@wjarka/cezarion 0.14.8 → 0.14.9-dev.1004

package/dist/runs/webhook.js

@@ -0,0 +1,256 @@
+import { randomUUID } from 'node:crypto';
+import { realpath } from 'node:fs/promises';
+import { join } from 'node:path';
+import { projectStatus } from '../task-cli/projections.js';
+import { loadWorkspaceConfig } from '../workspace/config.js';
+import { deriveRunContextEvents } from './event-history.js';
+export const WEBHOOK_TIMEOUT_MS = 10_000;
+export const WEBHOOK_ATTEMPTS = 3;
+/** Wait before attempt 2 and attempt 3. */
+export const WEBHOOK_BACKOFF_MS = [1_000, 4_000];
+/** One POST, no retries. Shared by the queue and `POST /projects/:id/webhook/test`. */
+export async function deliverOnce(target, payload, options = {}) {
+    try {
+        const response = await (options.fetch ?? fetch)(target.url, {
+            method: 'POST',
+            // A redirect would carry the Bearer token to a URL nobody configured.
+            redirect: 'error',
+            headers: {
+                'content-type': 'application/json',
+                'user-agent': 'cezar-task-webhook',
+                ...(target.token ? { authorization: `Bearer ${target.token}` } : {}),
+            },
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(options.timeoutMs ?? WEBHOOK_TIMEOUT_MS),
+        });
+        await response.body?.cancel().catch(() => undefined);
+        return response.ok
+            ? { ok: true, status: response.status }
+            : { ok: false, status: response.status, error: `HTTP ${response.status}` };
+    }
+    catch (error) {
+        const name = error instanceof Error ? error.name : '';
+        if (name === 'TimeoutError' || name === 'AbortError')
+            return { ok: false, error: 'timed out' };
+        const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : '';
+        return { ok: false, error: `${error instanceof Error ? error.message : String(error)}${cause}`.slice(0, 500) };
+    }
+}
+/** A 4xx other than 408/429 is the endpoint's answer, not a transient failure. */
+function retryable(result) {
+    if (result.status === undefined)
+        return true;
+    return result.status >= 500 || result.status === 408 || result.status === 429;
+}
+const seenOf = (run) => ({
+    status: run.status,
+    activity: run.activity ?? null,
+    ask: run.hasPendingHumanAsk === true,
+});
+export class TaskWebhook {
+    store;
+    options;
+    seen = new Map();
+    queues = new Map();
+    seqs = new Map();
+    onRun = (run) => this.observe(run);
+    onDeleted = (id) => this.seen.delete(id);
+    disposed = false;
+    constructor(store, options) {
+        this.store = store;
+        this.options = options;
+        // Seed from what the store already holds, so a context built after a restart does not
+        // report every existing run as a fresh transition.
+        for (const run of store.listRuns())
+            this.seen.set(run.id, seenOf(run));
+        store.on('run', this.onRun);
+        store.on('deleted', this.onDeleted);
+    }
+    dispose() {
+        this.disposed = true;
+        this.store.off('run', this.onRun);
+        this.store.off('deleted', this.onDeleted);
+    }
+    /** The hand-off delivery (`POST /runs/:id/notify` turning notify on). A run created with
+     *  `notify: true` gets the same delivery from `observe`. */
+    subscribed(runId, message) {
+        const run = this.store.getRun(runId);
+        if (!run)
+            return;
+        this.enqueue({ event: 'task.subscribed', run, previousStatus: null, occurredAt: new Date().toISOString(), message });
+    }
+    /** Resolves once every delivery queued so far has settled (tests, shutdown). */
+    async idle() {
+        while (this.queues.size > 0)
+            await Promise.all([...this.queues.values()]);
+    }
+    observe(run) {
+        const before = this.seen.get(run.id);
+        const now = seenOf(run);
+        this.seen.set(run.id, now);
+        if (!run.notify || this.disposed)
+            return;
+        const occurredAt = new Date().toISOString();
+        // A run created opted in (the New task toggle, `cez task start`) announces itself once, as
+        // `POST /runs/:id/notify` does, so the bot learns the id and link while the run is queued.
