there are and where the list ends. Each\n        * row names its vendor once, the features that spend it, the scopes its consent has accumulated, and ONE state:\n        * a refused grant is marked here once, not on every feature that uses it. Its actions are buttons whose\n        * accessible names carry the vendor, because \"Disconnect\" said five times in one list names nothing.\n        */}\n      <section aria-labelledby={connectionsHeadingId} className=\"flex flex-col gap-group\">\n        <Subheading level={3} id={connectionsHeadingId}>{t('connectionsHeading')}</Subheading>\n        {connectionsLoading ? (\n          <Text className=\"text-sm text-muted-foreground\">{t('connectionsLoading')}</Text>\n        ) : connectionsFailed ? (\n          <Alert variant=\"destructive\"><AlertDescription>{t('connectionsFailed')}</AlertDescription></Alert>\n        ) : connections.length === 0 ? (\n          <Text className=\"text-sm text-muted-foreground\">{t('connectionsEmpty')}</Text>\n        ) : (\n          <ul aria-labelledby={connectionsHeadingId} className=\"flex flex-col gap-group\">\n            {connections.map((connection) => {\n              const label = labelOf(connection.connectionRef);\n              const standing = connectedAccountStanding(connection);\n              const pending = standing === ConnectedAccountStanding.SUPERSEDED\n                ? undefined\n                // THIS owner's offer only: a person's own grant and their organization's share a connection ref.\n                : pendingReauthorizationFor(connection, ownerId === null ? undefined : findProviderScopeReauthorizationOffer(offers, { ownerScope, ownerId }, connection.connectionRef));\n              const catalogueEntry = available.find((provider) => (provider.connectionRef ?? provider.providerRef) === connection.connectionRef);\n              const confirming = confirmingDisconnectRef === connection.connectionRef;\n              const disconnecting = disconnectingRef === connection.connectionRef;\n              return (\n                <li key={connection.connectionRef}>\n                  <Card>\n                    <CardContent className=\"flex flex-col gap-item-xs\">\n                      <Text className=\"text-sm font-medium\">{label}</Text>\n                      <DescriptionList>\n                        <DescriptionTerm>{t('statusLabel')}</DescriptionTerm>\n                        <DescriptionDetails>\n                          <Badge variant={standing === ConnectedAccountStanding.WORKING ? 'success' : standing === ConnectedAccountStanding.NOT_YET_USED ? 'secondary' : 'destructive'}>\n                            {t(STANDING_LABEL_KEY[standing])}\n                          </Badge>\n                        </DescriptionDetails>\n                        {connection.servesRefs.length > 0 && (\n                          <>\n                            <DescriptionTerm>{t('servesLabel')}</DescriptionTerm>\n                            <DescriptionDetails>{connection.servesRefs.map(labelOf).join(', ')}</DescriptionDetails>\n                          </>\n                        )}\n                        {(connection.grantedScopes ?? []).length > 0 && (\n                          <>\n                            <DescriptionTerm>{t('grantedScopesLabel')}</DescriptionTerm>\n                            {/* The vendor's own permission identifiers, verbatim — see the connect form's scope list. */}\n                            <DescriptionDetails>{(connection.grantedScopes ?? []).join(', ')}</DescriptionDetails>\n                          </>\n                        )}\n                      </DescriptionList>\n\n                      {standing === ConnectedAccountStanding.SUPERSEDED && connection.supersededByConnectionRef !== undefined && (\n                        <Text className=\"text-xs text-muted-foreground\">\n                          {tWith('supersededNotice', { connection: labelOf(connection.supersededByConnectionRef) })}\n                        </Text>\n                      )}\n                      {standing === ConnectedAccountStanding.NEEDS_REAUTHORIZATION && (\n                        <div className=\"flex flex-col gap-item-xs\">\n                          <Text className=\"text-xs text-muted-foreground\">{t('needsReauthorizationNotice')}</Text>\n                          {catalogueEntry !== undefined && (\n                            <div className=\"flex justify-end\">\n                              <Button\n                                size={ButtonSize.SM}\n                                variant={ButtonVariants_Variant.OUTLINE}\n                                aria-label={tWith('reconnectAccessibleName', { provider: label })}\n                                onClick={() => chooseProvider(catalogueEntry.providerRef)}\n                              >\n                                {t('reconnectButton')}\n                              </Button>\n                            </div>\n                          )}\n                        </div>\n                      )}\n\n                      {pending !== undefined && (\n                        <ConnectionGrowAction\n                          connection={connection}\n                          pending={pending}\n                          catalogueEntry={catalogueEntry}\n                          ownerScope={ownerScope}\n                          ownerId={ownerId}\n                          signedInUserId={user?._id ?? null}\n                          label={label}\n                          t={t}\n                          tWith={tWith}\n                        />\n                      )}\n\n                      {/* ONE disconnect for the one grant, confirmed with what it ends: every feature listed above. */}\n                      {confirming ? (\n                        <div className=\"flex flex-col gap-item-xs\">\n                          <Text className=\"text-xs\">{tWith('disconnectConfirmDescription', { provider: label })}</Text>\n                          {/* Whether the vendor is told is a fact about THIS connection (#545), so it is said here. */}\n                          <Text className=\"text-xs text-muted-foreground\">\n                            {t(connection.revocationTellsVendor ? 'disconnectRevokesNotice' : 'disconnectNotice')}\n                          </Text>\n                          <div className=\"flex justify-end gap-item-xs\">\n                            <Button\n                              size={ButtonSize.SM}\n                              variant={ButtonVariants_Variant.GHOST}\n                              disabled={disconnecting}\n                              onClick={() => setConfirmingDisconnectRef(null)}\n                            >\n                              {t('disconnectCancelButton')}\n                            </Button>\n                            <Button\n                              size={ButtonSize.SM}\n                              variant={ButtonVariants_Variant.DESTRUCTIVE}\n                              aria-label={tWith('disconnectConfirmAccessibleName', { provider: label })}\n                              disabled={disconnecting}\n                              onClick={() => { void handleDisconnect(connection); }}\n                            >\n                              {t('disconnectConfirmButton')}\n                            </Button>\n                          </div>\n                        </div>\n                      ) : (\n                        <div className=\"flex justify-end\">\n                          <Button\n                            size={ButtonSize.SM}\n                            variant={ButtonVariants_Variant.OUTLINE}\n                            aria-label={tWith('disconnectAccessibleName', { provider: label })}\n                            disabled={disconnectingRef !== null}\n                            onClick={() => { setConfirmingDisconnectRef(connection.connectionRef); setDisconnectOutcome(null); }}\n                          >\n                            {t('disconnectButton')}\n                          </Button>\n                        </div>\n                      )}\n                    </CardContent>\n                  </Card>\n                </li>\n              );\n            })}\n          </ul>\n        )}\n      </section>\n\n      {/*\n        * The whole configuration's gaps, stated once and before anything else.\n        *\n        * Written rather than hidden, which is the decision this panel exists to make visible: a\n        * provider whose registration is absent still appears in the chooser, and this says what an\n        * operator must set for ANY of them to work. An environment variable's NAME is not a secret —\n        * it is the only thing that makes the gap actionable.\n        */}\n      {configurationGaps.length > 0 && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>\n            <div className=\"flex flex-col gap-item-xs\">\n              <Text className=\"text-sm font-medium\">{t('configurationGapsHeading')}</Text>\n              <Text className=\"text-xs\">{t('configurationGapsDescription')}</Text>\n              <ul className=\"list-disc pl-4\">\n                {configurationGaps.map((gap) => (\n                  <li key={gap.providerRef} className=\"text-xs\">\n                    {labelOf(gap.providerRef)}\n                    {': '}\n                    {gap.envVarNames.join(', ')}\n                  </li>\n                ))}\n              </ul>\n            </div>\n          </AlertDescription>\n        </Alert>\n      )}\n\n      {/* No card heading: it sat over one control and said what that control's placeholder already says\n          (\"Choose provider\" above \"Choose a provider\"). */}\n      <Card>\n        <CardContent className=\"flex flex-col gap-group\">\n          {loading ? (\n            <Text className=\"text-sm text-muted-foreground\">{t('loading')}</Text>\n          ) : providerOptions.length === 0 ? (\n            <Text className=\"text-sm text-muted-foreground\">{t('empty')}</Text>\n          ) : (\n            <>\n              {/* A SELECT over what the application declares. The whole point: a provider ref is\n                  never typed, so it can never be a ref that does not exist. */}\n              <Select\n                name=\"providerRef\"\n                schema={PROVIDER_REF_SCHEMA}\n                options={providerOptions}\n                value={selectedRef}\n                placeholder={t('choosePlaceholder')}\n                onChange={chooseProvider}\n              />\n\n              {selected !== undefined && (\n                <div className=\"flex flex-col gap-group\">\n                  {/* No second notice for a provider this deployment has not registered with. Its\n                      environment variables are already named, by provider, in the configuration block\n                      above the chooser — which is computed over every provider, so the one chosen here is\n                      always in it — and the same list printed a second time beside the button said\n                      nothing the first had not. The disabled button is the per-provider consequence. */}\n\n                  {/* The features this ONE connection serves (#1727), so a person connecting a vendor once knows\n                      everything that consent reaches. Said only when there is more than the connection itself. */}\n                  {(selected.servesRefs ?? []).length > 1 && (\n                    <Text className=\"text-xs text-muted-foreground\">\n                      {t('servesLabel')}\n                      {' '}\n                      {(selected.servesRefs ?? []).map(labelOf).join(', ')}\n                    </Text>\n                  )}\n\n                  {!oauth2 && missing.length === 0 && (\n                    <Text className=\"text-xs text-muted-foreground\">{t('pastedCredentialNotice')}</Text>\n                  )}\n\n                  {/* ON WHOSE BEHALF — asked ONLY where the provider's own declaration leaves it open.\n                      One admitted delegation is an answer, not a question, so the ordinary provider\n                      renders nothing here and the connect carries what the vendor declared. The 27\n                      that admit both at one scope are a real choice between two different accounts —\n                      the tenant's own token, or a token minted for the person acting — and neither\n                      the panel nor a default may make it on their behalf. */}\n                  {delegations.length > 1 && (\n                    <div className=\"flex flex-col gap-item-xs\">\n                      <Text className=\"text-sm font-medium\">{t('delegationHeading')}</Text>\n                      <Text className=\"text-xs text-muted-foreground\">{t('delegationDescription')}</Text>\n                      <Select\n                        name=\"delegation\"\n                        schema={DELEGATION_SCHEMA}\n                        options={delegations.map((mode) => ({\n                          value: mode,\n                          label: t(mode === ExternalProvider_Connection_DelegationMode.SERVICE\n                            ? 'delegationServiceOption'\n                            : 'delegationUserOption'),\n                        }))}\n                        value={delegationChoice}\n                        placeholder={t('delegationPlaceholder')}\n                        onChange={(mode: string) => {\n                          setDelegationChoice(mode);\n                          // An acknowledgement given for one delegation is not consent to another:\n                          // switching away and back must ask again.\n                          setOrganizationWideUseAcknowledged(false);\n                        }}\n                      />\n                    </div>\n                  )}\n\n                  {/* WHAT THIS WILL ASK THE VENDOR FOR, before the button that asks for it.\n                      *\n                      * The scopes are the substance of the consent: `slack` requests THIRTY of them,\n                      * `gitlab` asks for `api`, and a panel that sends somebody to a vendor without\n                      * naming them is asking for a signature on an unread page. The catalogue has\n                      * carried `scopes` since the route was written and nothing rendered it — the\n                      * label existed too, authored and never wired.