@zackbart/connecta 0.8.0 → 0.9.0

package/dist/credential-health.js

@@ -1,610 +0,0 @@
-// Proactive liveness checks for the credentials connecta itself stores —
-// downstream-OAuth tokens and operator-managed vault credentials (issue #24).
-//
-// The problem this solves: a connector's auth state used to flip only when
-// something *observed* a failure, so an expired or revoked token surfaced
-// mid-task as a failed agent call. A liveness check asks the connector whether
-// the credential it holds still works, records the verdict, and lets the cached
-// status surfaces (`list_connectors({ probe: false })`, operator pages) report
-// `auth_required` BEFORE a real call discovers it.
-//
-// Runtime-agnostic on purpose: nothing here schedules itself. The core exposes a
-// due-gated sweep (piggybacked on inbound traffic by the server) and an awaited
-// entry point (`Connecta.checkCredentials()`) an operator wires to whatever
-// scheduler their runtime has — a Worker cron trigger, a Node `setInterval`.
-// There is no background daemon and no long-lived timer, so Workers and Node run
-// the same code.
-import { credentialTestRule, STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR, storedCredentialShape, } from "./credentials.js";
-import { closeConnectorScope, } from "./connector-scope.js";
-import { DEFAULT_PROBE_TIMEOUT_MS, normalizeTimeoutMs, withTimeout } from "./timeout.js";
-const DEFAULT_CREDENTIAL_CHECK_INTERVAL_SECONDS = 900;
-const DEFAULT_CREDENTIAL_CHECK_CONCURRENCY = 4;
-/**
- * How long a read of one connector's record is served from memory before going
- * back to storage. Short: it exists so a burst of `list_connectors` calls costs
- * one storage read rather than one per call, not to cache a verdict.
- */
-const MIRROR_TTL_MS = 5_000;
-/**
- * Minimum gap between storage WRITES of an unchanged verdict. A liveness
- * observation arrives from more than one place (the sweep, and every
- * `list_connectors({ probe: true })`), and re-persisting "still ok" on each one
- * would spend a KV write per probe for no new information. A verdict whose state
- * or message CHANGED is always written immediately.
- */
-const MIN_WRITE_GAP_MS = 60_000;
-function msg(err) {
-    return err instanceof Error ? err.message : String(err);
-}
-function storageKey(connectorId) {
-    return `credhealth:${connectorId}`;
-}
-/**
- * Generation counter key. Connector ids are `[a-z0-9_-]+`, so the extra colon
- * puts this outside the space `storageKey` can produce — no id can collide with
- * another id's counter.
- */
-function generationKey(connectorId) {
-    return `credhealth:gen:${connectorId}`;
-}
-function validRecord(raw) {
-    if (!raw)
-        return null;
-    try {
-        const value = JSON.parse(raw);
-        if ((value.state !== "ok" &&
-            value.state !== "auth_required" &&
-            value.state !== "error") ||
-            typeof value.checkedAt !== "string" ||
-            Number.isNaN(Date.parse(value.checkedAt))) {
-            return null;
-        }
-        const stamped = Date.parse(value.checkedAt);
-        const now = Date.now();
-        return {
-            state: value.state,
-            // A verdict from the future is a clock-skewed isolate, and left alone it
-            // would be permanently fresh (never re-checked) AND permanently newer than
-            // any real-call success (never retired) — a wrong answer that cannot age
-            // out. Clamping to now costs at most one early re-check.
-            checkedAt: stamped > now ? new Date(now).toISOString() : value.checkedAt,
-            ...(typeof value.message === "string" ? { message: value.message } : {}),
-            ...(typeof value.authorizationUrl === "string"
-                ? { authorizationUrl: value.authorizationUrl }
-                : {}),
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * The stored verdicts, in the deployment's own KVStorage under
- * `credhealth:<connectorId>`.
- *
- * Persisted rather than held in memory because the two runtimes disagree about
- * what "in memory" means: a Cloudflare cron trigger runs in a different isolate
- * from the fetch handlers, so a verdict only reaches `list_connectors` if it
- * goes through storage. The in-memory mirror is a read cache over that, not the
- * source of truth.
