@aitne/daemon 0.1.0

package/dist/services/mail/account-registry.js

@@ -0,0 +1,554 @@
+import { randomUUID } from "node:crypto";
+import { redactSensitiveString } from "@aitne/shared";
+import { createLogger } from "../../logging.js";
+import { mailAccountBlobName } from "./provider.js";
+import { parseCapabilitiesJson, serializeCapabilities, } from "./imap/capabilities.js";
+const logger = createLogger("mail-account-registry");
+const VALID_KINDS = [
+    "gmail",
+    "outlook",
+    "yahoo",
+    "icloud",
+];
+const VALID_STATUSES = [
+    "healthy",
+    "requires_consent",
+    "degraded",
+];
+export function parseMailAccountRow(row) {
+    if (!VALID_KINDS.includes(row.kind)) {
+        throw new Error(`Invalid mail_accounts.kind: ${row.kind}`);
+    }
+    if (!VALID_STATUSES.includes(row.auth_status)) {
+        throw new Error(`Invalid mail_accounts.auth_status: ${row.auth_status}`);
+    }
+    return {
+        id: row.id,
+        kind: row.kind,
+        email: row.email,
+        label: row.label ?? undefined,
+        authStatus: row.auth_status,
+        idleEnabled: row.idle_enabled === 1,
+        active: row.active === 1,
+        createdAt: row.created_at_utc,
+    };
+}
+export function parseMailAccountHealth(row) {
+    return {
+        accountId: row.id,
+        lastPollAtUtc: row.last_poll_at_utc,
+        lastError: row.last_error,
+        lastErrorAtUtc: row.last_error_at_utc,
+        consecutiveErrorCount: row.consecutive_error_count,
+        idleFallbackUntilUtc: row.idle_fallback_until,
+    };
+}
+/**
+ * Pure scope-gate predicate (§3.2).
+ *
+ * The unified mail-poller and pre-materialized skill must only surface
+ * accounts matching ALL four conditions. Legacy gmail rows (unifiedPoll=false)
+ * pass through the legacy poller path and are intentionally excluded from the
+ * unified set to avoid double-polling.
+ */
+export function passesScopeGate(input, enabledKinds) {
+    return (enabledKinds.includes(input.kind) &&
+        input.active &&
+        input.authStatus === "healthy" &&
+        input.unifiedPoll);
+}
+export class ProviderNotEnabledError extends Error {
+    code = "provider_not_enabled";
+    constructor(kind) {
+        super(`Mail provider not enabled: ${kind}`);
+        this.name = "ProviderNotEnabledError";
+    }
+}
+export class ProviderNotImplementedError extends Error {
+    code = "provider_not_implemented";
+    constructor(kind) {
+        super(`Mail provider implementation not available yet: ${kind}`);
+        this.name = "ProviderNotImplementedError";
+    }
+}
+export class DuplicateAccountError extends Error {
+    code = "duplicate_account";
+    constructor(kind, email) {
+        super(`Mail account already exists for ${kind}:${email}`);
+        this.name = "DuplicateAccountError";
+    }
+}
+/* v8 ignore next 5 — only reachable from TOCTOU catch block below; early duplicate check (line ~292) prevents this in single-threaded tests */
+function isUniqueConstraintError(err) {
+    if (!err || typeof err !== "object")
+        return false;
+    const code = err.code;
+    return code === "SQLITE_CONSTRAINT_UNIQUE" || code === "SQLITE_CONSTRAINT";
+}
+/**
+ * Owns the set of configured mail accounts: DB rows, secret blobs, and live
+ * MailProvider instances. The provider cache is lazy and per-accountId.
+ *
+ * Per §3.2 each accountId owns an AbortController so {@link removeAccount}
+ * can cancel in-flight polls before tearing down credentials.
+ */
+export class MailAccountRegistry {
+    db;
+    blobStore;
+    getEnabledKinds;
+    providerFactories;
+    now;
+    onScopeChanged;
+    mutexes = new Map();
+    providerCache = new Map();
+    abortControllers = new Map();
+    /** Last kinds set passed to onProviderSelectionChanged, for no-op elision. */
+    lastAnnouncedKinds = null;
+    constructor(options) {
+        this.db = options.db;
+        this.blobStore = options.blobStore;
+        this.getEnabledKinds = options.getEnabledKinds;
+        this.providerFactories = options.providerFactories ?? {};
+        this.now = options.now ?? (() => new Date());
+        // Wrap the user callback so a throwing observer can never break a
+        // mutation — mail operations must succeed even if the refresh hook
+        // is misbehaving.
