@zackbart/connecta 0.5.0 → 0.6.1

package/dist/credential-health.js

@@ -0,0 +1,551 @@
+// Proactive liveness checks for the credentials connecta itself stores —
+// downstream-OAuth tokens and operator-managed vault credentials (issue #24).
+//
+// The problem this solves: a connector's auth state used to flip only when
+// something *observed* a failure, so an expired or revoked token surfaced
+// mid-task as a failed agent call. A liveness check asks the connector whether
+// the credential it holds still works, records the verdict, and lets the cached
+// status surfaces (`list_connectors({ probe: false })`, `/ui`) report
+// `auth_required` BEFORE a real call discovers it.
+//
+// Runtime-agnostic on purpose: nothing here schedules itself. The core exposes a
+// due-gated sweep (piggybacked on inbound traffic by the server) and an awaited
+// entry point (`Connecta.checkCredentials()`) an operator wires to whatever
+// scheduler their runtime has — a Worker cron trigger, a Node `setInterval`.
+// There is no background daemon and no long-lived timer, so Workers and Node run
+// the same code.
+import { credentialTestRule } from "./credentials.js";
+import { DEFAULT_PROBE_TIMEOUT_MS, normalizeTimeoutMs, withTimeout } from "./timeout.js";
+export const DEFAULT_CREDENTIAL_CHECK_INTERVAL_SECONDS = 900;
+export const DEFAULT_CREDENTIAL_CHECK_CONCURRENCY = 4;
+/**
+ * How long a read of one connector's record is served from memory before going
+ * back to storage. Short: it exists so a burst of `list_connectors` calls costs
+ * one storage read rather than one per call, not to cache a verdict.
+ */
+const MIRROR_TTL_MS = 5_000;
+/**
+ * Minimum gap between storage WRITES of an unchanged verdict. A liveness
+ * observation arrives from more than one place (the sweep, and every
+ * `list_connectors({ probe: true })`), and re-persisting "still ok" on each one
+ * would spend a KV write per probe for no new information. A verdict whose state
+ * or message CHANGED is always written immediately.
+ */
+const MIN_WRITE_GAP_MS = 60_000;
+function msg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function storageKey(connectorId) {
+    return `credhealth:${connectorId}`;
+}
+/**
+ * Generation counter key. Connector ids are `[a-z0-9_-]+`, so the extra colon
+ * puts this outside the space `storageKey` can produce — no id can collide with
+ * another id's counter.
+ */
+function generationKey(connectorId) {
+    return `credhealth:gen:${connectorId}`;
+}
+function validRecord(raw) {
+    if (!raw)
+        return null;
+    try {
+        const value = JSON.parse(raw);
+        if ((value.state !== "ok" &&
+            value.state !== "auth_required" &&
+            value.state !== "error") ||
+            typeof value.checkedAt !== "string" ||
+            Number.isNaN(Date.parse(value.checkedAt))) {
+            return null;
+        }
+        const stamped = Date.parse(value.checkedAt);
+        const now = Date.now();
+        return {
+            state: value.state,
+            // A verdict from the future is a clock-skewed isolate, and left alone it
+            // would be permanently fresh (never re-checked) AND permanently newer than
+            // any real-call success (never retired) — a wrong answer that cannot age
+            // out. Clamping to now costs at most one early re-check.
+            checkedAt: stamped > now ? new Date(now).toISOString() : value.checkedAt,
+            ...(typeof value.message === "string" ? { message: value.message } : {}),
+            ...(typeof value.authorizationUrl === "string"
+                ? { authorizationUrl: value.authorizationUrl }
+                : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The stored verdicts, in the deployment's own KVStorage under
+ * `credhealth:<connectorId>`.
+ *
+ * Persisted rather than held in memory because the two runtimes disagree about
+ * what "in memory" means: a Cloudflare cron trigger runs in a different isolate
+ * from the fetch handlers, so a verdict only reaches `list_connectors` if it
+ * goes through storage. The in-memory mirror is a read cache over that, not the
+ * source of truth.
+ *
+ * Never throws: a check that cannot be persisted (or read back) must degrade to
+ * "no verdict" rather than break the status surface that reads it.