+        if (!before) {
+            this.enqueue({ event: 'task.subscribed', run, previousStatus: null, occurredAt });
+            return;
+        }
+        if (before.status !== now.status) {
+            this.enqueue({ event: 'task.status', run, previousStatus: before.status, occurredAt });
+        }
+        if (before.activity !== now.activity) {
+            this.enqueue({ event: 'task.activity', run, previousStatus: null, occurredAt });
+        }
+        if (!before.ask && now.ask) {
+            this.enqueue({ event: 'task.question', run, previousStatus: null, occurredAt });
+        }
+    }
+    enqueue(pending) {
+        const runId = pending.run.id;
+        // Snapshot now: the record object is live and will have moved on by the time this sends.
+        const snapshot = { ...pending, run: { ...pending.run } };
+        const previous = this.queues.get(runId) ?? Promise.resolve();
+        const next = previous
+            .then(() => this.deliver(snapshot))
+            .catch(() => undefined)
+            .finally(() => {
+            if (this.queues.get(runId) === next)
+                this.queues.delete(runId);
+        });
+        this.queues.set(runId, next);
+    }
+    async payload(pending, projectId) {
+        const { run } = pending;
+        const seq = (this.seqs.get(run.id) ?? 0) + 1;
+        this.seqs.set(run.id, seq);
+        const origin = this.options.origin() ?? '';
+        const url = `${origin}/p/${encodeURIComponent(projectId)}/tasks/${encodeURIComponent(run.id)}`;
+        const question = run.hasPendingHumanAsk ? await this.pendingQuestion(run.id) : undefined;
+        return {
+            event: pending.event,
+            deliveryId: randomUUID(),
+            seq,
+            projectId,
+            runId: run.id,
+            url,
+            status: run.status,
+            previousStatus: pending.previousStatus,
+            activity: run.activity ?? null,
+            occurredAt: pending.occurredAt,
+            ...(pending.message === undefined ? {} : { message: pending.message }),
+            // The same slim projection `cez task status` prints, so a bot parses one shape.
+            task: { ...projectStatus(run, url, question), notify: run.notify === true },
+        };
+    }
+    async pendingQuestion(runId) {
+        try {
+            const context = await deriveRunContextEvents(join(this.options.dataDir, 'runs', `${runId}.ndjson`));
+            return [...context.contextEvents].reverse().find((event) => event.type === 'ask.requested')?.questions;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async deliver(pending) {
+        await this.options.ready?.();
+        const project = await this.options.resolveProject().catch(() => undefined);
+        // Removed since the run opted in: nothing to send to, and nobody to tell.
+        if (!project?.webhook)
+            return;
+        const payload = await this.payload(pending, project.id);
+        const runId = pending.run.id;
+        if (this.options.dryRun ?? process.env.CEZ_DRY_RUN === '1') {
+            this.store.appendEvent(runId, { type: 'webhook.dry-run', event: payload.event, payload });
+            this.store.updateRun(runId, { webhook: { lastDeliveredAt: new Date().toISOString() } });
+            return;
+        }
+        const sleep = this.options.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+        let result = { ok: false, error: 'not attempted' };
+        let attempts = 0;
+        while (attempts < WEBHOOK_ATTEMPTS) {
+            if (attempts > 0)
+                await sleep(WEBHOOK_BACKOFF_MS[attempts - 1] ?? 0);
+            attempts += 1;
+            result = await deliverOnce(project.webhook, payload, {
+                fetch: this.options.fetch,
+                timeoutMs: this.options.timeoutMs,
+            });
+            if (result.ok || !retryable(result))
+                break;
+        }
+        const previous = this.store.getRun(runId)?.webhook;
+        if (result.ok) {
+            this.store.updateRun(runId, { webhook: { lastDeliveredAt: new Date().toISOString() } });
+            return;
+        }
+        const error = (result.error ?? 'delivery failed').slice(0, 500);
+        this.store.updateRun(runId, {
+            webhook: { ...(previous?.lastDeliveredAt ? { lastDeliveredAt: previous.lastDeliveredAt } : {}), lastError: error },
+        });
+        this.store.appendEvent(runId, {
+            type: 'webhook.failed',
+            event: payload.event,
+            deliveryId: payload.deliveryId,
+            attempts,
+            error,
+            ...(result.status === undefined ? {} : { status: result.status }),
+        });
+    }
+}
+/**
+ * Every project's `TaskWebhook`, keyed by store (#589). It exists so the subscriber can be
+ * attached BEFORE `manager.recover()`: recovery re-queues, resumes or fails the runs that were
+ * live when the last process exited, and a subscriber attached after it would seed those new
+ * statuses as the starting state and never report them. `index.ts` attaches the boot project
+ * right after opening its store; every lazily built project attaches through
+ * `ProjectContexts`' `prepareManager` hook, which runs before that project's recovery.