+        const userHook = options.onScopeChanged;
+        this.onScopeChanged = userHook
+            ? (reason) => {
+                try {
+                    userHook(reason);
+                }
+                catch {
+                    // Swallowed intentionally. Callers log inside their handlers.
+                }
+            }
+            : () => undefined;
+    }
+    listAccounts() {
+        const rows = this.db
+            .prepare(`SELECT * FROM mail_accounts ORDER BY created_at_utc ASC`)
+            .all();
+        return rows.map(parseMailAccountRow);
+    }
+    listActiveAccounts() {
+        const enabled = this.getEnabledKinds();
+        const rows = this.db
+            .prepare(`SELECT * FROM mail_accounts ORDER BY created_at_utc ASC`)
+            .all();
+        return rows
+            .filter((row) => passesScopeGate({
+            kind: row.kind,
+            active: row.active === 1,
+            authStatus: row.auth_status,
+            unifiedPoll: row.unified_poll === 1,
+        }, enabled))
+            .map(parseMailAccountRow);
+    }
+    getAccount(accountId) {
+        const row = this.db
+            .prepare(`SELECT * FROM mail_accounts WHERE id = ?`)
+            .get(accountId);
+        return row ? parseMailAccountRow(row) : null;
+    }
+    getHealth(accountId) {
+        const row = this.db
+            .prepare(`SELECT * FROM mail_accounts WHERE id = ?`)
+            .get(accountId);
+        return row ? parseMailAccountHealth(row) : null;
+    }
+    /**
+     * Returns the current abort signal for an account. The controller is
+     * created lazily so callers (providers, pollers) always get a live signal
+     * even for accounts that haven't been touched yet. `removeAccount` aborts
+     * and drops the controller; the next caller mints a fresh one.
+     */
+    getAbortSignal(accountId) {
+        return this.getOrCreateAbortController(accountId).signal;
+    }
+    getOrCreateAbortController(accountId) {
+        const existing = this.abortControllers.get(accountId);
+        if (existing && !existing.signal.aborted)
+            return existing;
+        const controller = new AbortController();
+        this.abortControllers.set(accountId, controller);
+        return controller;
+    }
+    async addAccount(input) {
+        // Auth-then-enable flow (UI v2): registration is allowed regardless of
+        // `enabledMailProviders` — the kind being absent only means the account
+        // sits dormant. Operation routes (read/send) and the unified poller
+        // both gate on `enabledMailProviders` independently via `passesScopeGate`,
+        // so a dormant kind cannot be observed or written. Letting the user
+        // authenticate first matches the dashboard UX where the per-card Enable
+        // toggle becomes interactive only after a successful auth.
+        //
+        if (!this.providerFactories[input.kind]) {
+            throw new ProviderNotImplementedError(input.kind);
+        }
+        // Early duplicate check so the caller gets DuplicateAccountError instead
+        // of leaking an SQLITE_CONSTRAINT from the INSERT below.
+        const existing = this.db
+            .prepare(`SELECT id FROM mail_accounts WHERE kind = ? AND email = ?`)
+            .get(input.kind, input.email);
+        if (existing) {
+            throw new DuplicateAccountError(input.kind, input.email);
+        }
+        const id = `${input.kind}-${randomSuffix()}`;
+        const blobName = mailAccountBlobName(input.kind, id);
+        await this.blobStore.writeUtf8(blobName, input.secretPayload);
+        const createdAt = this.now().toISOString();
+        try {
+            // Account resolution is context-driven at the skill layer; the
+            // schema has no is_primary column, so the INSERT column set
+            // intentionally never mentions it.
+            this.db
+                .prepare(`INSERT INTO mail_accounts (
+             id, kind, email, label, auth_type, auth_status,
+             secret_blob_name, poll_interval_seconds, idle_enabled,
+             unified_poll, active, created_at_utc, imap_capabilities_json
+           ) VALUES (?, ?, ?, ?, ?, 'healthy', ?, ?, ?, ?, 1, ?, ?)`)
+                .run(id, input.kind, input.email, input.label ?? null, input.authType, blobName, input.pollIntervalSeconds ?? 300, input.idleEnabled ? 1 : 0, input.unifiedPoll === false ? 0 : 1, createdAt, input.capabilities ? serializeCapabilities(input.capabilities) : null);
+        }
+        catch (error) {
+            /* v8 ignore next 5 — concurrent insert race: early duplicate check prevents this in tests */
+            await this.blobStore.remove(blobName);
+            if (isUniqueConstraintError(error)) {
+                throw new DuplicateAccountError(input.kind, input.email);
+            }
+            throw error;
+        }
+        const row = this.db
+            .prepare(`SELECT * FROM mail_accounts WHERE id = ?`)
+            .get(id);
+        const account = parseMailAccountRow(row);
+        this.onScopeChanged("account_added");
+        return account;
+    }
+    async removeAccount(accountId) {
+        return this.withMutex(accountId, async () => {
+            const row = this.db
+                .prepare(`SELECT * FROM mail_accounts WHERE id = ?`)
+                .get(accountId);
+            if (!row)
+                return false;
+            // (1) Cancel in-flight polls per §3.2 so pending Graph/IMAP fetches
+            // error out before we revoke tokens and delete the blob.
