@gitkraken/core-gitlens 0.4.101 → 0.5.100

package/src/plus/integrations/authentication/integrationAuthenticationProvider.ts

@@ -32,6 +32,38 @@ export interface IntegrationAuthenticationSessionDescriptor {
 	[key: string]: unknown;
 }
 
+/**
+ * Options for {@link IntegrationAuthenticationProvider.getSession}. The two variants keep `sync` exclusive
+ * with the interactive flags: a sync resolves whatever the cloud already has, so it must never open a connect
+ * window.
+ *
+ * `refreshRejectedToken` marks the stored token as known-refused by the provider (an `AuthenticationError` on
+ * a previous read), which forces a cloud `/refresh` even when the token's expiry still claims it is valid —
+ * the case a purely time-based refresh cannot see. The refresh token itself never reaches the client: the GK
+ * cloud performs the exchange server-side.
+ */
+export type GetSessionOptions =
+	| {
+			createIfNeeded?: boolean;
+			forceNewSession?: boolean;
+			sync?: never;
+			refreshRejectedToken?: boolean;
+			source?: Sources;
+	  }
+	| {
+			createIfNeeded?: never;
+			forceNewSession?: never;
+			sync: boolean;
+			refreshRejectedToken?: boolean;
+			source?: Sources;
+	  };
+
+/**
+ * What {@link IntegrationAuthenticationProviderBase.getSession} passes down once it has decided the stored
+ * session can't be served as-is. `refreshIfExpired` is its own conclusion, not a caller's option.
+ */
+type GetNewSessionOptions = GetSessionOptions & { refreshIfExpired?: boolean };
+
 export interface IntegrationAuthenticationProvider extends Disposable {
 	/**
 	 * Clears the stored secret for one connection only (never the whole provider). Unlike
@@ -46,11 +78,13 @@ export interface IntegrationAuthenticationProvider extends Disposable {
 		options?: { preserveConfigured?: boolean },
 	): Promise<void>;
 	deleteAllSessions(descriptor?: IntegrationAuthenticationSessionDescriptor): Promise<void>;
+	/**
+	 * Resolves the session for `descriptor`, from storage when it is still usable and from the cloud
+	 * otherwise. See {@link GetSessionOptions}.
+	 */
 	getSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
-		options?:
-			| { createIfNeeded?: boolean; forceNewSession?: boolean; sync?: never; source?: Sources }
-			| { createIfNeeded?: never; forceNewSession?: never; sync: boolean; source?: Sources },
+		options?: GetSessionOptions,
 	): Promise<ProviderAuthenticationSession | undefined>;
 	get onDidChange(): Event<void>;
 }
@@ -120,9 +154,7 @@ abstract class IntegrationAuthenticationProviderBase<
 	@trace()
 	async getSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
-		options?:
-			| { createIfNeeded?: boolean; forceNewSession?: boolean; sync?: never; source?: Sources }
-			| { createIfNeeded?: never; forceNewSession?: never; sync: boolean; source?: Sources },
+		options?: GetSessionOptions,
 	): Promise<ProviderAuthenticationSession | undefined> {
 		let session;
 		let previousToken;
@@ -143,10 +175,15 @@ abstract class IntegrationAuthenticationProviderBase<
 		}
 
 		const isExpiredSession = session?.expiresAt != null && new Date(session.expiresAt).getTime() < Date.now();
-		if (session == null || isExpiredSession) {
+		// A rejected token has to re-resolve even when the stored session looks perfectly healthy: that is
+		// the whole point — the provider refused it while its expiry still says valid. Without this the
+		// stored session short-circuits here and the refresh below is never reached.
+		const refreshRejectedToken = options?.refreshRejectedToken === true && session != null;
+		if (session == null || isExpiredSession || refreshRejectedToken) {
 			session = await this.getNewSession(descriptor, {
 				...options,
 				refreshIfExpired: isExpiredSession,
+				refreshRejectedToken: refreshRejectedToken,
 			});
 
 			if (session != null) {
@@ -163,21 +200,7 @@ abstract class IntegrationAuthenticationProviderBase<
 
 	protected abstract getNewSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
-		options?:
-			| {
-					createIfNeeded?: boolean;
-					forceNewSession?: boolean;
-					sync?: never;
-					refreshIfExpired?: boolean;
-					source?: Sources;
-			  }
-			| {
-					createIfNeeded?: never;
-					forceNewSession?: never;
-					sync: boolean;
-					refreshIfExpired?: boolean;
-					source?: Sources;
-			  },
+		options?: GetNewSessionOptions,
 	): Promise<ProviderAuthenticationSession | undefined>;
 