\n                      *\n                      * VERBATIM, and deliberately: a scope is the vendor's own token, it is the\n                      * string the vendor's own consent screen is about to show, and there is no\n                      * authored label for an open vocabulary spanning every provider. Prettifying\n                      * `channels:write.invites` into words would invent display text no translator\n                      * can reach and would no longer match what the vendor says next. */}\n                  {oauth2 && scopes.length > 0 && (\n                    <Text className=\"text-xs text-muted-foreground\">\n                      {t('scopesPrefix')}\n                      {' '}\n                      {describeRequestedScopes(scopes, answers, t('scopeChosenBelow')).join(', ')}\n                    </Text>\n                  )}\n\n                  {/* THE DECLARED FIELDS — for an authorization flow, the placeholders its own URLs\n                      carry; for a typed credential, the slots the provider's secrets contract names AND\n                      the placeholders its REST base URL carries (#1097). Either way the form knows what\n                      to ask for, and nobody types a slug. */}\n                  {(parameters.length > 0 || (!oauth2 && credentialFields.length > 0)) && (\n                    <div className=\"flex flex-col gap-item-xs\">\n                      <Text className=\"text-sm font-medium\">{t('parametersHeading')}</Text>\n                      <Text className=\"text-xs text-muted-foreground\">{t('parametersDescription')}</Text>\n                    </div>\n                  )}\n\n                  {[\n                    // The credential itself, for a typed one: a secret, so a password field.\n                    ...(oauth2 ? [] : credentialFields.map((field) => ({ key: field.slug, label: field.slug, description: field.description, choices: undefined, secret: true }))),\n                    // The placeholders — the endpoints' for an authorization flow, the REST base URL's for\n                    // a typed credential (#1097): which cloud, which subdomain. Not secrets, and shown.\n                    ...parameters.map((name) => ({ key: name, label: name, description: undefined as string | undefined, choices: parameterChoices[name], secret: false })),\n                  ].map((field) => (\n                    <div key={field.key} className=\"flex flex-col gap-item-xs\">\n                      <Text className=\"text-sm font-medium\">{field.label}</Text>\n                      {field.description !== undefined && (\n                        <Text className=\"text-xs text-muted-foreground\">{field.description}</Text>\n                      )}\n                      {/* A HOST the vendor is reached at is CHOSEN from what the provider declares, never\n                          typed (#623): the token endpoint receives the application's client secret, and\n                          the start route refuses anything else. The values are hostnames, rendered\n                          verbatim like provider refs — there is no authored label for a vendor's host. */}\n                      {field.choices !== undefined && (field.choices.hostSuffixes ?? []).length === 0 ? (\n                        <Select\n                          name={field.key}\n                          schema={CONNECTION_PARAMETER_SCHEMA}\n                          options={field.choices.values.map((value) => ({ value, label: value }))}\n                          value={answers[field.key] ?? ''}\n                          onChange={(value: string) => setAnswers((previous) => ({ ...previous, [field.key]: value }))}\n                        />\n                      ) : (\n                        <>\n                          {/* A vendor with per-customer hosts under a domain it controls (Salesforce My\n                              Domain) still takes a typed host — but the screen says which ones will be\n                              accepted before the route has to refuse. Under an ORIGIN (a Dataverse\n                              environment URL, #991) the accepted spelling carries the scheme. */}\n                          {field.choices !== undefined && (\n                            <Text className=\"text-xs text-muted-foreground\">\n                              {t('parameterAdmittedHostsPrefix')}\n                              {' '}\n                              {[\n                                ...field.choices.values,\n                                ...(field.choices.hostSuffixes ?? []).map((suffix) => (field.choices?.position === ProviderOAuth2EndpointPlaceholderPosition.ORIGIN\n                                  ? `https://*${suffix}`\n                                  : `*${suffix}`)),\n                              ].join(', ')}\n                            </Text>\n                          )}\n                          <InputRoot\n                            aria-label={field.label}\n                            // A credential is typed into a password field; a connection parameter — which\n                            // cloud, which directory — is not a secret and is shown.\n                            type={field.secret ? 'password' : 'text'}\n                            value={answers[field.key] ?? ''}\n                            onChange={(event) => setAnswers((previous) => ({ ...previous, [field.key]: event.target.value }))}\n                          />\n                        </>\n                      )}\n                    </div>\n                  ))}\n\n                  {/* WHOSE ACCOUNT THE ORGANIZATION WILL USE — asked only when connecting lends the\n                      person's own vendor account to every member (ORGANIZATION × USER). The person is\n                      trusting their colleagues' activity with it; this is where they say so, and the\n                      connect leg refuses a link that did not (decision on wildo-ai/wildo-ai#18). */}\n                  {lendsAccountToOrganization && (\n                    <div className=\"flex items-start gap-item-xs\">\n                      <Checkbox\n                        name=\"organizationWideUseAcknowledged\"\n                        schema={ACKNOWLEDGEMENT_SCHEMA}\n                        checked={organizationWideUseAcknowledged}\n                        onCheckedChange={setOrganizationWideUseAcknowledged}\n                        aria-describedby=\"organization-wide-use-description\"\n                      />\n                      <div className=\"flex flex-col gap-item-xs\">\n                        <Text className=\"text-sm font-medium\">{t('organizationWideUseAcknowledgement')}</Text>\n                        <Text id=\"organization-wide-use-description\" className=\"text-xs text-muted-foreground\">\n                          {t('organizationWideUseDescription')}\n                        </Text>\n                      </div>\n                    </div>\n                  )}\n\n                  <div className=\"flex justify-end\">\n                    <Button\n                      size={ButtonSize.SM}\n                      variant={ButtonVariants_Variant.DEFAULT}\n                      disabled={\n                        busy\n                        || ownerId === null\n                        // Any blocker except NO_AUTHORIZATION_FLOW, which is the typed-credential path this\n                        // same button serves. An endpoint the provider cannot resolve (#623) refuses on\n                        // press whatever is typed, so the button must not invite the press.\n                        || (selected.notConnectableBecause !== undefined\n                          && selected.notConnectableBecause !== ProviderConnectabilityBlocker.NO_AUTHORIZATION_FLOW)\n                        || unanswered\n                        || delegation === undefined\n                        || (lendsAccountToOrganization && !organizationWideUseAcknowledged)\n                      }\n                      onClick={handleConnect}\n                    >\n                      {busy ? t('connectingButton') : t('connectButton')}\n                    </Button>\n                  </div>\n                </div>\n              )}\n            </>\n          )}\n\n          {/*\n            * A standing note, not a banner: it is true all the time rather than the report of\n            * something that just happened.\n            *\n            * ## Three notices, because the answer is PER VENDOR (#545)\n            *\n            * This said one thing for everybody — \"removing a connection tells the provider nothing\" —\n            * and that was true of every vendor until `google-drive` and `asana` declared an RFC 7009\n            * revocation endpoint. RFC 7009 is the only revocation standard and the vendors do not\n            * agree with it (Slack's `auth.revoke` is a Web API method, GitHub's is a `DELETE` with\n            * basic auth), so no single sentence can be true of the whole list.\n            *\n            * A notice that is false for SOME providers is worse than none: it sends somebody to\n            * revoke by hand at a vendor that has already been told, and teaches them the reassuring\n            * sentence is not to be believed.\n            *\n            * Computed over the providers on THIS screen rather than over the catalogue: what the\n            * person needs to know is about the accounts in front of them.\n            */}\n          <Text className=\"text-xs text-muted-foreground\">{t(disconnectNoticeRef)}</Text>\n        </CardContent>\n      </Card>\n    </div>\n  );\n};\n"]}
+{"version":3,"file":"AppPage_ConnectedAccountsSettings.js","sourceRoot":"","sources":["../../../../../src/components/settings/AppPage_ConnectedAccountsSettings.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,kBAAkB,EAClB,6BAA6B,EAC7B,iCAAiC,GAGlC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EACtC,yCAAyC,EACzC,0CAA0C,EAC1C,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,+DAA+D,CAAC;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,0DAA0D,CAAC;AAClF,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,KAAK,EAAE,MAAM,mDAAmD,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,8DAA8D,CAAC;AACpI,OAAO,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AAC/E,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EACL,qCAAqC,EACrC,qCAAqC,GACtC,MAAM,4FAA4F,CAAC;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EACL,wBAAwB,GAEzB,MAAM,mFAAmF,CAAC;AAE3F,MAAM,SAAS,GAAG,qBAAqB,CAAC,uCAAuC,CAAC;AAEhF,sGAAsG;AACtG,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9C,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5C,wGAAwG;AACxG,MAAM,sBAAsB,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;AAC3C,mFAAmF;AACnF,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,SAA6C,EAC7C,UAAkD,EACvB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAChG,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAC3C,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,QAAiC,EACjC,UAAkD,EACJ,EAAE;IAChD,+FAA+F;IAC/F,8FAA8F;IAC9F,iGAAiG;IACjG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACzF,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,SAAS;QAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,UAAwD,CAAC;QAClF,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAKrC,EAKC,EAAE,CAAC,CAAC;IACJ,UAAU,EAAE,KAAK,CAAC,UAAU;IAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;IAC5B,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QACnG,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC/B,GAAG,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;QACzE,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,cAAc,EAAE;QAC3C,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,MAAyB,EACzB,OAAyC,EACzC,YAAoB,EACV,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;IAClC,MAAM,WAAW,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9G,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAN,IAAY,wBAWX;AAXD,WAAY,wBAAwB;IAClC,gHAAgH;IAChH,qDAAyB,CAAA;IACzB,6EAA6E;IAC7E,iDAAqB,CAAA;IACrB,wGAAwG;IACxG,2EAA+C,CAAA;IAC/C,8BAA8B;IAC9B,+CAAmB,CAAA;IACnB,6CAA6C;IAC7C,yDAA6B,CAAA;AAC/B,CAAC,EAXW,wBAAwB,KAAxB,wBAAwB,QAWnC;AAED,oFAAoF;AACpF,MAAM,CAAN,IAAY,iCAIX;AAJD,WAAY,iCAAiC;IAC3C,kEAA6B,CAAA;IAC7B,4GAA4G;IAC5G,sDAAiB,CAAA;AACnB,CAAC,EAJW,iCAAiC,KAAjC,iCAAiC,QAI5C;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,UAAwC,EAA4B,EAAE;IAC7G,IAAI,UAAU,CAAC,yBAAyB,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,UAAU,CAAC;IACnG,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC;IAClE,QAAQ,UAAU,CAAC,eAAe,EAAE,CAAC;QACnC,KAAK,iCAAiC,CAAC,OAAO;YAC5C,OAAO,wBAAwB,CAAC,qBAAqB,CAAC;QACxD,KAAK,iCAAiC,CAAC,KAAK;YAC1C,OAAO,wBAAwB,CAAC,OAAO,CAAC;QAC1C,KAAK,iCAAiC,CAAC,WAAW;YAChD,OAAO,wBAAwB,CAAC,YAAY,CAAC;IACjD,CAAC;AACH,CAAC,CAAC;AAEF,4GAA4G;AAC5G,MAAM,kBAAkB,GAAuD;IAC7E,CAAC,wBAAwB,CAAC,UAAU,CAAC,EAAE,kBAAkB;IACzD,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,gBAAgB;IACrD,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,4BAA4B;IAC9E,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,eAAe;IACnD,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,kBAAkB;CAC5D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,UAAwC,EACxC,KAAoD,EACyE,EAAE;IAC/H,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACzF,MAAM,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3G,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,0BAA0B,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChG,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,SAA6C,EAC7C,WAAoD,EAC1C,EAAE,CAAC,uCAAuC,CAAC;IACrD,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1F,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;CACpM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAG,GAKxB,EAAE;IACF,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;QAC/C,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS;QAC3D,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QACvC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;KACtC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,2BAA2B,GAAG,GAAS,EAAE;IAC7C,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxE,CAAC,CAAC;AAgBF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,oBAAoB,GAAwC,CAAC,EACjE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,GAC1F,EAAE,EAAE;IACH,MAAM,4BAA4B,GAAG,KAAK,EAAE,CAAC;IAC7C,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAClH,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC;IAC/H,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS,IAAI,0CAA0C,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IACjH,MAAM,OAAO,GAAG,UAAU,KAAK,sCAAsC,CAAC,IAAI;WACrE,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS,IAAI,UAAU,CAAC,cAAc,KAAK,cAAc,CAAC,CAAC;IAE/F,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC3G,MAAM,EAAE,qBAAqB,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;gBAClF,SAAS,EAAE,OAAO,CAAC,iBAAiB;gBACpC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;gBACzC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC,CAAC;YACH,gGAAgG;YAChG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC;QACtC,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAEpF,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,iCAAiC,CAAC,GAAQ,EAEtE,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CACvC,MAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,aAC5C,CAAC,CAAC,6BAA6B,CAAC,EAChC,GAAG,EACH,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAChC,CACR,EACA,OAAO,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,IAAI,CAChD,MAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,aAC5C,CAAC,CAAC,oCAAoC,CAAC,EACvC,GAAG,EACH,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IACzC,CACR,EACA,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CACnD,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,iCAAiC,CAAC,GAAQ,CAC9F,EACA,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,IAAI,CAClD,8BACG,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CACzB,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAQ,EACrE,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,uBAAuB,CAAC,GAAQ,EACnF,KAAC,MAAM,IACL,IAAI,EAAE,cAAc,UAAU,CAAC,aAAa,EAAE,EAC9C,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oCAClC,KAAK,EAAE,IAAI;oCACX,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,0CAA0C,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,sBAAsB,CAAC;iCAC3H,CAAC,CAAC,EACH,KAAK,EAAE,gBAAgB,EACvB,WAAW,EAAE,CAAC,CAAC,uBAAuB,CAAC,EACvC,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;oCACzB,mBAAmB,CAAC,IAAI,CAAC,CAAC;oCAC1B,eAAe,CAAC,KAAK,CAAC,CAAC;gCACzB,CAAC,GACD,IACE,CACP,EACA,KAAK,IAAI,CACR,eAAK,SAAS,EAAC,8BAA8B,aAC3C,KAAC,QAAQ,IACP,IAAI,EAAE,mCAAmC,UAAU,CAAC,aAAa,EAAE,EACnE,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,YAAY,EACrB,eAAe,EAAE,eAAe,sBACd,4BAA4B,GAC9C,EACF,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,oCAAoC,CAAC,GAAQ,EACtF,KAAC,IAAI,IAAC,EAAE,EAAE,4BAA4B,EAAE,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,gCAAgC,CAAC,GAAQ,IAC1H,IACF,CACP,EACD,cAAK,SAAS,EAAC,kBAAkB,YAC/B,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,OAAO,gBAC3B,KAAK,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvE,QAAQ,EAAE,IAAI,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,EAC1F,OAAO,EAAE,IAAI,YAEZ,CAAC,CAAC,uBAAuB,CAAC,GACpB,GACL,IACL,CACJ,EACA,MAAM,IAAI,CACT,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,cAAc,CAAC,GAAoB,GAAQ,CAC9F,IACG,CACP,CAAC;AACJ,CAAC,CAAC;AAYF,MAAM,CAAC,MAAM,iCAAiC,GAAsD,CAAC;AACnG,uFAAuF;AACvF,oDAAoD;AACpD,UAAU,GAAG,sCAAsC,CAAC,IAAI,GACzD,EAAE,EAAE;IACH,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,WAAW,EAGlD,CAAC;IAEF,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACjF,sHAAsH;IACtH,MAAM,KAAK,GAAG,WAAW,CACvB,CAAC,GAAW,EAAE,MAA8B,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,EACnF,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,oBAAoB,GAAG,KAAK,EAAE,CAAC;IAErC;;;;;OAKG;IACH,MAAM,OAAO,GAAG,UAAU,KAAK,sCAAsC,CAAC,IAAI;QACxE,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI;QACnB,CAAC,CAAC,qBAAqB,IAAI,IAAI,CAAC;IAElC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAA4B,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAS,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,+FAA+F;IAC/F,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAS,EAAE,CAAC,CAAC;IACrE,0GAA0G;IAC1G,MAAM,CAAC,+BAA+B,EAAE,kCAAkC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9F,wFAAwF;IACxF,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAyB,EAAE,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAE1D;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,UAAU,GAAG,MAAM,CAAwC,IAAI,CAAC,CAAC;IACvE,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO;QACtD,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAChC,2BAA2B,EAAE,CAAC;YAC9B,UAAU,CAAC,OAAO,GAAG,wBAAwB,EAAE,CAAC,0BAA0B,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,UAAU,CAAC,OAAO;aACf,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;aACvE,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;YACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,oFAAoF;YACpF,IAAI,CAAC,SAAS;gBAAE,UAAU,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,4FAA4F;QAC5F,+EAA+E;QAC/E,uDAAuD;IACzD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,CAAC,KAAK,IAAI,EAAE;YACV,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,wBAAwB,EAAE,CAAC,wBAAwB,EAAE,CAAC;gBACxE,IAAI,CAAC,SAAS;oBAAE,YAAY,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YAC9C,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,SAAS;oBAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAER,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAEzG,+DAA+D;IAC/D,MAAM,EACJ,WAAW,EACX,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,iBAAiB,EACzB,UAAU,GACX,GAAG,2BAA2B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACrD,iFAAiF;IACjF,MAAM,MAAM,GAAG,qCAAqC,EAAE,CAAC;IAEvD;;;;OAIG;IACH,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5H,MAAM,EAAE,CAAC,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,WAAmB,EAAE,EAAE,CAAC,mCAAmC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,EAC3G,CAAC,iBAAiB,CAAC,CACpB,CAAC;IAEF,gFAAgF;IAChF,MAAM,CAAC,uBAAuB,EAAE,0BAA0B,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC5F,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC9E,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,GAAG,QAAQ,CAA2C,IAAI,CAAC,CAAC;IAE3G;;;OAGG;IACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,EAAE,UAAwC,EAAE,EAAE;QACtF,mBAAmB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC9C,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;YAC7B,oBAAoB,CAAC,iCAAiC,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,oBAAoB,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACT,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC1B,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB;;;;OAIG;IACH,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,EAAE;QACvC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,kBAAkB,CAAC;QACtD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAC5F,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,kBAAkB,CAAC;QAC1C,OAAO,IAAI,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,uBAAuB,CAAC;IACzF,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB;;;;;;;;;;OAUG;IACH,MAAM,iBAAiB,GAAG,OAAO,CAC/B,GAAG,EAAE,CAAC,SAAS;SACZ,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SACrE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,WAAW,EAAE,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;KACjF,CAAC,CAAC,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CACtB,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,KAAK,WAAW,CAAC,EACxE,CAAC,SAAS,EAAE,WAAW,CAAC,CACzB,CAAC;IAEF,+FAA+F;IAC/F,6FAA6F;IAC7F,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,GAAW,EAAE,EAAE;QACjD,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,UAAU,CAAC,EAAE,CAAC,CAAC;QACf,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACxB,kGAAkG;QAClG,qCAAqC;QACrC,kCAAkC,CAAC,KAAK,CAAC,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;;;OAMG;IACH,MAAM,WAAW,GAAG,OAAO,CACzB,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EACzF,CAAC,UAAU,EAAE,QAAQ,CAAC,CACvB,CAAC;IACF,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC;QACzC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAChB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC;IAEpE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAEpE;;;OAGG;IACH,MAAM,0BAA0B,GAAG,UAAU,KAAK,SAAS;WACtD,0CAA0C,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAE5E;;;;;;;OAOG;IACH,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,gGAAgG;QAChG,iGAAiG;QACjG,oFAAoF;QACpF,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7G,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC1F,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,uBAAuB,CAC/E,QAAQ,CAAC,WAAW,EACpB;oBACE,MAAM;oBACN,oBAAoB,EAAE,OAAO;oBAC7B,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5G,CACF,CAAC;gBACF,6FAA6F;gBAC7F,+EAA+E;gBAC/E,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC;gBACpC,OAAO;YACT,CAAC;YAED,6FAA6F;YAC7F,8FAA8F;YAC9F,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAC7F,CAAC;YACF,8FAA8F;YAC9F,2FAA2F;YAC3F,iEAAiE;YACjE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,oBAAoB,GAAG,MAAM,CAAC,WAAW,CAC7C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAC1F,CAAC;YACF,MAAM,wBAAwB,EAAE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,WAAW,EAAE;gBAC7E,MAAM;gBACN,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;gBACnF,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G,CAAC,CAAC;YAEH,yFAAyF;YACzF,uEAAuE;YACvE,UAAU,CAAC,EAAE,CAAC,CAAC;YACf,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IAAI,mBAAmB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YACpC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAEpI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnD,KAAK,EAAE,QAAQ,CAAC,WAAW;QAC3B,6GAA6G;QAC7G,kHAAkH;QAClH,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrC,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAG,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,IAAI,KAAK,CAAC;IACtG,MAAM,OAAO,GAAG,QAAQ,EAAE,mBAAmB,IAAI,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,QAAQ,EAAE,oBAAoB,IAAI,EAAE,CAAC;IACxD,MAAM,gBAAgB,GAAG,QAAQ,EAAE,0BAA0B,IAAI,EAAE,CAAC;IACpE,MAAM,gBAAgB,GAAG,QAAQ,EAAE,gBAAgB,IAAI,EAAE,CAAC;IAC1D,kGAAkG;IAClG,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;IACtC,uGAAuG;IACvG,sGAAsG;IACtG,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;SACjH,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAErD,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aAUvC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAClC,KAAC,KAAK,cAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,iBAAiB,CAAC,GAAoB,GAAQ,CAC3E,EACA,OAAO,CAAC,eAAe,KAAK,UAAU,IAAI,CACzC,KAAC,KAAK,cAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,gBAAgB,CAAC,GAAoB,GAAQ,CAC1E,EACA,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,UAAU,IAAI,CAClF,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,cAAc,CAAC,GAAoB,GAAQ,CAC9F,EACA,WAAW,IAAI,KAAC,KAAK,cAAC,KAAC,gBAAgB,cAAE,WAAW,GAAoB,GAAQ,EAChF,KAAK,IAAI,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAAC,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GAAQ,EAC1F,iBAAiB,KAAK,iCAAiC,CAAC,YAAY,IAAI,CACvE,KAAC,KAAK,cAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,oBAAoB,CAAC,GAAoB,GAAQ,CAC9E,EACA,iBAAiB,KAAK,iCAAiC,CAAC,MAAM,IAAI,CACjE,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,wBAAwB,CAAC,GAAoB,GAAQ,CACxG,EAUD,sCAA0B,oBAAoB,EAAE,SAAS,EAAC,yBAAyB,aACjF,KAAC,UAAU,IAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,oBAAoB,YAAG,CAAC,CAAC,oBAAoB,CAAC,GAAc,EACrF,kBAAkB,CAAC,CAAC,CAAC,CACpB,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,oBAAoB,CAAC,GAAQ,CACjF,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CACtB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAAC,KAAC,gBAAgB,cAAE,CAAC,CAAC,mBAAmB,CAAC,GAAoB,GAAQ,CACnG,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAC7B,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,kBAAkB,CAAC,GAAQ,CAC/E,CAAC,CAAC,CAAC,CACF,gCAAqB,oBAAoB,EAAE,SAAS,EAAC,yBAAyB,YAC3E,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;4BAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;4BAChD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;4BACtD,MAAM,OAAO,GAAG,QAAQ,KAAK,wBAAwB,CAAC,UAAU;gCAC9D,CAAC,CAAC,SAAS;gCACX,iGAAiG;gCACjG,CAAC,CAAC,yBAAyB,CAAC,UAAU,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qCAAqC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;4BAC3K,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,UAAU,CAAC,aAAa,CAAC,CAAC;4BACnI,MAAM,UAAU,GAAG,uBAAuB,KAAK,UAAU,CAAC,aAAa,CAAC;4BACxE,MAAM,aAAa,GAAG,gBAAgB,KAAK,UAAU,CAAC,aAAa,CAAC;4BACpE,OAAO,CACL,uBACE,KAAC,IAAI,cACH,MAAC,WAAW,IAAC,SAAS,EAAC,2BAA2B,aAChD,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,KAAK,GAAQ,EACpD,MAAC,eAAe,eACd,KAAC,eAAe,cAAE,CAAC,CAAC,aAAa,CAAC,GAAmB,EACrD,KAAC,kBAAkB,cACjB,KAAC,KAAK,IAAC,OAAO,EAAE,QAAQ,KAAK,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,YACzJ,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,GAC1B,GACW,EACpB,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CACnC,8BACE,KAAC,eAAe,cAAE,CAAC,CAAC,aAAa,CAAC,GAAmB,EACrD,KAAC,kBAAkB,cAAE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAsB,IACvF,CACJ,EACA,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAC9C,8BACE,KAAC,eAAe,cAAE,CAAC,CAAC,oBAAoB,CAAC,GAAmB,EAE5D,KAAC,kBAAkB,cAAE,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAsB,IACrF,CACJ,IACe,EAEjB,QAAQ,KAAK,wBAAwB,CAAC,UAAU,IAAI,UAAU,CAAC,yBAAyB,KAAK,SAAS,IAAI,CACzG,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAC5C,KAAK,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC,GACpF,CACR,EACA,QAAQ,KAAK,wBAAwB,CAAC,qBAAqB,IAAI,CAC9D,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,4BAA4B,CAAC,GAAQ,EACvF,cAAc,KAAK,SAAS,IAAI,CAC/B,cAAK,SAAS,EAAC,kBAAkB,YAC/B,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,OAAO,gBAC3B,KAAK,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACjE,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,WAAW,CAAC,YAExD,CAAC,CAAC,iBAAiB,CAAC,GACd,GACL,CACP,IACG,CACP,EAEA,OAAO,KAAK,SAAS,IAAI,CACxB,KAAC,oBAAoB,IACnB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EACjC,KAAK,EAAE,KAAK,EACZ,CAAC,EAAE,CAAC,EACJ,KAAK,EAAE,KAAK,GACZ,CACH,EAGA,UAAU,CAAC,CAAC,CAAC,CACZ,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,KAAK,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAQ,EAE7F,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAC5C,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAChF,EACP,eAAK,SAAS,EAAC,8BAA8B,aAC3C,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,KAAK,EACrC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,GAAG,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,YAE9C,CAAC,CAAC,wBAAwB,CAAC,GACrB,EACT,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,WAAW,gBAC/B,KAAK,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACzE,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAEpD,CAAC,CAAC,yBAAyB,CAAC,GACtB,IACL,IACF,CACP,CAAC,CAAC,CAAC,CACF,cAAK,SAAS,EAAC,kBAAkB,YAC/B,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,OAAO,gBAC3B,KAAK,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAClE,QAAQ,EAAE,gBAAgB,KAAK,IAAI,EACnC,OAAO,EAAE,GAAG,EAAE,GAAG,0BAA0B,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnG,CAAC,CAAC,kBAAkB,CAAC,GACf,GACL,CACP,IACW,GACT,IAzGA,UAAU,CAAC,aAAa,CA0G5B,CACN,CAAC;wBACJ,CAAC,CAAC,GACC,CACN,IACO,EAUT,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAC/B,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cACf,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,0BAA0B,CAAC,GAAQ,EAC5E,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,8BAA8B,CAAC,GAAQ,EACpE,aAAI,SAAS,EAAC,gBAAgB,YAC3B,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAC9B,cAA0B,SAAS,EAAC,SAAS,aAC1C,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EACxB,IAAI,EACJ,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAHpB,GAAG,CAAC,WAAW,CAInB,CACN,CAAC,GACC,IACD,GACW,GACb,CACT,