@zackbart/connecta 0.5.0 → 0.6.0

package/dist/credential-health.js

@@ -0,0 +1,535 @@
+// Proactive liveness checks for the credentials connecta itself stores —
+// downstream-OAuth tokens and operator-managed vault credentials (issue #24).
+//
+// The problem this solves: a connector's auth state used to flip only when
+// something *observed* a failure, so an expired or revoked token surfaced
+// mid-task as a failed agent call. A liveness check asks the connector whether
+// the credential it holds still works, records the verdict, and lets the cached
+// status surfaces (`list_connectors({ probe: false })`, `/ui`) report
+// `auth_required` BEFORE a real call discovers it.
+//
+// Runtime-agnostic on purpose: nothing here schedules itself. The core exposes a
+// due-gated sweep (piggybacked on inbound traffic by the server) and an awaited
+// entry point (`Connecta.checkCredentials()`) an operator wires to whatever
+// scheduler their runtime has — a Worker cron trigger, a Node `setInterval`.
+// There is no background daemon and no long-lived timer, so Workers and Node run
+// the same code.
+import { DEFAULT_PROBE_TIMEOUT_MS, normalizeTimeoutMs, withTimeout } from "./timeout.js";
+export const DEFAULT_CREDENTIAL_CHECK_INTERVAL_SECONDS = 900;
+export const DEFAULT_CREDENTIAL_CHECK_CONCURRENCY = 4;
+/**
+ * How long a read of one connector's record is served from memory before going
+ * back to storage. Short: it exists so a burst of `list_connectors` calls costs
+ * one storage read rather than one per call, not to cache a verdict.
+ */
+const MIRROR_TTL_MS = 5_000;
+/**
+ * Minimum gap between storage WRITES of an unchanged verdict. A liveness
+ * observation arrives from more than one place (the sweep, and every
+ * `list_connectors({ probe: true })`), and re-persisting "still ok" on each one
+ * would spend a KV write per probe for no new information. A verdict whose state
+ * or message CHANGED is always written immediately.
+ */
+const MIN_WRITE_GAP_MS = 60_000;
+function msg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function storageKey(connectorId) {
+    return `credhealth:${connectorId}`;
+}
+/**
+ * Generation counter key. Connector ids are `[a-z0-9_-]+`, so the extra colon
+ * puts this outside the space `storageKey` can produce — no id can collide with
+ * another id's counter.
+ */
+function generationKey(connectorId) {
+    return `credhealth:gen:${connectorId}`;
+}
+function validRecord(raw) {
+    if (!raw)
+        return null;
+    try {
+        const value = JSON.parse(raw);
+        if ((value.state !== "ok" &&
+            value.state !== "auth_required" &&
+            value.state !== "error") ||
+            typeof value.checkedAt !== "string" ||
+            Number.isNaN(Date.parse(value.checkedAt))) {
+            return null;
+        }
+        const stamped = Date.parse(value.checkedAt);
+        const now = Date.now();
+        return {
+            state: value.state,
+            // A verdict from the future is a clock-skewed isolate, and left alone it
+            // would be permanently fresh (never re-checked) AND permanently newer than
+            // any real-call success (never retired) — a wrong answer that cannot age
+            // out. Clamping to now costs at most one early re-check.
+            checkedAt: stamped > now ? new Date(now).toISOString() : value.checkedAt,
+            ...(typeof value.message === "string" ? { message: value.message } : {}),
+            ...(typeof value.authorizationUrl === "string"
+                ? { authorizationUrl: value.authorizationUrl }
+                : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The stored verdicts, in the deployment's own KVStorage under
+ * `credhealth:<connectorId>`.
+ *
+ * Persisted rather than held in memory because the two runtimes disagree about
+ * what "in memory" means: a Cloudflare cron trigger runs in a different isolate
+ * from the fetch handlers, so a verdict only reaches `list_connectors` if it
+ * goes through storage. The in-memory mirror is a read cache over that, not the
+ * source of truth.