+ */
+class CredentialHealthStore {
+    storage;
+    logger;
+    mirror = new Map();
+    constructor(storage, logger) {
+        this.storage = storage;
+        this.logger = logger;
+    }
+    async get(connectorId) {
+        const cached = this.mirror.get(connectorId);
+        if (cached && Date.now() - cached.readAt < MIRROR_TTL_MS) {
+            return cached.record ?? undefined;
+        }
+        let record = null;
+        try {
+            record = validRecord(await this.storage.get(storageKey(connectorId)));
+        }
+        catch (err) {
+            this.logger.warn(`[connecta] connector "${connectorId}" credential-health read failed: ${msg(err)}`);
+            return cached?.record ?? undefined;
+        }
+        this.mirror.set(connectorId, { record, readAt: Date.now() });
+        return record ?? undefined;
+    }
+    /**
+     * Monotonic per-connector counter, advanced by {@link clear}. Read straight
+     * from storage, never from the mirror: its whole job is to notice a change
+     * another isolate made, which a read cache would hide.
+     *
+     * A read failure answers 0. Paired with the fence in `put`, that fails
+     * *closed* — a mismatched generation drops the verdict — because losing one
+     * verdict costs a re-check, while resurrecting one costs an operator a
+     * connector that reports dead after they just fixed it.
+     */
+    async generation(connectorId) {
+        try {
+            const raw = await this.storage.get(generationKey(connectorId));
+            const value = raw ? Number(raw) : 0;
+            return Number.isFinite(value) ? value : 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    /**
+     * Write a verdict. `expectedGeneration` fences the write against a `clear`
+     * that landed while the check was in flight: pass the generation captured
+     * before the check started, and the write is dropped if it has since advanced.
+     * Omit it for a verdict observed synchronously (a live probe, an operator's
+     * Test), where there is no window to race.
+     *
+     * Returns whether the verdict was actually stored.
+     */
+    async put(connectorId, record, expectedGeneration) {
+        if (expectedGeneration !== undefined &&
+            (await this.generation(connectorId)) !== expectedGeneration) {
+            // The credential this verdict judged was replaced or removed mid-check.
+            // Drop the mirror too: this isolate's idea of the verdict is as stale as
+            // the write it just declined to make.
+            this.mirror.delete(connectorId);
+            return false;
+        }
+        const current = await this.get(connectorId);
+        const unchanged = current !== undefined &&
+            current.state === record.state &&
+            current.message === record.message &&
+            current.authorizationUrl === record.authorizationUrl;
+        if (unchanged &&
+            Date.parse(record.checkedAt) - Date.parse(current.checkedAt) <
+                MIN_WRITE_GAP_MS) {
+            return true;
+        }
+        this.mirror.set(connectorId, { record, readAt: Date.now() });
+        try {
+            await this.storage.set(storageKey(connectorId), JSON.stringify(record));
+        }
+        catch (err) {
+            this.logger.warn(`[connecta] connector "${connectorId}" credential-health persistence failed: ${msg(err)}`);
+        }
+        return true;
+    }
+    /**
+     * Forget a connector's verdict, and advance its generation so a check already
+     * in flight — in this isolate or any other — cannot write the verdict it
+     * formed about the credential that was just replaced.
+     *
+     * Bump BEFORE the delete, the same ordering the OAuth force path uses: a
+     * racing writer must see the advance rather than land between the two writes.
+     */
+    async clear(connectorId) {
+        this.mirror.delete(connectorId);
+        try {
+            const next = (await this.generation(connectorId)) + 1;
+            await this.storage.set(generationKey(connectorId), String(next));
+            await this.storage.delete(storageKey(connectorId));
+        }
+        catch (err) {
+            this.logger.warn(`[connecta] connector "${connectorId}" credential-health reset failed: ${msg(err)}`);
+        }
+    }
+}
+/**
+ * Whether a connector holds a credential connecta stores AND exposes a way to
+ * ask whether it still works.
