crewly 1.20.264 → 1.20.266

package/dist/backend/backend/src/services/google/google-api.client.js

@@ -9,6 +9,39 @@
  */
 import { GOOGLE_WORKSPACE_CONSTANTS } from '../../constants.js';
 import { GoogleWorkspaceError } from './google-workspace-token.service.js';
+/**
+ * Whether a Google 403 means "this token lacks a scope" rather than "this
+ * user may not touch this resource".
+ *
+ * Google says it two ways, often both at once: the legacy
+ * `errors[].reason: insufficientPermissions` and the newer
+ * `details[].reason: ACCESS_TOKEN_SCOPE_INSUFFICIENT` (an ErrorInfo), with
+ * the message "Request had insufficient authentication scopes."
+ * `insufficientFilePermissions` (Drive: no access to this file) is a
+ * different thing and deliberately does not match.
+ *
+ * @param status - HTTP status
+ * @param text - Raw response body
+ * @returns True for a scope refusal
+ */
+export function isInsufficientScopeError(status, text) {
+    if (status !== 403)
+        return false;
+    try {
+        const parsed = JSON.parse(text);
+        const err = typeof parsed.error === 'object' ? parsed.error : undefined;
+        if (!err)
+            return false;
+        if (err.errors?.some((e) => e.reason === 'insufficientPermissions'))
+            return true;
+        if (err.details?.some((d) => d.reason === 'ACCESS_TOKEN_SCOPE_INSUFFICIENT'))
+            return true;
+        return /insufficient authentication scopes/i.test(err.message ?? '');
+    }
+    catch {
+        return /insufficient authentication scopes/i.test(text);
+    }
+}
 /**
  * Extract the human message from a Google error body, tolerating both the
  * object and the plain-string shapes Google uses.
@@ -100,6 +133,17 @@ export async function googleRequest(deps, url, init = {}) {
             deps.tokens.clearCache(deps.account);
             throw new GoogleWorkspaceError(401, CODES.GOOGLE_ERROR, `Google rejected the access token: ${message}`);
         }
+        if (isInsufficientScopeError(res.status, text)) {
+            // The grant is narrower than this call (2026-10-08: Gmail drafts need
+            // gmail.compose). Only the owner can widen it; the cached token must
+            // go so the call after the reconnect carries the new scope.
+            deps.tokens.clearCache(deps.account);
+            throw new GoogleWorkspaceError(403, CODES.REAUTH_REQUIRED, message, {
+                reason: 'insufficient_scope',
+                ...(deps.product ? { product: deps.product } : {}),
+                ...(deps.account ? { account: deps.account } : {}),
+            });
+        }
         const passthrough = res.status === 403 || res.status === 404 || res.status === 429;
         throw new GoogleWorkspaceError(passthrough ? res.status : 502, CODES.GOOGLE_ERROR, message);
     }

package/dist/backend/backend/src/services/google/google-api.client.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-api.client.js","sourceRoot":"","sources":["../../../../../../backend/src/services/google/google-api.client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,0BAA0B,EAAsB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AA0C3E;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QACnD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAC1D,OAAO,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,SAAiE,EAAE;IAC9G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAmBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,IAAmB,EAAE,GAAW,EAAE,OAA0B,EAAE;IACnG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,0BAA0B,CAAC,WAAW,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC;IAEnD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;gBAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;oBAC5B,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE;oBACpE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;wBACvB,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBACxC,CAAC,CAAC,EAAE,CAAC;aACV;YACD,IAAI,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACjH,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC,kBAAkB,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,uBAAuB,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,IAAI,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAiB,CAAC;IACvF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,0BAA0B,GAAG,CAAC,MAAM,GAAG,CAAC;QACpF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,qCAAqC,OAAO,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;QACnF,MAAM,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS;QAAE,OAAO,IAAoB,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAO,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC"}
+{"version":3,"file":"google-api.client.js","sourceRoot":"","sources":["../../../../../../backend/src/services/google/google-api.client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,0BAA0B,EAAsB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAkD3E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,IAAY;IACnE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QACnD,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,yBAAyB,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,iCAAiC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1F,OAAO,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QACnD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAC1D,OAAO,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,SAAiE,EAAE;IAC9G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAmBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,IAAmB,EAAE,GAAW,EAAE,OAA0B,EAAE;IACnG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,0BAA0B,CAAC,WAAW,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC;IAEnD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;gBAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;oBAC5B,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE;oBACpE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;wBACvB,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBACxC,CAAC,CAAC,EAAE,CAAC;aACV;YACD,IAAI,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACjH,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC,kBAAkB,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,uBAAuB,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,IAAI,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAiB,CAAC;IACvF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,0BAA0B,GAAG,CAAC,MAAM,GAAG,CAAC;QACpF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,qCAAqC,OAAO,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,wBAAwB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/C,sEAAsE;YACtE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE;gBAClE,MAAM,EAAE,oBAAoB;gBAC5B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;QACnF,MAAM,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS;QAAE,OAAO,IAAoB,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAO,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC"}

package/dist/backend/backend/src/services/google/google-reauth-notifier.service.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Google reconnect cards — the harness asks the owner, not the agent.