+ *
+ * Never throws: a check that cannot be persisted (or read back) must degrade to
+ * "no verdict" rather than break the status surface that reads it.
+ */
+class CredentialHealthStore {
+    storage;
+    logger;
+    mirror = new Map();
+    constructor(storage, logger) {
+        this.storage = storage;
+        this.logger = logger;
+    }
+    async get(connectorId) {
+        const cached = this.mirror.get(connectorId);
+        if (cached && Date.now() - cached.readAt < MIRROR_TTL_MS) {
+            return cached.record ?? undefined;
+        }
+        let record = null;
+        try {
+            record = validRecord(await this.storage.get(storageKey(connectorId)));
+        }
+        catch (err) {
+            this.logger.warn(`[connecta] connector "${connectorId}" credential-health read failed: ${msg(err)}`);
+            return cached?.record ?? undefined;
+        }
+        this.mirror.set(connectorId, { record, readAt: Date.now() });
+        return record ?? undefined;
+    }
+    /**
+     * Monotonic per-connector counter, advanced by {@link clear}. Read straight
+     * from storage, never from the mirror: its whole job is to notice a change
+     * another isolate made, which a read cache would hide.
+     *
+     * A read failure answers 0. Paired with the fence in `put`, that fails
+     * *closed* — a mismatched generation drops the verdict — because losing one
+     * verdict costs a re-check, while resurrecting one costs an operator a
+     * connector that reports dead after they just fixed it.
+     */
+    async generation(connectorId) {
+        try {
+            const raw = await this.storage.get(generationKey(connectorId));
+            const value = raw ? Number(raw) : 0;
+            return Number.isFinite(value) ? value : 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    /**
+     * Write a verdict. `expectedGeneration` fences the write against a `clear`
+     * that landed while the check was in flight: pass the generation captured
+     * before the check started, and the write is dropped if it has since advanced.
+     * Omit it for a verdict observed synchronously (a live probe, an operator's
+     * Test), where there is no window to race.
+     *
+     * Returns whether the verdict was actually stored.
+     */
+    async put(connectorId, record, expectedGeneration) {
+        if (expectedGeneration !== undefined &&
+            (await this.generation(connectorId)) !== expectedGeneration) {
+            // The credential this verdict judged was replaced or removed mid-check.
+            // Drop the mirror too: this isolate's idea of the verdict is as stale as
+            // the write it just declined to make.
+            this.mirror.delete(connectorId);
+            return false;
+        }
+        const current = await this.get(connectorId);
+        const unchanged = current !== undefined &&
+            current.state === record.state &&
+            current.message === record.message &&
+            current.authorizationUrl === record.authorizationUrl;
+        if (unchanged &&
+            Date.parse(record.checkedAt) - Date.parse(current.checkedAt) <
+                MIN_WRITE_GAP_MS) {
+            return true;
+        }
+        this.mirror.set(connectorId, { record, readAt: Date.now() });
+        try {
+            await this.storage.set(storageKey(connectorId), JSON.stringify(record));
+        }
+        catch (err) {
+            this.logger.warn(`[connecta] connector "${connectorId}" credential-health persistence failed: ${msg(err)}`);
+        }
+        return true;
+    }
+    /**
+     * Forget a connector's verdict, and advance its generation so a check already
+     * in flight — in this isolate or any other — cannot write the verdict it
+     * formed about the credential that was just replaced.
+     *
+     * Bump BEFORE the delete, the same ordering the OAuth force path uses: a
+     * racing writer must see the advance rather than land between the two writes.
+     */
+    async clear(connectorId) {
+        this.mirror.delete(connectorId);
+        try {
+            const next = (await this.generation(connectorId)) + 1;
+            await this.storage.set(generationKey(connectorId), String(next));
+            await this.storage.delete(storageKey(connectorId));
+        }
+        catch (err) {
+            this.logger.warn(`[connecta] connector "${connectorId}" credential-health reset failed: ${msg(err)}`);
+        }
+    }
+}
+/**
+ * Whether a connector holds a credential connecta stores AND exposes a way to
+ * ask whether it still works.