 	protected fireChange(): void {
@@ -202,21 +225,7 @@ export class CloudIntegrationAuthenticationProvider<
 
 	protected override async getNewSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
-		options?:
-			| {
-					createIfNeeded?: boolean;
-					forceNewSession?: boolean;
-					sync?: never;
-					refreshIfExpired?: boolean;
-					source?: Sources;
-			  }
-			| {
-					createIfNeeded?: never;
-					forceNewSession?: never;
-					sync: boolean;
-					refreshIfExpired?: boolean;
-					source?: Sources;
-			  },
+		options?: GetNewSessionOptions,
 	): Promise<ProviderAuthenticationSession | undefined> {
 		if (options?.forceNewSession) {
 			if ((await this.disconnectCloudSession()) === 'failure') {
@@ -230,9 +239,15 @@ export class CloudIntegrationAuthenticationProvider<
 		// TODO: This is a stopgap to make sure we're not hammering the api on automatic calls to get the session.
 		// Ultimately we want to timestamp calls to syncCloudIntegrations and use that to determine whether we should
 		// make the call or not.
+		// `refreshRejectedToken` joins the list for the same reason `refreshIfExpired` is on it: both mean the
+		// session in hand is known-unusable, so skipping the cloud round trip would just re-serve it.
 		let session =
-			options?.refreshIfExpired || options?.createIfNeeded || options?.forceNewSession || options?.sync
-				? await this.getCloudSession(descriptor)
+			options?.refreshIfExpired ||
+			options?.refreshRejectedToken ||
+			options?.createIfNeeded ||
+			options?.forceNewSession ||
+			options?.sync
+				? await this.getCloudSession(descriptor, { refreshRejectedToken: options?.refreshRejectedToken })
 				: undefined;
 
 		const shouldCreateSession = options?.createIfNeeded && session == null;
@@ -269,6 +284,7 @@ export class CloudIntegrationAuthenticationProvider<
 
 	private async getCloudSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
+		options?: { refreshRejectedToken?: boolean },
 	): Promise<ProviderAuthenticationSession | undefined> {
 		const loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;
 		if (!loggedIn) return undefined;
@@ -304,7 +320,13 @@ export class CloudIntegrationAuthenticationProvider<
 			session.expiresIn = maxSmallIntegerV8; // maximum expiration length
 		}
 
-		if (session != null && session.expiresIn < 60) {
+		// `expiresIn < 60` is a PREDICTION that the token is about to lapse, and it is the only trigger the
+		// refresh used to have. It cannot see a token the provider has already refused while the backend
+		// still believes it is valid — a revoked grant, retired scopes, an app removed from the org — where
+		// `expiresIn` stays high and the doomed token is re-sent on every read. `refreshRejectedToken` is
+		// the observed counterpart: the caller saw the provider reject this exact token, so refresh it
+		// regardless of what its expiry claims.
+		if (session != null && (session.expiresIn < 60 || options?.refreshRejectedToken)) {
 			session = await cloudIntegrations.getConnectionSession(
 				this.authProviderId,
 				session.accessToken,

package/src/plus/integrations/authentication/rejectedTokenTracker.ts

@@ -0,0 +1,56 @@
+/**
+ * Per-connection recovery state for a cloud token the provider REFUSED — a revoked grant, retired scopes, an
+ * app removed from the org. A purely predictive refresh (`expiresIn < 60`) cannot see that case, because the
+ * backend still believes the token is valid, so without this the refused token is re-sent on every read and
+ * the failure only clears when the user reconnects by hand.
+ *
+ * One recovery refresh per connection, then the connection is the failure budget's problem:
+ * - {@link recordRejection} on an `AuthenticationError` — arms the refresh, or reports that the rejection is
+ *   not recoverable so the caller counts it as a real failure instead.
+ * - {@link claimRefresh} before the next read resolves its session — spends the rejection, so the refresh
+ *   fires once and no further read of that connection asks the cloud again.
+ *
+ * Deliberately NOT re-armed when the refresh hands back a different token. The GK cloud mints a new access
+ * token on every `/refresh`, so a credential the provider refuses for a reason a refresh cannot fix (retired
+ * scopes being the plain case) would look "rotated" on each attempt: re-arming on that would refresh on every
+ * read forever and the failure budget — the thing that disconnects and prompts a reconnect — would never
+ * advance. What resets this instead is {@link clear}, called by every path that replaces or removes the stored
+ * tokens; a connection that is simply working never reaches here at all.
+ */
+export class RejectedTokenTracker {
+	private readonly _rejections = new Map<string, 'armed' | 'spent'>();
+
+	/**
+	 * Whether a read of `connectionId` must force the cloud refresh of a token known to be refused, spending
+	 * the rejection so the refresh runs at most once. Spent here rather than after the read because a resolve
+	 * that throws must not leave the refresh armed and ask the cloud again on the next read.
+	 */
+	claimRefresh(connectionId: string): boolean {
+		if (this._rejections.get(connectionId) !== 'armed') return false;
+
+		this._rejections.set(connectionId, 'spent');
+		return true;
+	}
+
+	/**
+	 * Arms the recovery refresh for `connectionId`. Returns `false` once this connection has had its refresh
+	 * (or already has one pending), so the caller falls back to its own failure handling: a token still
+	 * refused after the refresh is not self-healing, and only the failure budget ends in a reconnect prompt.
+	 */
+	recordRejection(connectionId: string): boolean {
+		if (this._rejections.has(connectionId)) return false;
+
+		this._rejections.set(connectionId, 'armed');
+		return true;
+	}
+
+	/** Drops all state, for when the stored tokens a rejection could name are replaced or gone. */
+	clear(): void {
+		this._rejections.clear();
+	}
+
+	/** Whether any connection is holding a rejection. For assertions; the read path uses {@link claimRefresh}. */
+	get empty(): boolean {
+		return this._rejections.size === 0;
+	}
+}