+ *
+ * Deliberately narrow. `listTools`/`callTool` are NOT liveness probes here: a
+ * tool call may mutate downstream state, and the catalog path is already covered
+ * by the existing probe. So a connector is checkable only through the two hooks
+ * that exist to answer exactly this question — `testCredential(s)` (what /ui's
+ * Test button runs) and `status()` — and only when it has a credential of ours
+ * to be asked about: an operator-managed `credential`, or a stored downstream
+ * grant it reports via `hasStoredCredential`. A static-token connector stores
+ * nothing here and is never probed on a timer.
+ *
+ * Whether a test hook counts is `credentialTestRule`'s call, not this function's
+ * — the same rule /ui's Test button and the credential API read (issue #55), so
+ * a credential the operator cannot test by hand is not one a sweep tests behind
+ * their back. A connector whose only hook cannot test its declared shape is
+ * checkable only if it also implements `status()`.
+ */
+export function isCheckableConnector(connector) {
+    const hasCredentialStore = Boolean(connector.credential || connector.hasStoredCredential);
+    const canAsk = Boolean(credentialTestRule(connector).mode !== null || connector.status);
+    return hasCredentialStore && canAsk;
+}
+/**
+ * The credential test the connector's DECLARED shape selects, bound to what is
+ * actually stored — or undefined when there is no honest question to put.
+ *
+ * `isCheckableConnector` answers the static question ("could this connector be
+ * asked at all"); this answers it against the vault. The hook itself is picked
+ * by `credentialTestRule` (src/credentials.ts, issue #55), the one rule /ui's
+ * `testable` flag and `POST /ui/credentials/<id>/test` also read: named
+ * `credential.fields` are tested as a set by `testCredentials`, a single-value
+ * `credential` by `testCredential` on the vault's reserved `value` field, and
+ * the other hook is never substituted. Substituting it is what a sweep must not
+ * do quietly — handing `testCredential` a `values.value` that named fields never
+ * wrote would test the empty string and record a confident `auth_required` about
+ * a credential nothing examined, and handing `testCredentials` the reserved
+ * `{ value }` map would call a hook with a shape its connector never declared.
+ * Either way the connector is skipped (`not_checkable`) rather than given an
+ * invented verdict, and `createConnecta` already warned about the mismatch at
+ * construction.
+ */
+function testHookFor(connector, values) {
+    if (!values)
+        return undefined;
+    const { mode } = credentialTestRule(connector);
+    if (mode === "multiple") {
+        return (ctx) => connector.testCredentials(values, ctx);
+    }
+    // A single-value shape with nothing under the reserved field is still nothing
+    // to test, so the stored value gets the last word even when the rule fits.
+    if (mode === "single" && typeof values.value === "string") {
+        return (ctx) => connector.testCredential(values.value, ctx);
+    }
+    return undefined;
+}
+/** Run `fn` over `items` with at most `limit` in flight, preserving order. */
+async function mapWithConcurrency(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (next < items.length) {
+            const index = next++;
+            out[index] = await fn(items[index]);
+        }
+    });
+    await Promise.all(workers);
+    return out;
+}
+/**
+ * Runs and caches credential liveness checks. One instance per `Registry`.
+ *
+ * Cost is bounded four ways, because a status surface an agent polls must never
+ * become a way to hammer a downstream auth endpoint:
+ *
+ * 1. **Eligibility** — only connectors holding a credential of ours are probed
+ *    at all (`isCheckableConnector`), and only when something is actually stored.
+ * 2. **Freshness (cross-isolate)** — a persisted verdict younger than
+ *    `intervalSeconds` short-circuits the check, so every isolate and every
+ *    trigger share one budget.
+ * 3. **Sweep gate (per isolate)** — `sweepIfDue` runs at most one traffic-
+ *    triggered sweep per interval per isolate, and never two at once, so a burst
+ *    of requests costs one sweep, not one per request.
+ * 4. **Deadline + fan-out bound** — each check is bounded by `timeoutMs` and at
+ *    most `concurrency` run together (the same shape as the `probeTimeoutMs`
+ *    bound on the discovery fan-out, issue #19).