+ *
+ * Deliberately narrow. `listTools`/`callTool` are NOT liveness probes here: a
+ * tool call may mutate downstream state, and the catalog path is already covered
+ * by the existing probe. So a connector is checkable only through the two hooks
+ * that exist to answer exactly this question — `testCredential(s)` (what /ui's
+ * Test button runs) and `status()` — and only when it has a credential of ours
+ * to be asked about: an operator-managed `credential`, or a stored downstream
+ * grant it reports via `hasStoredCredential`. A static-token connector stores
+ * nothing here and is never probed on a timer.
+ */
+export function isCheckableConnector(connector) {
+    const hasCredentialStore = Boolean(connector.credential || connector.hasStoredCredential);
+    const canAsk = Boolean((connector.credential &&
+        (connector.testCredentials || connector.testCredential)) ||
+        connector.status);
+    return hasCredentialStore && canAsk;
+}
+/**
+ * The credential test that fits the STORED value's shape, or undefined.
+ *
+ * `isCheckableConnector` answers the static question ("could this connector be
+ * asked at all"); this answers it against what is actually in the vault. The gap
+ * that matters is a connector with named fields but only the single-value
+ * `testCredential` hook: handing it `values.value` — the reserved single-value
+ * field, absent here — would test the empty string and record a confident
+ * `auth_required` about a credential nothing examined. The credential API
+ * refuses that same shape with a 409 rather than testing it; here the connector
+ * is skipped rather than given an invented verdict.
+ */
+function testHookFor(connector, values) {
+    if (!values)
+        return undefined;
+    if (connector.testCredentials) {
+        return (ctx) => connector.testCredentials(values, ctx);
+    }
+    if (connector.testCredential && typeof values.value === "string") {
+        return (ctx) => connector.testCredential(values.value, ctx);
+    }
+    return undefined;
+}
+/** Run `fn` over `items` with at most `limit` in flight, preserving order. */
+async function mapWithConcurrency(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (next < items.length) {
+            const index = next++;
+            out[index] = await fn(items[index]);
+        }
+    });
+    await Promise.all(workers);
+    return out;
+}
+/**
+ * Runs and caches credential liveness checks. One instance per `Registry`.
+ *
+ * Cost is bounded four ways, because a status surface an agent polls must never
+ * become a way to hammer a downstream auth endpoint:
+ *
+ * 1. **Eligibility** — only connectors holding a credential of ours are probed
+ *    at all (`isCheckableConnector`), and only when something is actually stored.
+ * 2. **Freshness (cross-isolate)** — a persisted verdict younger than
+ *    `intervalSeconds` short-circuits the check, so every isolate and every
+ *    trigger share one budget.
+ * 3. **Sweep gate (per isolate)** — `sweepIfDue` runs at most one traffic-
+ *    triggered sweep per interval per isolate, and never two at once, so a burst
+ *    of requests costs one sweep, not one per request.
+ * 4. **Deadline + fan-out bound** — each check is bounded by `timeoutMs` and at
+ *    most `concurrency` run together (the same shape as the `probeTimeoutMs`
+ *    bound on the discovery fan-out, issue #19).
+ */
+export class CredentialHealthChecker {
+    deps;
+    store;
+    intervalMs;
+    concurrency;
+    timeoutMs;
+    onRequest;
+    /** Per-connector checks in flight in THIS isolate. */
+    inFlight = new Map();
+    /** Earliest a traffic-triggered sweep may run again in this isolate. */
+    nextSweepAt = 0;
+    sweeping;
+    constructor(deps, config = {}) {
+        this.deps = deps;
+        this.store = new CredentialHealthStore(deps.storage, deps.logger);
+        // Out-of-range tuning falls back to the default rather than being coerced:
+        // a zero or negative interval would turn the rate limit off, which is the
+        // one thing this class is for.