+            const controller = this.abortControllers.get(accountId);
+            if (controller) {
+                controller.abort();
+                this.abortControllers.delete(accountId);
+            }
+            // (2) Best-effort revoke before tearing down state. Failures here must
+            // not block deletion — the user already asked to remove the account.
+            const cached = this.providerCache.get(accountId);
+            if (cached) {
+                try {
+                    await cached.revoke();
+                }
+                catch {
+                    // swallowed — token already expired or network down
+                }
+                this.providerCache.delete(accountId);
+            }
+            this.db
+                .prepare(`DELETE FROM mail_accounts WHERE id = ?`)
+                .run(accountId);
+            // Best-effort blob teardown — the row is already gone, so the secret
+            // is no longer reachable. A failure here only orphans bytes on disk.
+            // Log so operators can clean up manually if it ever happens.
+            try {
+                await this.blobStore.remove(row.secret_blob_name);
+            }
+            catch (err) {
+                logger.warn({ err, accountId, blobName: row.secret_blob_name }, "Failed to remove secret blob after account delete (orphaned)");
+            }
+            this.onScopeChanged("account_removed");
+            return true;
+        });
+    }
+    /**
+     * Replace the on-disk secret for an existing IMAP (app-password) account
+     * — used when the user rotates their Yahoo / iCloud app password and the
+     * account has flipped to `requires_consent`. The secret blob is overwritten
+     * in place (same name) so the account ID and poll cursor survive intact;
+     * the cached provider is evicted so the next poll opens a fresh IMAP
+     * session with the new credentials.
+     *
+     * Caller is responsible for verifying the new credentials against the IMAP
+     * server before calling — this method does not re-validate.
+     */
+    async refreshImapSecret(accountId, secretPayload, capabilities) {
+        return this.withMutex(accountId, async () => {
+            const row = this.db
+                .prepare(`SELECT * FROM mail_accounts WHERE id = ?`)
+                .get(accountId);
+            if (!row)
+                return null;
+            if (row.auth_type !== "app_password") {
+                throw new Error(`refreshImapSecret only supports app_password accounts (got ${row.auth_type})`);
+            }
+            // Cancel any in-flight poll so it doesn't race with the secret swap.
+            const controller = this.abortControllers.get(accountId);
+            if (controller) {
+                controller.abort();
+                this.abortControllers.delete(accountId);
+            }
+            // Drop the cached provider so the next poll opens a fresh IMAP session
+            // with the rotated credentials. revoke() is a no-op for IMAP.
+            const cached = this.providerCache.get(accountId);
+            if (cached) {
+                try {
+                    await cached.revoke();
+                }
+                catch {
+                    // best-effort teardown
+                }
+                this.providerCache.delete(accountId);
+            }
+            await this.blobStore.writeUtf8(row.secret_blob_name, secretPayload);
+            const updateTxn = this.db.transaction(() => {
+                this.db
+                    .prepare(`UPDATE mail_accounts
+                SET auth_status = 'healthy',
+                    consecutive_error_count = 0,
+                    last_error = NULL,
+                    last_error_at_utc = NULL
+              WHERE id = ?`)
+                    .run(accountId);
+                if (capabilities) {
+                    this.db
+                        .prepare(`UPDATE mail_accounts SET imap_capabilities_json = ? WHERE id = ?`)
+                        .run(serializeCapabilities(capabilities), accountId);
+                }
+            });
+            updateTxn();
+            const updated = this.db
+                .prepare(`SELECT * FROM mail_accounts WHERE id = ?`)
+                .get(accountId);
+            const wasHealthy = row.auth_status === "healthy";
+            this.onScopeChanged(wasHealthy ? "account_reauthed" : "auth_status_recovered");
+            return parseMailAccountRow(updated);
+        });
+    }
+    async setActive(accountId, active) {
+        return this.withMutex(accountId, async () => {
+            // Read the current value so we can skip the scope-changed notification
+            // on idempotent calls. The SQL UPDATE below reports `changes > 0` even
+            // when the value didn't change (SQLite counts matched rows), so we need
+            // a pre-read to distinguish a genuine flip from a no-op request.