+ */
+export class CredentialHealthChecker {
+    deps;
+    store;
+    intervalMs;
+    concurrency;
+    timeoutMs;
+    onRequest;
+    /** Per-connector checks in flight in THIS isolate. */
+    inFlight = new Map();
+    /** Earliest a traffic-triggered sweep may run again in this isolate. */
+    nextSweepAt = 0;
+    sweeping;
+    constructor(deps, config = {}) {
+        this.deps = deps;
+        this.store = new CredentialHealthStore(deps.storage, deps.logger);
+        // Out-of-range tuning falls back to the default rather than being coerced:
+        // a zero or negative interval would turn the rate limit off, which is the
+        // one thing this class is for.
+        const seconds = config.intervalSeconds;
+        this.intervalMs =
+            seconds !== undefined && Number.isFinite(seconds) && seconds > 0
+                ? seconds * 1000
+                : DEFAULT_CREDENTIAL_CHECK_INTERVAL_SECONDS * 1000;
+        this.concurrency =
+            config.concurrency !== undefined &&
+                Number.isInteger(config.concurrency) &&
+                config.concurrency > 0
+                ? config.concurrency
+                : DEFAULT_CREDENTIAL_CHECK_CONCURRENCY;
+        this.timeoutMs =
+            normalizeTimeoutMs(config.timeoutMs) ?? DEFAULT_PROBE_TIMEOUT_MS;
+        this.onRequest = config.onRequest ?? true;
+    }
+    /**
+     * The stored verdict, if any. No downstream I/O — and no storage read at all
+     * for a connector that stores no credential of ours, since only a checkable
+     * connector can ever have had a verdict written. That keeps
+     * `list_connectors({ probe: false })` exactly as cheap as it was for the
+     * deployments this feature does not apply to.
+     */
+    healthFor(connectorId) {
+        const connector = this.deps.getConnector(connectorId);
+        if (!connector || !isCheckableConnector(connector)) {
+            return Promise.resolve(undefined);
+        }
+        return this.store.get(connectorId);
+    }
+    /**
+     * Record a liveness verdict observed elsewhere — today, the live status a
+     * `list_connectors({ probe: true })` just performed. Filtered by the same
+     * eligibility rule as a check, so this stays a record of *credential* health
+     * rather than a general status cache, and so it also counts against the
+     * freshness budget: an operator who just probed live does not get swept again
+     * moments later.
+     */
+    async record(connectorId, record) {
+        const connector = this.deps.getConnector(connectorId);
+        if (!connector || !isCheckableConnector(connector))
+            return;
+        await this.store.put(connectorId, record);
+    }
+    /** Forget a connector's verdict — its credential just changed under us. */
+    clear(connectorId) {
+        return this.store.clear(connectorId);
+    }
+    /** Whether any connector in this deployment could be checked at all. */
+    hasCheckableConnectors() {
+        return this.deps.listConnectors().some(isCheckableConnector);
+    }
+    /**
+     * Check every (or the named) connector's stored credential and return one
+     * outcome per connector considered. Never rejects: a connector that throws,
+     * hangs past `timeoutMs`, or cannot be persisted becomes an `error` verdict.
+     */
+    async check(baseUrl, opts = {}) {
+        // An id naming no connector is reported, not dropped: a typo in a scheduled
+        // check would otherwise return an empty list that looks exactly like a
+        // deployment with nothing to check.
+        const targets = opts.ids
+            ? opts.ids.map((id) => this.deps.getConnector(id) ?? id)
+            : this.deps.listConnectors();
+        return mapWithConcurrency(targets, this.concurrency, (target) => typeof target === "string"
+            ? Promise.resolve({ connectorId: target, skipped: "not_found" })
+            : this.checkOne(target, baseUrl, opts));
+    }
+    /**
+     * The traffic-triggered sweep: a promise to hand to `ctx.waitUntil`, or
+     * `undefined` when nothing is due (the common case, and free — no I/O). The
+     * gate is armed BEFORE the sweep starts, so a burst of concurrent requests
+     * produces one sweep.