+        const seconds = config.intervalSeconds;
+        this.intervalMs =
+            seconds !== undefined && Number.isFinite(seconds) && seconds > 0
+                ? seconds * 1000
+                : DEFAULT_CREDENTIAL_CHECK_INTERVAL_SECONDS * 1000;
+        this.concurrency =
+            config.concurrency !== undefined &&
+                Number.isInteger(config.concurrency) &&
+                config.concurrency > 0
+                ? config.concurrency
+                : DEFAULT_CREDENTIAL_CHECK_CONCURRENCY;
+        this.timeoutMs =
+            normalizeTimeoutMs(config.timeoutMs) ?? DEFAULT_PROBE_TIMEOUT_MS;
+        this.onRequest = config.onRequest ?? true;
+    }
+    /**
+     * The stored verdict, if any. No downstream I/O — and no storage read at all
+     * for a connector that stores no credential of ours, since only a checkable
+     * connector can ever have had a verdict written. That keeps
+     * `list_connectors({ probe: false })` exactly as cheap as it was for the
+     * deployments this feature does not apply to.
+     */
+    healthFor(connectorId) {
+        const connector = this.deps.getConnector(connectorId);
+        if (!connector || !isCheckableConnector(connector)) {
+            return Promise.resolve(undefined);
+        }
+        return this.store.get(connectorId);
+    }
+    /**
+     * Record a liveness verdict observed elsewhere — today, the live status a
+     * `list_connectors({ probe: true })` just performed. Filtered by the same
+     * eligibility rule as a check, so this stays a record of *credential* health
+     * rather than a general status cache, and so it also counts against the
+     * freshness budget: an operator who just probed live does not get swept again
+     * moments later.
+     */
+    async record(connectorId, record) {
+        const connector = this.deps.getConnector(connectorId);
+        if (!connector || !isCheckableConnector(connector))
+            return;
+        await this.store.put(connectorId, record);
+    }
+    /** Forget a connector's verdict — its credential just changed under us. */
+    clear(connectorId) {
+        return this.store.clear(connectorId);
+    }
+    /** Whether any connector in this deployment could be checked at all. */
+    hasCheckableConnectors() {
+        return this.deps.listConnectors().some(isCheckableConnector);
+    }
+    /**
+     * Check every (or the named) connector's stored credential and return one
+     * outcome per connector considered. Never rejects: a connector that throws,
+     * hangs past `timeoutMs`, or cannot be persisted becomes an `error` verdict.
+     */
+    async check(baseUrl, opts = {}) {
+        // An id naming no connector is reported, not dropped: a typo in a scheduled
+        // check would otherwise return an empty list that looks exactly like a
+        // deployment with nothing to check.
+        const targets = opts.ids
+            ? opts.ids.map((id) => this.deps.getConnector(id) ?? id)
+            : this.deps.listConnectors();
+        return mapWithConcurrency(targets, this.concurrency, (target) => typeof target === "string"
+            ? Promise.resolve({ connectorId: target, skipped: "not_found" })
+            : this.checkOne(target, baseUrl, opts));
+    }
+    /**
+     * The traffic-triggered sweep: a promise to hand to `ctx.waitUntil`, or
+     * `undefined` when nothing is due (the common case, and free — no I/O). The
+     * gate is armed BEFORE the sweep starts, so a burst of concurrent requests
+     * produces one sweep.
+     */
+    sweepIfDue(baseUrl) {
+        if (!this.onRequest || this.sweeping)
+            return undefined;
+        const now = Date.now();
+        if (now < this.nextSweepAt)
+            return undefined;
+        if (!this.hasCheckableConnectors())
+            return undefined;
+        this.nextSweepAt = now + this.intervalMs;
+        const sweep = this.check(baseUrl).finally(() => {
+            this.sweeping = undefined;
+        });
+        this.sweeping = sweep;
+        return sweep;
+    }
+    async checkOne(connector, baseUrl, opts) {
+        const connectorId = connector.id;
+        if (!isCheckableConnector(connector)) {
+            return { connectorId, skipped: "not_checkable" };
+        }
+        if (this.inFlight.has(connectorId)) {
+            // Report rather than join: the caller wants to know a check happened, not
+            // to be blocked behind one someone else already pays for.