- *
- * Never throws: a check that cannot be persisted (or read back) must degrade to
- * "no verdict" rather than break the status surface that reads it.
- */
-class CredentialHealthStore {
-    storage;
-    logger;
-    mirror = new Map();
-    constructor(storage, logger) {
-        this.storage = storage;
-        this.logger = logger;
-    }
-    async get(connectorId) {
-        const cached = this.mirror.get(connectorId);
-        if (cached && Date.now() - cached.readAt < MIRROR_TTL_MS) {
-            return cached.record ?? undefined;
-        }
-        let record = null;
-        try {
-            record = validRecord(await this.storage.get(storageKey(connectorId)));
-        }
-        catch (err) {
-            this.logger.warn(`[connecta] connector "${connectorId}" credential-health read failed: ${msg(err)}`);
-            return cached?.record ?? undefined;
-        }
-        this.mirror.set(connectorId, { record, readAt: Date.now() });
-        return record ?? undefined;
-    }
-    /**
-     * Monotonic per-connector counter, advanced by {@link clear}. Read straight
-     * from storage, never from the mirror: its whole job is to notice a change
-     * another isolate made, which a read cache would hide.
-     *
-     * A read failure answers 0. Paired with the fence in `put`, that fails
-     * *closed* — a mismatched generation drops the verdict — because losing one
-     * verdict costs a re-check, while resurrecting one costs an operator a
-     * connector that reports dead after they just fixed it.
-     */
-    async generation(connectorId) {
-        try {
-            const raw = await this.storage.get(generationKey(connectorId));
-            const value = raw ? Number(raw) : 0;
-            return Number.isFinite(value) ? value : 0;
-        }
-        catch {
-            return 0;
-        }
-    }
-    /**
-     * Write a verdict. `expectedGeneration` fences the write against a `clear`
-     * that landed while the check was in flight: pass the generation captured
-     * before the check started, and the write is dropped if it has since advanced.
-     * Omit it for a verdict observed synchronously (a live probe, an operator's
-     * Test), where there is no window to race.
-     *
-     * Returns whether the verdict was actually stored.
-     */
-    async put(connectorId, record, expectedGeneration) {
-        if (expectedGeneration !== undefined &&
-            (await this.generation(connectorId)) !== expectedGeneration) {
-            // The credential this verdict judged was replaced or removed mid-check.
-            // Drop the mirror too: this isolate's idea of the verdict is as stale as
-            // the write it just declined to make.
-            this.mirror.delete(connectorId);
-            return false;
-        }
-        const current = await this.get(connectorId);
-        const unchanged = current !== undefined &&
-            current.state === record.state &&
-            current.message === record.message &&
-            current.authorizationUrl === record.authorizationUrl;
-        if (unchanged &&
-            Date.parse(record.checkedAt) - Date.parse(current.checkedAt) <
-                MIN_WRITE_GAP_MS) {
-            return true;
-        }
-        this.mirror.set(connectorId, { record, readAt: Date.now() });
-        try {
-            await this.storage.set(storageKey(connectorId), JSON.stringify(record));
-        }
-        catch (err) {
-            this.logger.warn(`[connecta] connector "${connectorId}" credential-health persistence failed: ${msg(err)}`);
-        }
-        return true;
-    }
-    /**
-     * Forget a connector's verdict, and advance its generation so a check already
-     * in flight — in this isolate or any other — cannot write the verdict it
-     * formed about the credential that was just replaced.
-     *
-     * Bump BEFORE the delete, the same ordering the OAuth force path uses: a
-     * racing writer must see the advance rather than land between the two writes.
-     */
-    async clear(connectorId) {
-        this.mirror.delete(connectorId);
-        try {
-            const next = (await this.generation(connectorId)) + 1;
-            await this.storage.set(generationKey(connectorId), String(next));
-            await this.storage.delete(storageKey(connectorId));
-        }
-        catch (err) {
-            this.logger.warn(`[connecta] connector "${connectorId}" credential-health reset failed: ${msg(err)}`);
-        }
-    }
-}
-/**
- * Whether a connector holds a credential connecta stores AND exposes a way to
- * ask whether it still works.