+            const before = this.db
+                .prepare(`SELECT active FROM mail_accounts WHERE id = ?`)
+                .get(accountId);
+            if (!before)
+                return null;
+            const wasActive = before.active === 1;
+            const result = this.db
+                .prepare(`UPDATE mail_accounts SET active = ? WHERE id = ?`)
+                .run(active ? 1 : 0, accountId);
+            if (result.changes === 0)
+                return null;
+            // Disabling an account should shed the cached provider so it does not
+            // retain live MSAL/IMAP sessions. Re-enabling simply lazily rebuilds.
+            if (!active) {
+                const controller = this.abortControllers.get(accountId);
+                if (controller) {
+                    controller.abort();
+                    this.abortControllers.delete(accountId);
+                }
+                const cached = this.providerCache.get(accountId);
+                if (cached) {
+                    try {
+                        await cached.revoke();
+                    }
+                    catch {
+                        // Disabling should still succeed if provider teardown fails.
+                    }
+                    this.providerCache.delete(accountId);
+                }
+            }
+            const row = this.db
+                .prepare(`SELECT * FROM mail_accounts WHERE id = ?`)
+                .get(accountId);
+            if (wasActive !== active) {
+                this.onScopeChanged(active ? "account_activated" : "account_deactivated");
+            }
+            return parseMailAccountRow(row);
+        });
+    }
+    /**
+     * Atomic auth-status flip. Use the {@link effectiveAuthStatus} pure helper
+     * (auth-failure-classifier.ts) to decide what status to pass in.
+     *
+     * Fires `onScopeChanged` ONLY when crossing the `healthy` boundary
+     * (healthy → non-healthy or vice versa). Reclassifying within the
+     * non-healthy space (e.g. `degraded` → `requires_consent`) does not
+     * change scope-gate membership, so no notification.
+     */
+    updateAuthStatus(accountId, status, lastError) {
+        const nowIso = this.now().toISOString();
+        const before = this.db
+            .prepare(`SELECT auth_status FROM mail_accounts WHERE id = ?`)
+            .get(accountId);
+        const result = this.db
+            .prepare(`UPDATE mail_accounts
+            SET auth_status = ?, last_error = ?, last_error_at_utc = ?
+          WHERE id = ?`)
+            .run(status, lastError != null ? redactSensitiveString(lastError) : null, lastError === undefined ? null : nowIso, accountId);
+        if (result.changes > 0 && before) {
+            const wasHealthy = before.auth_status === "healthy";
+            const isHealthy = status === "healthy";
+            if (wasHealthy && !isHealthy) {
+                this.onScopeChanged("auth_status_degraded");
+            }
+            else if (!wasHealthy && isHealthy) {
+                this.onScopeChanged("auth_status_recovered");
+            }
+        }
+        return result.changes > 0;
+    }
+    /**
+     * Bookkeeping after a poll tick. `success=true` resets
+     * `consecutive_error_count` to 0 and clears `last_error`.
+     * `success=false` increments the counter and records the error.
+     */
+    recordPollTick(accountId, outcome) {
+        const nowIso = this.now().toISOString();
+        if (outcome.success) {
+            const result = this.db
+                .prepare(`UPDATE mail_accounts
+              SET last_poll_at_utc = ?, consecutive_error_count = 0,
+                  last_error = NULL, last_error_at_utc = NULL
+            WHERE id = ?`)
+                .run(nowIso, accountId);
+            return result.changes > 0;
+        }
+        const result = this.db
+            .prepare(`UPDATE mail_accounts
+            SET last_poll_at_utc = ?,
+                last_error = ?, last_error_at_utc = ?,
+                consecutive_error_count = consecutive_error_count + 1
+          WHERE id = ?`)
+            .run(nowIso, redactSensitiveString(outcome.error), nowIso, accountId);
+        return result.changes > 0;
+    }
+    getConsecutiveErrorCount(accountId) {
+        const row = this.db
+            .prepare(`SELECT consecutive_error_count FROM mail_accounts WHERE id = ?`)
+            .get(accountId);
+        return row?.consecutive_error_count ?? 0;
+    }
+    /**
+     * Persist the CAPABILITY probe for an account (§3 Phase 4). The provider
+     * calls this fire-and-forget on first connect; the row may not exist if the
+     * account was removed mid-connect, in which case the UPDATE is a no-op.