+ *
+ * 2026-10-08: the Personal Assistant tried to save a reply as a Gmail draft,
+ * Google answered 403 "insufficient authentication scopes" (no grant carried
+ * `gmail.compose`), and the agent told the owner to "re-authorize Gmail in
+ * Crewly Connections" — a page the owner cannot reach from a phone. The
+ * same dead end follows an expired or revoked grant.
+ *
+ * So when a Google call fails because the grant is too narrow or no longer
+ * honoured, this posts the existing one-tap connect card (single-use ticket,
+ * `google-connect-card.ts`) to the owner in Slack — where the agent is
+ * working if that is known, else the owner's DM with that agent — at most
+ * once per product and Google account per
+ * {@link GOOGLE_WORKSPACE_CONSTANTS.REAUTH.CARD_THROTTLE_MS}. It then watches
+ * Cloud until the reconnect lands and tells the waiting agents to retry.
+ *
+ * Everything that touches Slack, Cloud or an agent is injected, so the
+ * machine the failure happened on is the one that posts — any machine with
+ * Slack and a Cloud session works the same.
+ *
+ * @module services/google/google-reauth-notifier.service
+ */
+import { type GoogleProduct } from '../../constants.js';
+import type { GoogleWorkspaceStatus } from './google-workspace-token.service.js';
+/** Why the owner has to reconnect. */
+export type ReauthKind = 'missing_scope' | 'expired';
+/** A Google failure that only the owner can fix. */
+export interface ReauthTrigger {
+    product: GoogleProduct;
+    kind: ReauthKind;
+    /** Google account the call acted as; undefined = the default connection */
+    account?: string;
+    /** The agent whose call failed; it is told when to retry */
+    agentSession?: string;
+}
+/** Where a card goes. */
+export interface ReauthPlace {
+    slackChannelId: string;
+    threadTs?: string;
+    /** Post as this bot (the agent's own); the shared bot when absent */
+    botToken?: string;
+}
+/** What {@link GoogleReauthNotifier.notify} did. */
+export type ReauthNotifyResult = {
+    status: 'posted';
+    expiresAt: string;
+} | {
+    status: 'already_sent';
+    sentAt: string;
+    nextCardAfter: string;
+} | {
+    status: 'unavailable';
+    why: string;
+};
+/** Collaborators. */
+export interface ReauthNotifierDeps {
+    /** The owner's Slack user id */
+    ownerUserId: () => string | null;
+    /** The thread the agent is working in, else the owner's DM with it */
+    placeFor: (agentSession: string | undefined, ownerUserId: string) => Promise<ReauthPlace | null>;
+    /** A single-use connect link from Cloud */
+    connectUrl: (args: {
+        products: GoogleProduct[];
+        email?: string;
+        slackUserId: string;
+        slackChannelId: string;
+        slackThreadTs?: string;
+    }) => Promise<{
+        url: string;
+        expiresAt: string;
+    }>;
+    /** Post so only the owner sees it; true when Slack accepted */
+    postCard: (place: ReauthPlace, ownerUserId: string, text: string, blocks: unknown[]) => Promise<boolean>;
+    /** Cloud's view of the connections now (fresh, not cached) */
+    status: () => Promise<GoogleWorkspaceStatus>;
+    /** Drop cached Google tokens so the retry carries the new grant */
+    clearTokenCache: (account?: string) => void;
+    /** Tell an agent something (wakes or queues it) */
+    tellAgent: (session: string, text: string) => Promise<boolean>;
+    now?: () => number;
+    /** Timer seam for tests */
+    setTimer?: (fn: () => void, ms: number) => {
+        cancel: () => void;
+    };
+}
+/**
+ * The card's first line. Owner-facing, so it says what broke and that it is
+ * quick — not which scope is missing.