package/src/plus/integrations/models/gitHostIntegration.ts

@@ -373,7 +373,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getOrganizationsForUser');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getOrganizationsForUser', ex, { scope: scope });
+			this.handleProviderException('getOrganizationsForUser', ex, {
+				scope: scope,
+				connectionId: connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -409,7 +412,7 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getProjectsForOrg');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getProjectsForOrg', ex, { scope: scope });
+			this.handleProviderException('getProjectsForOrg', ex, { scope: scope, connectionId: connectionId });
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -446,7 +449,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getRepositoriesForOrg');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getRepositoriesForOrg', ex, { scope: scope });
+			this.handleProviderException('getRepositoriesForOrg', ex, {
+				scope: scope,
+				connectionId: options?.connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -484,7 +490,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getRepositoriesForUser');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getRepositoriesForUser', ex, { scope: scope });
+			this.handleProviderException('getRepositoriesForUser', ex, {
+				scope: scope,
+				connectionId: options?.connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -1414,6 +1423,7 @@ export abstract class GitHostIntegration<
 			this.handleProviderException('searchMyPullRequests', ex, {
 				scope: scope,
 				silent: true,
+				connectionId: connectionId,
 			});
 			return {
 				error: toError(ex),
@@ -1456,7 +1466,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getMyPullRequestsForUser');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getMyPullRequestsForUser', ex, { scope: scope });
+			this.handleProviderException('getMyPullRequestsForUser', ex, {
+				scope: scope,
+				connectionId: connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -1588,7 +1601,7 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('searchPullRequests');
 			return prs;
 		} catch (ex) {
-			this.handleProviderException('searchPullRequests', ex, { scope: scope });
+			this.handleProviderException('searchPullRequests', ex, { scope: scope, connectionId: connectionId });
 			return undefined;
 		}
 	}

package/src/plus/integrations/models/integration.ts

@@ -20,6 +20,7 @@ import type {
 } from '../authentication/integrationAuthenticationProvider.js';
 import type { IntegrationAuthenticationService } from '../authentication/integrationAuthenticationService.js';
 import type { ProviderAuthenticationSession } from '../authentication/models.js';
+import { RejectedTokenTracker } from '../authentication/rejectedTokenTracker.js';
 import type { IntegrationIds, IssuesCloudHostIntegrationId } from '../constants.js';
 import { GitCloudHostIntegrationId } from '../constants.js';
 import type { IntegrationServiceContext } from '../context.js';
@@ -240,13 +241,18 @@ export abstract class IntegrationBase<
 		// A truthy connectionId targets a specific account; an empty string is not a real target, so it falls
 		// through to the primary path below.
 		if (connectionId) {
+			// A read of this connection previously failed with an AuthenticationError, so the token in
+			// storage is known-refused. Ask for a refresh through the GK cloud before reading again, which
+			// is this branch's equivalent of the primary path's `refreshSessionIfExpired`. Claimed here so
+			// the forced refresh runs at most once per rejection.
+			const refreshRejectedToken = this._rejectedTokens.claimRefresh(connectionId);
 			// Degrade to "no results" on failure, matching the primary path (whose ensureSession/
 			// refreshSessionIfExpired swallow errors) so read methods keep their never-throws contract.
 			try {
 				const authProvider = await this.authenticationService.get(this.authProvider.id);
 				const session = await authProvider.getSession(
 					{ ...this.authProviderDescriptor, connectionId: connectionId, cloud: true },
-					{ source: source },
+					{ source: source, refreshRejectedToken: refreshRejectedToken },
 				);
 				return session != null && this.isSessionForIntegrationHost(session) ? session : undefined;
 			} catch (ex) {
@@ -326,6 +332,10 @@ export abstract class IntegrationBase<
 
