node-autotask 0.8.0 → 0.8.1

package/dist/chunk-FE225M76.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/logger.ts","../src/redact.ts","../src/errors.ts"],"sourcesContent":["/**\n * Logger hook + credential redaction (ARCHITECTURE sections 14, 9).\n *\n * The transport logs at `debug` per request (method and path only — never query\n * values, never header values) and at `warn` on retry/429. The redaction set\n * covers the four credential-shaped header names plus `authToken`\n * (name-based, case-insensitive, caller-extensible). `NoopLogger` is the\n * default sink; `Logger` methods are all optional so `console` is assignable.\n */\n\nexport interface Logger {\n  debug?(message: string, ...args: unknown[]): void;\n  info?(message: string, ...args: unknown[]): void;\n  warn?(message: string, ...args: unknown[]): void;\n  error?(message: string, ...args: unknown[]): void;\n}\n\n/** Default no-op logger. */\nexport const NoopLogger: Logger = {};\n\n/** Replacement value written over every credential-shaped value. */\nexport const REDACTED = '[REDACTED]';\n\n/**\n * Credential-shaped header names redacted by name (case-insensitive,\n * separator-insensitive). `authToken` included: token responses are credential\n * payloads (ARCHITECTURE section 9).\n */\nexport const CREDENTIAL_HEADER_NAMES: readonly string[] = [\n  'ApiIntegrationCode',\n  'UserName',\n  'Secret',\n  'ImpersonationResourceId',\n  'authToken',\n];\n\n/** Keys are compared lower-cased with `_`/`-` removed, so every spelling of the same name matches. */\nfunction normalizeKey(key: string): string {\n  return key.toLowerCase().replace(/[_-]/g, '');\n}\n\nconst CREDENTIAL_KEY_SET: ReadonlySet<string> = new Set<string>(CREDENTIAL_HEADER_NAMES.map(normalizeKey));\n\n/** True when `name` matches a credential-shaped key (built-in set or `extraSecretKeys`). */\nexport function isCredentialHeaderName(name: string, extraSecretKeys?: readonly string[]): boolean {\n  const normalized = normalizeKey(name);\n  if (CREDENTIAL_KEY_SET.has(normalized)) return true;\n  if (extraSecretKeys === undefined) return false;\n  return extraSecretKeys.some((extra) => normalizeKey(extra) === normalized);\n}\n\n/** A plain record: object whose prototype is Object.prototype or null. */\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n\n/**\n * Recursively replace credential-shaped keys with `[REDACTED]`. Returns a copy\n * — the input is never mutated. The one redactor used for audit payloads and\n * log-side data (the transport never interpolates header values into log lines).\n * Class instances (Date, Blob, ...) are opaque and passed through unchanged.\n */\nexport function redactRecord(value: unknown, extraSecretKeys?: readonly string[]): unknown {\n  if (Array.isArray(value)) {\n    return value.map((item) => redactRecord(item, extraSecretKeys));\n  }\n  if (isPlainRecord(value)) {\n    const out: Record<string, unknown> = {};\n    for (const [key, item] of Object.entries(value)) {\n      out[key] = isCredentialHeaderName(key, extraSecretKeys) ? REDACTED : redactRecord(item, extraSecretKeys);\n    }\n    return out;\n  }\n  return value;\n}\n","/**\n * Response-side field redaction (the INV-A1 leak hotfix).\n *\n * The A1 leak audit (.run/reports/leak-audit.md) confirmed the SDK response\n * path is a pass-through: plaintext credential field values (password,\n * secretKey, secret) and personal/business-sensitive data reach every caller.\n * This module is the single transform applied at the two response sites:\n *\n * - the 2xx branch of `HttpClient.request()` (src/http.ts) — the choke point\n *   for every JSON response surface (dedicated tools, invoke, compositions);\n * - `errorFromStatus` (src/errors.ts) — the vendor 4xx/5xx body (vendorError\n *   + the adopted message), which may echo a request body that carried a\n *   secret.\n *\n * Two classes, two behaviors (the A1 design):\n *\n * - SECRET (always redacted, NO opt-out): the pinned exact vendor-casing key\n *   set `password` / `secretKey` / `secret`. The A1 census proves these 3\n *   names are secret-only across all 787 swagger definitions (17,167 leaf\n *   fields), so name-based matching is safe — exact case-sensitive keys, no\n *   regex. The SDK is the only permission boundary (the vendor API has no\n *   read-only key), so credential values never cross the SDK boundary in a\n *   response.