+ *
+ * @param trigger - The failure
+ * @returns Card message
+ */
+export declare function reauthCardMessage(trigger: Pick<ReauthTrigger, 'product' | 'kind'>): string;
+/**
+ * What the agent is told once the owner has reconnected.
+ *
+ * @param trigger - The failure
+ * @returns Notice text
+ */
+export declare function reauthRetryNotice(trigger: Pick<ReauthTrigger, 'product' | 'kind'>): string;
+/**
+ * Whether a status from Cloud shows the failure fixed.
+ *
+ * - `missing_scope`: the account is connected for the product and now
+ *   carries the scope the call lacked (or, for a product with no known
+ *   extra, reports nothing missing).
+ * - `expired`: the account is connected for the product again (Cloud
+ *   deleted the dead grant, so being there at all is new).
+ *
+ * @param status - Cloud's connections
+ * @param trigger - The failure
+ * @returns True when the agent can retry
+ */
+export declare function isReconnected(status: GoogleWorkspaceStatus, trigger: ReauthTrigger): boolean;
+/**
+ * Posts reconnect cards and tells agents when to retry.
+ */
+export declare class GoogleReauthNotifier {
+    private readonly deps;
+    private static instance;
+    private readonly pending;
+    /** Posts on the wire, so two failures at once post one card */
+    private readonly posting;
+    private readonly now;
+    private readonly setTimer;
+    /**
+     * @param deps - Collaborators
+     */
+    constructor(deps: ReauthNotifierDeps);
+    /** The wired instance, or null when Slack is not set up on this machine. */
+    static getInstance(): GoogleReauthNotifier | null;
+    /**
+     * Install (or, with null, remove) the process-wide instance.
+     *
+     * @param next - Notifier
+     */
+    static setInstance(next: GoogleReauthNotifier | null): void;
+    /**
+     * Ask the owner to reconnect, unless a card for this product and account
+     * went out within the throttle window — then only remember that this
+     * agent is waiting too.
+     *
+     * @param trigger - The failure
+     * @returns What happened, for the agent's hint
+     */
+    notify(trigger: ReauthTrigger): Promise<ReauthNotifyResult>;
+    /** Stop every watch (shutdown, tests). */
+    stop(): void;
+    private post;
+    /** Check again after the poll interval, until the watch window closes. */
+    private schedule;
+    /**
+     * One look at Cloud. On success the waiting agents are told to retry and
+     * the throttle is lifted, so a later, different failure gets its own card.