EAID,KAAC,IAAI,cACH,MAAC,WAAW,IAAC,SAAS,EAAC,yBAAyB,aAC7C,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,SAAS,CAAC,GAAQ,CACtE,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACjC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,OAAO,CAAC,GAAQ,CACpE,CAAC,CAAC,CAAC,CACF,8BAGE,KAAC,MAAM,IACL,IAAI,EAAC,aAAa,EAClB,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,CAAC,mBAAmB,CAAC,EACnC,QAAQ,EAAE,cAAc,GACxB,EAED,QAAQ,KAAK,SAAS,IAAI,CACzB,eAAK,SAAS,EAAC,yBAAyB,aASrC,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CACzC,MAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,aAC5C,CAAC,CAAC,aAAa,CAAC,EAChB,GAAG,EACH,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAC/C,CACR,EAEA,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAClC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,wBAAwB,CAAC,GAAQ,CACrF,EAQA,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CACzB,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAQ,EACrE,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,uBAAuB,CAAC,GAAQ,EACnF,KAAC,MAAM,IACL,IAAI,EAAC,YAAY,EACjB,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wDAClC,KAAK,EAAE,IAAI;wDACX,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,0CAA0C,CAAC,OAAO;4DAClE,CAAC,CAAC,yBAAyB;4DAC3B,CAAC,CAAC,sBAAsB,CAAC;qDAC5B,CAAC,CAAC,EACH,KAAK,EAAE,gBAAgB,EACvB,WAAW,EAAE,CAAC,CAAC,uBAAuB,CAAC,EACvC,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;wDACzB,mBAAmB,CAAC,IAAI,CAAC,CAAC;wDAC1B,yEAAyE;wDACzE,0CAA0C;wDAC1C,kCAAkC,CAAC,KAAK,CAAC,CAAC;oDAC5C,CAAC,GACD,IACE,CACP,EAeA,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAC9B,MAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,aAC5C,CAAC,CAAC,cAAc,CAAC,EACjB,GAAG,EACH,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IACtE,CACR,EAMA,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CACtE,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAQ,EACrE,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,uBAAuB,CAAC,GAAQ,IAC/E,CACP,EAEA;4CACC,yEAAyE;4CACzE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;4CAC9J,uFAAuF;4CACvF,oFAAoF;4CACpF,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,SAA+B,EAAE,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;yCACxJ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACf,eAAqB,SAAS,EAAC,2BAA2B,aACxD,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,KAAK,CAAC,KAAK,GAAQ,EACzD,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAClC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,KAAK,CAAC,WAAW,GAAQ,CAC3E,EAKA,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAChF,KAAC,MAAM,IACL,IAAI,EAAE,KAAK,CAAC,GAAG,EACf,MAAM,EAAE,2BAA2B,EACnC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EACvE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAC/B,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAC5F,CACH,CAAC,CAAC,CAAC,CACF,8BAKG,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAC9B,MAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,aAC5C,CAAC,CAAC,8BAA8B,CAAC,EACjC,GAAG,EACH;oEACC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM;oEACvB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,KAAK,yCAAyC,CAAC,MAAM;wEACjI,CAAC,CAAC,YAAY,MAAM,EAAE;wEACtB,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;iEACnB,CAAC,IAAI,CAAC,IAAI,CAAC,IACP,CACR,EACD,KAAC,SAAS,kBACI,KAAK,CAAC,KAAK;4DACvB,8EAA8E;4DAC9E,yDAAyD;4DACzD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EACxC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAC/B,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,GACjG,IACD,CACJ,KA5CO,KAAK,CAAC,GAAG,CA6Cb,CACP,CAAC,EAMD,0BAA0B,IAAI,CAC7B,eAAK,SAAS,EAAC,8BAA8B,aAC3C,KAAC,QAAQ,IACP,IAAI,EAAC,iCAAiC,EACtC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,+BAA+B,EACxC,eAAe,EAAE,kCAAkC,sBAClC,mCAAmC,GACpD,EACF,eAAK,SAAS,EAAC,2BAA2B,aACxC,KAAC,IAAI,IAAC,SAAS,EAAC,qBAAqB,YAAE,CAAC,CAAC,oCAAoC,CAAC,GAAQ,EACtF,KAAC,IAAI,IAAC,EAAE,EAAC,mCAAmC,EAAC,SAAS,EAAC,+BAA+B,YACnF,CAAC,CAAC,gCAAgC,CAAC,GAC/B,IACH,IACF,CACP,EAED,cAAK,SAAS,EAAC,kBAAkB,YAC/B,KAAC,MAAM,IACL,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,sBAAsB,CAAC,OAAO,EACvC,QAAQ,EACN,IAAI;uDACD,OAAO,KAAK,IAAI;oDACnB,oFAAoF;oDACpF,gFAAgF;oDAChF,oEAAoE;uDACjE,CAAC,QAAQ,CAAC,qBAAqB,KAAK,SAAS;2DAC3C,QAAQ,CAAC,qBAAqB,KAAK,6BAA6B,CAAC,qBAAqB,CAAC;uDACzF,UAAU;uDACV,UAAU,KAAK,SAAS;uDACxB,CAAC,0BAA0B,IAAI,CAAC,+BAA+B,CAAC,EAErE,OAAO,EAAE,aAAa,YAErB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAC3C,GACL,IACF,CACP,IACA,CACJ,EAqBD,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAQ,IACnE,GACT,IACH,CACP,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * AppPage_ConnectedAccountsSettings — connecting a third-party account, at either owner scope.\n *\n * A bespoke `ENGINE_PANEL`, and the reason is the shape of the act rather than the shape of the data.\n * The stored credentials ARE a resource and the generic surface beside this one lists, inspects and\n * deletes them perfectly. What it cannot do is CONNECT: that is not a row somebody creates, it is a\n * flow that leaves the application, obtains consent at a vendor, and returns with a grant nobody\n * typed. A resource screen has no mechanism for an action of that shape.\n *\n * ## Nothing is typed by hand\n *\n * The provider comes from a SELECT over what the application declares; the credential fields come\n * from that provider's own secrets contract. Both were free text until this panel existed, which is\n * how somebody ends up typing `secretSlug` into a box and storing a grant in a slot nothing reads.\n *\n * So this panel is the ONLY place the application offers to add a credential. The list beside it hides\n * its resource CREATE (`actionVisibility: HIDDEN`, no empty-state call to action) — for a while it kept\n * the free-text form as a second door, and a slot the provider does not declare was refused with a\n * message naming the valid ones that the form then reduced to a generic toast (#1040).\n *\n * ## The flow follows the AUTH METHOD\n *\n * A connect surface cannot be one form. A vendor with an authorization flow gets the consent round\n * trip; a vendor whose credential is typed gets a form over the fields IT declares. One button for\n * both would be wrong for whichever it was not built around.\n *\n * ## A provider this deployment cannot connect is SHOWN, never hidden\n *\n * When the application has not registered with a vendor, the panel names the environment variables an\n * operator must set. Removing the provider would answer \"we do not support Asana\", which is false and\n * unfixable; naming `ASANA_CLIENT_ID` is true and is the thing that gets it set.\n *\n * ## One component, both scopes\n *\n * `ownerScope` decides whose account is being connected — a person's own, or the tenant's. The panel\n * is otherwise identical because the ACT is identical, and duplicating it would guarantee the two\n * drift. What must never be shared is the DATA: a person's connection and a tenant's shared\n * integration have different owners, different authorization and different readers, and the scope is\n * what keeps them apart at every call this panel makes.\n *\n * ## One row per CONNECTION, never one per ref (#1727)\n *\n * A vendor can be served by several refs — an engine part and the add-on packages beside it — declared as one shared\n * connection (`providers.sharedConnections`, #1725) that holds ONE grant (#1670). So both halves of this panel speak in\n * connections: the chooser offers one entry per connection (the catalogue folds members into their base and names\n * them in `servesRefs`), and the list above it shows one row per connection the owner holds — its vendor label, the\n * features it serves, the scopes its consent has accumulated (#1671), one health state, one \"grant more access\" when a\n * feature was refused for a missing scope, and one disconnect that says it ends access for every feature listed. A\n * vendor served by one ref is a connection of one ref and reads as it always did.\n *\n * Vendor names are the i18n tree's `providers.<ref>.displayName` (`buildProviderDisplayNameLabelKey`), owned by the\n * connection's BASE ref; a name nobody has authored renders the raw ref, so the gap looks like a gap.\n *\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the surface on which a principal\n * authorizes this application to act toward a named third party on their behalf.\n */\nimport React, { useCallback, useEffect, useId, useMemo, useRef, useState } from 'react';\nimport { z } from 'zod';\nimport { ButtonSize, FrontendComponentType } from '@wildo-ai/presets-components-models';\nimport {\n  buildProviderDisplayNameLabelKey,\n  isWildoBackendError,\n  ProviderAuthMethod,\n  ProviderConnectabilityBlocker,\n  ProviderCredentialValidationState,\n  type LinkedProviderConnectionView,\n  type ProviderScopeReauthorizationOffer,\n} from '@wildo-ai/saas-models';\nimport {\n  ExternalProvider_Connection_DelegationMode,\n  ExternalProvider_Connection_OwnerScope,\n  ProviderOAuth2EndpointPlaceholderPosition,\n  connectionLendsMemberAccountToOrganization,\n  connectionTargetNamesActingUser,\n} from '@wildo-ai/external-connectors-models';\nimport { Card, CardContent } from '~wildo-frontend-lib/components/sections/card';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Checkbox } from '~wildo-frontend-lib/components/form/controls/boolean/checkbox';\nimport { Select } from '~wildo-frontend-lib/components/form/controls/enum/select';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { Badge } from '~wildo-frontend-lib/components/data-display/badge';\nimport { DescriptionDetails, DescriptionList, DescriptionTerm } from '~wildo-frontend-lib/components/data-display/description-list';\nimport { Subheading } from '~wildo-frontend-lib/components/typography/heading';\nimport {\n  collectFrontendProviderDisplayLabelKeys,\n  resolveFrontendProviderDisplayLabel,\n} from '~wildo-frontend-lib/core/external-providers/frontend-provider-display-label.frontend.utils';\nimport {\n  findProviderScopeReauthorizationOffer,\n  useProviderScopeReauthorizationOffers,\n} from '~wildo-frontend-lib/core/external-providers/provider-scope-reauthorization-offers.frontend';\nimport { useOwnerProviderConnections } from './useOwnerProviderConnections';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport {\n  getManualCallsHttpClient,\n  type ConnectableProviderView,\n} from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\n\nconst COMPONENT = FrontendComponentType.APP_LAYOUTS_CONNECTED_ACCOUNTS_SETTINGS;\n\n/** The select's schema. A provider ref is an open identifier, so the control validates shape only. */\nconst PROVIDER_REF_SCHEMA = z.string().min(1);\n/** The chooser's own shape. Its OPTIONS are the provider's declared delegations, never this. */\nconst DELEGATION_SCHEMA = z.string().min(1);\n/** The organization-wide-use acknowledgement's shape: a statement a person either makes or does not. */\nconst ACKNOWLEDGEMENT_SCHEMA = z.boolean();\n/** A host chosen from the provider's declared values — never empty once chosen. */\nconst CONNECTION_PARAMETER_SCHEMA = z.string().min(1);\n\n/**\n * The providers connectable AT THIS SCOPE.\n *\n * Exported and named because it is the panel's one substantive claim: a provider admitting only\n * ORGANIZATION connections must never be offered on a person's screen, and vice versa — offering it\n * renders an action that answers 403 at the start leg.\n *\n * It deliberately does NOT filter on `connectable`. A provider this deployment cannot connect is\n * still offered, because the panel's answer for it is the missing configuration rather than silence.\n */\nexport const selectProvidersForScope = (\n  providers: readonly ConnectableProviderView[],\n  ownerScope: ExternalProvider_Connection_OwnerScope,\n): ConnectableProviderView[] => providers.filter((provider) => provider.admissibleConnections.some(\n  (shape) => shape.ownerScope === ownerScope,\n));\n\n/**\n * ON WHOSE BEHALF this provider admits a connection at this scope — DERIVED, never assumed.\n *\n * The panel used to send `delegation: SERVICE` for every connect, at both scopes. That is one of the\n * five declared shapes, so it worked by coincidence for the providers that happen to declare it and\n * answered `409 CONNECTION_NOT_ADMISSIBLE` for the rest — the start leg checks the exact\n * (ownerScope, delegation) PAIR against what the provider admits, and a scope does not imply a\n * delegation.\n *\n * Measured across the generated catalogue on 2026-09-10, which is why this is a derivation rather\n * than a better constant: at ORGANIZATION scope, 75 vendors declare `USER` and 39 declare `SERVICE`.\n * A hard-coded `SERVICE` was therefore wrong for the larger half — `asana` among them, which is how\n * this surfaced: the provider was listed, the button rendered, and the vendor was never reached.\n *\n * The pair is the provider's own statement, so the panel reads it rather than the person supplying\n * it. Where a provider declares BOTH delegations for one scope — 27 vendors do, `box`, `dropbox`,\n * `gmail` and `google-calendar` among them — the declaration genuinely does not decide, and only\n * then is there a question to put to anybody. See `.claude/rules/derive-before-you-ask.md`.\n */\nexport const admissibleDelegationsForScope = (\n  provider: ConnectableProviderView,\n  ownerScope: ExternalProvider_Connection_OwnerScope,\n): ExternalProvider_Connection_DelegationMode[] => {\n  // The view types both members as `string` — it is a wire record — so this is where they become\n  // the vocabulary. NARROWED rather than cast: a delegation this build does not know is dropped\n  // instead of being sent to the start leg, which would answer 409 for a value the panel invented.\n  const known = new Set<string>(Object.values(ExternalProvider_Connection_DelegationMode));\n  const delegations: ExternalProvider_Connection_DelegationMode[] = [];\n  for (const shape of provider.admissibleConnections) {\n    if (shape.ownerScope !== ownerScope || !known.has(shape.delegation)) continue;\n    const delegation = shape.delegation as ExternalProvider_Connection_DelegationMode;\n    if (!delegations.includes(delegation)) delegations.push(delegation);\n  }\n  return delegations;\n};\n\n/**\n * The target the start leg is given — assembled here so the shape is TESTABLE, not inlined.\n *\n * `ExternalProvider_ConnectionTargetSchema` decides `actingForUserId`, and it refuses in BOTH\n * directions, through the one predicate `connectionTargetNamesActingUser`:\n *\n * - an APPLICATION × USER call MUST name the person the application's identity impersonates;\n * - every other shape MUST NOT. For ORGANIZATION × USER — what 75 of the harvested vendors declare,\n *   `asana` among them — the person is whoever LINKS the account: one member lends their own vendor\n *   account to the whole organization (decision on wildo-ai/wildo-ai#18), so the grant, not the\n *   call, fixes who it acts as. A USER-owned connection already names its person in `ownerId`.