\n * - PII + CONFIDENTIAL (redacted by DEFAULT, opt-out via\n *   `redactPersonalData: false`): the pinned name sets from the A1 artifacts\n *   (41 personal + 12 confidential, exact vendor casing).\n *\n * EXEMPT: `authToken` (AuthTokenResultModel, GET /V1.0/Authenticate) — the\n * endpoint's purpose is token issuance; it is in no pinned set and is never\n * redacted (pinned by test).\n *\n * RESPONSE-ONLY by design: request bodies are NEVER redacted (password /\n * secretKey legitimately travel IN create/patch requests; the G10b\n * request-body-audit redaction in utils/index.ts is a separate mechanism and\n * is untouched). The transform redacts a key wherever it appears in the\n * parsed body (deep — object values, arrays of items, nested models),\n * replaces the VALUE with the existing `REDACTED` marker (src/logger.ts),\n * keeps the key (stable shape), returns a copy, and never mutates the input.\n */\nimport { REDACTED } from './logger.js';\n\n/**\n * The SECRET class — ALWAYS redacted, no opt-out. Pinned exact vendor casing\n * (case-sensitive; the A1 census: each name appears only on secret-bearing\n * models). A pinned set, not a regex — see the module header for why.\n */\nexport const SECRET_RESPONSE_FIELDS: readonly string[] = [\n  'password',       // ClientPortalUserModel\n  'secretKey',      // the 5 webhook models\n  'secret',         // IntegrationVendorInsightModel, IntegrationVendorWidgetModel\n];\n\n/**\n * The PII class — redacted by default, opt-out via `redactPersonalData:\n * false`. The 41 personal-data names from the A1 artifact (pii-refined.json\n * \"personal\"), exact vendor casing as found in the vendored swagger.\n */\nexport const PERSONAL_RESPONSE_FIELDS: readonly string[] = [\n  'additionalAddressInformation',\n  'additionalBillToAddressInformation',\n  'additionalShipToAddressInformation',\n  'address1',\n  'address2',\n  'addressLine',\n  'addressLine1',\n  'alternatePhone',\n  'alternatePhone1',\n  'alternatePhone2',\n  'billingAddress1',\n  'billingAddress2',\n  'billToAdditionalAddressInformation',\n  'billToCity',\n  'billToPostalCode',\n  'billToZipCode',\n  'city',\n  'email',\n  'email2',\n  'email3',\n  'emailAddress',\n  'emailAddress2',\n  'emailAddress3',\n  'extApprovalContactResponse',\n  'fax',\n  'faxNumber',\n  'gender',\n  'homePhone',\n  'mobilePhone',\n  'notificationEmailAddress',\n  'officePhone',\n  'phone',\n  'postalCode',\n  'recipientEmailAddress',\n  'rmmIsMobileDeviceManagementEnrolled',\n  'shipToAddress1',\n  'shipToAddress2',\n  'shipToCity',\n  'shipToPostalCode',\n  'userName',\n  'zipCode',\n];\n\n/**\n * The CONFIDENTIAL class (business/device-sensitive) — redacted by default,\n * opt-out via `redactPersonalData: false`. The 12 names from the A1 artifact\n * (pii-refined.json \"business\"), exact vendor casing (note `taxID`, not\n * `taxId`; `rmmDeviceAuditSNMPContact` with the vendor's SNMP casing).\n */\nexport const CONFIDENTIAL_RESPONSE_FIELDS: readonly string[] = [\n  'domain',\n  'domainExpirationDateTime',\n  'domainLastUpdatedDateTime',\n  'domainRegistrationDateTime',\n  'primaryContact',\n  'rmmDeviceAuditExternalIPAddress',\n  'rmmDeviceAuditIPAddress',\n  'rmmDeviceAuditMacAddress',\n  'rmmDeviceAuditMobileNumber',\n  'rmmDeviceAuditSNMPContact',\n  'taxID',\n  'webAddress',\n];\n\nconst SECRET_SET = new Set<string>(SECRET_RESPONSE_FIELDS);\nconst OPTIONAL_SET = new Set<string>([...PERSONAL_RESPONSE_FIELDS, ...CONFIDENTIAL_RESPONSE_FIELDS]);\n\n/** The redaction policy for one transform run (resolved from AutotaskConfig). */\nexport interface RedactionPolicy {\n  /**\n   * Redact the PII + CONFIDENTIAL classes. `false` (the `redactPersonalData:\n   * false` opt-out) passes those fields through unredacted; the SECRET class\n   * is ALWAYS redacted regardless.\n   */\n  redactPersonalData: boolean;\n}\n\n/** A plain record (prototype Object.prototype or null) — class instances are opaque. */\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n\n/**\n * Whether a field NAME is redacted under the policy (the SAME key-name sets\n * the response transform uses: SECRET always; PII + CONFIDENTIAL when\n * `redactPersonalData` is on). Exact vendor casing, case-sensitive.