+     */
+    private check;
+}
+//# sourceMappingURL=google-reauth-notifier.service.d.ts.map

package/dist/backend/backend/src/services/google/google-reauth-notifier.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-reauth-notifier.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/google/google-reauth-notifier.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGpF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAIjF,sCAAsC;AACtC,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,SAAS,CAAC;AAErD,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,yBAAyB;AACzB,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,oDAAoD;AACpD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,qBAAqB;AACrB,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,WAAW,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACjC,sEAAsE;IACtE,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjG,2CAA2C;IAC3C,UAAU,EAAE,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,aAAa,EAAE,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,+DAA+D;IAC/D,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzG,8DAA8D;IAC9D,MAAM,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7C,mEAAmE;IACnE,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,mDAAmD;IACnD,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;CACnE;AAiCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,MAAM,CAAC,GAAG,MAAM,CAK1F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,MAAM,CAAC,GAAG,MAAM,CAI1F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAW5F;AAYD;;GAEG;AACH,qBAAa,oBAAoB;IAYnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAXjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAqC;IAE5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkD;IAC1E,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyD;IAElF;;OAEG;gBAC0B,IAAI,EAAE,kBAAkB;IAWrD,4EAA4E;IAC5E,MAAM,CAAC,WAAW,IAAI,oBAAoB,GAAG,IAAI;IAIjD;;;;OAIG;IACH,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI,GAAG,IAAI;IAK3D;;;;;;;OAOG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA6BjE,0CAA0C;IAC1C,IAAI,IAAI,IAAI;YAKE,IAAI;IAkDlB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ;IAMhB;;;OAGG;YACW,KAAK;CA2BpB"}

package/dist/backend/backend/src/services/google/google-reauth-notifier.service.js

@@ -0,0 +1,283 @@
+/**
+ * Google reconnect cards — the harness asks the owner, not the agent.
+ *
+ * 2026-10-08: the Personal Assistant tried to save a reply as a Gmail draft,
+ * Google answered 403 "insufficient authentication scopes" (no grant carried
+ * `gmail.compose`), and the agent told the owner to "re-authorize Gmail in
+ * Crewly Connections" — a page the owner cannot reach from a phone. The
+ * same dead end follows an expired or revoked grant.
+ *
+ * So when a Google call fails because the grant is too narrow or no longer
+ * honoured, this posts the existing one-tap connect card (single-use ticket,
+ * `google-connect-card.ts`) to the owner in Slack — where the agent is
+ * working if that is known, else the owner's DM with that agent — at most
+ * once per product and Google account per
+ * {@link GOOGLE_WORKSPACE_CONSTANTS.REAUTH.CARD_THROTTLE_MS}. It then watches
+ * Cloud until the reconnect lands and tells the waiting agents to retry.
+ *
+ * Everything that touches Slack, Cloud or an agent is injected, so the
+ * machine the failure happened on is the one that posts — any machine with
+ * Slack and a Cloud session works the same.
+ *
+ * @module services/google/google-reauth-notifier.service
+ */
+import { GOOGLE_WORKSPACE_CONSTANTS } from '../../constants.js';
+import { LoggerService } from '../core/logger.service.js';
+import { buildConnectCard, PRODUCT_LABELS } from '../../controllers/google/google-connect-card.js';
+const logger = LoggerService.getInstance().createComponentLogger('GoogleReauthNotifier');
+/**
+ * The scope a `missing_scope` failure is about, per product — what a
+ * reconnect must have added for the retry to work.
+ */
+const EXTRA_SCOPE = {
+    gmail: GOOGLE_WORKSPACE_CONSTANTS.GMAIL_COMPOSE_SCOPE,
+    drive: GOOGLE_WORKSPACE_CONSTANTS.DRIVE_FULL_SCOPE,
+};
+/** What the missing scope lets the agent do, for the card. */
+const EXTRA_PURPOSE = {
+    gmail: 'save drafts',
+    drive: 'comment on documents',
+};
+/** What the agent retries once the scope is there. */
+const EXTRA_RETRY = {
+    gmail: 'your draft',
+    drive: 'your comment',
+};
+/**
+ * The card's first line. Owner-facing, so it says what broke and that it is
+ * quick — not which scope is missing.
+ *
+ * @param trigger - The failure
+ * @returns Card message
+ */
+export function reauthCardMessage(trigger) {
+    const label = PRODUCT_LABELS[trigger.product] ?? trigger.product;
+    if (trigger.kind === 'expired')
+        return `${label} access expired — tap to reconnect.`;
+    const purpose = EXTRA_PURPOSE[trigger.product];
+    return `${label} needs re-authorization${purpose ? ` to ${purpose}` : ''} (missing permission). Tap to reconnect — takes 30 seconds on your phone.`;
+}
+/**
+ * What the agent is told once the owner has reconnected.