- *
- * Deliberately narrow. `listTools`/`callTool` are NOT liveness probes here: a
- * tool call may mutate downstream state, and the catalog path is already covered
- * by the existing probe. So a connector is checkable only through the two hooks
- * that exist to answer exactly this question — `testCredential(s)` (what the
- * Test button runs) and `status()` — and only when it has a credential of ours
- * to be asked about: an operator-managed `credential`, or a stored downstream
- * grant it reports via `hasStoredCredential`. A static-token connector stores
- * nothing here and is never probed on a timer.
- *
- * Whether a test hook counts is `credentialTestRule`'s call, not this function's
- * Credentials Test button and the credential API read (issue #55), so
- * a credential the operator cannot test by hand is not one a sweep tests behind
- * their back. A connector whose only hook cannot test its declared shape is
- * checkable only if it also implements `status()`.
- */
-function isCheckableConnector(connector) {
-    const hasCredentialStore = Boolean(connector.credential || connector.hasStoredCredential);
-    const canAsk = Boolean(credentialTestRule(connector).mode !== null || connector.status);
-    return hasCredentialStore && canAsk;
-}
-/**
- * The credential test the connector's DECLARED shape selects, bound to what is
- * actually stored — or undefined when there is no honest question to put.
- *
- * `isCheckableConnector` answers the static question ("could this connector be
- * asked at all"); this answers it against the vault. The hook itself is picked
- * by `credentialTestRule` (src/credentials.ts, issue #55), the one rule the UI's
- * `testable` flag and `POST /ui/credentials/<id>/test` also read: named
- * `credential.fields` are tested as a set by `testCredentials`, a single-value
- * `credential` by `testCredential` on the vault's reserved `value` field, and
- * the other hook is never substituted. Substituting it is what a sweep must not
- * do quietly — handing `testCredential` a `values.value` that named fields never
- * wrote would test the empty string and record a confident `auth_required` about
- * a credential nothing examined, and handing `testCredentials` the reserved
- * `{ value }` map would call a hook with a shape its connector never declared.
- * Either way the connector is skipped (`not_checkable`) rather than given an
- * invented verdict, and `createConnecta` already warned about the mismatch at
- * construction.
- */
-function testHookFor(connector, values) {
-    if (!connector.credential ||
-        storedCredentialShape(connector.credential, values).state !== "valid") {
-        return undefined;
-    }
-    const storedValues = values;
-    const { mode } = credentialTestRule(connector);
-    if (mode === "multiple") {
-        return (ctx) => connector.testCredentials(storedValues, ctx);
-    }
-    // A single-value shape with nothing under the reserved field is still nothing
-    // to test, so the stored value gets the last word even when the rule fits.
-    const storedValue = storedValues.value;
-    if (mode === "single" && typeof storedValue === "string") {
-        return (ctx) => connector.testCredential(storedValue, ctx);
-    }
-    return undefined;
-}
-/** Run `fn` over `items` with at most `limit` in flight, preserving order. */
-async function mapWithConcurrency(items, limit, fn) {
-    const out = Array(items.length);
-    const remaining = items.entries();
-    const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
-        for (;;) {
-            const next = remaining.next();
-            if (next.done)
-                return;
-            const [index, item] = next.value;
-            out[index] = await fn(item);
-        }
-    });
-    await Promise.all(workers);
-    return out;
-}
-/**
- * Runs and caches credential liveness checks. One instance per `Registry`.
- *
- * Cost is bounded four ways, because a status surface an agent polls must never
- * become a way to hammer a downstream auth endpoint:
- *
- * 1. **Eligibility** — only connectors holding a credential of ours are probed
- *    at all (`isCheckableConnector`), and only when something is actually stored.
- * 2. **Freshness (cross-isolate)** — a persisted verdict younger than
- *    `intervalSeconds` short-circuits the check, so every isolate and every
- *    trigger share one budget.
- * 3. **Sweep gate (per isolate)** — `sweepIfDue` runs at most one traffic-
- *    triggered sweep per interval per isolate, and never two at once, so a burst
- *    of requests costs one sweep, not one per request.