\n */\nexport function isRedactedFieldName(name: string, policy: RedactionPolicy): boolean {\n  return SECRET_SET.has(name) || (policy.redactPersonalData && OPTIONAL_SET.has(name));\n}\n\n/**\n * Deep-redact the pinned response field names. Returns a copy (the input is\n * never mutated); the value of every key in a pinned set is replaced with the\n * `REDACTED` marker ('[REDACTED]'), the key itself is kept (stable shape).\n * Keys are matched by exact vendor casing (case-sensitive); scalars, null,\n * class instances and empty containers pass through unchanged.\n */\nexport function redactResponseBody(value: unknown, policy: RedactionPolicy): unknown {\n  const personal = policy.redactPersonalData;\n  if (Array.isArray(value)) {\n    return value.map((entry) => redactResponseBody(entry, policy));\n  }\n  if (!isPlainRecord(value)) return value;\n  const out: Record<string, unknown> = {};\n  for (const [key, entry] of Object.entries(value)) {\n    const pinned = SECRET_SET.has(key) || (personal && OPTIONAL_SET.has(key));\n    out[key] = pinned ? REDACTED : redactResponseBody(entry, policy);\n  }\n  return out;\n}\n","import { redactResponseBody } from './redact.js';\n\n/**\n * AutotaskError hierarchy (ARCHITECTURE section 10).\n *\n * Every error carries the structured contract: `code` (stable SCREAMING_SNAKE\n * machine code), `category`, `retryable`, plus `operation`, `httpStatus`,\n * `vendorError` (the vendor payload under a documented key, deep-redacted —\n * the INV-A1 hotfix), `resourceIds`,\n * `suggestedAction` (deterministic next step only), `correlationId` and `url`.\n *\n * `item: null` on a single GET (HTTP 200) is a NOT FOUND, not a success — the\n * vendor's not-found signal (G1 envelope.md). The vendor documents no error\n * bodies; the shape `{ errors: [{ message, field?, code? }] }` is pinned from\n * the node's errorHandler and parsed defensively here.\n */\n\nexport type ErrorCategory =\n  | 'auth'\n  | 'not_found'\n  | 'validation'\n  | 'conflict'\n  | 'rate_limit'\n  | 'server'\n  | 'network'\n  | 'timeout'\n  | 'resolution'\n  | 'policy';\n\nexport interface AutotaskErrorOptions {\n  code?: string;\n  category?: ErrorCategory;\n  operation?: string;\n  httpStatus?: number;\n  vendorError?: unknown;\n  resourceIds?: number[];\n  suggestedAction?: string;\n  correlationId?: string;\n  retryable?: boolean;\n  url?: string;\n  /**\n   * The structured, deterministic extras that ride on the error WITHOUT\n   * changing its contract: issue #9 — the recovery refusals' payload\n   * (`{ resource, reason/note, ... }` on DELETE_BOUNDARY /\n   * MARKER_UNSAFE_ID / RECOVERY_TRUNCATED); issue #14 — `emptyReason`\n   * (the typed reason a miss / drift carries — { kind, note, authority,\n   * remedy }) and `pointerNote` (the known-unusable-op pointer sentence).\n   * Additive only — the status, code, message and retryability are never\n   * derived from it.\n   */\n  details?: Record<string, unknown>;\n}\n\n/** A plain object record (prototype Object.prototype or null). */\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n\nexport class AutotaskError extends Error {\n  code: string;\n  category: ErrorCategory;\n  operation?: string;\n  httpStatus?: number;\n  vendorError?: unknown;\n  resourceIds?: number[];\n  suggestedAction?: string;\n  correlationId?: string;\n  retryable: boolean;\n  url?: string;\n  /** Issue #9/#14: the additive structured extras (recovery refusal payload; emptyReason / pointerNote) — never changes the error contract. */\n  details?: Record<string, unknown>;\n\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message);\n    this.name = 'AutotaskError';\n    this.code = options.code ?? 'AUTOTASK_ERROR';\n    this.category = options.category ?? 'server';\n    this.retryable = options.retryable ?? false;\n    this.operation = options.operation;\n    this.httpStatus = options.httpStatus;\n    this.vendorError = options.vendorError;\n    this.resourceIds = options.resourceIds;\n    this.suggestedAction = options.suggestedAction;\n    this.correlationId = options.correlationId;\n    this.url = options.url;\n    this.details = options.details;\n    Error.captureStackTrace?.