+ *
+ * @param trigger - The failure
+ * @returns Notice text
+ */
+export function reauthRetryNotice(trigger) {
+    const label = PRODUCT_LABELS[trigger.product] ?? trigger.product;
+    const what = trigger.kind === 'missing_scope' ? EXTRA_RETRY[trigger.product] : undefined;
+    return `[GOOGLE] ${label} reconnected — retry ${what ?? 'what failed'}.`;
+}
+/**
+ * Whether a status from Cloud shows the failure fixed.
+ *
+ * - `missing_scope`: the account is connected for the product and now
+ *   carries the scope the call lacked (or, for a product with no known
+ *   extra, reports nothing missing).
+ * - `expired`: the account is connected for the product again (Cloud
+ *   deleted the dead grant, so being there at all is new).
+ *
+ * @param status - Cloud's connections
+ * @param trigger - The failure
+ * @returns True when the agent can retry
+ */
+export function isReconnected(status, trigger) {
+    if (!status.connected)
+        return false;
+    const account = trigger.account?.toLowerCase();
+    const connection = account
+        ? status.connections.find((c) => c.email.toLowerCase() === account)
+        : status.connections.find((c) => c.isDefault) ?? status.connections[0];
+    if (!connection || !connection.products.includes(trigger.product))
+        return false;
+    if (trigger.kind === 'expired')
+        return true;
+    const needed = EXTRA_SCOPE[trigger.product];
+    if (needed)
+        return connection.scopes.includes(needed);
+    return (connection.missingScopes ?? []).length === 0;
+}
+/**
+ * Throttle key: one card per product and Google account.
+ *
+ * @param trigger - The failure
+ * @returns Key
+ */
+function keyOf(trigger) {
+    return `${trigger.product}\u0000${(trigger.account ?? '').toLowerCase()}`;
+}
+/**
+ * Posts reconnect cards and tells agents when to retry.
+ */
+export class GoogleReauthNotifier {
+    deps;
+    static instance = null;
+    pending = new Map();
+    /** Posts on the wire, so two failures at once post one card */
+    posting = new Map();
+    now;
+    setTimer;
+    /**
+     * @param deps - Collaborators
+     */
+    constructor(deps) {
+        this.deps = deps;
+        this.now = deps.now ?? (() => Date.now());
+        this.setTimer =
+            deps.setTimer ??
+                ((fn, ms) => {
+                    const t = setTimeout(fn, ms);
+                    t.unref?.();
+                    return { cancel: () => clearTimeout(t) };
+                });
+    }
+    /** The wired instance, or null when Slack is not set up on this machine. */
+    static getInstance() {
+        return GoogleReauthNotifier.instance;
+    }
+    /**
+     * Install (or, with null, remove) the process-wide instance.
+     *
+     * @param next - Notifier
+     */
+    static setInstance(next) {
+        GoogleReauthNotifier.instance?.stop();
+        GoogleReauthNotifier.instance = next;
+    }
+    /**
+     * Ask the owner to reconnect, unless a card for this product and account
+     * went out within the throttle window — then only remember that this
+     * agent is waiting too.
+     *
+     * @param trigger - The failure
+     * @returns What happened, for the agent's hint
+     */
+    async notify(trigger) {
+        const key = keyOf(trigger);
+        const nowMs = this.now();
+        const existing = this.pending.get(key);
+        if (existing && nowMs - existing.sentAtMs < GOOGLE_WORKSPACE_CONSTANTS.REAUTH.CARD_THROTTLE_MS) {
+            if (trigger.agentSession)
+                existing.waiters.add(trigger.agentSession);
+            // The watch on the card may have run out; someone is waiting again, so
+            // look for a reconnect made some other way (the Connections page).