+ *
+ * Deliveries wait for `setOrigin`, which `startServer` calls once it knows its port.
+ */
+export class TaskWebhooks {
+    options;
+    hooks = new WeakMap();
+    origin;
+    markReady;
+    ready = new Promise((done) => { this.markReady = done; });
+    constructor(options = {}) {
+        this.options = options;
+        if (options.origin !== undefined)
+            this.setOrigin(options.origin);
+    }
+    setOrigin(origin) {
+        this.origin = origin;
+        this.markReady();
+    }
+    /** Idempotent: a store already attached keeps its subscriber and its queue. `id` may be the
+     *  reserved `default` alias, which resolves to the registry entry holding `root`. */
+    attach(project) {
+        const existing = this.hooks.get(project.store);
+        if (existing)
+            return existing;
+        const hook = new TaskWebhook(project.store, {
+            resolveProject: () => registryWebhook(project.id, project.root),
+            origin: () => this.origin,
+            ready: () => this.ready,
+            dataDir: join(project.root, '.ai/cezar'),
+            fetch: this.options.fetch,
+        });
+        this.hooks.set(project.store, hook);
+        return hook;
+    }
+    get(store) {
+        return this.hooks.get(store);
+    }
+}
+/** The registry entry this project is, read per delivery so a settings change applies at once. */
+async function registryWebhook(id, root) {
+    const projects = (await loadWorkspaceConfig()).projects;
+    const real = id === 'default' ? await realpath(root).catch(() => root) : root;
+    const entry = id === 'default'
+        ? projects.find((project) => project.root === real || project.root === root)
+        : projects.find((project) => project.id === id);
+    return entry ? { id: entry.id, ...(entry.webhook ? { webhook: entry.webhook } : {}) } : undefined;
+}
+//# sourceMappingURL=webhook.js.map

package/dist/runs/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/runs/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAkD5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAoBpE,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAyB,EACzB,OAAgB,EAChB,OAAO,GAAiD,EAAE;IAE1D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,sEAAsE;YACtE,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,oBAAoB;gBAClC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACrE,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,EAAE;YAChB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;YACvC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC/F,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACjH,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAAC,MAAsB;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;AAChF,CAAC;AAgBD,MAAM,MAAM,GAAG,CAAC,GAAc,EAAQ,EAAE,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;IAC9B,GAAG,EAAE,GAAG,CAAC,kBAAkB,KAAK,IAAI;CACrC,CAAC,CAAC;AAEH,MAAM,OAAO,WAAW;IASH,KAAK;IACL,OAAO;IATT,IAAI,GAAG,IAAI,GAAG,EAAgB,CAAC;IAC/B,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1C,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjC,KAAK,GAAG,CAAC,GAAc,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1D,QAAQ,GAAG,KAAK,CAAC;IAEzB,YACmB,KAAe,EACf,OAA2B;qBAD3B,KAAK;uBACL,OAAO;QAExB,sFAAsF;QACtF,mDAAmD;QACnD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED;gEAC4D;IAC5D,UAAU,CAAC,KAAa,EAAE,OAAgB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAEO,OAAO,CAAC,GAAc;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QACzC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,2FAA2F;QAC3F,2FAA2F;QAC3F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,OAAgB;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,yFAAyF;QACzF,MAAM,QAAQ,GAAY,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,QAAQ;aAClB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;aAClC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACtB,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAgB,EAAE,SAAiB;QACvD,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,MAAM,MAAM,kBAAkB,CAAC,SAAS,CAAC,UAAU,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/F,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