+     */
+    sweepIfDue(baseUrl) {
+        if (!this.onRequest || this.sweeping)
+            return undefined;
+        const now = Date.now();
+        if (now < this.nextSweepAt)
+            return undefined;
+        if (!this.hasCheckableConnectors())
+            return undefined;
+        this.nextSweepAt = now + this.intervalMs;
+        const sweep = this.check(baseUrl).finally(() => {
+            this.sweeping = undefined;
+        });
+        this.sweeping = sweep;
+        return sweep;
+    }
+    async checkOne(connector, baseUrl, opts) {
+        const connectorId = connector.id;
+        if (!isCheckableConnector(connector)) {
+            return { connectorId, skipped: "not_checkable" };
+        }
+        if (this.inFlight.has(connectorId)) {
+            // Report rather than join: the caller wants to know a check happened, not
+            // to be blocked behind one someone else already pays for.
+            return {
+                connectorId,
+                skipped: "in_flight",
+                ...(await this.recordOrNothing(connectorId)),
+            };
+        }
+        if (!opts.force) {
+            const current = await this.store.get(connectorId);
+            if (current &&
+                Date.now() - Date.parse(current.checkedAt) < this.intervalMs) {
+                return { connectorId, skipped: "fresh", record: current };
+            }
+        }
+        const run = this.runCheck(connector, baseUrl, opts.requestScope);
+        this.inFlight.set(connectorId, run);
+        try {
+            return await run;
+        }
+        finally {
+            this.inFlight.delete(connectorId);
+        }
+    }
+    async recordOrNothing(connectorId) {
+        const record = await this.store.get(connectorId);
+        return record ? { record } : {};
+    }
+    async runCheck(connector, baseUrl, requestScope) {
+        const connectorId = connector.id;
+        const started = Date.now();
+        // Captured BEFORE anything downstream happens: everything after this point
+        // is a window in which the operator may replace the very credential being
+        // judged, and `settle` fences the write against exactly that.
+        const generation = await this.store.generation(connectorId);
+        const ctx = this.deps.contextFor(connectorId, baseUrl, requestScope);
+        let values = null;
+        if (connector.credential && this.deps.credentialVault) {
+            try {
+                values = await this.deps.credentialVault.getAll(connectorId);
+            }
+            catch (err) {
+                // A stored credential that cannot be decrypted (rotated key, corrupt
+                // envelope) is exactly the kind of dead credential this feature exists
+                // to surface early, so it is a verdict rather than a skip.
+                return this.settle(connectorId, started, generation, {
+                    state: "auth_required",
+                    checkedAt: new Date().toISOString(),
+                    message: msg(err),
+                });
+            }
+        }
+        const stored = connector.hasStoredCredential
+            ? await connector
+                .hasStoredCredential(ctx)
+                .catch(() => values !== null)
+            : values !== null;
+        if (!stored)
+            return { connectorId, skipped: "no_credential" };
+        if (!this.canAsk(connector, values)) {
+            return { connectorId, skipped: "not_checkable" };
+        }
+        try {
+            const verdict = await withTimeout(this.probe(connector, ctx, values), this.timeoutMs, `credential check of "${connectorId}"`);
+            return await this.settle(connectorId, started, generation, {
+                ...verdict,
+                checkedAt: new Date().toISOString(),
+            });
+        }
+        catch (err) {
+            return await this.settle(connectorId, started, generation, {
+                state: "error",
+                checkedAt: new Date().toISOString(),
+                message: msg(err),
+            });
+        }
+    }
+    /**
+     * `isCheckableConnector` re-asked against what is actually stored: the hook
+     * the declared shape selects, bound to a value that fits it (see
+     * {@link testHookFor}), or a `status()` to fall back on. Neither ⇒ there is no
+     * honest question to put to this connector.
+     */
+    canAsk(connector, values) {
+        return Boolean(testHookFor(connector, values) || connector.status);
+    }
+    /**
+     * Ask the connector whether the credential it holds still works — with no
+     * downstream mutation and no tool call. A credential test is preferred for a
+     * vault credential because it validates the stored value itself; `status()` is
+     * the downstream-OAuth answer (it refreshes the grant, which is the liveness
+     * question for a token).