\n *\n * History worth keeping: the panel once sent no `actingForUserId` at all, then (2026-09-10) sent the\n * signed-in person for every USER delegation. The second fixed the connect and hid that the spend\n * path refused the same shape, so a grant could be connected that nothing could use.\n *\n * `ownerId` is omitted for APPLICATION, which the schema likewise refuses — \"an application-owned\n * connection has exactly one instance, so an ownerId here names something that does not exist\".\n * The Settings Hub renders only USER and ORGANIZATION today, so that arm is unreachable from this\n * panel; it is handled because the function is the shape's one statement, and a caller that grows\n * the third scope should not have to rediscover the rule.\n */\nexport const buildConnectionTarget = (input: {\n  ownerScope: ExternalProvider_Connection_OwnerScope;\n  ownerId: string | null;\n  delegation: ExternalProvider_Connection_DelegationMode;\n  signedInUserId: string | null;\n}): {\n  ownerScope: ExternalProvider_Connection_OwnerScope;\n  delegation: ExternalProvider_Connection_DelegationMode;\n  ownerId?: string;\n  actingForUserId?: string;\n} => ({\n  ownerScope: input.ownerScope,\n  delegation: input.delegation,\n  ...(input.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION || input.ownerId === null\n    ? {}\n    : { ownerId: input.ownerId }),\n  ...(connectionTargetNamesActingUser(input) && input.signedInUserId !== null\n    ? { actingForUserId: input.signedInUserId }\n    : {}),\n});\n\n/**\n * The scopes a connection will REQUEST, as a person reads them before consenting (#991 review F12).\n *\n * A declared scope can carry a placeholder — Dataverse's `{hostUrl}/.default`, Outlook's `{accessMode}` —\n * and shown raw the list promised the literal brace. So a placeholder the person has ANSWERED below is\n * replaced by that answer, exactly as the start route resolves it, and one not yet answered is replaced\n * by the authored `pendingLabel`. Every other scope stays VERBATIM: it is the vendor's own token and the\n * string its consent screen is about to show, and no text is invented for it.\n */\nexport const describeRequestedScopes = (\n  scopes: readonly string[],\n  answers: Readonly<Record<string, string>>,\n  pendingLabel: string,\n): string[] => scopes.map((scope) => {\n  const placeholder = /^\\{([A-Za-z_][A-Za-z0-9_]*)\\}/.exec(scope);\n  if (placeholder === null) return scope;\n  const answer = (Object.hasOwn(answers, placeholder[1]!) ? answers[placeholder[1]!] : undefined)?.trim() ?? '';\n  return answer === '' ? pendingLabel : `${answer}${scope.slice(placeholder[0].length)}`;\n});\n\n/**\n * How one CONNECTION stands, as the list shows it (#1727) — one state for the connection, never one per ref.\n *\n * Ordered by what the person must do: a superseded row serves nothing any more, a disabled one resolves as absent, a\n * refused one must be re-authorized; only then does the grant's own validation say whether it has been proven.\n */\nexport enum ConnectedAccountStanding {\n  /** Stored under a ref before that ref joined a shared connection: nothing reads it (#1670, no re-seal door). */\n  SUPERSEDED = 'SUPERSEDED',\n  /** A row of it is disabled, so every ref it serves resolves it as absent. */\n  DISABLED = 'DISABLED',\n  /** The vendor refused it: every ref it serves needs it re-authorized — said ONCE, on the connection. */\n  NEEDS_REAUTHORIZATION = 'NEEDS_REAUTHORIZATION',\n  /** The vendor accepted it. */\n  WORKING = 'WORKING',\n  /** Stored, and not yet proven either way. */\n  NOT_YET_USED = 'NOT_YET_USED',\n}\n\n/** How the last disconnect on this screen ended — the notice it owes the person. */\nexport enum ConnectedAccountDisconnectOutcome {\n  DISCONNECTED = 'DISCONNECTED',\n  /** A row could not be deleted; rows already deleted stay deleted, and the list is read again either way. */\n  FAILED = 'FAILED',\n}\n\n/** The standing of one connection, from the listing's fields. */\nexport const connectedAccountStanding = (connection: LinkedProviderConnectionView): ConnectedAccountStanding => {\n  if (connection.supersededByConnectionRef !== undefined) return ConnectedAccountStanding.SUPERSEDED;\n  if (!connection.enabled) return ConnectedAccountStanding.DISABLED;\n  switch (connection.validationState) {\n    case ProviderCredentialValidationState.INVALID:\n      return ConnectedAccountStanding.NEEDS_REAUTHORIZATION;\n    case ProviderCredentialValidationState.VALID:\n      return ConnectedAccountStanding.WORKING;\n    case ProviderCredentialValidationState.UNVALIDATED:\n      return ConnectedAccountStanding.NOT_YET_USED;\n  }\n};\n\n/** The authored words for each standing — one key per member, so a new standing is a compile error here. */\nconst STANDING_LABEL_KEY: Readonly<Record<ConnectedAccountStanding, string>> = {\n  [ConnectedAccountStanding.SUPERSEDED]: 'statusSuperseded',\n  [ConnectedAccountStanding.DISABLED]: 'statusDisabled',\n  [ConnectedAccountStanding.NEEDS_REAUTHORIZATION]: 'statusNeedsReauthorization',\n  [ConnectedAccountStanding.WORKING]: 'statusWorking',\n  [ConnectedAccountStanding.NOT_YET_USED]: 'statusNotYetUsed',\n};\n\n/**\n * What a pending re-authorization offer (#1671) still asks of THIS connection — `undefined` when nothing is left.\n *\n * The offer was composed when a call was refused; the connection may have been granted some of those scopes since\n * (another re-authorization, a reconnect). So a scope the connection already records is dropped here rather than\n * requested again — the start leg would refuse it as `SCOPES_ALREADY_GRANTED` anyway, and asking a person to consent\n * to what they already granted is noise. An offer for another connection is not this connection's.\n */\nexport const pendingReauthorizationFor = (\n  connection: LinkedProviderConnectionView,\n  offer: ProviderScopeReauthorizationOffer | undefined,\n): { requestableScopes: string[]; administratorConsentScopes: string[]; offer: ProviderScopeReauthorizationOffer } | undefined => {\n  if (offer === undefined || offer.connectionRef !== connection.connectionRef) return undefined;\n  const granted = new Set(connection.grantedScopes ?? []);\n  const requestableScopes = offer.requestableScopes.filter((scope) => !granted.has(scope));\n  const administratorConsentScopes = offer.administratorConsentScopes.filter((scope) => !granted.has(scope));\n  if (requestableScopes.length === 0 && administratorConsentScopes.length === 0) return undefined;\n  return { requestableScopes, administratorConsentScopes, offer };\n};\n\n/**\n * Every provider display-label key the panel may render (#1727): each connection's and each served ref's, from the\n * catalogue and from the listing. The i18n tree's `providers.<ref>.displayName` is the only source of a vendor's name.\n */\nexport const collectConnectedAccountLabelKeys = (\n  providers: readonly ConnectableProviderView[],\n  connections: readonly LinkedProviderConnectionView[],\n): string[] => collectFrontendProviderDisplayLabelKeys([\n  ...providers.flatMap((provider) => [provider.providerRef, ...(provider.servesRefs ?? [])]),\n  ...connections.flatMap((connection) => [connection.connectionRef, ...connection.servesRefs, ...(connection.supersededByConnectionRef === undefined ? [] : [connection.supersededByConnectionRef])]),\n].map(buildProviderDisplayNameLabelKey));\n\n/**\n * What the callback left in the URL on its way back. Read once — see the panel's mount.\n *\n * Two shapes arrive here, and they are different acts. `connectionError` is a FINISHED outcome the\n * callback already decided — a refusal at the vendor, or an attempt it could not recognise. `state`\n * and `code` are an approval that is NOT yet redeemed: the callback cannot redeem it, because a\n * vendor redirect carries no bearer token, so it hands the approval to this screen to finish.\n */\nconst readReturnOutcome = (): {\n  connected?: string;\n  connectionError?: string;\n  state?: string;\n  code?: string;\n} => {\n  if (typeof window === 'undefined') return {};\n  const params = new URLSearchParams(window.location.search);\n  return {\n    connected: params.get('connected') ?? undefined,\n    connectionError: params.get('connectionError') ?? undefined,\n    state: params.get('state') ?? undefined,\n    code: params.get('code') ?? undefined,\n  };\n};\n\n/**\n * Take the approval out of the address bar once it has been redeemed.\n *\n * `replaceState` rather than a navigation: the entry is REPLACED, so the code does not sit in\n * history for a back button to return to, and no re-render is triggered. It is single-use at the\n * backend regardless — this is about not leaving it lying in the URL, in a referrer, or in whatever\n * the browser syncs.\n */\nconst clearApprovalFromAddressBar = (): void => {\n  if (typeof window === 'undefined') return;\n  const url = new URL(window.location.href);\n  url.searchParams.delete('state');\n  url.searchParams.delete('code');\n  window.history.replaceState(window.history.state, '', url.toString());\n};\n\ninterface ConnectionGrowActionProps {\n  connection: LinkedProviderConnectionView;\n  pending: NonNullable<ReturnType<typeof pendingReauthorizationFor>>;\n  /** The catalogue's entry for this connection — what it admits at this scope. Absent when it is no longer offered. */\n  catalogueEntry: ConnectableProviderView | undefined;\n  ownerScope: ExternalProvider_Connection_OwnerScope;\n  ownerId: string | null;\n  signedInUserId: string | null;\n  /** The connection's vendor label, for the button's accessible name. */\n  label: string;\n  t: (key: string) => string;\n  tWith: (key: string, params: Record<string, string>) => string;\n}\n\n/**\n * \"Grant more access\" on one connection (#1671, #1727): grow the stored grant by exactly the scopes a refused call\n * needs, through the ref that call used, naming the operation so the grant's audit row names its cause.\n *\n * ## It asks only what the declaration leaves open, like the connect form\n *\n * The start leg checks the (owner scope, delegation) pair, and the grant's audit row records the delegation, so a\n * delegation is never assumed: one admitted at this scope is the answer; several (the engine `microsoft` admits both a\n * tenant identity and a member's own account for an organization) are a question for the person, asked here with the\n * connect form's own words. A connection that lends a member's account to the organization asks for the same\n * acknowledgement the connect did.\n *\n * ## Only the member who linked an organization's account may grow it\n *\n * The start leg refuses anyone else (`NOT_THE_LINKING_MEMBER`, failing closed when no linker is recorded), so the\n * button is not offered to them: they are told who can, instead of pressing into a refusal.\n */\nconst ConnectionGrowAction: React.FC<ConnectionGrowActionProps> = ({\n  connection, pending, catalogueEntry, ownerScope, ownerId, signedInUserId, label, t, tWith,\n}) => {\n  const acknowledgementDescriptionId = useId();\n  const [delegationChoice, setDelegationChoice] = useState('');\n  const [acknowledged, setAcknowledged] = useState(false);\n  const [busy, setBusy] = useState(false);\n  const [failed, setFailed] = useState(false);\n\n  const delegations = catalogueEntry === undefined ? [] : admissibleDelegationsForScope(catalogueEntry, ownerScope);\n  const delegation = delegations.length === 1 ? delegations[0] : delegations.find((candidate) => candidate === delegationChoice);\n  const lends = delegation !== undefined && connectionLendsMemberAccountToOrganization({ ownerScope, delegation });\n  const mayGrow = ownerScope === ExternalProvider_Connection_OwnerScope.USER\n    || (connection.linkedByUserId !== undefined && connection.linkedByUserId === signedInUserId);\n\n  const grow = useCallback(async () => {\n    if (ownerId === null || delegation === undefined) return;\n    setBusy(true);\n    setFailed(false);\n    try {\n      const { authorizeUrl } = await getManualCallsHttpClient().startProviderConnection(pending.offer.providerRef, {\n        target: buildConnectionTarget({ ownerScope, ownerId, delegation, signedInUserId }),\n        addScopes: pending.requestableScopes,\n        forOperationId: pending.offer.operationId,\n        ...(lends ? { acknowledgesOrganizationWideUse: acknowledged } : {}),\n      });\n      // The browser leaves for the vendor; see the connect handler for why nothing is set afterwards.\n      window.location.href = authorizeUrl;\n    } catch (e: unknown) {\n      if (isWildoBackendError(e)) throw e;\n      setFailed(true);\n      setBusy(false);\n    }\n  }, [acknowledged, delegation, lends, ownerId, ownerScope, pending, signedInUserId]);\n\n  return (\n    <div className=\"flex flex-col gap-item-xs\">\n      <Text className=\"text-xs\">{t('reauthorizationOfferDescription')}</Text>\n      {/* Scopes VERBATIM, for the reason the connect form gives: they are the vendor's own words for the consent. */}\n      {pending.requestableScopes.length > 0 && (\n        <Text className=\"text-xs text-muted-foreground\">\n          {t('reauthorizationScopesPrefix')}\n          {' '}\n          {pending.requestableScopes.join(', ')}\n        </Text>\n      )}\n      {pending.administratorConsentScopes.length > 0 && (\n        <Text className=\"text-xs text-muted-foreground\">\n          {t('reauthorizationAdministratorPrefix')}\n          {' '}\n          {pending.administratorConsentScopes.join(', ')}\n        </Text>\n      )}\n      {pending.requestableScopes.length > 0 && !mayGrow && (\n        <Text className=\"text-xs text-muted-foreground\">{t('reauthorizationLinkerOnlyNotice')}</Text>\n      )}\n      {pending.requestableScopes.length > 0 && mayGrow && (\n        <>\n          {delegations.length > 1 && (\n            <div className=\"flex flex-col gap-item-xs\">\n              <Text className=\"text-sm font-medium\">{t('delegationHeading')}</Text>\n              <Text className=\"text-xs text-muted-foreground\">{t('delegationDescription')}</Text>\n              <Select\n                name={`delegation-${connection.connectionRef}`}\n                schema={DELEGATION_SCHEMA}\n                options={delegations.map((mode) => ({\n                  value: mode,\n                  label: t(mode === ExternalProvider_Connection_DelegationMode.SERVICE ? 