- * 4. **Deadline + fan-out bound** — each check is bounded by `timeoutMs` and at
- *    most `concurrency` run together (the same shape as the
- *    `discovery.probeTimeoutMs` bound on the discovery fan-out, issue #19).
- */
-export class CredentialHealthChecker {
-    deps;
-    store;
-    intervalMs;
-    concurrency;
-    timeoutMs;
-    onRequest;
-    /** Per-connector checks in flight in THIS isolate. */
-    inFlight = new Map();
-    /** Earliest a traffic-triggered sweep may run again in this isolate. */
-    nextSweepAt = 0;
-    sweeping;
-    constructor(deps, config = {}) {
-        this.deps = deps;
-        this.store = new CredentialHealthStore(deps.storage, deps.logger);
-        // Out-of-range tuning falls back to the default rather than being coerced:
-        // a zero or negative interval would turn the rate limit off, which is the
-        // one thing this class is for.
-        const seconds = config.intervalSeconds;
-        this.intervalMs =
-            seconds !== undefined && Number.isFinite(seconds) && seconds > 0
-                ? seconds * 1000
-                : DEFAULT_CREDENTIAL_CHECK_INTERVAL_SECONDS * 1000;
-        this.concurrency =
-            config.concurrency !== undefined &&
-                Number.isInteger(config.concurrency) &&
-                config.concurrency > 0
-                ? config.concurrency
-                : DEFAULT_CREDENTIAL_CHECK_CONCURRENCY;
-        this.timeoutMs =
-            normalizeTimeoutMs(config.timeoutMs) ?? DEFAULT_PROBE_TIMEOUT_MS;
-        this.onRequest = config.onRequest ?? true;
-    }
-    /**
-     * The stored verdict, if any. No downstream I/O — and no storage read at all
-     * for a connector that stores no credential of ours, since only a checkable
-     * connector can ever have had a verdict written. That keeps
-     * `list_connectors({ probe: false })` exactly as cheap as it was for the
-     * deployments this feature does not apply to.
-     */
-    healthFor(connectorId) {
-        const connector = this.deps.getConnector(connectorId);
-        if (!connector || !isCheckableConnector(connector)) {
-            return Promise.resolve(undefined);
-        }
-        return this.store.get(connectorId);
-    }
-    /**
-     * Record a liveness verdict observed elsewhere — today, the live status a
-     * `list_connectors({ probe: true })` just performed. Filtered by the same
-     * eligibility rule as a check, so this stays a record of *credential* health
-     * rather than a general status cache, and so it also counts against the
-     * freshness budget: an operator who just probed live does not get swept again
-     * moments later.
-     */
-    async record(connectorId, record) {
-        const connector = this.deps.getConnector(connectorId);
-        if (!connector || !isCheckableConnector(connector))
-            return;
-        await this.store.put(connectorId, record);
-    }
-    /** Forget a connector's verdict — its credential just changed under us. */
-    clear(connectorId) {
-        return this.store.clear(connectorId);
-    }
-    /** Whether any connector in this deployment could be checked at all. */
-    hasCheckableConnectors() {
-        return this.deps.listConnectors().some(isCheckableConnector);
-    }
-    /**
-     * Check every (or the named) connector's stored credential and return one
-     * outcome per connector considered. Never rejects: a connector that throws,
-     * hangs past `timeoutMs`, or cannot be persisted becomes an `error` verdict.
-     */
-    async check(baseUrl, opts = {}, defer) {
-        // An id naming no connector is reported, not dropped: a typo in a scheduled
-        // check would otherwise return an empty list that looks exactly like a
-        // deployment with nothing to check.
-        const targets = opts.ids
-            ? opts.ids.map((id) => this.deps.getConnector(id) ?? id)
-            : this.deps.listConnectors();
-        return mapWithConcurrency(targets, this.concurrency, (target) => typeof target === "string"
-            ? Promise.resolve({ connectorId: target, skipped: "not_found" })
-            : this.checkOne(target, baseUrl, opts, defer));
-    }
-    /**
-     * The traffic-triggered sweep: a promise to hand to `ctx.waitUntil`, or
-     * `undefined` when nothing is due (the common case, and free — no I/O). The
-     * gate is armed BEFORE the sweep starts, so a burst of concurrent requests
-     * produces one sweep.