+            return {
+                connectorId,
+                skipped: "in_flight",
+                ...(await this.recordOrNothing(connectorId)),
+            };
+        }
+        if (!opts.force) {
+            const current = await this.store.get(connectorId);
+            if (current &&
+                Date.now() - Date.parse(current.checkedAt) < this.intervalMs) {
+                return { connectorId, skipped: "fresh", record: current };
+            }
+        }
+        const run = this.runCheck(connector, baseUrl, opts.requestScope);
+        this.inFlight.set(connectorId, run);
+        try {
+            return await run;
+        }
+        finally {
+            this.inFlight.delete(connectorId);
+        }
+    }
+    async recordOrNothing(connectorId) {
+        const record = await this.store.get(connectorId);
+        return record ? { record } : {};
+    }
+    async runCheck(connector, baseUrl, requestScope) {
+        const connectorId = connector.id;
+        const started = Date.now();
+        // Captured BEFORE anything downstream happens: everything after this point
+        // is a window in which the operator may replace the very credential being
+        // judged, and `settle` fences the write against exactly that.
+        const generation = await this.store.generation(connectorId);
+        const ctx = this.deps.contextFor(connectorId, baseUrl, requestScope);
+        let values = null;
+        if (connector.credential && this.deps.credentialVault) {
+            try {
+                values = await this.deps.credentialVault.getAll(connectorId);
+            }
+            catch (err) {
+                // A stored credential that cannot be decrypted (rotated key, corrupt
+                // envelope) is exactly the kind of dead credential this feature exists
+                // to surface early, so it is a verdict rather than a skip.
+                return this.settle(connectorId, started, generation, {
+                    state: "auth_required",
+                    checkedAt: new Date().toISOString(),
+                    message: msg(err),
+                });
+            }
+        }
+        const stored = connector.hasStoredCredential
+            ? await connector
+                .hasStoredCredential(ctx)
+                .catch(() => values !== null)
+            : values !== null;
+        if (!stored)
+            return { connectorId, skipped: "no_credential" };
+        if (!this.canAsk(connector, values)) {
+            return { connectorId, skipped: "not_checkable" };
+        }
+        try {
+            const verdict = await withTimeout(this.probe(connector, ctx, values), this.timeoutMs, `credential check of "${connectorId}"`);
+            return await this.settle(connectorId, started, generation, {
+                ...verdict,
+                checkedAt: new Date().toISOString(),
+            });
+        }
+        catch (err) {
+            return await this.settle(connectorId, started, generation, {
+                state: "error",
+                checkedAt: new Date().toISOString(),
+                message: msg(err),
+            });
+        }
+    }
+    /**
+     * `isCheckableConnector` re-asked against what is actually stored: a hook that
+     * fits the value's shape (see {@link testHookFor}), or a `status()` to fall
+     * back on. Neither ⇒ there is no honest question to put to this connector.
+     */
+    canAsk(connector, values) {
+        return Boolean(testHookFor(connector, values) || connector.status);
+    }
+    /**
+     * Ask the connector whether the credential it holds still works — with no
+     * downstream mutation and no tool call. A credential test is preferred for a
+     * vault credential because it validates the stored value itself; `status()` is
+     * the downstream-OAuth answer (it refreshes the grant, which is the liveness
+     * question for a token).
+     */
+    async probe(connector, ctx, values) {
+        const test = testHookFor(connector, values);
+        if (test) {
+            const result = await test(ctx);
+            if (result.ok) {
+                return { state: "ok", ...(result.message ? { message: result.message } : {}) };
+            }
+            // A rejected stored credential needs an operator, not a retry — the same
+            // actionable state a revoked OAuth grant reports. There is no consent URL
+            // for a vault credential; /ui's credential form is where it is replaced.
+            return {
+                state: "auth_required",
+                message: result.message ??