,UAAU,EAAE;YACxB,GAAG;YACH,SAAS;YACT,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,GAAG;YACH,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YACtE,gFAAgF;YAChF,IAAI,EAAE,EAAE,GAAG,aAAa,CAAC,GAAwB,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE;SACjG,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAa;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC;YACpG,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,SAAS,CAAC;QACzG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAgB;QACpC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3E,0EAA0E;QAC1E,IAAI,CAAC,OAAO,EAAE,OAAO;YAAE,OAAO;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,EAAE,CAAC;YAC3D,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACxG,IAAI,MAAM,GAAmB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACnE,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,OAAO,QAAQ,GAAG,gBAAgB,EAAE,CAAC;YACnC,IAAI,QAAQ,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC,kBAAkB,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE;gBACnD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;aAClC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAAE,MAAM;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QACnD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE;YAC1B,OAAO,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;SACnH,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;YAC5B,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IAMM,OAAO;IALnB,KAAK,GAAG,IAAI,OAAO,EAAyB,CAAC;IACtD,MAAM,CAAqB;IAC3B,SAAS,CAAc;IACd,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjF,YAA6B,OAAO,GAA8C,EAAE;uBAAvD,OAAO;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAED;yFACqF;IACrF,MAAM,CAAC,OAAsD;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE;YAC1C,cAAc,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC;YAC/D,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM;YACzB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;YACxC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAe;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,kGAAkG;AAClG,KAAK,UAAU,eAAe,CAAC,EAAU,EAAE,IAAY;IACrD,MAAM,QAAQ,GAAG,CAAC,MAAM,mBAAmB,EAAE,CAAC,CAAC,QAAQ,CAAC;IACxD,MAAM,IAAI,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,MAAM,KAAK,GAAG,EAAE,KAAK,SAAS;QAC5B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;QAC5E,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC"}

package/dist/server/provider-auth-runtime.d.ts

@@ -1,6 +1,31 @@
-import { type ProviderAuthService, type ProviderStatus } from '../core/provider-auth.ts';
+import { type ProviderAuthService, type ProviderId, type ProviderStatus } from '../core/provider-auth.ts';
 import type { RunStore } from '../runs/store.ts';
-export declare function watchProviderRuntimeAuthFailures(store: RunStore, providerAuth: ProviderAuthService, onInvalidated: (status: ProviderStatus) => void): () => void;
+import { type RuntimeAuthVerificationTarget } from '../workspace/agent-profiles.ts';
+/** Where the self-check's probe is aimed. Injectable so tests can pin the account resolution;
+ *  the default reads `~/.cezar/agent-accounts.json` (see {@link resolveRuntimeAuthVerificationTarget}).
+ *  Resolving to `null` means "this incident cannot be checked" — the latch then stands. */
+export type RuntimeAuthProfileResolver = (provider: ProviderId, profileId: string | undefined) => Promise<RuntimeAuthVerificationTarget | null>;
+/**
+ * Watch a run store for the vendor errors that mean "your credentials were rejected", latch the
+ * provider, and — because the latch is only ever as good as the pattern match that raised it —
+ * immediately ask the provider's own CLI whether it was true.
+ *
+ * The self-check is aimed at the account the failing step actually ran under (`step.profileId`,
+ * falling back to the run's `agentProfile` for step-less errors): a named account can be rejected
+ * while the default login is fine, and verifying the default would clear the latch and let every
+ * future run on the broken account fail again. When the recorded account cannot be resolved at
+ * all, the incident stays latched — an unverifiable rejection is not a recovered one.