(this, this.constructor);\n  }\n}\n\nexport class AutotaskConfigError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'CONFIG_ERROR', category: 'validation', ...options });\n    this.name = 'AutotaskConfigError';\n  }\n}\n\nexport class AutotaskNetworkError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, {\n      code: 'NETWORK_ERROR',\n      category: 'network',\n      retryable: true,\n      suggestedAction: options.suggestedAction ?? 'Check connectivity to the Autotask zone and retry.',\n      ...options,\n    });\n    this.name = 'AutotaskNetworkError';\n  }\n}\n\nexport class AutotaskTimeoutError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, {\n      code: 'TIMEOUT',\n      category: 'timeout',\n      retryable: true,\n      suggestedAction: options.suggestedAction ?? 'Retry, narrow the query, or raise timeoutMs.',\n      ...options,\n    });\n    this.name = 'AutotaskTimeoutError';\n  }\n}\n\n/** The caller's `AbortSignal` fired: distinct from a timeout, never retried. */\nexport class AutotaskAbortError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'ABORTED', category: 'network', retryable: false, ...options });\n    this.name = 'AutotaskAbortError';\n  }\n}\n\n/** A response (or redirect) the transport refuses by policy: non-retryable. */\nexport class ResponseRejectedError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'RESPONSE_REJECTED', category: 'policy', retryable: false, ...options });\n    this.name = 'ResponseRejectedError';\n  }\n}\n\nexport class BadRequestError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'BAD_REQUEST', category: 'validation', ...options });\n    this.name = 'BadRequestError';\n  }\n}\n\nexport class UnauthorizedError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'UNAUTHORIZED', category: 'auth', ...options });\n    this.name = 'UnauthorizedError';\n  }\n}\n\nexport class ForbiddenError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'FORBIDDEN', category: 'auth', ...options });\n    this.name = 'ForbiddenError';\n  }\n}\n\nexport class NotFoundError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'NOT_FOUND', category: 'not_found', ...options });\n    this.name = 'NotFoundError';\n  }\n}\n\nexport class ConflictError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'CONFLICT', category: 'conflict', ...options });\n    this.name = 'ConflictError';\n  }\n}\n\nexport class UnprocessableEntityError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'VALIDATION_FAILED', category: 'validation', ...options });\n    this.name = 'UnprocessableEntityError';\n  }\n}\n\nexport class RateLimitError extends AutotaskError {\n  /** Seconds the server asked the client to wait (`Retry-After`), when present. */\n  retryAfter?: number;\n  /** True when the call was refused locally (the tenant cooldown gate) and never sent. */\n  notSent?: boolean;\n\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'RATE_LIMITED', category: 'rate_limit', retryable: true, ...options });\n    this.name = 'RateLimitError';\n  }\n}\n\nexport class ServerError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'SERVER_ERROR', category: 'server', retryable: true, ...options });\n    this.name = 'ServerError';\n  }\n}\n\n/**\n * Issue #24: a 2xx whose body does not parse as JSON and whose `Content-Type`\n * is NOT a JSON media type (the vendor maintenance / edge HTML page). The\n * vendor never processed the request — `retryable` is advisory (the transport\n * retries it per policy on idempotent methods only). The raw, HOST-SOURCED\n * free text lives ONLY in `details.bodySnippet` (the first 256 bytes,\n * truncation-only — name-based redaction is a no-op on free text; untrusted\n * host content for the served surface). A JSON-ish header\n * (`application/json*` or a plus-json suffix media type) or an ABSENT\n * header keeps `INVALID_RESPONSE` (the #13/W-A7 shape-drift key); JSON\n * under any other header still decodes (the decode attempt is\n * unconditional).\n */\nexport class UnexpectedContentTypeError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'UNEXPECTED_CONTENT_TYPE', category: 'server', retryable: true, ...options });\n    this.name = 'UnexpectedContentTypeError';\n  }\n}\n\n/**\n * Issue #25: a 2xx with an EMPTY body where a result was expected (the\n * transport's `expectBody` contract — non-DELETE by default; DELETE and 204\n * keep returning `undefined`). A blank 200 from a proxy or maintenance edge\n * is a transport fault, not \"no data\". `retryable` is advisory (true for\n * non-DELETE reads — the loop never retries 2xx). `details = { httpStatus,\n * method }`. The transport attaches the typed empty-reason details (issue\n * #14) on it before throwing, so a pinned blind surface keeps its stamp.