-     */
-    sweepIfDue(baseUrl, defer) {
-        if (!this.onRequest || this.sweeping)
-            return undefined;
-        const now = Date.now();
-        if (now < this.nextSweepAt)
-            return undefined;
-        if (!this.hasCheckableConnectors())
-            return undefined;
-        this.nextSweepAt = now + this.intervalMs;
-        const sweep = this.check(baseUrl, {}, defer).finally(() => {
-            this.sweeping = undefined;
-        });
-        this.sweeping = sweep;
-        return sweep;
-    }
-    async checkOne(connector, baseUrl, opts, defer) {
-        const connectorId = connector.id;
-        if (!isCheckableConnector(connector)) {
-            return { connectorId, skipped: "not_checkable" };
-        }
-        if (this.inFlight.has(connectorId)) {
-            // Report rather than join: the caller wants to know a check happened, not
-            // to be blocked behind one someone else already pays for.
-            return {
-                connectorId,
-                skipped: "in_flight",
-                ...(await this.recordOrNothing(connectorId)),
-            };
-        }
-        const run = this.runCheck(connector, baseUrl, opts.force ?? false, defer);
-        this.inFlight.set(connectorId, run);
-        try {
-            return await run;
-        }
-        finally {
-            this.inFlight.delete(connectorId);
-        }
-    }
-    async recordOrNothing(connectorId) {
-        const record = await this.store.get(connectorId);
-        return record ? { record } : {};
-    }
-    async runCheck(connector, baseUrl, force, defer) {
-        const connectorId = connector.id;
-        const started = Date.now();
-        // Captured BEFORE anything downstream happens — including the vault read
-        // below: everything after this point is a window in which the operator may
-        // replace the very credential being judged, and `settle` fences the write
-        // against exactly that. It cannot move later to save a read on the fresh
-        // path; a generation sampled AFTER the values would miss a `clear` that
-        // landed between the two and let a verdict about the replaced credential
-        // through the fence.
-        const generation = await this.store.generation(connectorId);
-        let values = null;
-        let credentialReadError;
-        if (connector.credential && this.deps.credentialVault) {
-            try {
-                values = await this.deps.credentialVault.getAll(connectorId);
-            }
-            catch (err) {
-                credentialReadError = err;
-            }
-            const shape = storedCredentialShape(connector.credential, values);
-            if (shape.state === "mismatch") {
-                // Drift is a persistent operator-reconfiguration state, not an event:
-                // outside the freshness gate it would spend a write on every sweep in
-                // every isolate, forever, against exactly the deployments this feature
-                // is meant to help (and on Cloudflare KV those writes are metered).
-                // Once the SAME drift verdict is already stored and still fresh, this
-                // is the rate limit doing its job, same as a fresh `ok`. A stored
-                // verdict that says anything else — a pre-redeploy `ok`, a different
-                // message — is still replaced immediately, which is the whole point of
-                // checking the shape before the gate.
-                if (!force) {
-                    const current = await this.store.get(connectorId);
-                    if (current &&
-                        current.state === "auth_required" &&
-                        current.message === shape.message &&
-                        Date.now() - Date.parse(current.checkedAt) < this.intervalMs) {
-                        return { connectorId, skipped: "fresh", record: current };
-                    }
-                }
-                return this.settle(connectorId, started, generation, {
-                    // Unlike a failed check, this is a completed static classification:
-                    // the current declaration cannot consume what the vault holds.
-                    state: "auth_required",
-                    checkedAt: new Date().toISOString(),
-                    message: shape.message,
-                });
-            }
-        }
-        // Shape drift is checked before this shortcut so an old, still-fresh `ok`
-        // cannot survive a redeploy that changed the credential declaration.
-        if (!force) {
-            const current = await this.store.get(connectorId);
-            if (current &&
-                Date.now() - Date.parse(current.checkedAt) < this.intervalMs) {
-                return { connectorId, skipped: "fresh", record: current };
-            }
-        }
-        // Credential checks are always probe owners. No caller may lend them an
-        // ordinary request scope and thereby suppress the teardown below.