+     */
+    async probe(connector, ctx, values) {
+        const test = testHookFor(connector, values);
+        if (test) {
+            const result = await test(ctx);
+            if (result.ok) {
+                return { state: "ok", ...(result.message ? { message: result.message } : {}) };
+            }
+            // A rejected stored credential needs an operator, not a retry — the same
+            // actionable state a revoked OAuth grant reports. There is no consent URL
+            // for a vault credential; /ui's credential form is where it is replaced.
+            return {
+                state: "auth_required",
+                message: result.message ??
+                    "Stored credential was rejected by the connector — replace it in /ui.",
+            };
+        }
+        const status = await connector.status(ctx);
+        return {
+            state: status.state,
+            ...(status.message ? { message: status.message } : {}),
+            ...(status.authorizationUrl
+                ? { authorizationUrl: status.authorizationUrl }
+                : {}),
+        };
+    }
+    async settle(connectorId, started, generation, record) {
+        const stored = await this.store.put(connectorId, record, generation);
+        return {
+            connectorId,
+            record,
+            ...(stored ? {} : { discarded: true }),
+            latencyMs: Date.now() - started,
+        };
+    }
+}
+/**
+ * Whether a liveness verdict may DECIDE a connector's cached status.
+ *
+ * Only `auth_required` ever does, and only while nothing better has happened
+ * since. Two separate judgements:
+ *
+ * 1. **`error` is not credential evidence.** A check that timed out, threw, or
+ *    got a 502 from the provider's status endpoint failed to *complete* — it
+ *    learned nothing about the credential. Letting it set the status would flip
+ *    a connector whose calls are fine to `error` for a whole interval on a DNS
+ *    blip. Error verdicts stay visible in `credentialCheck` (an operator wants
+ *    to know checks are failing) but the status keeps coming from observed real
+ *    calls, which is evidence.
+ * 2. **A successful real call retires the verdict.** Traffic beats a background
+ *    probe, so a `lastSuccessAt` at or after `checkedAt` means the credential
+ *    demonstrably works whatever the check concluded. The next check re-decides.
+ *
+ * `auth_required` deliberately outranks an observed real-call *failure*: both
+ * say something is wrong, and only one of them carries the URL that fixes it.
+ * The failure stays visible as `lastError`.
+ */
+export function credentialVerdictApplies(record, lastSuccessAt) {
+    if (!record || record.state !== "auth_required")
+        return false;
+    if (!lastSuccessAt)
+        return true;
+    const success = Date.parse(lastSuccessAt);
+    return Number.isNaN(success) || success < Date.parse(record.checkedAt);
+}
+//# sourceMappingURL=credential-health.js.map

package/dist/credential-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-health.js","sourceRoot":"","sources":["../src/credential-health.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,mDAAmD;AACnD,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,iFAAiF;AACjF,iBAAiB;AAEjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA4FzF,MAAM,CAAC,MAAM,yCAAyC,GAAG,GAAG,CAAC;AAC7D,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACrC,OAAO,cAAc,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,WAAmB;IACxC,OAAO,kBAAkB,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,GAAkB;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoC,CAAC;QACjE,IACE,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;YACnB,KAAK,CAAC,KAAK,KAAK,eAAe;YAC/B,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC;YAC1B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,yEAAyE;YACzE,2EAA2E;YAC3E,yEAAyE;YACzE,yDAAyD;YACzD,SAAS,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;YACxE,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ;gBAC5C,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB;IAON;IACA;IAPF,MAAM,GAAG,IAAI,GAAG,EAG9B,CAAC;IAEJ,YACmB,OAAkB,EAClB,MAAc;QADd,YAAO,GAAP,OAAO,CAAW;QAClB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,GAAkC,IAAI,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yBAAyB,WAAW,oCAAoC,GAAG,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;YACF,OAAO,MAAM,EAAE,MAAM,IAAI,SAAS,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,SAAS,CAAC;IAC7B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACP,WAAmB,EACnB,MAA8B,EAC9B,kBAA2B;QAE3B,IACE,kBAAkB,KAAK,SAAS;YAChC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,kBAAkB,EAC3D,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,SAAS,GACb,OAAO,KAAK,SAAS;YACrB,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;YAC9B,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAClC,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,CAAC;QACvD,IACE,SAAS;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC1D,gBAAgB,EAClB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yBAAyB,WAAW,2CAA2C,GAAG,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,WAAmB;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yBAAyB,WAAW,qCAAqC,GAAG,CAAC,GAAG,CAAC,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAyBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAoB;IACvD,MAAM,kBAAkB,GAAG,OAAO,CAChC,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,mBAAmB,CACtD,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CACpB,kBAAkB,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,SAAS,CAAC,MAAM,CAChE,CAAC;IACF,OAAO,kBAAkB,IAAI,MAAM,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,WAAW,CAClB,SAAoB,EACpB,MAAwC;IAExC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,eAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,cAAe,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,kBAAkB,CAC/B,KAAU,EACV,KAAa,EACb,EAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EACzC,KAAK,IAAI,EAAE;QACT,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CACF,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,uBAAuB;IAaf;IAZF,KAAK,CAAwB;IAC7B,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,SAAS,CAAS;IAClB,SAAS,CAAU;IACpC,sDAAsD;IACrC,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IAChE,wEAAwE;IAChE,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,CAA+C;IAE/D,YACmB,IAA0B,EAC3C,SAAiC,EAAE;QADlB,SAAI,GAAJ,IAAI,CAAsB;QAG3C,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,2EAA2E;QAC3E,0EAA0E;QAC1E,+BAA+B;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC;QACvC,IAAI,CAAC,UAAU;YACb,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;gBAC9D,CAAC,CAAC,OAAO,GAAG,IAAI;gBAChB,CAAC,CAAC,yCAAyC,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,WAAW;YACd,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;gBACpC,MAAM,CAAC,WAAW,GAAG,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,WAAW;gBACpB,CAAC,CAAC,oCAAoC,CAAC;QAC3C,IAAI,CAAC,SAAS;YACZ,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC;QACnE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,WAAmB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,MAA8B;QAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,WAAmB;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,wEAAwE;IACxE,sBAAsB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CACT,OAAe,EACf,OAA+B,EAAE;QAEjC,4EAA4E;QAC5E,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,OAAO,GAA8B,IAAI,CAAC,GAAG;YACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACxD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAC9D,OAAO,MAAM,KAAK,QAAQ;YACxB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,WAAoB,EAAE,CAAC;YACzE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CACzC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAe;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAAE,OAAO,SAAS,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,SAAoB,EACpB,OAAe,EACf,IAA4B;QAE5B,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,0EAA0E;YAC1E,0DAA0D;YAC1D,OAAO;gBACL,WAAW;gBACX,OAAO,EAAE,WAAW;gBACpB,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;aAC7C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,IACE,OAAO;gBACP,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,UAAU,EAC5D,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,SAAoB,EACpB,OAAe,EACf,YAAqB;QAErB,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,2EAA2E;QAC3E,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,MAAM,GAAqC,IAAI,CAAC;QACpD,IAAI,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,uEAAuE;gBACvE,2DAA2D;gBAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;oBACnD,KAAK,EAAE,eAAe;oBACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,mBAAmB;YAC1C,CAAC,CAAC,MAAM,SAAS;iBACZ,mBAAmB,CAAC,GAAG,CAAC;iBACxB,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC;YACjC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,EAClC,IAAI,CAAC,SAAS,EACd,wBAAwB,WAAW,GAAG,CACvC,CAAC;YACF,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;gBACzD,GAAG,OAAO;gBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;gBACzD,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,MAAM,CACZ,SAAoB,EACpB,MAAwC;QAExC,OAAO,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,KAAK,CACjB,SAAoB,EACpB,GAAqB,EACrB,MAAwC;QAExC,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACjF,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,OAAO;gBACL,KAAK,EAAE,eAAe;gBACtB,OAAO,EACL,MAAM,CAAC,OAAO;oBACd,sEAAsE;aACzE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,gBAAgB;gBACzB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,WAAmB,EACnB,OAAe,EACf,UAAkB,EAClB,MAA8B;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACrE,OAAO;YACL,WAAW;YACX,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA0C,EAC1C,aAAiC;IAEjC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACzE,CAAC"}