+ *
+ * `onProviderStatus` carries BOTH edges: the invalidation, and the recovery when the self-check
+ * finds the credentials were never gone. One callback rather than two on purpose — every caller
+ * wires it to the same `provider-status` fan-out, and the cockpit already folds a `connected` row
+ * over a latched one (`applyProviderStatusRow` drops the stale incident id), so recovery needs no
+ * new wiring at any of the observer's construction sites. The channel speaks DEFAULT rows (the
+ * cockpit's parser drops `profileId`), so a DEFAULT recovery publishes its verified row while a
+ * NAMED recovery publishes the provider's current cached default row — the account's own answer
+ * stays under the account, and a disconnected default is never shown connected.
+ */
+export declare function watchProviderRuntimeAuthFailures(store: RunStore, providerAuth: ProviderAuthService, onProviderStatus: (status: ProviderStatus) => void, resolveProfile?: RuntimeAuthProfileResolver): () => void;
 /**
  * Process-wide dedupe for store observation. The same boot store is wired
  * before recovery and again when the HTTP app is constructed; lazy stores are
@@ -9,9 +34,10 @@ export declare function watchProviderRuntimeAuthFailures(store: RunStore, provid
  */
 export declare class ProviderRuntimeAuthObserver {
     private readonly providerAuth;
-    private readonly onInvalidated;
+    private readonly onProviderStatus;
+    private readonly resolveProfile;
     private readonly watched;
-    constructor(providerAuth: ProviderAuthService, onInvalidated: (status: ProviderStatus) => void);
+    constructor(providerAuth: ProviderAuthService, onProviderStatus: (status: ProviderStatus) => void, resolveProfile?: RuntimeAuthProfileResolver);
     watch(store: RunStore): void;
 }
 /**

package/dist/server/provider-auth-runtime.js

@@ -1,6 +1,27 @@
 import { isRuntimeProviderAuthFailure, } from '../core/provider-auth.js';
+import { resolveRuntimeAuthVerificationTarget, } from '../workspace/agent-profiles.js';
 const AUTH_ERROR_EVENT_TYPES = new Set(['error', 'session.error', 'note']);
-export function watchProviderRuntimeAuthFailures(store, providerAuth, onInvalidated) {
+/**
+ * Watch a run store for the vendor errors that mean "your credentials were rejected", latch the
+ * provider, and — because the latch is only ever as good as the pattern match that raised it —
+ * immediately ask the provider's own CLI whether it was true.
+ *
+ * The self-check is aimed at the account the failing step actually ran under (`step.profileId`,
+ * falling back to the run's `agentProfile` for step-less errors): a named account can be rejected
+ * while the default login is fine, and verifying the default would clear the latch and let every
+ * future run on the broken account fail again. When the recorded account cannot be resolved at
+ * all, the incident stays latched — an unverifiable rejection is not a recovered one.
+ *
+ * `onProviderStatus` carries BOTH edges: the invalidation, and the recovery when the self-check
+ * finds the credentials were never gone. One callback rather than two on purpose — every caller
+ * wires it to the same `provider-status` fan-out, and the cockpit already folds a `connected` row
+ * over a latched one (`applyProviderStatusRow` drops the stale incident id), so recovery needs no
+ * new wiring at any of the observer's construction sites. The channel speaks DEFAULT rows (the
+ * cockpit's parser drops `profileId`), so a DEFAULT recovery publishes its verified row while a
+ * NAMED recovery publishes the provider's current cached default row — the account's own answer
+ * stays under the account, and a disconnected default is never shown connected.