\n */\nexport class EmptyResponseError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'EMPTY_RESPONSE', category: 'server', ...options });\n    this.name = 'EmptyResponseError';\n  }\n}\n\n/**\n * Issue #26: the host circuit breaker is OPEN and the call was refused\n * LOCALLY (pre-send — zero upstream calls, no hourly-limiter stamp, the\n * #6 cooldown gate's slot). `retryable: true` is a DELIBERATE divergence\n * from #6's `RATE_LIMITED_COOLDOWN` (`retryable: false`): the open period\n * is bounded and advertised via `retryAfter`, so retrying the SAME call\n * after the wait is the correct caller behaviour (service health, not\n * request shape — no narrowing needed). `notSent: true` is the shared\n * local-refusal marker. `details = { state: 'open' | 'half-open',\n * retryAfterMs, failureCount }` rides the error (and the MCP served\n * payload) verbatim.\n */\nexport class CircuitBreakerError extends AutotaskError {\n  /** Seconds remaining in the open period (absent when the half-open probe budget is in flight). */\n  retryAfter?: number;\n  /** True when the call was refused locally (the circuit is open) and never sent. */\n  notSent?: boolean;\n\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'CIRCUIT_BREAKER_OPEN', category: 'policy', retryable: true, ...options });\n    this.name = 'CircuitBreakerError';\n  }\n}\n\n/**\n * Skill 3.5.0 / L2 (finding A1): an opt-in `hostPolicy` bound refused the\n * configured (or discovery-provided) host at CONFIG resolution — a typed\n * config error, thrown BEFORE any wire activity (zero fetch; the issue-#43\n * re-point never happens and the original 401 propagates untouched).\n * `retryable: false` (the same contract as the #6 cooldown refusal): the\n * bound is a caller policy, not service health, so retrying the identical\n * call cannot succeed. `details = { bound: 'private' | 'allowlist',\n * origin }` rides the error verbatim and names the offending canonical\n * origin.\n */\nexport class HostPolicyDeniedError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'HOST_POLICY_DENIED', category: 'policy', retryable: false, ...options });\n    this.name = 'HostPolicyDeniedError';\n  }\n}\n\nexport class ResolutionError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, {\n      code: options.code === undefined ? 'RESOLUTION_AMBIGUOUS' : options.code,\n      category: 'resolution',\n      ...options,\n    });\n    this.name = 'ResolutionError';\n  }\n}\n\nexport class PaginationLimitError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, {\n      code: 'PAGINATION_LIMIT',\n      category: 'policy',\n      suggestedAction:\n        options.suggestedAction ??\n        'Narrow the query with a tighter filter so the walk stays under the 1000-page limit.',\n      ...options,\n    });\n    this.name = 'PaginationLimitError';\n  }\n}\n\nexport class QueryTooLongError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, {\n      code: 'QUERY_TOO_LONG',\n      category: 'policy',\n      suggestedAction:\n        options.suggestedAction ??\n        'Use the default POST query path (omit via: \"get\") for filters above the 2048-char GET cap.',\n      ...options,\n    });\n    this.name = 'QueryTooLongError';\n  }\n}\n\n/** One vendor field rejection, parsed from the error body. */\nexport interface VendorFieldError {\n  message?: string;\n  field?: string;\n  code?: string;\n}\n\n/**\n * Parse the vendor `errors` array defensively (swagger documents no error\n * bodies). TWO live-verified shapes:\n *   1. object entries `[{ message, field?, code? }]` (the node seed shape);\n *   2. STRING entries (the ww29 live-verified shape — S12-A discovery,\n *      e.g. `errors: [\"Missing Required Field: title.\", \"Data violation: ...\",\n *      \"Error updating entity for record number [1].\"]`). A string entry\n *      matching `Missing Required Field: <name>` yields `{ field: <name>,\n *      message: <the string> }`; any other string yields `{ message }`.\n * Mixed arrays are supported; other entry types are dropped.