 	@debug()
 	async reauthenticate(): Promise<void> {
+		// `forceNewSession` below deletes the stored secrets to reconnect. Ahead of the guard — see
+		// `onStoredTokensReplaced`.
+		this.onStoredTokensReplaced();
+
 		if (this._session === undefined) return;
 
 		this._session = undefined;
@@ -343,6 +353,30 @@ export abstract class IntegrationBase<
 	requestSessionSyncForUsecase(syncReqUsecase: SyncReqUsecase): void {
 		this._syncRequestsPerFailedUsecase.add(syncReqUsecase);
 	}
+
+	/**
+	 * The per-connection counterpart of the primary session's expire-and-resync recovery: a token the
+	 * provider refused is refreshed once through the GK cloud, which exchanges the refresh token server-side
+	 * (the client never holds one). Armed by {@link handleProviderException} and consumed by
+	 * {@link resolveReadSession}; a rejection it declines belongs to {@link trackRequestException} instead.
+	 */
+	private readonly _rejectedTokens = new RejectedTokenTracker();
+
+	/**
+	 * Called by every path that replaces or removes the stored tokens — a disconnect, a forced re-sync, a
+	 * reauthentication, or the connection set changing. A rejection names a specific credential, so once that
+	 * credential is gone the rejection describes nothing and must not force a refresh (or, for a deleted
+	 * connection, outlive it).
+	 *
+	 * Deliberately NOT conditioned on `_session`. A per-connection read resolves through the auth provider and
+	 * never populates the cached primary session, so the connections this recovery exists for are exactly the
+	 * ones with no `_session` to inspect — the same blind spot the recovery itself was added to fix. Callers
+	 * that guard on `_session` therefore invoke this ahead of that guard.
+	 */
+	protected onStoredTokensReplaced(): void {
+		this._rejectedTokens.clear();
+	}
+
 	private static readonly requestExceptionLimit = 5;
 	private requestExceptionCount = 0;
 
@@ -350,6 +384,8 @@ export abstract class IntegrationBase<
 		this.requestExceptionCount = 0;
 		if (syncReqUsecase === 'all') {
 			this._syncRequestsPerFailedUsecase.clear();
+			// 'all' is the whole-integration reset: a disconnect, or a re-sync that produced a new access token.
+			this.onStoredTokensReplaced();
 		} else {
 			this._syncRequestsPerFailedUsecase.delete(syncReqUsecase);
 		}
@@ -374,6 +410,10 @@ export abstract class IntegrationBase<
 	 * `deleteConnection`). Unlike {@link reset}/{@link disconnect}, it deletes nothing from storage.
 	 */
 	switchConnection(): void {
+		// A connection was deleted, or a different one became primary. Ahead of the guard — see
+		// `onStoredTokensReplaced`.
+		this.onStoredTokensReplaced();
+
 		if (this._session === undefined) return;
 
 		const wasConnected = this._session != null;
@@ -419,6 +459,9 @@ export abstract class IntegrationBase<
 					// Reset our stored session so that we get a new one from the cloud
 					const authProvider = await this.authenticationService.get(this.authProvider.id);
 					await authProvider.deleteSession(this.authProviderDescriptor);
+					// The stored token was just deleted. Not left to the token-changed check below, which needs
+					// an `oldSession` — see `onStoredTokensReplaced`.
+					this.onStoredTokensReplaced();
 					// Reset the session and clear our "stay disconnected" flag
 					this._session = undefined;
 					await this.ctx.storage.deleteWorkspace(this.connectedKey);
@@ -474,12 +517,29 @@ export abstract class IntegrationBase<
 	protected handleProviderException(
 		syncReqUsecase: SyncReqUsecase,
 		ex: Error,
-		options?: { scope?: ScopedLogger | undefined; silent?: boolean },
+		options?: { scope?: ScopedLogger | undefined; silent?: boolean; connectionId?: string },
 	): void {
 		if (isCancellationError(ex)) return;
 
 		options?.scope?.error(ex);
 