+ */
+export function watchProviderRuntimeAuthFailures(store, providerAuth, onProviderStatus, resolveProfile = resolveRuntimeAuthVerificationTarget) {
     const onEvent = ({ runId, event }) => {
         if (!AUTH_ERROR_EVENT_TYPES.has(event.type))
             return;
@@ -14,11 +35,16 @@ export function watchProviderRuntimeAuthFailures(store, providerAuth, onInvalida
             ? run.steps.find(({ id }) => id === event.stepId)
             : undefined;
         const provider = step?.backend ?? run.runner ?? 'claude';
+        // The run-level profile belongs to the run's RUNNER: a mixed-backend step failing on another
+        // backend ran under THAT backend's own default login, and asking the resolver for the runner's
+        // profile under the wrong provider can only mis-answer the check or stall it unresolved.
+        const profileId = step?.profileId
+            ?? (provider === (run.runner ?? 'claude') ? run.agentProfile : undefined);
         const report = providerAuth.reportRuntimeAuthFailure(provider);
         if (!report)
             return;
         if (report.transitioned)
-            onInvalidated(report.status);
+            onProviderStatus(report.status);
         const duplicate = store.readEvents(runId).some((candidate) => candidate.type === 'provider-auth-required'
             && candidate.provider === provider
             && candidate.authFailureId === report.status.authFailureId);
@@ -30,6 +56,43 @@ export function watchProviderRuntimeAuthFailures(store, providerAuth, onInvalida
                 ...(event.stepId ? { stepId: event.stepId } : {}),
             });
         }
+        // The self-check rides the LATCH EDGE, not every matching line: the second and third auth-shaped
+        // error of one failing run describe the incident already standing, and re-asking the CLI about it
+        // would only spend spawns on an answer we have. The service's own cooldown backstops the case the
+        // edge cannot see — a rejection that re-latches right after a successful recovery.
+        if (!report.transitioned)
+            return;
+        // The check carries the incident's generation THROUGH the account-resolution wait: while the
+        // resolver is pending a newer failure can replace the incident, and an older question must
+        // then stand down rather than answer for it.
+        const observed = { generation: report.generation };
+        void (async () => {
+            const target = await resolveProfile(provider, profileId);
+            // An account we cannot name cannot be verified: leave the latch exactly as it stands and let
+            // Settings' Try again — which asks no such question — stay the way out.
+            if (!target)
+                return;
+            const recovered = target.kind === 'profile'
+                ? await providerAuth.verifyRuntimeAuthFailure(provider, {
+                    id: target.id,
+                    configDir: target.configDir,
+                }, observed)
+                : await providerAuth.verifyRuntimeAuthFailure(provider, undefined, observed);
+            if (!recovered)
+                return;
+            if (target.kind !== 'profile') {
+                onProviderStatus(recovered);
+                return;
+            }
+            // A NAMED recovery answers for one account, not for the provider's default login, and this
+            // channel carries default rows — the cockpit's parser drops `profileId`, so publishing the
+            // account row would mark a disconnected default connected. Publish the provider's CURRENT
+            // default row (cache only, no spawn) so observers see the latch lift with the default's own
+            // answer; with nothing cached there is no default row to reconcile on this channel.