\n */\nconst MISSING_REQUIRED_FIELD = /^Missing Required Field:\\s*([A-Za-z_][A-Za-z0-9_]*)/;\n\nexport function parseVendorErrors(body: unknown): VendorFieldError[] | undefined {\n  if (!isRecord(body) || !Array.isArray(body.errors)) return undefined;\n  const out: VendorFieldError[] = [];\n  for (const entry of body.errors) {\n    if (typeof entry === 'string') {\n      const item: VendorFieldError = { message: entry };\n      const m = MISSING_REQUIRED_FIELD.exec(entry);\n      if (m) item.field = m[1];\n      out.push(item);\n      continue;\n    }\n    if (!isRecord(entry)) continue;\n    const item: VendorFieldError = {};\n    if (typeof entry.message === 'string') item.message = entry.message;\n    if (typeof entry.field === 'string') item.field = entry.field;\n    if (typeof entry.code === 'string') item.code = entry.code;\n    if (item.message !== undefined || item.field !== undefined || item.code !== undefined) {\n      out.push(item);\n    }\n  }\n  return out;\n}\n\n/**\n * #23: the deterministic vendor 500 phrase list — a documented HEURISTIC that\n * holds only wording seen in real responses (the vendor answers some rejected\n * input with a 500, e.g. a field value over its maxLength). Anything not\n * matched stays a plain (retryable) server error. Extend only with a new\n * live-verified phrase.\n */\nconst DETERMINISTIC_VENDOR_500_PHRASES: readonly RegExp[] = [/exceeds maximum length/i];\n\n/**\n * #23: true when the parsed vendor `errors[]` entries of a 500 name a known\n * deterministic field-validation phrase (case-insensitive, over every\n * entry's message — string and object entries alike; `parseVendorErrors`\n * normalises both). The shared signal for the transport's no-retry decision\n * and the #26 breaker predicate (key on this, never on INVALID_RESPONSE).\n */\nexport function isDeterministicVendor500(entries: VendorFieldError[] | undefined): boolean {\n  if (entries === undefined) return false;\n  return entries.some(\n    (entry) => entry.message !== undefined && DETERMINISTIC_VENDOR_500_PHRASES.some((phrase) => phrase.test(entry.message as string)),\n  );\n}\n\n/** Format one vendor entry as `[<code>] Field '<field>': <message>` (absent parts dropped). */\nfunction formatVendorEntry(entry: VendorFieldError): string {\n  const parts: string[] = [];\n  if (entry.code) parts.push(`[${entry.code}]`);\n  if (entry.field) parts.push(`Field '${entry.field}':`);\n  if (entry.message) parts.push(entry.message);\n  return parts.join(' ');\n}\n\n/**\n * The vendor detail line: entries joined with ` | `, or the top-level vendor\n * `message`, or undefined when the body names nothing.\n */\nexport function formatVendorDetail(body: unknown): string | undefined {\n  const entries = parseVendorErrors(body);\n  if (entries && entries.length > 0) {\n    const formatted = entries.map(formatVendorEntry).filter((line) => line.length > 0);\n    if (formatted.length > 0) return formatted.join(' | ');\n  }\n  if (isRecord(body) && typeof body.message === 'string' && body.message.trim().length > 0) {\n    return body.message.trim();\n  }\n  return undefined;\n}\n\n/**\n * A vendor code adopted as the stable machine code: a single token of at least\n * 3 chars containing at least one digit (e.g. `Itgenatr005`, `E001`). Plain\n * words (`Invalid`) and sentences are not machine codes.\n */\nfunction isMachineCode(code: string): boolean {\n  return /^[A-Za-z0-9][A-Za-z0-9_-]{2,}$/.test(code) && /\\d/.test(code);\n}\n\n/** The class for a documented status (unmapped statuses return the base). */\ntype ErrorCtor = new (message: string, options: AutotaskErrorOptions) => AutotaskError;\n\n/** The class for a documented status (4xx table + 5xx ServerError); unmapped → null. */\nfunction errorClassForStatus(status: number): ErrorCtor | null {\n  switch (status) {\n    case 400: return BadRequestError;\n    case 401: return UnauthorizedError;\n    case 403: return ForbiddenError;\n    case 404: return NotFoundError;\n    case 409:\n    case 412: return ConflictError;\n    case 422: return UnprocessableEntityError;\n    case 429: return RateLimitError;\n    default:\n      return status >= 500 && status < 600 ? ServerError : null;\n  }\n}\n\nfunction statusDefaultMessage(status: number): string {\n  switch (status) {\n    case 401: return 'Authentication failed: Invalid credentials';\n    case 404: return 'Resource not found';\n    default: return `Autotask API request failed with status ${status}`;\n  }\n}\n\n/** Suffix length cap for the vendor body appended to the default status message. */\nconst VENDOR_BODY_SUFFIX_LIMIT = 200;\n\n/**\n * Render the (already redacted) vendor body as a short suffix for the default\n * status message. Parsed bodies are JSON.stringified; a raw non-JSON text body\n * passes through as text. Absent and empty bodies (`{}`, `[]`) render nothing\n * — the message stays exactly the status default.