+     */
+    updateCapabilities(accountId, capabilities) {
+        const result = this.db
+            .prepare(`UPDATE mail_accounts SET imap_capabilities_json = ? WHERE id = ?`)
+            .run(serializeCapabilities(capabilities), accountId);
+        return result.changes > 0;
+    }
+    getCapabilities(accountId) {
+        const row = this.db
+            .prepare(`SELECT imap_capabilities_json FROM mail_accounts WHERE id = ?`)
+            .get(accountId);
+        return parseCapabilitiesJson(row?.imap_capabilities_json ?? null);
+    }
+    loadPollCursor(accountId) {
+        const row = this.db
+            .prepare(`SELECT poll_cursor_json FROM mail_accounts WHERE id = ?`)
+            .get(accountId);
+        if (!row?.poll_cursor_json)
+            return null;
+        try {
+            return JSON.parse(row.poll_cursor_json);
+        }
+        catch {
+            return null;
+        }
+    }
+    savePollCursor(accountId, cursor) {
+        const result = this.db
+            .prepare(`UPDATE mail_accounts SET poll_cursor_json = ? WHERE id = ?`)
+            .run(JSON.stringify(cursor), accountId);
+        return result.changes > 0;
+    }
+    /**
+     * Lazy provider lookup. Caches per accountId. Throws
+     * {@link ProviderNotImplementedError} if no factory is registered.
+     */
+    peekProvider(accountId) {
+        return this.providerCache.get(accountId) ?? null;
+    }
+    async getProvider(accountId) {
+        const cached = this.providerCache.get(accountId);
+        if (cached)
+            return cached;
+        const account = this.getAccount(accountId);
+        if (!account)
+            return null;
+        const factory = this.providerFactories[account.kind];
+        if (!factory) {
+            throw new ProviderNotImplementedError(account.kind);
+        }
+        const signal = this.getOrCreateAbortController(accountId).signal;
+        const provider = await factory(account, { signal });
+        this.providerCache.set(accountId, provider);
+        return provider;
+    }
+    /** Drop a cached provider — used after auth failures so the next call rebuilds the MSAL/IMAP client fresh. */
+    evictProvider(accountId) {
+        this.providerCache.delete(accountId);
+    }
+    /**
+     * Scope-gate change hook (§6.0). Phase 2 evicts cached providers for kinds
+     * leaving the enabled set so polling stops. Pollers also re-check on each
+     * tick via {@link listActiveAccounts}, so this is best-effort acceleration.
+     *
+     * Fires `onScopeChanged` only when `newKinds` differs from the last
+     * announced set (by membership, order-independent). Idempotent calls
+     * (e.g. PATCH /mail/providers with the same enabledKinds) are silent.
+     */
+    onProviderSelectionChanged(newKinds) {
+        const enabled = new Set(newKinds);
+        for (const [accountId, provider] of this.providerCache) {
+            if (!enabled.has(provider.kind)) {
+                const controller = this.abortControllers.get(accountId);
+                if (controller) {
+                    controller.abort();
+                    this.abortControllers.delete(accountId);
+                }
+                this.providerCache.delete(accountId);
+            }
+        }
+        const changed = this.lastAnnouncedKinds === null ||
+            this.lastAnnouncedKinds.size !== enabled.size ||
+            [...enabled].some((k) => !this.lastAnnouncedKinds.has(k));
+        this.lastAnnouncedKinds = enabled;
+        if (changed) {
+            this.onScopeChanged("enabled_providers_changed");
+        }
+    }
+    async withMutex(key, fn) {
+        const prev = this.mutexes.get(key) ?? Promise.resolve();
+        const next = prev.then(fn, fn);
+        const tracked = next.catch(() => undefined);
+        this.mutexes.set(key, tracked);
+        try {
+            return (await next);
+        }
+        finally {
+            if (this.mutexes.get(key) === tracked) {
+                this.mutexes.delete(key);
+            }
+        }
+    }
+}
+function randomSuffix() {
+    // crypto.randomUUID() — 128-bit collision-resistant identifier. Previously
+    // used Math.random().toString(36) which is non-cryptographic and gave only
+    // ~41 bits of entropy for a secret-blob filename.