'delegationServiceOption' : 'delegationUserOption'),\n                }))}\n                value={delegationChoice}\n                placeholder={t('delegationPlaceholder')}\n                onChange={(mode: string) => {\n                  setDelegationChoice(mode);\n                  setAcknowledged(false);\n                }}\n              />\n            </div>\n          )}\n          {lends && (\n            <div className=\"flex items-start gap-item-xs\">\n              <Checkbox\n                name={`organizationWideUseAcknowledged-${connection.connectionRef}`}\n                schema={ACKNOWLEDGEMENT_SCHEMA}\n                checked={acknowledged}\n                onCheckedChange={setAcknowledged}\n                aria-describedby={acknowledgementDescriptionId}\n              />\n              <div className=\"flex flex-col gap-item-xs\">\n                <Text className=\"text-sm font-medium\">{t('organizationWideUseAcknowledgement')}</Text>\n                <Text id={acknowledgementDescriptionId} className=\"text-xs text-muted-foreground\">{t('organizationWideUseDescription')}</Text>\n              </div>\n            </div>\n          )}\n          <div className=\"flex justify-end\">\n            <Button\n              size={ButtonSize.SM}\n              variant={ButtonVariants_Variant.DEFAULT}\n              aria-label={tWith('grantMoreAccessAccessibleName', { provider: label })}\n              disabled={busy || ownerId === null || delegation === undefined || (lends && !acknowledged)}\n              onClick={grow}\n            >\n              {t('grantMoreAccessButton')}\n            </Button>\n          </div>\n        </>\n      )}\n      {failed && (\n        <Alert variant=\"destructive\"><AlertDescription>{t('errorGeneric')}</AlertDescription></Alert>\n      )}\n    </div>\n  );\n};\n\nexport interface ConnectedAccountsSettingsProps {\n  /**\n   * WHOSE account is being connected.\n   *\n   * A prop rather than two components: the act is identical and duplicating it would guarantee the\n   * two screens drift. The DATA never mixes — every call this panel makes carries the scope.\n   */\n  ownerScope: ExternalProvider_Connection_OwnerScope;\n}\n\nexport const AppPage_ConnectedAccountsSettings: React.FC<Partial<ConnectedAccountsSettingsProps>> = ({\n  // Defaults to the person's own, which is the destination this panel was built for; the\n  // organization surface passes the scope explicitly.\n  ownerScope = ExternalProvider_Connection_OwnerScope.USER,\n}) => {\n  const { tComponent, isReady } = useI18n({ component: COMPONENT });\n  const { user, currentOrganizationId } = useUserOrgs() as {\n    user?: { _id?: string };\n    currentOrganizationId?: string | null;\n  };\n\n  const t = useCallback((key: string) => tComponent(COMPONENT, key), [tComponent]);\n  /** A label whose words carry a vendor name or a list — `{provider}`, `{connection}` — declared in the labels file. */\n  const tWith = useCallback(\n    (key: string, params: Record<string, string>) => tComponent(COMPONENT, key, params),\n    [tComponent],\n  );\n  const connectionsHeadingId = useId();\n\n  /**\n   * WHOSE account, resolved for the scope in play.\n   *\n   * The backend re-checks it — a USER target must be the caller, an ORGANIZATION target goes through\n   * the membership port — so supplying it is a statement of intent rather than a decision.\n   */\n  const ownerId = ownerScope === ExternalProvider_Connection_OwnerScope.USER\n    ? user?._id ?? null\n    : currentOrganizationId ?? null;\n\n  const [providers, setProviders] = useState<ConnectableProviderView[]>([]);\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const [selectedRef, setSelectedRef] = useState<string>('');\n  const [busy, setBusy] = useState(false);\n  /** Set ONLY when the provider declares both delegations for this scope — otherwise derived. */\n  const [delegationChoice, setDelegationChoice] = useState<string>('');\n  /** The linking member's acknowledgement for a connection that lends their account to the organization. */\n  const [organizationWideUseAcknowledged, setOrganizationWideUseAcknowledged] = useState(false);\n  /** Answers keyed by the slug the PROVIDER declared — never by a name somebody typed. */\n  const [answers, setAnswers] = useState<Record<string, string>>({});\n\n  const [outcome, setOutcome] = useState(readReturnOutcome);\n\n  /**\n   * Redeem an approval the vendor just granted — the half the callback could not do.\n   *\n   * ## The in-flight request is CACHED, and both mounts subscribe to it\n   *\n   * React 18 mounts an effect, tears it down and mounts it again in StrictMode, and the attempt is\n   * consumed atomically by the backend — so a second redemption answers\n   * `CONNECTION_ATTEMPT_INVALID` and the `catch` would replace a connection that genuinely succeeded\n   * with a failure notice. That is not hypothetical: on the first real consent, 2026-09-10, the\n   * backend logged `[oauth2-connect] account connected` with `grantedScopes: [\"default\",\"identity\"]`\n   * and stored the credential, and the browser then posted a second time and showed a 400.\n   *\n   * A once-guard alone does not fix it, and the way it fails is worse than the defect — the same\n   * trap `TotpEnrollmentMethod.strict-mode-setup.test.tsx` records. A guard PLUS a cancel-on-cleanup\n   * flag means mount 1 starts the request, its cleanup cancels the only subscriber, and the guard\n   * then stops mount 2 from applying anything: the account connects and the panel says nothing at\n   * all. Caching the PROMISE instead lets the remount re-subscribe, so there is one request and the\n   * live mount is the one that renders its result.\n   *\n   * The address bar is cleared beside the request rather than after it, for its own reason: not\n   * leaving an authorization code sitting in history behind a back button.\n   */\n  const redemption = useRef<Promise<{ connected: string }> | null>(null);\n  useEffect(() => {\n    const { state, code } = outcome;\n    if (state === undefined || code === undefined) return;\n    if (redemption.current === null) {\n      clearApprovalFromAddressBar();\n      redemption.current = getManualCallsHttpClient().completeProviderConnection({ state, code });\n    }\n    let cancelled = false;\n    redemption.current\n      .then(({ connected }) => { if (!cancelled) setOutcome({ connected }); })\n      .catch((e: unknown) => {\n        if (isWildoBackendError(e)) throw e;\n        // The callback's own vocabulary, so the notices below stay one set rather than two.\n        if (!cancelled) setOutcome({ connectionError: 'failed' });\n      });\n    return () => { cancelled = true; };\n    // `outcome` is seeded once from the URL and the cached promise is what makes this issue one\n    // request, so this deliberately does not re-run on the outcome it sets itself.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, []);\n\n  useEffect(() => {\n    let cancelled = false;\n    (async () => {\n      try {\n        const res = await getManualCallsHttpClient().listConnectableProviders();\n        if (!cancelled) setProviders(res.providers ?? []);\n      } catch (e: unknown) {\n        if (isWildoBackendError(e)) throw e;\n        if (!cancelled) setError(t('errorGeneric'));\n      } finally {\n        if (!cancelled) setLoading(false);\n      }\n    })();\n    return () => { cancelled = true; };\n  }, [t]);\n\n  const available = useMemo(() => selectProvidersForScope(providers, ownerScope), [providers, ownerScope]);\n\n  /** The connections this owner HOLDS — one row each (#1727). */\n  const {\n    connections,\n    loading: connectionsLoading,\n    failed: connectionsFailed,\n    disconnect,\n  } = useOwnerProviderConnections(ownerScope, ownerId);\n  /** Re-authorization offers a refused call left behind (#1671), by connection. */\n  const offers = useProviderScopeReauthorizationOffers();\n\n  /*\n   * Vendor names come from the i18n tree, keyed on each connection's BASE ref. Loaded through their own `useI18n`\n   * rather than folded into the component's: the key set grows when the listing arrives, and gating the whole panel\n   * on it would blank the panel for that moment. An unloaded or unauthored name renders the raw ref.\n   */\n  const providerLabelKeys = useMemo(() => collectConnectedAccountLabelKeys(providers, connections), [providers, connections]);\n  const { t: translateProvider } = useI18n({ keys: providerLabelKeys });\n  const labelOf = useCallback(\n    (providerRef: string) => resolveFrontendProviderDisplayLabel({ providerRef, translate: translateProvider }),\n    [translateProvider],\n  );\n\n  /** The connection whose disconnect is awaiting confirmation — one at a time. */\n  const [confirmingDisconnectRef, setConfirmingDisconnectRef] = useState<string | null>(null);\n  const [disconnectingRef, setDisconnectingRef] = useState<string | null>(null);\n  const [disconnectOutcome, setDisconnectOutcome] = useState<ConnectedAccountDisconnectOutcome | null>(null);\n\n  /**\n   * End one connection. The confirmation above the button already said it ends access for every feature listed; this\n   * deletes every row of it through the credential resource's own DELETE (`useOwnerProviderConnections`).\n   */\n  const handleDisconnect = useCallback(async (connection: LinkedProviderConnectionView) => {\n    setDisconnectingRef(connection.connectionRef);\n    setDisconnectOutcome(null);\n    try {\n      await disconnect(connection);\n      setDisconnectOutcome(ConnectedAccountDisconnectOutcome.DISCONNECTED);\n    } catch (e: unknown) {\n      if (isWildoBackendError(e)) throw e;\n      setDisconnectOutcome(ConnectedAccountDisconnectOutcome.FAILED);\n    } finally {\n      setDisconnectingRef(null);\n      setConfirmingDisconnectRef(null);\n    }\n  }, [disconnect]);\n\n  /*\n   * WHICH disconnect notice is true here. `undefined` from an older backend counts as \"cannot be\n   * told\", which is the safe direction: it sends the person to check at the vendor, where the worst\n   * outcome is a wasted look rather than a belief that access ended when it did not.\n   */\n  const disconnectNoticeRef = useMemo(() => {\n    if (available.length === 0) return 'disconnectNotice';\n    const told = available.filter((provider) => provider.revocationTellsVendor === true).length;\n    if (told === 0) return 'disconnectNotice';\n    return told === available.length ? 'disconnectRevokesNotice' : 'disconnectMixedNotice';\n  }, [available]);\n\n  /**\n   * EVERY declared provider still missing part of its configuration — not just the selected one.\n   *\n   * A gap found by selecting a provider is a gap found one click at a time, and an operator asking\n   * \"what is not configured\" would have to walk all eighteen. This answers it once.\n   *\n   * Deliberately NOT filtered by `ownerScope`. A missing environment variable is a fact about the\n   * APPLICATION: `ASANA_CLIENT_ID` is absent for everybody, and hiding it on the person's screen\n   * because Asana also admits a tenant connection would make the same gap visible or invisible\n   * depending on which settings page somebody happened to open.\n   */\n  const configurationGaps = useMemo(\n    () => providers\n      .filter((provider) => (provider.missingRegistration ?? []).length > 0)\n      .map((provider) => ({\n        providerRef: provider.providerRef,\n        envVarNames: (provider.missingRegistration ?? []).map((slot) => slot.envVarName),\n      })),\n    [providers],\n  );\n  const selected = useMemo(\n    () => available.find((provider) => provider.providerRef === selectedRef),\n    [available, selectedRef],\n  );\n\n  // Answers belong to the provider they were typed for. Clearing on change is what stops a value\n  // meant for one vendor being submitted to another when somebody changes their mind mid-form.\n  const chooseProvider = useCallback((ref: string) => {\n    setSelectedRef(ref);\n    setAnswers({});\n    setDelegationChoice('');\n    // An acknowledgement is about ONE provider's account; carrying it to the next would be consent to\n    // something the person has not read.\n    setOrganizationWideUseAcknowledged(false);\n    setError(null);\n  }, []);\n\n  /**\n   * What this provider admits at the scope in play, and the one the connect will carry.\n   *\n   * `delegationChoice` is only ever set by the chooser below, which renders solely when the provider\n   * declares more than one. For the ordinary provider `delegations` has a single member and that\n   * member IS the answer — nothing is asked and nothing is assumed.\n   */\n  const delegations = useMemo(\n    () => (selected === undefined ? [] : admissibleDelegationsForScope(selected, ownerScope)),\n    [ownerScope, selected],\n  );\n  const delegation = delegations.length === 1\n    ? delegations[0]\n    : delegations.find((candidate) => candidate === delegationChoice);\n\n  const [savedNotice, setSavedNotice] = useState<string | null>(null);\n\n  /**\n   * Whether connecting lends the signed-in member's OWN account to the whole organization — and so\n   * owes their acknowledgement before the connect may run. Same predicate the connect leg enforces.\n   */\n  const lendsAccountToOrganization = delegation !== undefined\n    && connectionLendsMemberAccountToOrganization({ ownerScope, delegation });\n\n  /**\n   * The two acts behind one button, branching on the provider's own auth method.\n   *\n   * An authorization flow ENDS THE PAGE — the browser leaves for the vendor and returns to a fresh\n   * load. A typed credential ends in a stored row and the person stays here. Sharing a handler is\n   * right because the person's intent is the same (\"connect this\"); sharing the OUTCOME would not be,\n   * which is why only one of the branches navigates.\n   */\n  const handleConnect = useCallback(async () => {\n    // `delegation` undefined means the provider declares several and none is chosen yet. The button\n    // is disabled in that state; the guard is here because a disabled control is a courtesy and this\n    // is the statement that a target is never assembled with a delegation nobody chose.\n    if (selected === undefined || ownerId === null || delegation === undefined) return;\n    setBusy(true);\n    setError(null);\n    setSavedNotice(null);\n    const target = buildConnectionTarget({ ownerScope, ownerId, delegation, signedInUserId: user?._id ?? null });\n    try {\n      if (selected.authMethods?.includes(ProviderAuthMethod.OAUTH2_AUTHORIZATION_CODE) ?? false) {\n        const { authorizeUrl } = await getManualCallsHttpClient().startProviderConnection(\n          selected.providerRef,\n          {\n            target,\n            connectionParameters: answers,\n            ...(lendsAccountToOrganization ? { acknowledgesOrganizationWideUse: organizationWideUseAcknowledged } : {}),\n          },\n        );\n        // The browser leaves. No state is set afterwards: this component is about to be unmounted by\n        // a navigation, and a `setState` here would be a React warning on the way out.\n        window.location.href = authorizeUrl;\n        return;\n      }\n\n      // Only the values the provider DECLARED, so a stale answer left over from a field that is no\n      // longer offered cannot be posted. The route re-checks this; sending less is still the honest\n      // thing for the screen to do.