+            if (!existing.timer) {
+                existing.watchUntilMs = nowMs + GOOGLE_WORKSPACE_CONSTANTS.REAUTH.POLL_GRACE_MS;
+                this.schedule(key, existing);
+            }
+            return {
+                status: 'already_sent',
+                sentAt: new Date(existing.sentAtMs).toISOString(),
+                nextCardAfter: new Date(existing.sentAtMs + GOOGLE_WORKSPACE_CONSTANTS.REAUTH.CARD_THROTTLE_MS).toISOString(),
+            };
+        }
+        const inFlight = this.posting.get(key);
+        if (inFlight) {
+            const result = await inFlight;
+            if (trigger.agentSession)
+                this.pending.get(key)?.waiters.add(trigger.agentSession);
+            return result;
+        }
+        const task = this.post(key, trigger).finally(() => this.posting.delete(key));
+        this.posting.set(key, task);
+        return task;
+    }
+    /** Stop every watch (shutdown, tests). */
+    stop() {
+        for (const p of this.pending.values())
+            p.timer?.cancel();
+        this.pending.clear();
+    }
+    async post(key, trigger) {
+        const owner = this.deps.ownerUserId();
+        if (!owner)
+            return { status: 'unavailable', why: 'the owner is not known on Slack' };
+        const place = await this.deps.placeFor(trigger.agentSession, owner).catch(() => null);
+        if (!place)
+            return { status: 'unavailable', why: 'no Slack conversation with the owner from this machine' };
+        let link;
+        try {
+            link = await this.deps.connectUrl({
+                products: [trigger.product],
+                ...(trigger.account ? { email: trigger.account } : {}),
+                slackUserId: owner,
+                slackChannelId: place.slackChannelId,
+                ...(place.threadTs ? { slackThreadTs: place.threadTs } : {}),
+            });
+        }
+        catch (err) {
+            const why = err instanceof Error ? err.message : String(err);
+            logger.warn('Could not mint a Google reconnect link', { product: trigger.product, error: why });
+            return { status: 'unavailable', why: `Crewly Cloud did not issue a link (${why})` };
+        }
+        const card = buildConnectCard(trigger.product, link.url, link.expiresAt, {
+            message: reauthCardMessage(trigger),
+            ...(trigger.account ? { account: trigger.account } : {}),
+        });
+        const posted = await this.deps.postCard(place, owner, card.text, card.blocks).catch(() => false);
+        if (!posted)
+            return { status: 'unavailable', why: 'Slack refused the card' };
+        const sentAtMs = this.now();
+        const expiresMs = Date.parse(link.expiresAt);
+        const pending = {
+            trigger,
+            sentAtMs,
+            watchUntilMs: (Number.isFinite(expiresMs) ? expiresMs : sentAtMs) + GOOGLE_WORKSPACE_CONSTANTS.REAUTH.POLL_GRACE_MS,
+            waiters: new Set(trigger.agentSession ? [trigger.agentSession] : []),
+        };
+        this.pending.get(key)?.timer?.cancel();
+        this.pending.set(key, pending);
+        this.schedule(key, pending);
+        logger.info('Posted a Google reconnect card', {
+            product: trigger.product,
+            kind: trigger.kind,
+            account: trigger.account,
+            slackChannelId: place.slackChannelId,
+            threaded: !!place.threadTs,
+            agentSession: trigger.agentSession,
+        });
+        return { status: 'posted', expiresAt: link.expiresAt };
+    }
+    /** Check again after the poll interval, until the watch window closes. */
+    schedule(key, pending) {
+        pending.timer = this.setTimer(() => {
+            void this.check(key, pending);
+        }, GOOGLE_WORKSPACE_CONSTANTS.REAUTH.POLL_INTERVAL_MS);
+    }
+    /**
+     * One look at Cloud. On success the waiting agents are told to retry and
+     * the throttle is lifted, so a later, different failure gets its own card.