+    return randomUUID().replace(/-/g, "").slice(0, 12);
+}
+//# sourceMappingURL=account-registry.js.map

package/dist/services/mail/account-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-registry.js","sourceRoot":"","sources":["../../../src/services/mail/account-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAUhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,MAAM,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAuBrD,MAAM,WAAW,GAAgC;IAC/C,OAAO;IACP,SAAS;IACT,OAAO;IACP,QAAQ;CACT,CAAC;AAEF,MAAM,cAAc,GAA0B;IAC5C,SAAS;IACT,kBAAkB;IAClB,UAAU;CACX,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IACrD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAwB,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAyB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAwB;QAClC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;QAC7B,UAAU,EAAE,GAAG,CAAC,WAAyB;QACzC,WAAW,EAAE,GAAG,CAAC,YAAY,KAAK,CAAC;QACnC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC;QACxB,SAAS,EAAE,GAAG,CAAC,cAAc;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAmB;IACxD,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,EAAE;QACjB,aAAa,EAAE,GAAG,CAAC,gBAAgB;QACnC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,cAAc,EAAE,GAAG,CAAC,iBAAiB;QACrC,qBAAqB,EAAE,GAAG,CAAC,uBAAuB;QAClD,oBAAoB,EAAE,GAAG,CAAC,mBAAmB;KAC9C,CAAC;AACJ,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAqB,EACrB,YAAyC;IAEzC,OAAO,CACL,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACjC,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,UAAU,KAAK,SAAS;QAC9B,KAAK,CAAC,WAAW,CAClB,CAAC;AACJ,CAAC;AAoBD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,sBAAsB,CAAC;IACvC,YAAY,IAAsB;QAChC,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,GAAG,0BAA0B,CAAC;IAC3C,YAAY,IAAsB;QAChC,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAAY,IAAsB,EAAE,KAAa;QAC/C,KAAK,CAAC,mCAAmC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AA2DD,+IAA+I;AAC/I,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAI,GAAuB,CAAC,IAAI,CAAC;IAC3C,OAAO,IAAI,KAAK,0BAA0B,IAAI,IAAI,KAAK,mBAAmB,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACb,EAAE,CAAoB;IACtB,SAAS,CAAqB;IAC9B,eAAe,CAAoC;IACnD,iBAAiB,CAAyD;IAC1E,GAAG,CAAa;IAChB,cAAc,CAA0C;IACxD,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC9C,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACvE,8EAA8E;IACtE,kBAAkB,GAAyC,IAAI,CAAC;IAExE,YAAY,OAAmC;QAC7C,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,kEAAkE;QAClE,mEAAmE;QACnE,kBAAkB;QAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,QAAQ;YAC5B,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE;gBACT,IAAI,CAAC;oBACH,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,8DAA8D;gBAChE,CAAC;YACH,CAAC;YACH,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;IACtB,CAAC;IAED,YAAY;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,yDAAyD,CAAC;aAClE,GAAG,EAAsB,CAAC;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,kBAAkB;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,yDAAyD,CAAC;aAClE,GAAG,EAAsB,CAAC;QAC7B,OAAO,IAAI;aACR,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CACd,eAAe,CACb;YACE,IAAI,EAAE,GAAG,CAAC,IAAwB;YAClC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC;YACxB,UAAU,EAAE,GAAG,CAAC,WAAyB;YACzC,WAAW,EAAE,GAAG,CAAC,YAAY,KAAK,CAAC;SACpC,EACD,OAAO,CACR,CACF;aACA,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,0CAA0C,CAAC;aACnD,GAAG,CAAC,SAAS,CAA+B,CAAC;QAChD,OAAO,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,SAAS,CAAC,SAAiB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,0CAA0C,CAAC;aACnD,GAAG,CAAC,SAAS,CAA+B,CAAC;QAChD,OAAO,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,SAAiB;QAC9B,OAAO,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC3D,CAAC;IAEO,0BAA0B,CAAC,SAAiB;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrC,uEAAuE;QACvE,wEAAwE;QACxE,oEAAoE;QACpE,2EAA2E;QAC3E,oEAAoE;QACpE,wEAAwE;QACxE,2DAA2D;QAC3D,EAAE;QACF,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,OAAO,CAAC,2DAA2D,CAAC;aACpE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAA+B,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,EAAE,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAE9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,+DAA+D;YAC/D,4DAA4D;YAC5D,mCAAmC;YACnC,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;;;oEAI0D,CAC3D;iBACA,GAAG,CACF,EAAE,EACF,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,IAAI,IAAI,EACnB,KAAK,CAAC,QAAQ,EACd,QAAQ,EACR,KAAK,CAAC,mBAAmB,IAAI,GAAG,EAChC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACzB,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACnC,SAAS,EACT,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