\n      const declared = new Set((selected.credentialFields ?? []).map((field) => field.slug));\n      const values = Object.fromEntries(\n        Object.entries(answers).filter(([slug, value]) => declared.has(slug) && value.trim() !== ''),\n      );\n      // The REST base URL's own answers, apart from the credential (#1097) — which subdomain, which\n      // workspace host. Not secrets; the route admits each against the provider's host allowance\n      // before anything is written, and refuses a missing one by name.\n      const asked = new Set(selected.connectionParameters ?? []);\n      const connectionParameters = Object.fromEntries(\n        Object.entries(answers).filter(([name, value]) => asked.has(name) && value.trim() !== ''),\n      );\n      await getManualCallsHttpClient().storeProviderCredential(selected.providerRef, {\n        target,\n        values,\n        ...(Object.keys(connectionParameters).length === 0 ? {} : { connectionParameters }),\n        ...(lendsAccountToOrganization ? { acknowledgesOrganizationWideUse: organizationWideUseAcknowledged } : {}),\n      });\n\n      // The typed values are cleared once stored. They are secrets, and a form that keeps them\n      // on screen after they have been sealed is holding them for no reason.\n      setAnswers({});\n      setSavedNotice(t('credentialStoredNotice'));\n      setBusy(false);\n    } catch (e: unknown) {\n      if (isWildoBackendError(e)) throw e;\n      setError(t('errorGeneric'));\n      setBusy(false);\n    }\n  }, [answers, delegation, lendsAccountToOrganization, organizationWideUseAcknowledged, ownerId, ownerScope, selected, t, user?._id]);\n\n  if (!isReady) return null;\n\n  const providerOptions = available.map((provider) => ({\n    value: provider.providerRef,\n    // The CONNECTION's vendor name from the i18n tree (`providers.<ref>.displayName`), one option per connection\n    // (#1727). It used to be the ref verbatim; an unauthored name still renders the ref, never words derived from it.\n    label: labelOf(provider.providerRef),\n  }));\n\n  const oauth2 = selected?.authMethods?.includes(ProviderAuthMethod.OAUTH2_AUTHORIZATION_CODE) ?? false;\n  const missing = selected?.missingRegistration ?? [];\n  const parameters = selected?.connectionParameters ?? [];\n  const parameterChoices = selected?.connectionParameterChoices ?? {};\n  const credentialFields = selected?.credentialFields ?? [];\n  /** What the authorization will REQUEST — rendered before the button, never only after consent. */\n  const scopes = selected?.scopes ?? [];\n  // Every asked connection parameter is required on BOTH paths (#1097): a base-URL placeholder is a hole\n  // in the address every call dials, exactly as an endpoint placeholder is a hole in the vendor's URLs.\n  const unanswered = [...parameters, ...(oauth2 ? [] : credentialFields.filter((f) => f.required).map((f) => f.slug))]\n    .some((key) => (answers[key] ?? '').trim() === '');\n\n  return (\n    <div className=\"flex flex-col gap-section\">\n      {/*\n        * No heading of the panel's own. It sat under a tab already named for this act (\"Connect\") inside\n        * a destination already named for the subject (\"Integrations\"), and said a third thing — \"Connected\n        * accounts\", over a form that lists none. The sentence under it promised \"act on your behalf\" on the\n        * organization screen too, where the account is the tenant's. The tab and the chooser say it.\n        */}\n\n      {/* The return leg's own report. `declined` is NOT destructive — somebody who pressed \"Deny\"\n          made a decision, and dressing it in red tells them they did something wrong. */}\n      {outcome.connected !== undefined && (\n        <Alert><AlertDescription>{t('connectedNotice')}</AlertDescription></Alert>\n      )}\n      {outcome.connectionError === 'declined' && (\n        <Alert><AlertDescription>{t('declinedNotice')}</AlertDescription></Alert>\n      )}\n      {outcome.connectionError !== undefined && outcome.connectionError !== 'declined' && (\n        <Alert variant=\"destructive\"><AlertDescription>{t('failedNotice')}</AlertDescription></Alert>\n      )}\n      {savedNotice && <Alert><AlertDescription>{savedNotice}</AlertDescription></Alert>}\n      {error && <Alert variant=\"destructive\"><AlertDescription>{error}</AlertDescription></Alert>}\n      {disconnectOutcome === ConnectedAccountDisconnectOutcome.DISCONNECTED && (\n        <Alert><AlertDescription>{t('disconnectedNotice')}</AlertDescription></Alert>\n      )}\n      {disconnectOutcome === ConnectedAccountDisconnectOutcome.FAILED && (\n        <Alert variant=\"destructive\"><AlertDescription>{t('disconnectFailedNotice')}</AlertDescription></Alert>\n      )}\n\n      {/*\n        * WHAT THIS OWNER HOLDS — one row per CONNECTION (#1727).\n        *\n        * A labelled list, so a screen reader announces how many connections there are and where the list ends. Each\n        * row names its vendor once, the features that spend it, the scopes its consent has accumulated, and ONE state:\n        * a refused grant is marked here once, not on every feature that uses it. Its actions are buttons whose\n        * accessible names carry the vendor, because \"Disconnect\" said five times in one list names nothing.\n        */}\n      <section aria-labelledby={connectionsHeadingId} className=\"flex flex-col gap-group\">\n        <Subheading level={3} id={connectionsHeadingId}>{t('connectionsHeading')}</Subheading>\n        {connectionsLoading ? (\n          <Text className=\"text-sm text-muted-foreground\">{t('connectionsLoading')}</Text>\n        ) : connectionsFailed ? (\n          <Alert variant=\"destructive\"><AlertDescription>{t('connectionsFailed')}</AlertDescription></Alert>\n        ) : connections.length === 0 ? (\n          <Text className=\"text-sm text-muted-foreground\">{t('connectionsEmpty')}</Text>\n        ) : (\n          <ul aria-labelledby={connectionsHeadingId} className=\"flex flex-col gap-group\">\n            {connections.map((connection) => {\n              const label = labelOf(connection.connectionRef);\n              const standing = connectedAccountStanding(connection);\n              const pending = standing === ConnectedAccountStanding.SUPERSEDED\n                ? undefined\n                // THIS owner's offer only: a person's own grant and their organization's share a connection ref.\n                : pendingReauthorizationFor(connection, ownerId === null ? undefined : findProviderScopeReauthorizationOffer(offers, { ownerScope, ownerId }, connection.connectionRef));\n              const catalogueEntry = available.find((provider) => (provider.connectionRef ?? provider.providerRef) === connection.connectionRef);\n              const confirming = confirmingDisconnectRef === connection.connectionRef;\n              const disconnecting = disconnectingRef === connection.connectionRef;\n              return (\n                <li key={connection.connectionRef}>\n                  <Card>\n                    <CardContent className=\"flex flex-col gap-item-xs\">\n                      <Text className=\"text-sm font-medium\">{label}</Text>\n                      <DescriptionList>\n                        <DescriptionTerm>{t('statusLabel')}</DescriptionTerm>\n                        <DescriptionDetails>\n                          <Badge variant={standing === ConnectedAccountStanding.WORKING ? 'success' : standing === ConnectedAccountStanding.NOT_YET_USED ? 'secondary' : 'destructive'}>\n                            {t(STANDING_LABEL_KEY[standing])}\n                          </Badge>\n                        </DescriptionDetails>\n                        {connection.servesRefs.length > 0 && (\n                          <>\n                            <DescriptionTerm>{t('servesLabel')}</DescriptionTerm>\n                            <DescriptionDetails>{connection.servesRefs.map(labelOf).join(', ')}</DescriptionDetails>\n                          </>\n                        )}\n                        {(connection.grantedScopes ?? []).length > 0 && (\n                          <>\n                            <DescriptionTerm>{t('grantedScopesLabel')}</DescriptionTerm>\n                            {/* The vendor's own permission identifiers, verbatim — see the connect form's scope list. */}\n                            <DescriptionDetails>{(connection.grantedScopes ?? []).join(', ')}</DescriptionDetails>\n                          </>\n                        )}\n                      </DescriptionList>\n\n                      {standing === ConnectedAccountStanding.SUPERSEDED && connection.supersededByConnectionRef !== undefined && (\n                        <Text className=\"text-xs text-muted-foreground\">\n                          {tWith('supersededNotice', { connection: labelOf(connection.supersededByConnectionRef) })}\n                        </Text>\n                      )}\n                      {standing === ConnectedAccountStanding.NEEDS_REAUTHORIZATION && (\n                        <div className=\"flex flex-col gap-item-xs\">\n                          <Text className=\"text-xs text-muted-foreground\">{t('needsReauthorizationNotice')}</Text>\n                          {catalogueEntry !== undefined && (\n                            <div className=\"flex justify-end\">\n                              <Button\n                                size={ButtonSize.SM}\n                                variant={ButtonVariants_Variant.OUTLINE}\n                                aria-label={tWith('reconnectAccessibleName', { provider: label })}\n                                onClick={() => chooseProvider(catalogueEntry.providerRef)}\n                              >\n                                {t('reconnectButton')}\n                              </Button>\n                            </div>\n                          )}\n                        </div>\n                      )}\n\n                      {pending !== undefined && (\n                        <ConnectionGrowAction\n                          connection={connection}\n                          pending={pending}\n                          catalogueEntry={catalogueEntry}\n                          ownerScope={ownerScope}\n                          ownerId={ownerId}\n                          signedInUserId={user?._id ?? null}\n                          label={label}\n                          t={t}\n                          tWith={tWith}\n                        />\n                      )}\n\n                      {/* ONE disconnect for the one grant, confirmed with what it ends: every feature listed above. */}\n                      {confirming ? (\n                        <div className=\"flex flex-col gap-item-xs\">\n                          <Text className=\"text-xs\">{tWith('disconnectConfirmDescription', { provider: label })}</Text>\n                          {/* Whether the vendor is told is a fact about THIS connection (#545), so it is said here. */}\n                          <Text className=\"text-xs text-muted-foreground\">\n                            {t(connection.revocationTellsVendor ? 'disconnectRevokesNotice' : 'disconnectNotice')}\n                          </Text>\n                          <div className=\"flex justify-end gap-item-xs\">\n                            <Button\n                              size={ButtonSize.SM}\n                              variant={ButtonVariants_Variant.GHOST}\n                              disabled={disconnecting}\n                              onClick={() => setConfirmingDisconnectRef(null)}\n                            >\n                              {t('disconnectCancelButton')}\n                            </Button>\n                            <Button\n                              size={ButtonSize.SM}\n                              variant={ButtonVariants_Variant.DESTRUCTIVE}\n                              aria-label={tWith('disconnectConfirmAccessibleName', { provider: label })}\n                              disabled={disconnecting}\n                              onClick={() => { void handleDisconnect(connection); }}\n                            >\n                              {t('disconnectConfirmButton')}\n                            </Button>\n                          </div>\n                        </div>\n                      ) : (\n                        <div className=\"flex justify-end\">\n                          <Button\n                            size={ButtonSize.SM}\n                            variant={ButtonVariants_Variant.OUTLINE}\n                            aria-label={tWith('disconnectAccessibleName', { provider: label })}\n                            disabled={disconnectingRef !== null}\n                            onClick={() => { setConfirmingDisconnectRef(connection.connectionRef); setDisconnectOutcome(null); }}\n                          >\n                            {t('disconnectButton')}\n                          </Button>\n                        </div>\n                      )}\n                    </CardContent>\n                  </Card>\n                </li>\n              );\n            })}\n          </ul>\n        )}\n      </section>\n\n      {/*\n        * The whole configuration's gaps, stated once and before anything else.\n        *\n        * Written rather than hidden, which is the decision this panel exists to make visible: a\n        * provider whose registration is absent still appears in the chooser, and this says what an\n        * operator must set for ANY of them to work. An environment variable's NAME is not a secret —\n        * it is the only thing that makes the gap actionable.\n        */}\n      {configurationGaps.length > 0 && (\n        <Alert variant=\"destructive\">\n          <AlertDescription>\n            <div className=\"flex flex-col gap-item-xs\">\n              <Text className=\"text-sm font-medium\">{t('configurationGapsHeading')}</Text>\n              <Text className=\"text-xs\">{t('configurationGapsDescription')}</Text>\n              <ul className=\"list-disc pl-4\">\n                {configurationGaps.map((gap) => (\n                  <li key={gap.providerRef} className=\"text-xs\">\n                    {labelOf(gap.providerRef)}\n                    {': '}\n                    {gap.envVarNames.join(', ')}\n                  </li>\n                ))}\n              </ul>\n            </div>\n          </AlertDescription>\n        </Alert>\n      )}\n\n      {/* No card heading: it sat over one control and said what that control's placeholder already says\n          (\"Choose provider\" above \"Choose a provider\"). */}\n      <Card>\n        <CardContent className=\"flex flex-col gap-group\">\n          {loading ? (\n            <Text className=\"text-sm text-muted-foreground\">{t('loading')}</Text>\n          ) : providerOptions.length === 0 ? (\n            <Text className=\"text-sm text-muted-foreground\">{t('empty')}</Text>\n          ) : (\n            <>\n              {/* A SELECT over what the application declares. The whole point: a provider ref is\n                  never typed, so it can never be a ref that does not exist. */}\n              <Select\n                name=\"providerRef\"\n                schema={PROVIDER_REF_SCHEMA}\n                options={providerOptions}\n                value={selectedRef}\n                placeholder={t('choosePlaceholder')}\n                onChange={chooseProvider}\n              />\n\n              {selected !