package/dist/credentials.d.ts

@@ -1,4 +1,4 @@
-import type { ConnectorCredentialValues, KVStorage } from "./types.js";
+import type { Connector, ConnectorCredentialValues, KVStorage } from "./types.js";
 export interface CredentialFieldMetadata {
     configured: true;
     /** Only emitted when the value is long enough that four chars don't leak much. */
@@ -13,6 +13,40 @@ export interface CredentialMetadata {
     /** Per-field masked metadata for named multi-value credentials. */
     fields?: Record<string, CredentialFieldMetadata>;
 }
+/** Which hook a testable credential is checked with. */
+export type CredentialTestMode = "single" | "multiple";
+/** A declared credential shape whose only test hook cannot test it. */
+export interface CredentialTestMismatch {
+    /** The shape the connector declared. */
+    shape: CredentialTestMode;
+    /** The hook it implements, which that shape cannot use. */
+    hook: "testCredential" | "testCredentials";
+}
+export interface CredentialTestRule {
+    /** The hook to call, or null when this credential cannot be tested at all. */
+    mode: CredentialTestMode | null;
+    /** Set only when the sole implemented hook is the one the shape cannot use. */
+    mismatch?: CredentialTestMismatch;
+}
+/**
+ * The one rule deciding whether a connector's credential can be tested — read
+ * by /ui's `testable` flag, by the `POST /ui/credentials/<id>/test` route when
+ * it picks a hook, and by the construction-time mismatch warning, so those
+ * three cannot drift apart.
+ *
+ * The declared credential *shape* selects the hook: named `credential.fields`
+ * are tested as a set by `testCredentials`, a single-value `credential` by
+ * `testCredential` on the vault's reserved `value` field. The other hook is
+ * never substituted — it would be handed a shape the connector never declared —
+ * so a connector implementing only the mismatched hook is not testable, and
+ * says so at construction rather than under an operator's click.
+ */
+export declare function credentialTestRule(connector: Pick<Connector, "credential" | "testCredential" | "testCredentials">): CredentialTestRule;
+/**
+ * One clause naming a mismatch, shared by the startup warning and the test
+ * route's 400 so an operator reads the same explanation in both places.
+ */
+export declare function describeCredentialTestMismatch(mismatch: CredentialTestMismatch): string;
 /**
  * Encrypted, connector-scoped credential vault over the deployment's existing
  * KVStorage. Only ciphertext enters KV; the AES-GCM key remains an environment

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAqBvE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,IAAI,CAAC;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,IAAI,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;CAClD;AAkGD;;;;GAIG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;gBAGtB,OAAO,EAAE,SAAS,EACnC,aAAa,EAAE,MAAM;IAiBvB,OAAO,CAAC,cAAc;YAIR,IAAI;IAoBZ,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,SAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIjE,MAAM,CACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAKtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAwBjE,GAAG,CACP,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC;IAOxB,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,yBAAyB,EACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC;IA2BxB,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjD"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,SAAS,EACT,yBAAyB,EACzB,SAAS,EACV,MAAM,YAAY,CAAC;AAqBpB,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,IAAI,CAAC;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,IAAI,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;CAClD;AAED,wDAAwD;AACxD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEvD,uEAAuE;AACvE,MAAM,WAAW,sBAAsB;IACrC,wCAAwC;IACxC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,2DAA2D;IAC3D,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,IAAI,CACb,SAAS,EACT,YAAY,GAAG,gBAAgB,GAAG,iBAAiB,CACpD,GACA,kBAAkB,CAYpB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,CAQR;AAkGD;;;;GAIG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;gBAGtB,OAAO,EAAE,SAAS,EACnC,aAAa,EAAE,MAAM;IAiBvB,OAAO,CAAC,cAAc;YAIR,IAAI;IAoBZ,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,SAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIjE,MAAM,CACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAKtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAwBjE,GAAG,CACP,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC;IAOxB,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,yBAAyB,EACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC;IA2BxB,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjD"}