CACtE,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6FAA6F;YAC7F,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,0CAA0C,CAAC;aACnD,GAAG,CAAC,EAAE,CAAmB,CAAC;QAC7B,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;iBAChB,OAAO,CAAC,0CAA0C,CAAC;iBACnD,GAAG,CAAC,SAAS,CAA+B,CAAC;YAChD,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YAEvB,oEAAoE;YACpE,yDAAyD;YACzD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxD,IAAI,UAAU,EAAE,CAAC;gBACf,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;YAED,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,oDAAoD;gBACtD,CAAC;gBACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAED,IAAI,CAAC,EAAE;iBACJ,OAAO,CAAC,wCAAwC,CAAC;iBACjD,GAAG,CAAC,SAAS,CAAC,CAAC;YAClB,qEAAqE;YACrE,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,gBAAgB,EAAE,EAClD,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CACrB,SAAiB,EACjB,aAAqB,EACrB,YAAgC;QAEhC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;iBAChB,OAAO,CAAC,0CAA0C,CAAC;iBACnD,GAAG,CAAC,SAAS,CAA+B,CAAC;YAChD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,GAAG,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,8DAA8D,GAAG,CAAC,SAAS,GAAG,CAC/E,CAAC;YACJ,CAAC;YACD,qEAAqE;YACrE,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxD,IAAI,UAAU,EAAE,CAAC;gBACf,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;YACD,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;gBACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAEpE,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACzC,IAAI,CAAC,EAAE;qBACJ,OAAO,CACN;;;;;2BAKe,CAChB;qBACA,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClB,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAI,CAAC,EAAE;yBACJ,OAAO,CACN,kEAAkE,CACnE;yBACA,GAAG,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC,CAAC,CAAC;YACH,SAAS,EAAE,CAAC;YAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;iBACpB,OAAO,CAAC,0CAA0C,CAAC;iBACnD,GAAG,CAAC,SAAS,CAAmB,CAAC;YACpC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;YACjD,IAAI,CAAC,cAAc,CACjB,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,uBAAuB,CAC1D,CAAC;YACF,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,MAAe;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC1C,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,iEAAiE;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;iBACnB,OAAO,CAAC,+CAA+C,CAAC;iBACxD,GAAG,CAAC,SAAS,CAAmC,CAAC;YACpD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;iBACnB,OAAO,CAAC,kDAAkD,CAAC;iBAC3D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtC,sEAAsE;YACtE,sEAAsE;YACtE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,UAAU,EAAE,CAAC;oBACf,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACjD,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,6DAA6D;oBAC/D,CAAC;oBACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;iBAChB,OAAO,CAAC,0CAA0C,CAAC;iBACnD,GAAG,CAAC,SAAS,CAAmB,CAAC;YACpC,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB,CACd,SAAiB,EACjB,MAAkB,EAClB,SAAyB;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CAAC,oDAAoD,CAAC;aAC7D,GAAG,CAAC,SAAS,CAAwC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;;uBAEe,CAChB;aACA,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChI,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC;YACpD,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC;YACvC,IAAI,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,cAAc,CACZ,SAAiB,EACjB,OAA8D;QAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;iBACnB,OAAO,CACN;;;yBAGe,CAChB;iBACA,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1B,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;;;;uBAIe,CAChB;aACA,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,wBAAwB,CAAC,SAAiB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,gEAAgE,CAAC;aACzE,GAAG,CAAC,SAAS,CAAoD,CAAC;QACrE,OAAO,GAAG,EAAE,uBAAuB,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAChB,SAAiB,EACjB,YAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN,kEAAkE,CACnE;aACA,GAAG,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,+DAA+D,CAAC;aACxE,GAAG,CAAC,SAAS,CAA0D,CAAC;QAC3E,OAAO,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,IAAI,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,yDAAyD,CAAC;aAClE,GAAG,CAAC,SAAS,CAAoD,CAAC;QACrE,IAAI,CAAC,GAAG,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAe,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,MAAkB;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CAAC,4DAA4D,CAAC;aACrE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAiB;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAA2B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