\n */\nfunction vendorBodySuffix(body: unknown): string | undefined {\n  const rendered = typeof body === 'string' ? body : JSON.stringify(body);\n  if (rendered === undefined || rendered === 'null' || rendered === '{}' || rendered === '[]') return undefined;\n  return rendered.length > VENDOR_BODY_SUFFIX_LIMIT ? rendered.slice(0, VENDOR_BODY_SUFFIX_LIMIT) : rendered;\n}\n\n/**\n * What the transport knows about the credential values it actually put on the wire for the failed\n * attempt. Only the header NAMES are carried — a value never leaves the transport.\n */\nexport interface CredentialShapeExpectation {\n  /** Credential header names whose values were sent. */\n  headerNames: readonly string[];\n  /** True when EVERY one of those values had a clean shape. */\n  allValuesClean: boolean;\n  /** The shape artifact found, when one was found (never the value itself). */\n  problem?: string;\n}\n\n/** The two fixed, value-free 401 sentences. */\nconst DIAGNOSTIC_SHAPE_ANOMALY =\n  'sent value shows shell-quoting/line-break artifacts — check your env load';\nconst DIAGNOSTIC_NO_ANOMALY =\n  'sent value shows no shape anomalies — credentials or account state are the likely cause';\n\n/** The pointer a 401's shape diagnostic carries to the canonical env load. */\nexport const CREDENTIAL_SHAPE_POINTER =\n  'Load the credential the way the file documents: shell-sourced (`set -a; . ./.env; set +a`) or ' +\n  'via loadAutotaskCredentialsFromEnv() from node-autotask — a quote-preserving parser hands the ' +\n  'value over with its quotes intact, which the vendor rejects as invalid credentials.';\n\n/**\n * The `details` extras a 401 gains from the credential shape of the sent value. Returns `undefined`\n * when there is nothing to say (no expectation supplied), so an `errorFromStatus(401, body)` call\n * behaves exactly as before.\n */\nfunction credentialDiagnosticDetails(\n  credential: CredentialShapeExpectation | undefined,\n): Record<string, unknown> | undefined {\n  if (credential === undefined) return undefined;\n  const diagnostic = credential.allValuesClean\n    ? DIAGNOSTIC_NO_ANOMALY\n    : `${DIAGNOSTIC_SHAPE_ANOMALY} (${credential.problem ?? 'shape anomaly detected'})`;\n  return { diagnostic, pointerNote: CREDENTIAL_SHAPE_POINTER };\n}\n\n/**\n * Merge the extras a 401 already carries (the issue-#43 `zoneRecovery` detail, the issue-#14\n * pointer/emptyReason) with the C3 credential diagnostic, field by field. Later fields win.\n */\nexport function mergeDetails(\n  base: Record<string, unknown> | undefined,\n  extra: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (base === undefined) return extra;\n  if (extra === undefined) return base;\n  return { ...base, ...extra };\n}\n\nfunction suggestedActionForStatus(status: number): string | undefined {\n  switch (status) {\n    case 400:\n    case 422:\n      return 'Fix the request payload; see the vendor error for the offending field.';\n    case 401:\n      return 'Check the API integration code, username and secret (3-header auth).';\n    case 403:\n      return 'Verify permissions; if ImpersonationResourceId is set, retry without it.';\n    case 404:\n      return 'Verify the id, or resolve the record by name first.';\n    case 409:\n    case 412:\n      return 'Re-read the record and retry with current values.';\n    case 429:\n      return 'Back off and retry; honour Retry-After.';\n    default:\n      return status >= 500 ? 'Retry with backoff; the server error is transient.' : undefined;\n  }\n}\n\n/**\n * Map an HTTP status + raw vendor body to the typed error (ARCHITECTURE\n * section 10). Keeps the raw body under `vendorError` and adopts a vendor\n * `code` that looks like a stable machine code (top-level, then the first\n * entry's) — otherwise the status-derived code is kept.