+		// A per-connection (multi-account) read resolved its session through `resolveReadSession`'s
+		// `connectionId` branch, which deliberately never touches the cached primary `_session`. So the
+		// primary-session recovery below cannot apply to it: expiring `_session` would mark a session this
+		// read never used, while the rejected connection kept its stored token and re-sent it on every
+		// later read — a token the provider has already refused (expired scopes, a revoked grant, an
+		// uninstalled app) is not self-healing, so the read failed identically until the user reconnected
+		// by hand. Record the rejection against the connection instead; `resolveReadSession` consumes it
+		// and forces the cloud `/refresh` on the next read of that connection. When there is nothing to
+		// recover, fall through to the shared failure budget, which disconnects after
+		// `requestExceptionLimit` and surfaces the reconnect prompt.
+		if (ex instanceof AuthenticationError && options?.connectionId) {
+			if (!this._rejectedTokens.recordRejection(options.connectionId)) {
+				this.trackRequestException(options);
+			}
+			return;
+		}
+
 		if (ex instanceof AuthenticationError && this._session?.cloud) {
 			if (!this.hasSessionSyncRequests()) {
 				this.requestSessionSyncForUsecase(syncReqUsecase);
@@ -686,7 +746,7 @@ export abstract class IntegrationBase<
 			this.resetRequestExceptionCount('searchMyIssues');
 			return { value: issues };
 		} catch (ex) {
-			this.handleProviderException('searchMyIssues', ex, { scope: scope });
+			this.handleProviderException('searchMyIssues', ex, { scope: scope, connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -738,7 +798,7 @@ export abstract class IntegrationBase<
 			this.resetRequestExceptionCount('searchMyIssues');
 			return { value: result };
 		} catch (ex) {
-			this.handleProviderException('searchMyIssues', ex, { scope: scope });
+			this.handleProviderException('searchMyIssues', ex, { scope: scope, connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -858,7 +918,10 @@ export abstract class IntegrationBase<
 							return undefined;
 						}
 
-						this.handleProviderException('getCurrentAccount', ex, { scope: scope });
+						this.handleProviderException('getCurrentAccount', ex, {
+							scope: scope,
+							connectionId: connectionId,
+						});
 
 						// Invalidate the cache on error, except for auth errors
 						if (!(ex instanceof AuthenticationError)) {

package/src/plus/integrations/models/issuesIntegration.ts

@@ -48,7 +48,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getAccountForResource');
 			return { value: account };
 		} catch (ex) {
-			this.handleProviderException('getAccountForResource', ex);
+			this.handleProviderException('getAccountForResource', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -80,7 +80,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getResourcesForUser');
 			return { value: resources };
 		} catch (ex) {
-			this.handleProviderException('getResourcesForUser', ex);
+			this.handleProviderException('getResourcesForUser', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -108,7 +108,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getProjectsForResources');
 			return { value: projects };
 		} catch (ex) {
-			this.handleProviderException('getProjectsForResources', ex);
+			this.handleProviderException('getProjectsForResources', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -161,7 +161,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getIssuesForProject');
 			return { value: issues };
 		} catch (ex) {
-			this.handleProviderException('getIssuesForProject', ex);
+			this.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -188,7 +188,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getIssuesForProject');
 			return { value: result };
 		} catch (ex) {
-			this.handleProviderException('getIssuesForProject', ex);
+			this.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}

package/src/utils/date.ts

@@ -149,9 +149,12 @@ export function unitThresholdMs(unit: Intl.RelativeTimeFormatUnit): number {
 
 // fromNow keeps its OWN single-pass loop (not routed through fromNowUnit) — one iteration, no
 // intermediate {unit,value} object allocation on this hot formatting path; fromNowUnit below iterates
-// the SAME `relativeUnitThresholds` array, so the two classifications can't drift apart.
-export function fromNow(date: Date | number, short?: boolean): string {
-	const elapsed = (typeof date === 'number' ? date : date.getTime()) - Date.now();
+// the SAME `relativeUnitThresholds` array, so the two classifications can't drift apart. `now` defaults
+// to `Date.now()`, like fromNowUnit's — pass it to pin the instant (a caller comparing against its own
+// clock read otherwise sits one unpredictable tick away from the bucket it expects).
+export function fromNow(date: Date | number, short?: boolean, now: Date | number = Date.now()): string {
+	const elapsed =
+		(typeof date === 'number' ? date : date.getTime()) - (typeof now === 'number' ? now : now.getTime());
 	// Guard against invalid dates (e.g. `new Date(<unparseable>)`), since a non-finite value would throw in `Intl.RelativeTimeFormat.format`
 	if (!Number.isFinite(elapsed)) return '';