,8GAA8G;IAC9G,aAAa,CAAC,SAAiB;QAC7B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;OAQG;IACH,0BAA0B,CAAC,QAAqC;QAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,UAAU,EAAE,CAAC;oBACf,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GACX,IAAI,CAAC,kBAAkB,KAAK,IAAI;YAChC,IAAI,CAAC,kBAAkB,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;YAC7C,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,GAAW,EACX,EAAoB;QAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAM,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;gBACtC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,YAAY;IACnB,2EAA2E;IAC3E,2EAA2E;IAC3E,kDAAkD;IAClD,OAAO,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC"}

package/dist/services/mail/gmail/auth-failure-classifier.d.ts

@@ -0,0 +1,24 @@
+import type { AuthStatus } from "../provider.js";
+export type GmailClassifiedFailure = {
+    status: "healthy";
+} | {
+    status: "requires_consent";
+    reason: string;
+} | {
+    status: "degraded";
+    reason: string;
+} | {
+    status: "transient";
+    reason: string;
+};
+export interface GmailClassifyInput {
+    errorName?: string | null;
+    errorCode?: string | null;
+    message?: string | null;
+    httpStatus?: number | null;
+    reason?: string | null;
+}
+export declare const GMAIL_TRANSIENT_BACKOFF_THRESHOLD = 10;
+export declare function classifyGmailAuthFailure(input: GmailClassifyInput): GmailClassifiedFailure;
+export declare function effectiveGmailAuthStatus(classified: GmailClassifiedFailure, consecutiveErrorCount: number, threshold?: number): AuthStatus | null;
+//# sourceMappingURL=auth-failure-classifier.d.ts.map

package/dist/services/mail/gmail/auth-failure-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-failure-classifier.d.ts","sourceRoot":"","sources":["../../../../src/services/mail/gmail/auth-failure-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AA2BD,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAEpD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,GACxB,sBAAsB,CAyCxB;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,sBAAsB,EAClC,qBAAqB,EAAE,MAAM,EAC7B,SAAS,SAAoC,GAC5C,UAAU,GAAG,IAAI,CAKnB"}

package/dist/services/mail/gmail/auth-failure-classifier.js

@@ -0,0 +1,67 @@
+const RECONSENT_ERROR_CODES = new Set([
+    "invalid_grant",
+    "invalid_client",
+    "access_denied",
+    "unauthorized_client",
+]);
+const RECONSENT_REASONS = new Set([
+    "authError",
+    "invalidGrant",
+    "invalidCredentials",
+    "insufficientPermissions",
+]);
+const DEGRADED_REASONS = new Set(["domainPolicy"]);
+const RECONSENT_MESSAGE_PATTERNS = [
+    /invalid credentials/i,
+    /expired or revoked/i,
+    /token has been expired or revoked/i,
+    /invalid_grant/i,
+    /insufficient authentication scopes/i,
+    /reauthori[sz]/i,
+];
+export const GMAIL_TRANSIENT_BACKOFF_THRESHOLD = 10;
+export function classifyGmailAuthFailure(input) {
+    const reason = input.reason ?? null;
+    const message = input.message ?? "";
+    if ((input.errorCode && RECONSENT_ERROR_CODES.has(input.errorCode)) ||
+        (reason && RECONSENT_REASONS.has(reason)) ||
+        RECONSENT_MESSAGE_PATTERNS.some((pattern) => pattern.test(message)) ||
+        input.httpStatus === 401) {
+        return {
+            status: "requires_consent",
+            reason: input.errorCode ?? reason ?? input.errorName ?? "google_auth_failed",
+        };
+    }
+    if (input.httpStatus === 403) {
+        if (reason && DEGRADED_REASONS.has(reason)) {
+            return { status: "degraded", reason };
+        }
+        return {
+            status: "degraded",
+            reason: reason ?? input.errorCode ?? input.errorName ?? "forbidden",
+        };
+    }
+    if (input.httpStatus === 429) {
+        return { status: "transient", reason: reason ?? "rate_limited" };
+    }
+    if (input.httpStatus && input.httpStatus >= 500) {
+        return {
+            status: "transient",
+            reason: reason ?? `http_${input.httpStatus}`,
+        };
+    }
+    return {
+        status: "transient",
+        reason: input.errorCode ?? reason ?? input.errorName ?? "unknown",
+    };
+}
+export function effectiveGmailAuthStatus(classified, consecutiveErrorCount, threshold = GMAIL_TRANSIENT_BACKOFF_THRESHOLD) {
+    if (classified.status === "healthy")
+        return "healthy";
+    if (classified.status === "requires_consent")
+        return "requires_consent";
+    if (classified.status === "degraded")
+        return "degraded";
+    return consecutiveErrorCount > threshold ? "degraded" : null;
+}
+//# sourceMappingURL=auth-failure-classifier.js.map