+                    "Stored credential was rejected by the connector — replace it in /ui.",
+            };
+        }
+        const status = await connector.status(ctx);
+        return {
+            state: status.state,
+            ...(status.message ? { message: status.message } : {}),
+            ...(status.authorizationUrl
+                ? { authorizationUrl: status.authorizationUrl }
+                : {}),
+        };
+    }
+    async settle(connectorId, started, generation, record) {
+        const stored = await this.store.put(connectorId, record, generation);
+        return {
+            connectorId,
+            record,
+            ...(stored ? {} : { discarded: true }),
+            latencyMs: Date.now() - started,
+        };
+    }
+}
+/**
+ * Whether a liveness verdict may DECIDE a connector's cached status.
+ *
+ * Only `auth_required` ever does, and only while nothing better has happened
+ * since. Two separate judgements:
+ *
+ * 1. **`error` is not credential evidence.** A check that timed out, threw, or
+ *    got a 502 from the provider's status endpoint failed to *complete* — it
+ *    learned nothing about the credential. Letting it set the status would flip
+ *    a connector whose calls are fine to `error` for a whole interval on a DNS
+ *    blip. Error verdicts stay visible in `credentialCheck` (an operator wants
+ *    to know checks are failing) but the status keeps coming from observed real
+ *    calls, which is evidence.
+ * 2. **A successful real call retires the verdict.** Traffic beats a background
+ *    probe, so a `lastSuccessAt` at or after `checkedAt` means the credential
+ *    demonstrably works whatever the check concluded. The next check re-decides.
+ *
+ * `auth_required` deliberately outranks an observed real-call *failure*: both
+ * say something is wrong, and only one of them carries the URL that fixes it.
+ * The failure stays visible as `lastError`.
+ */
+export function credentialVerdictApplies(record, lastSuccessAt) {
+    if (!record || record.state !== "auth_required")
+        return false;
+    if (!lastSuccessAt)
+        return true;
+    const success = Date.parse(lastSuccessAt);
+    return Number.isNaN(success) || success < Date.parse(record.checkedAt);
+}
+//# sourceMappingURL=credential-health.js.map

package/dist/credential-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-health.js","sourceRoot":"","sources":["../src/credential-health.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,mDAAmD;AACnD,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,iFAAiF;AACjF,iBAAiB;AAGjB,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA2FzF,MAAM,CAAC,MAAM,yCAAyC,GAAG,GAAG,CAAC;AAC7D,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACrC,OAAO,cAAc,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,WAAmB;IACxC,OAAO,kBAAkB,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,GAAkB;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoC,CAAC;QACjE,IACE,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;YACnB,KAAK,CAAC,KAAK,KAAK,eAAe;YAC/B,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC;YAC1B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,yEAAyE;YACzE,2EAA2E;YAC3E,yEAAyE;YACzE,yDAAyD;YACzD,SAAS,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;YACxE,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ;gBAC5C,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB;IAON;IACA;IAPF,MAAM,GAAG,IAAI,GAAG,EAG9B,CAAC;IAEJ,YACmB,OAAkB,EAClB,MAAc;QADd,YAAO,GAAP,OAAO,CAAW;QAClB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,GAAkC,IAAI,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yBAAyB,WAAW,oCAAoC,GAAG,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;YACF,OAAO,MAAM,EAAE,MAAM,IAAI,SAAS,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,SAAS,CAAC;IAC7B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACP,WAAmB,EACnB,MAA8B,EAC9B,kBAA2B;QAE3B,IACE,kBAAkB,KAAK,SAAS;YAChC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,kBAAkB,EAC3D,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,SAAS,GACb,OAAO,KAAK,SAAS;YACrB,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;YAC9B,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAClC,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,CAAC;QACvD,IACE,SAAS;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC1D,gBAAgB,EAClB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yBAAyB,WAAW,2CAA2C,GAAG,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,WAAmB;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yBAAyB,WAAW,qCAAqC,GAAG,CAAC,GAAG,CAAC,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAyBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAoB;IACvD,MAAM,kBAAkB,GAAG,OAAO,CAChC,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,mBAAmB,CACtD,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CACpB,CAAC,SAAS,CAAC,UAAU;QACnB,CAAC,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC;QACxD,SAAS,CAAC,MAAM,CACnB,CAAC;IACF,OAAO,kBAAkB,IAAI,MAAM,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAClB,SAAoB,EACpB,MAAwC;IAExC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,eAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,SAAS,CAAC,cAAc,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,cAAe,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,kBAAkB,CAC/B,KAAU,EACV,KAAa,EACb,EAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EACzC,KAAK,IAAI,EAAE;QACT,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CACF,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,uBAAuB;IAaf;IAZF,KAAK,CAAwB;IAC7B,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,SAAS,CAAS;IAClB,SAAS,CAAU;IACpC,sDAAsD;IACrC,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IAChE,wEAAwE;IAChE,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,CAA+C;IAE/D,YACmB,IAA0B,EAC3C,SAAiC,EAAE;QADlB,SAAI,GAAJ,IAAI,CAAsB;QAG3C,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,2EAA2E;QAC3E,0EAA0E;QAC1E,+BAA+B;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC;QACvC,IAAI,CAAC,UAAU;YACb,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;gBAC9D,CAAC,CAAC,OAAO,GAAG,IAAI;gBAChB,CAAC,CAAC,yCAAyC,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,WAAW;YACd,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;gBACpC,MAAM,CAAC,WAAW,GAAG,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,WAAW;gBACpB,CAAC,CAAC,oCAAoC,CAAC;QAC3C,IAAI,CAAC,SAAS;YACZ,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC;QACnE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,WAAmB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,MAA8B;QAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,WAAmB;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,wEAAwE;IACxE,sBAAsB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CACT,OAAe,EACf,OAA+B,EAAE;QAEjC,4EAA4E;QAC5E,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,OAAO,GAA8B,IAAI,CAAC,GAAG;YACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACxD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAC9D,OAAO,MAAM,KAAK,QAAQ;YACxB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,WAAoB,EAAE,CAAC;YACzE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CACzC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAe;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAAE,OAAO,SAAS,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,SAAoB,EACpB,OAAe,EACf,IAA4B;QAE5B,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,0EAA0E;YAC1E,0DAA0D;YAC1D,OAAO;gBACL,WAAW;gBACX,OAAO,EAAE,WAAW;gBACpB,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;aAC7C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,IACE,OAAO;gBACP,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,UAAU,EAC5D,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,SAAoB,EACpB,OAAe,EACf,YAAqB;QAErB,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,2EAA2E;QAC3E,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,MAAM,GAAqC,IAAI,CAAC;QACpD,IAAI,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,uEAAuE;gBACvE,2DAA2D;gBAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;oBACnD,KAAK,EAAE,eAAe;oBACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,mBAAmB;YAC1C,CAAC,CAAC,MAAM,SAAS;iBACZ,mBAAmB,CAAC,GAAG,CAAC;iBACxB,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC;YACjC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,EAClC,IAAI,CAAC,SAAS,EACd,wBAAwB,WAAW,GAAG,CACvC,CAAC;YACF,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;gBACzD,GAAG,OAAO;gBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;gBACzD,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,MAAM,CACZ,SAAoB,EACpB,MAAwC;QAExC,OAAO,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,KAAK,CACjB,SAAoB,EACpB,GAAqB,EACrB,MAAwC;QAExC,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACjF,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,OAAO;gBACL,KAAK,EAAE,eAAe;gBACtB,OAAO,EACL,MAAM,CAAC,OAAO;oBACd,sEAAsE;aACzE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,gBAAgB;gBACzB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,WAAmB,EACnB,OAAe,EACf,UAAkB,EAClB,MAA8B;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACrE,OAAO;YACL,WAAW;YACX,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA0C,EAC1C,aAAiC;IAEjC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACzE,CAAC"}