== undefined && (\n                <div className=\"flex flex-col gap-group\">\n                  {/* No second notice for a provider this deployment has not registered with. Its\n                      environment variables are already named, by provider, in the configuration block\n                      above the chooser — which is computed over every provider, so the one chosen here is\n                      always in it — and the same list printed a second time beside the button said\n                      nothing the first had not. The disabled button is the per-provider consequence. */}\n\n                  {/* The features this ONE connection serves (#1727), so a person connecting a vendor once knows\n                      everything that consent reaches. Said only when there is more than the connection itself. */}\n                  {(selected.servesRefs ?? []).length > 1 && (\n                    <Text className=\"text-xs text-muted-foreground\">\n                      {t('servesLabel')}\n                      {' '}\n                      {(selected.servesRefs ?? []).map(labelOf).join(', ')}\n                    </Text>\n                  )}\n\n                  {!oauth2 && missing.length === 0 && (\n                    <Text className=\"text-xs text-muted-foreground\">{t('pastedCredentialNotice')}</Text>\n                  )}\n\n                  {/* ON WHOSE BEHALF — asked ONLY where the provider's own declaration leaves it open.\n                      One admitted delegation is an answer, not a question, so the ordinary provider\n                      renders nothing here and the connect carries what the vendor declared. The 27\n                      that admit both at one scope are a real choice between two different accounts —\n                      the tenant's own token, or a token minted for the person acting — and neither\n                      the panel nor a default may make it on their behalf. */}\n                  {delegations.length > 1 && (\n                    <div className=\"flex flex-col gap-item-xs\">\n                      <Text className=\"text-sm font-medium\">{t('delegationHeading')}</Text>\n                      <Text className=\"text-xs text-muted-foreground\">{t('delegationDescription')}</Text>\n                      <Select\n                        name=\"delegation\"\n                        schema={DELEGATION_SCHEMA}\n                        options={delegations.map((mode) => ({\n                          value: mode,\n                          label: t(mode === ExternalProvider_Connection_DelegationMode.SERVICE\n                            ? 'delegationServiceOption'\n                            : 'delegationUserOption'),\n                        }))}\n                        value={delegationChoice}\n                        placeholder={t('delegationPlaceholder')}\n                        onChange={(mode: string) => {\n                          setDelegationChoice(mode);\n                          // An acknowledgement given for one delegation is not consent to another:\n                          // switching away and back must ask again.\n                          setOrganizationWideUseAcknowledged(false);\n                        }}\n                      />\n                    </div>\n                  )}\n\n                  {/* WHAT THIS WILL ASK THE VENDOR FOR, before the button that asks for it.\n                      *\n                      * The scopes are the substance of the consent: `slack` requests THIRTY of them,\n                      * `gitlab` asks for `api`, and a panel that sends somebody to a vendor without\n                      * naming them is asking for a signature on an unread page. The catalogue has\n                      * carried `scopes` since the route was written and nothing rendered it — the\n                      * label existed too, authored and never wired.\n                      *\n                      * VERBATIM, and deliberately: a scope is the vendor's own token, it is the\n                      * string the vendor's own consent screen is about to show, and there is no\n                      * authored label for an open vocabulary spanning every provider. Prettifying\n                      * `channels:write.invites` into words would invent display text no translator\n                      * can reach and would no longer match what the vendor says next. */}\n                  {oauth2 && scopes.length > 0 && (\n                    <Text className=\"text-xs text-muted-foreground\">\n                      {t('scopesPrefix')}\n                      {' '}\n                      {describeRequestedScopes(scopes, answers, t('scopeChosenBelow')).join(', ')}\n                    </Text>\n                  )}\n\n                  {/* THE DECLARED FIELDS — for an authorization flow, the placeholders its own URLs\n                      carry; for a typed credential, the slots the provider's secrets contract names AND\n                      the placeholders its REST base URL carries (#1097). Either way the form knows what\n                      to ask for, and nobody types a slug. */}\n                  {(parameters.length > 0 || (!oauth2 && credentialFields.length > 0)) && (\n                    <div className=\"flex flex-col gap-item-xs\">\n                      <Text className=\"text-sm font-medium\">{t('parametersHeading')}</Text>\n                      <Text className=\"text-xs text-muted-foreground\">{t('parametersDescription')}</Text>\n                    </div>\n                  )}\n\n                  {[\n                    // The credential itself, for a typed one: a secret, so a password field.\n                    ...(oauth2 ? [] : credentialFields.map((field) => ({ key: field.slug, label: field.slug, description: field.description, choices: undefined, secret: true }))),\n                    // The placeholders — the endpoints' for an authorization flow, the REST base URL's for\n                    // a typed credential (#1097): which cloud, which subdomain. Not secrets, and shown.\n                    ...parameters.map((name) => ({ key: name, label: name, description: undefined as string | undefined, choices: parameterChoices[name], secret: false })),\n                  ].map((field) => (\n                    <div key={field.key} className=\"flex flex-col gap-item-xs\">\n                      <Text className=\"text-sm font-medium\">{field.label}</Text>\n                      {field.description !== undefined && (\n                        <Text className=\"text-xs text-muted-foreground\">{field.description}</Text>\n                      )}\n                      {/* A HOST the vendor is reached at is CHOSEN from what the provider declares, never\n                          typed (#623): the token endpoint receives the application's client secret, and\n                          the start route refuses anything else. The values are hostnames, rendered\n                          verbatim like provider refs — there is no authored label for a vendor's host. */}\n                      {field.choices !== undefined && (field.choices.hostSuffixes ?? []).length === 0 ? (\n                        <Select\n                          name={field.key}\n                          schema={CONNECTION_PARAMETER_SCHEMA}\n                          options={field.choices.values.map((value) => ({ value, label: value }))}\n                          value={answers[field.key] ?? ''}\n                          onChange={(value: string) => setAnswers((previous) => ({ ...previous, [field.key]: value }))}\n                        />\n                      ) : (\n                        <>\n                          {/* A vendor with per-customer hosts under a domain it controls (Salesforce My\n                              Domain) still takes a typed host — but the screen says which ones will be\n                              accepted before the route has to refuse. Under an ORIGIN (a Dataverse\n                              environment URL, #991) the accepted spelling carries the scheme. */}\n                          {field.choices !== undefined && (\n                            <Text className=\"text-xs text-muted-foreground\">\n                              {t('parameterAdmittedHostsPrefix')}\n                              {' '}\n                              {[\n                                ...field.choices.values,\n                                ...(field.choices.hostSuffixes ?? []).map((suffix) => (field.choices?.position === ProviderOAuth2EndpointPlaceholderPosition.ORIGIN\n                                  ? `https://*${suffix}`\n                                  : `*${suffix}`)),\n                              ].join(', ')}\n                            </Text>\n                          )}\n                          <InputRoot\n                            aria-label={field.label}\n                            // A credential is typed into a password field; a connection parameter — which\n                            // cloud, which directory — is not a secret and is shown.\n                            type={field.secret ? 'password' : 'text'}\n                            value={answers[field.key] ?? ''}\n                            onChange={(event) => setAnswers((previous) => ({ ...previous, [field.key]: event.target.value }))}\n                          />\n                        </>\n                      )}\n                    </div>\n                  ))}\n\n                  {/* WHOSE ACCOUNT THE ORGANIZATION WILL USE — asked only when connecting lends the\n                      person's own vendor account to every member (ORGANIZATION × USER). The person is\n                      trusting their colleagues' activity with it; this is where they say so, and the\n                      connect leg refuses a link that did not (decision on wildo-ai/wildo-ai#18). */}\n                  {lendsAccountToOrganization && (\n                    <div className=\"flex items-start gap-item-xs\">\n                      <Checkbox\n                        name=\"organizationWideUseAcknowledged\"\n                        schema={ACKNOWLEDGEMENT_SCHEMA}\n                        checked={organizationWideUseAcknowledged}\n                        onCheckedChange={setOrganizationWideUseAcknowledged}\n                        aria-describedby=\"organization-wide-use-description\"\n                      />\n                      <div className=\"flex flex-col gap-item-xs\">\n                        <Text className=\"text-sm font-medium\">{t('organizationWideUseAcknowledgement')}</Text>\n                        <Text id=\"organization-wide-use-description\" className=\"text-xs text-muted-foreground\">\n                          {t('organizationWideUseDescription')}\n                        </Text>\n                      </div>\n                    </div>\n                  )}\n\n                  <div className=\"flex justify-end\">\n                    <Button\n                      size={ButtonSize.SM}\n                      variant={ButtonVariants_Variant.DEFAULT}\n                      disabled={\n                        busy\n                        || ownerId === null\n                        // Any blocker except NO_AUTHORIZATION_FLOW, which is the typed-credential path this\n                        // same button serves. An endpoint the provider cannot resolve (#623) refuses on\n                        // press whatever is typed, so the button must not invite the press.\n                        || (selected.notConnectableBecause !== undefined\n                          && selected.notConnectableBecause !== ProviderConnectabilityBlocker.NO_AUTHORIZATION_FLOW)\n                        || unanswered\n                        || delegation === undefined\n                        || (lendsAccountToOrganization && !organizationWideUseAcknowledged)\n                      }\n                      onClick={handleConnect}\n                    >\n                      {busy ? t('connectingButton') : t('connectButton')}\n                    </Button>\n                  </div>\n                </div>\n              )}\n            </>\n          )}\n\n          {/*\n            * A standing note, not a banner: it is true all the time rather than the report of\n            * something that just happened.\n            *\n            * ## Three notices, because the answer is PER VENDOR (#545)\n            *\n            * This said one thing for everybody — \"removing a connection tells the provider nothing\" —\n            * and that was true of every vendor until `google-drive` and `asana` declared an RFC 7009\n            * revocation endpoint. RFC 7009 is the only revocation standard and the vendors do not\n            * agree with it (Slack's `auth.revoke` is a Web API method, GitHub's is a `DELETE` with\n            * basic auth), so no single sentence can be true of the whole list.\n            *\n            * A notice that is false for SOME providers is worse than none: it sends somebody to\n            * revoke by hand at a vendor that has already been told, and teaches them the reassuring\n            * sentence is not to be believed.\n            *\n            * Computed over the providers on THIS screen rather than over the catalogue: what the\n            * person needs to know is about the accounts in front of them.\n            */}\n          <Text className=\"text-xs text-muted-foreground\">{t(disconnectNoticeRef)}</Text>\n        </CardContent>\n      </Card>\n    </div>\n  );\n};\n"]}

package/dist/esm/components/settings/AppPage_ConnectedAccountsSettings.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_ConnectedAccountsSettings.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/settings/AppPage_ConnectedAccountsSettings.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AA+B7C,eAAO,MAAM,yCAAyC,EAAE,mBAAmB,EA0F1E,CAAC"}
+{"version":3,"file":"AppPage_ConnectedAccountsSettings.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/settings/AppPage_ConnectedAccountsSettings.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AA+B7C,eAAO,MAAM,yCAAyC,EAAE,mBAAmB,EA0F1E,CAAC"}