-        const scope = {};
-        const ctx = this.deps.contextFor(connectorId, baseUrl, scope);
-        try {
-            if (credentialReadError) {
-                // A stored credential that cannot be decrypted (rotated key, corrupt
-                // envelope) is exactly the kind of dead credential this feature
-                // exists to surface early, so it is a verdict rather than a skip.
-                return this.settle(connectorId, started, generation, {
-                    state: "auth_required",
-                    checkedAt: new Date().toISOString(),
-                    message: msg(credentialReadError),
-                });
-            }
-            const stored = connector.hasStoredCredential
-                ? await connector
-                    .hasStoredCredential(ctx)
-                    .catch(() => values !== null)
-                : values !== null;
-            if (!stored)
-                return { connectorId, skipped: "no_credential" };
-            if (!this.canAsk(connector, values)) {
-                return { connectorId, skipped: "not_checkable" };
-            }
-            try {
-                const verdict = await withTimeout(this.probe(connector, ctx, values), this.timeoutMs, `credential check of "${connectorId}"`);
-                return await this.settle(connectorId, started, generation, {
-                    ...verdict,
-                    checkedAt: new Date().toISOString(),
-                });
-            }
-            catch (err) {
-                return await this.settle(connectorId, started, generation, {
-                    state: "error",
-                    checkedAt: new Date().toISOString(),
-                    message: msg(err),
-                });
-            }
-        }
-        finally {
-            await closeConnectorScope(connector, ctx, defer);
-        }
-    }
-    /**
-     * `isCheckableConnector` re-asked against what is actually stored: the hook
-     * the declared shape selects, bound to a value that fits it (see
-     * {@link testHookFor}), or a `status()` to fall back on. Neither ⇒ there is no
-     * honest question to put to this connector.
-     */
-    canAsk(connector, values) {
-        return Boolean(testHookFor(connector, values) || connector.status);
-    }
-    /**
-     * Ask the connector whether the credential it holds still works — with no
-     * downstream mutation and no tool call. A credential test is preferred for a
-     * vault credential because it validates the stored value itself; `status()` is
-     * the downstream-OAuth answer (it refreshes the grant, which is the liveness
-     * question for a token).
-     */
-    async probe(connector, ctx, values) {
-        const test = testHookFor(connector, values);
-        if (test) {
-            const result = await test(ctx);
-            if (result.ok) {
-                return { state: "ok", ...(result.message ? { message: result.message } : {}) };
-            }
-            // A rejected stored credential needs an operator, not a retry — the same
-            // actionable state a revoked OAuth grant reports. There is no consent URL
-            // for a vault credential; /credentials is where it is replaced.
-            return {
-                state: "auth_required",
-                message: result.message ??
-                    "Stored credential was rejected by the connector — replace it in /credentials.",
-            };
-        }
-        const status = await connector.status(ctx);
-        return {
-            state: status.state,
-            ...(status.message ? { message: status.message } : {}),
-            ...(status.authorizationUrl
-                ? { authorizationUrl: status.authorizationUrl }
-                : {}),
-        };
-    }
-    async settle(connectorId, started, generation, record) {
-        const stored = await this.store.put(connectorId, record, generation);
-        return {
-            connectorId,
-            record,
-            ...(stored ? {} : { discarded: true }),
-            latencyMs: Date.now() - started,
-        };
-    }
-}
-/**
- * Whether a liveness verdict may DECIDE a connector's cached status.
- *
- * Only `auth_required` ever does, and only while nothing better has happened
- * since. Two separate judgements:
- *
- * 1. **`error` is not credential evidence.** A check that timed out, threw, or
- *    got a 502 from the provider's status endpoint failed to *complete* — it
- *    learned nothing about the credential. Letting it set the status would flip
- *    a connector whose calls are fine to `error` for a whole interval on a DNS
- *    blip. Error verdicts stay visible in `credentialCheck` (an operator wants
- *    to know checks are failing) but the status keeps coming from observed real
- *    calls, which is evidence.
- * 2. **A successful real call retires the verdict, except static shape drift.**
- *    Traffic beats a background probe, so a `lastSuccessAt` at or after
- *    `checkedAt` normally means the credential demonstrably works. Stored-shape
- *    drift is different: a credential-independent tool can succeed without
- *    making a missing declared field appear, so only replacement/removal clears
- *    that verdict.