+            const defaultRow = providerAuth.peekStatus()?.providers.find(({ provider: id }) => id === provider);
+            if (defaultRow)
+                onProviderStatus(defaultRow);
+        })().catch(() => { });
     };
     store.on('event', onEvent);
     return () => store.off('event', onEvent);
@@ -42,17 +105,19 @@ export function watchProviderRuntimeAuthFailures(store, providerAuth, onInvalida
  */
 export class ProviderRuntimeAuthObserver {
     providerAuth;
-    onInvalidated;
+    onProviderStatus;
+    resolveProfile;
     watched = new WeakSet();
-    constructor(providerAuth, onInvalidated) {
+    constructor(providerAuth, onProviderStatus, resolveProfile = resolveRuntimeAuthVerificationTarget) {
         this.providerAuth = providerAuth;
-        this.onInvalidated = onInvalidated;
+        this.onProviderStatus = onProviderStatus;
+        this.resolveProfile = resolveProfile;
     }
     watch(store) {
         if (this.watched.has(store))
             return;
         this.watched.add(store);
-        watchProviderRuntimeAuthFailures(store, this.providerAuth, this.onInvalidated);
+        watchProviderRuntimeAuthFailures(store, this.providerAuth, this.onProviderStatus, this.resolveProfile);
     }
 }
 /**

package/dist/server/provider-auth-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-auth-runtime.js","sourceRoot":"","sources":["../../src/server/provider-auth-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,GAI7B,MAAM,0BAA0B,CAAC;AAGlC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AAE3E,MAAM,UAAU,gCAAgC,CAC9C,KAAe,EACf,YAAiC,EACjC,aAA+C;IAE/C,MAAM,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAsC,EAAQ,EAAE;QAC7E,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC;YAAE,OAAO;QAElF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;YAC3C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC;YACjD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,QAAQ,GAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;QACrE,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,MAAM,CAAC,YAAY;YAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEtD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3D,SAAS,CAAC,IAAI,KAAK,wBAAwB;eACxC,SAAS,CAAC,QAAQ,KAAK,QAAQ;eAC/B,SAAS,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;gBACvB,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ;gBACR,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;gBAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IAInB,YAAY;IACZ,aAAa;IAJf,OAAO,GAAG,IAAI,OAAO,EAAY,CAAC;IAEnD,YACmB,YAAiC,EACjC,aAA+C;4BAD/C,YAAY;6BACZ,aAAa;IAC7B,CAAC;IAEJ,KAAK,CAAC,KAAe;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACjF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAe,EACf,OAA4B,EAC5B,QAAqC;IAErC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtB,MAAM,OAAO,EAAE,CAAC;AAClB,CAAC"}
+{"version":3,"file":"provider-auth-runtime.js","sourceRoot":"","sources":["../../src/server/provider-auth-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,GAI7B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oCAAoC,GAErC,MAAM,gCAAgC,CAAC;AAExC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AAU3E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAAe,EACf,YAAiC,EACjC,gBAAkD,EAClD,cAAc,GAA+B,oCAAoC;IAEjF,MAAM,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAsC,EAAQ,EAAE;QAC7E,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC;YAAE,OAAO;QAElF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;YAC3C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC;YACjD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,QAAQ,GAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;QACrE,6FAA6F;QAC7F,+FAA+F;QAC/F,yFAAyF;QACzF,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS;eAC5B,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,MAAM,CAAC,YAAY;YAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3D,SAAS,CAAC,IAAI,KAAK,wBAAwB;eACxC,SAAS,CAAC,QAAQ,KAAK,QAAQ;eAC/B,SAAS,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;gBACvB,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ;gBACR,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa;gBAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAED,iGAAiG;QACjG,kGAAkG;QAClG,kGAAkG;QAClG,mFAAmF;QACnF,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO;QACjC,6FAA6F;QAC7F,2FAA2F;QAC3F,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QACnD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACzD,6FAA6F;YAC7F,wEAAwE;YACxE,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS;gBACzC,CAAC,CAAC,MAAM,YAAY,CAAC,wBAAwB,CAAC,QAAQ,EAAE;oBACtD,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,EAAE,QAAQ,CAAC;gBACZ,CAAC,CAAC,MAAM,YAAY,CAAC,wBAAwB,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,2FAA2F;YAC3F,2FAA2F;YAC3F,0FAA0F;YAC1F,4FAA4F;YAC5F,oFAAoF;YACpF,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;YACpG,IAAI,UAAU;gBAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IAInB,YAAY;IACZ,gBAAgB;IAChB,cAAc;IALhB,OAAO,GAAG,IAAI,OAAO,EAAY,CAAC;IAEnD,YACmB,YAAiC,EACjC,gBAAkD,EAClD,cAAc,GAA+B,oCAAoC;4BAFjF,YAAY;gCACZ,gBAAgB;8BAChB,cAAc;IAC9B,CAAC;IAEJ,KAAK,CAAC,KAAe;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACzG,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,KAAe,EACf,OAA4B,EAC5B,QAAqC;IAErC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtB,MAAM,OAAO,EAAE,CAAC;AAClB,CAAC"}