+     */
+    async check(key, pending) {
+        if (this.pending.get(key) !== pending)
+            return;
+        let fixed = false;
+        try {
+            fixed = isReconnected(await this.deps.status(), pending.trigger);
+        }
+        catch (err) {
+            logger.debug('Could not read Google status while waiting for a reconnect', {
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+        if (!fixed) {
+            if (this.now() < pending.watchUntilMs)
+                this.schedule(key, pending);
+            else
+                pending.timer = undefined;
+            return;
+        }
+        this.pending.delete(key);
+        this.deps.clearTokenCache(pending.trigger.account);
+        const notice = reauthRetryNotice(pending.trigger);
+        for (const session of pending.waiters) {
+            await this.deps.tellAgent(session, notice).catch(() => false);
+        }
+        logger.info('Google reconnected; told the waiting agents to retry', {
+            product: pending.trigger.product,
+            account: pending.trigger.account,
+            agents: [...pending.waiters],
+        });
+    }
+}
+//# sourceMappingURL=google-reauth-notifier.service.js.map

package/dist/backend/backend/src/services/google/google-reauth-notifier.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-reauth-notifier.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/google/google-reauth-notifier.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,0BAA0B,EAAsB,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGnG,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;AAkEzF;;;GAGG;AACH,MAAM,WAAW,GAA2C;IAC1D,KAAK,EAAE,0BAA0B,CAAC,mBAAmB;IACrD,KAAK,EAAE,0BAA0B,CAAC,gBAAgB;CACnD,CAAC;AAEF,8DAA8D;AAC9D,MAAM,aAAa,GAA2C;IAC5D,KAAK,EAAE,aAAa;IACpB,KAAK,EAAE,sBAAsB;CAC9B,CAAC;AAEF,sDAAsD;AACtD,MAAM,WAAW,GAA2C;IAC1D,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,cAAc;CACtB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgD;IAChF,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC;IACjE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,qCAAqC,CAAC;IACrF,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,GAAG,KAAK,0BAA0B,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,2EAA2E,CAAC;AACtJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgD;IAChF,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,OAAO,YAAY,KAAK,wBAAwB,IAAI,IAAI,aAAa,GAAG,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,MAA6B,EAAE,OAAsB;IACjF,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QACnE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,KAAK,CAAC,OAAmD;IAChE,OAAO,GAAG,OAAO,CAAC,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,oBAAoB;IAYF;IAXrB,MAAM,CAAC,QAAQ,GAAgC,IAAI,CAAC;IAE3C,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IACtD,+DAA+D;IAC9C,OAAO,GAAG,IAAI,GAAG,EAAuC,CAAC;IACzD,GAAG,CAAe;IAClB,QAAQ,CAAyD;IAElF;;OAEG;IACH,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ;YACX,IAAI,CAAC,QAAQ;gBACb,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;oBACV,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC7B,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;oBACZ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAC5E,MAAM,CAAC,WAAW;QAChB,OAAO,oBAAoB,CAAC,QAAQ,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,WAAW,CAAC,IAAiC;QAClD,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACtC,oBAAoB,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,IAAI,KAAK,GAAG,QAAQ,CAAC,QAAQ,GAAG,0BAA0B,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC/F,IAAI,OAAO,CAAC,YAAY;gBAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACrE,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,QAAQ,CAAC,YAAY,GAAG,KAAK,GAAG,0BAA0B,CAAC,MAAM,CAAC,aAAa,CAAC;gBAChF,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;gBACjD,aAAa,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,0BAA0B,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE;aAC9G,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;YAC9B,IAAI,OAAO,CAAC,YAAY;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACnF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,IAAI;QACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,OAAsB;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,wDAAwD,EAAE,CAAC;QAE5G,IAAI,IAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;gBAChC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC3B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,WAAW,EAAE,KAAK;gBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAChG,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,sCAAsC,GAAG,GAAG,EAAE,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE;YACvE,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC;QAE7E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAY;YACvB,OAAO;YACP,QAAQ;YACR,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,0BAA0B,CAAC,MAAM,CAAC,aAAa;YACnH,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACzD,CAAC;IAED,0EAA0E;IAClE,QAAQ,CAAC,GAAW,EAAE,OAAgB;QAC5C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;YACjC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC,EAAE,0BAA0B,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAgB;QAC/C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,OAAO;QAC9C,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,aAAa,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,4DAA4D,EAAE;gBACzE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY;gBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;;gBAC9D,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;YAClE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;YAChC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC"}

package/dist/backend/backend/src/services/google/google-reauth.wiring.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Google reconnect cards — wiring with the real Slack, Cloud and agents.