- *
- * `auth_required` deliberately outranks an observed real-call *failure*: both
- * say something is wrong, and only one of them carries the URL that fixes it.
- * The failure stays visible as `lastError`.
- */
-export function credentialVerdictApplies(record, lastSuccessAt) {
-    if (!record || record.state !== "auth_required")
-        return false;
-    if (record.message === STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR)
-        return true;
-    if (!lastSuccessAt)
-        return true;
-    const success = Date.parse(lastSuccessAt);
-    return Number.isNaN(success) || success < Date.parse(record.checkedAt);
-}
-//# sourceMappingURL=credential-health.js.map

package/dist/credential-health.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-health.js","sourceRoot":"","sources":["../src/credential-health.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,mDAAmD;AACnD,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,iFAAiF;AACjF,iBAAiB;AAEjB,OAAO,EACL,kBAAkB,EAClB,sCAAsC,EACtC,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA4FzF,MAAM,yCAAyC,GAAG,GAAG,CAAC;AACtD,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAE/C;;;;GAIG;AACH,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACrC,OAAO,cAAc,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,WAAmB;IACxC,OAAO,kBAAkB,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,GAAkB;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoC,CAAC;QACjE,IACE,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;YACnB,KAAK,CAAC,KAAK,KAAK,eAAe;YAC/B,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC;YAC1B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,yEAAyE;YACzE,2EAA2E;YAC3E,yEAAyE;YACzE,yDAAyD;YACzD,SAAS,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;YACxE,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ;gBAC5C,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB;IAON;IACA;IAPF,MAAM,GAAG,IAAI,GAAG,EAG9B,CAAC;IAEJ,YACmB,OAAkB,EAClB,MAAc;QADd,YAAO,GAAP,OAAO,CAAW;QAClB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,GAAkC,IAAI,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yBAAyB,WAAW,oCAAoC,GAAG,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;YACF,OAAO,MAAM,EAAE,MAAM,IAAI,SAAS,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,SAAS,CAAC;IAC7B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACP,WAAmB,EACnB,MAA8B,EAC9B,kBAA2B;QAE3B,IACE,kBAAkB,KAAK,SAAS;YAChC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,kBAAkB,EAC3D,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,SAAS,GACb,OAAO,KAAK,SAAS;YACrB,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;YAC9B,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAClC,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,CAAC;QACvD,IACE,SAAS;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC1D,gBAAgB,EAClB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yBAAyB,WAAW,2CAA2C,GAAG,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,WAAmB;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yBAAyB,WAAW,qCAAqC,GAAG,CAAC,GAAG,CAAC,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA4BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,oBAAoB,CAAC,SAAoB;IAChD,MAAM,kBAAkB,GAAG,OAAO,CAChC,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,mBAAmB,CACtD,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CACpB,kBAAkB,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,SAAS,CAAC,MAAM,CAChE,CAAC;IACF,OAAO,kBAAkB,IAAI,MAAM,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,WAAW,CAClB,SAAoB,EACpB,MAAwC;IAExC,IACE,CAAC,SAAS,CAAC,UAAU;QACrB,qBAAqB,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,OAAO,EACrE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,MAAO,CAAC;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,eAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC;IACvC,IAAI,IAAI,KAAK,QAAQ,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,cAAe,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,kBAAkB,CAC/B,KAAU,EACV,KAAa,EACb,EAA2B;IAE3B,MAAM,GAAG,GAAG,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EACzC,KAAK,IAAI,EAAE;QACT,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,IAAI;gBAAE,OAAO;YACtB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;YACjC,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CACF,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,uBAAuB;IAaf;IAZF,KAAK,CAAwB;IAC7B,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,SAAS,CAAS;IAClB,SAAS,CAAU;IACpC,sDAAsD;IACrC,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IAChE,wEAAwE;IAChE,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,CAA+C;IAE/D,YACmB,IAA0B,EAC3C,SAAiC,EAAE;QADlB,SAAI,GAAJ,IAAI,CAAsB;QAG3C,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,2EAA2E;QAC3E,0EAA0E;QAC1E,+BAA+B;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC;QACvC,IAAI,CAAC,UAAU;YACb,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;gBAC9D,CAAC,CAAC,OAAO,GAAG,IAAI;gBAChB,CAAC,CAAC,yCAAyC,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,WAAW;YACd,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;gBACpC,MAAM,CAAC,WAAW,GAAG,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,WAAW;gBACpB,CAAC,CAAC,oCAAoC,CAAC;QAC3C,IAAI,CAAC,SAAS;YACZ,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC;QACnE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,WAAmB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,MAA8B;QAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,WAAmB;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,wEAAwE;IACxE,sBAAsB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CACT,OAAe,EACf,OAA+B,EAAE,EACjC,KAAoB;QAEpB,4EAA4E;QAC5E,uEAAuE;QACvE,oCAAoC;QACpC,MAAM,OAAO,GAA8B,IAAI,CAAC,GAAG;YACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACxD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAC9D,OAAO,MAAM,KAAK,QAAQ;YACxB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,WAAoB,EAAE,CAAC;YACzE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAChD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,UAAU,CACR,OAAe,EACf,KAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAAE,OAAO,SAAS,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACxD,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,SAAoB,EACpB,OAAe,EACf,IAA4B,EAC5B,KAAoB;QAEpB,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,0EAA0E;YAC1E,0DAA0D;YAC1D,OAAO;gBACL,WAAW;gBACX,OAAO,EAAE,WAAW;gBACpB,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;aAC7C,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CACvB,SAAS,EACT,OAAO,EACP,IAAI,CAAC,KAAK,IAAI,KAAK,EACnB,KAAK,CACN,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,SAAoB,EACpB,OAAe,EACf,KAAc,EACd,KAAoB;QAEpB,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,MAAM,GAAqC,IAAI,CAAC;QACpD,IAAI,mBAA4B,CAAC;QACjC,IAAI,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mBAAmB,GAAG,GAAG,CAAC;YAC5B,CAAC;YACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC/B,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,oEAAoE;gBACpE,sEAAsE;gBACtE,kEAAkE;gBAClE,qEAAqE;gBACrE,uEAAuE;gBACvE,sCAAsC;gBACtC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBAClD,IACE,OAAO;wBACP,OAAO,CAAC,KAAK,KAAK,eAAe;wBACjC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;wBACjC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,UAAU,EAC5D,CAAC;wBACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;oBACnD,oEAAoE;oBACpE,+DAA+D;oBAC/D,KAAK,EAAE,eAAe;oBACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,IACE,OAAO;gBACP,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,UAAU,EAC5D,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,mBAAmB,EAAE,CAAC;gBACxB,qEAAqE;gBACrE,gEAAgE;gBAChE,kEAAkE;gBAClE,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;oBACnD,KAAK,EAAE,eAAe;oBACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,GAAG,CAAC,mBAAmB,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,mBAAmB;gBAC1C,CAAC,CAAC,MAAM,SAAS;qBACZ,mBAAmB,CAAC,GAAG,CAAC;qBACxB,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC;gBACjC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;YACpB,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnD,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,EAClC,IAAI,CAAC,SAAS,EACd,wBAAwB,WAAW,GAAG,CACvC,CAAC;gBACF,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;oBACzD,GAAG,OAAO;oBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;oBACzD,KAAK,EAAE,OAAO;oBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,mBAAmB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,MAAM,CACZ,SAAoB,EACpB,MAAwC;QAExC,OAAO,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,KAAK,CACjB,SAAoB,EACpB,GAAqB,EACrB,MAAwC;QAExC,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACjF,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,gEAAgE;YAChE,OAAO;gBACL,KAAK,EAAE,eAAe;gBACtB,OAAO,EACL,MAAM,CAAC,OAAO;oBACd,+EAA+E;aAClF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,gBAAgB;gBACzB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,WAAmB,EACnB,OAAe,EACf,UAAkB,EAClB,MAA8B;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACrE,OAAO;YACL,WAAW;YACX,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA0C,EAC1C,aAAiC;IAEjC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,MAAM,CAAC,OAAO,KAAK,sCAAsC;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACzE,CAAC"}