package/dist/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../src/execute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAA2B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,SAAS,EACT,QAAQ,EACR,gBAAgB,EAChB,MAAM,EAEP,MAAM,YAAY,CAAC;AAKpB,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,4BAA4B,QAAS,CAAC;AA+CnD,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EACvB,MAAM,EAAE,OAAO,GACd,OAAO,CAET;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,sBAAsB,EACjC,MAAM,GAAE;IACN,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACvB,GACL,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA2U7B;AAmBD,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,sBAAsB,IAEnB,UAAU;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,UAAU,CAAC,CA4C/D;AAeD,uFAAuF;AACvF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC,GACA,IAAI,CA2BN"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../src/execute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,SAAS,EACT,QAAQ,EACR,gBAAgB,EAChB,MAAM,EAEP,MAAM,YAAY,CAAC;AAKpB,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,4BAA4B,QAAS,CAAC;AA+CnD,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EACvB,MAAM,EAAE,OAAO,GACd,OAAO,CAET;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,sBAAsB,EACjC,MAAM,GAAE;IACN,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACvB,GACL,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA6V7B;AAoBD,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,sBAAsB,IAEnB,UAAU;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,UAAU,CAAC,CA4C/D;AAeD,uFAAuF;AACvF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC,GACA,IAAI,CA2BN"}

package/dist/execute.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { compactSchema, rankTools, summarizeDescription } from "./catalog.js";
 import { recordToolActivity } from "./activity.js";
-import { errorResult, jsonResult } from "./meta-tools.js";
+import { errorResult, jsonResult, serializeResultText, } from "./meta-tools.js";
 import { classifyCallError, ConnectorCallError } from "./errors.js";
 import { unwrapMcpResult } from "./mcp-result.js";
 /** ~6k tokens. Sandbox code should filter data down before returning. */
@@ -100,6 +100,7 @@ export async function buildSandboxProviders(registry, baseUrl, logger, activity,
         "__log",
     ]);
     const connectors = registry.listConnectors();
+    const catalogStarted = Date.now();
     const loaded = await Promise.allSettled(connectors.map((connector) => registry.getTools(connector.id, baseUrl, requestScope)));
     const catalogs = new Map();
     const callAddress = async (address, args) => {
@@ -188,7 +189,17 @@ export async function buildSandboxProviders(registry, baseUrl, logger, activity,
         }
         const loadedTools = loaded[i];
         if (loadedTools.status === "rejected") {
-            logger.warn(`[connecta] execute_code: connector "${connector.id}" skipped: ${msg(loadedTools.reason)}`);
+            // Same health accounting as the call_tool catalog catch: a connector whose
+            // catalog cannot be fetched is unusable, and dropping its namespace with
+            // only a warn would leave the cheap `list_connectors({ probe: false })`
+            // signal clean for a code-mode deployment whose downstream grant was
+            // revoked. Recorded through `registry` — this run's view — so a
+            // toolkit-scoped execute_code lands in that toolkit's log as well.
+            registry.recordFailure(connector.id, Date.now() - catalogStarted, loadedTools.reason);
+            // classifyCallError so a typed auth_required thrown while listing tools
+            // keeps its code where an operator can see it; health stores the message.
+            const details = classifyCallError(loadedTools.reason, "catalog_lookup_failed");
+            logger.warn(`[connecta] execute_code: connector "${connector.id}" skipped (${details.code}): ${msg(loadedTools.reason)}`);
             continue;
         }
         const tools = loadedTools.value;
@@ -351,8 +362,9 @@ function truncate(text, max) {
     return `${text.slice(0, max)}\n--- TRUNCATED (${text.length} chars total) — filter/map/slice data inside your code and return only what you need ---`;
 }
 function guardResultValue(value) {
-    const serialized = JSON.stringify(value, null, 2);
-    const text = serialized === undefined ? String(value) : serialized;
+    // Same serialization the call_tool guards measure, so a program returning
+    // nothing is rendered one way across every result path (issue #42).
+    const text = serializeResultText(value);
     if (text.length <= MAX_RESULT_CHARS)
         return value;
     return {