+ *
+ * Kept apart from the notifier so its rules (throttle, wording, when a
+ * reconnect counts) are testable without Slack. Everything here runs on the
+ * machine where the Google call failed: its Slack transport posts the card,
+ * its Cloud session mints the ticket, its agents are told to retry. That is
+ * the same on every machine, so an agent on a second machine (the Personal
+ * Assistant on iriss-air, 2026-10-08) gets the same card as one on the main
+ * Mac.
+ *
+ * @module services/google/google-reauth.wiring
+ */
+import type { SlackBlock } from '../../types/slack.types.js';
+import { GoogleReauthNotifier, type ReauthNotifierDeps } from './google-reauth-notifier.service.js';
+/** The Slack calls the wiring makes (a slice of SlackService). */
+export interface ReauthSlackApi {
+    getOwnerUserId?: (() => string | null) | null;
+    openDirectMessage: (userId: string, botToken?: string) => Promise<string>;
+    sendMessage: (message: {
+        channelId: string;
+        text: string;
+        blocks?: SlackBlock[];
+        threadTs?: string;
+        botToken?: string;
+        skipChatV2Mirror?: boolean;
+    }) => Promise<string>;
+    sendEphemeral: (channelId: string, userId: string, text: string, blocks?: unknown[], botToken?: string, threadTs?: string) => Promise<boolean>;
+}
+/** What the wiring needs from the rest of the process. */
+export interface ReauthWiringInput {
+    /** Deliver text to an agent; wakes it when needed */
+    sendToAgent: (session: string, text: string) => Promise<boolean>;
+    /** Seams for tests; default to the real singletons */
+    slack?: () => ReauthSlackApi;
+    /** The Slack place of the agent's current work */
+    workDestination?: (session: string) => Promise<{
+        slackChannelId: string;
+        threadTs?: string;
+    } | null>;
+    /** The owner↔agent Slack DM, when there is one */
+    agentDm?: (session: string) => {
+        slackChannelId: string;
+    } | null;
+    /** The agent's own installed bot token */
+    agentBotToken?: (session: string) => string | undefined;
+}
+/**
+ * A Slack DM channel id. DMs are private to the owner and the bot, so a
+ * card there can be an ordinary message — which, unlike an ephemeral one,
+ * reaches the owner's phone as a notification and survives a reload.
+ *
+ * @param channelId - Slack channel id
+ * @returns True for `D…`
+ */
+export declare function isDirectMessage(channelId: string): boolean;
+/**
+ * Build the notifier's collaborators.
+ *
+ * @param input - Process hooks and test seams
+ * @returns Notifier deps
+ */
+export declare function createReauthNotifierDeps(input: ReauthWiringInput): ReauthNotifierDeps;
+/**
+ * Install the process-wide notifier. Called once Slack is up.
+ *
+ * @param input - Process hooks
+ * @returns The notifier
+ */
+export declare function startGoogleReauthNotifier(input: ReauthWiringInput): GoogleReauthNotifier;
+//# sourceMappingURL=google-reauth.wiring.d.ts.map

package/dist/backend/backend/src/services/google/google-reauth.wiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-reauth.wiring.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/google/google-reauth.wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAM7D,OAAO,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAoB,MAAM,qCAAqC,CAAC;AAItH,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,WAAW,EAAE,CAAC,OAAO,EAAE;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,aAAa,EAAE,CACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,OAAO,EAAE,EAClB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,KACd,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,cAAc,CAAC;IAC7B,kDAAkD;IAClD,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACrG,kDAAkD;IAClD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,0CAA0C;IAC1C,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CACzD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAkFrF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,iBAAiB,GAAG,oBAAoB,CAKxF"}