\n *\n * The INV-A1 hotfix (second site): the vendor body is deep-redacted ONCE,\n * before anything is derived from it — so `vendorError` and the adopted\n * message (computed from the redacted body) never carry a pinned field value\n * (a 4xx that echoes a request body which carried a secret would otherwise\n * leak through the error path). `redactPersonalData` (default true) gates\n * the PII/CONFIDENTIAL classes; the SECRET class is always redacted.\n *\n * When the body names nothing (no `errors[]` entry, no top-level `message`),\n * the default status message gains a `: <body>` suffix — the redacted body\n  * (parsed → JSON text, raw → text) truncated to 200 chars — so 4xx/5xx\n * triage sees the vendor text in the message itself.\n */\nexport function errorFromStatus(\n  status: number,\n  body: unknown,\n  url?: string,\n  operation?: string,\n  redactPersonalData = true,\n  credential?: CredentialShapeExpectation,\n): AutotaskError {\n  const safeBody = redactResponseBody(body, { redactPersonalData });\n  let detail = formatVendorDetail(safeBody);\n  // message hygiene: the parsed-entry detail honors the same 200-char bound\n  // as the raw-body suffix (a long vendor error string never floods the message)\n  if (detail !== undefined && detail.length > VENDOR_BODY_SUFFIX_LIMIT) {\n    detail = detail.slice(0, VENDOR_BODY_SUFFIX_LIMIT);\n  }\n  const suffix = detail === undefined ? vendorBodySuffix(safeBody) : undefined;\n  const message =\n    detail ?? (suffix !== undefined ? `${statusDefaultMessage(status)}: ${suffix}` : statusDefaultMessage(status));\n  const mapped = errorClassForStatus(status);\n  const Ctor: ErrorCtor = mapped ?? AutotaskError;\n  const code = mapped !== null ? defaultCodeForClass(mapped) : `HTTP_${status}`;\n  const entries = parseVendorErrors(safeBody);\n  const vendorCodeCandidate =\n    (isRecord(safeBody) && typeof safeBody.code === 'string' ? safeBody.code : undefined) ??\n    (entries?.[0]?.code ?? undefined);\n  // C3 (2026-10-07 incident class): a 401 whose sent credential values carried a shell-quoting or\n  // line-break artifact gains a value-free `details.diagnostic` naming the env load as the suspect.\n  // The message and `suggestedAction` are unchanged (append, never replace) — the diagnostic rides\n  // as a separate field, and a direct `errorFromStatus(401, body)` call (no expectation supplied)\n  // behaves exactly as before.\n  const credentialDetails = status === 401 ? credentialDiagnosticDetails(credential) : undefined;\n  const extraDetails = mergeDetails(undefined, credentialDetails);\n  const err = new Ctor(message, {\n    code: vendorCodeCandidate !== undefined && isMachineCode(vendorCodeCandidate) ? vendorCodeCandidate : code,\n    httpStatus: status,\n    vendorError: safeBody,\n    url,\n    operation,\n    retryable: status === 429 || status >= 500,\n    suggestedAction: suggestedActionForStatus(status),\n    ...(extraDetails !== undefined ? { details: extraDetails } : {}),\n  });\n  if (Ctor === AutotaskError) err.name = 'AutotaskError';\n  // #23: a deterministic vendor field-validation 500 (a known phrase) is a\n  // PERMANENT failure — the same body fails identically on retry. Keep the\n  // class (ServerError) + code (SERVER_ERROR) + httpStatus (500), override\n  // the 5xx retryable default, and point at the field catalog (the\n  // deterministic suggestedAction — no vendor free text).\n  if (status >= 500 && isDeterministicVendor500(entries)) {\n    err.retryable = false;\n    err.details = mergeDetails(err.details, { deterministic: true });\n    const dot = operation !== undefined ? operation.indexOf('.') : -1;\n    const resource = operation !== undefined && dot > 0 ? operation.slice(0, dot) : undefined;\n    err.suggestedAction =\n      'Deterministic field rejection — fix the value, do not retry. ' +\n      (resource !== undefined\n        ? `Consult ${resource}.getFieldInfo for the field catalog (types, required, maxLength).`\n        : \"Consult the resource's getFieldInfo for the field catalog (types, required, maxLength).\");\n  }\n  return err;\n}\n\n/**\n * Stale-object protection (ARCHITECTURE section 19.3): the caller-supplied\n * `lastModifiedDate` no longer matches the vendor's current value. No\n * `If-Match`/ETag exists in the API — the plan's `staleCheck` field is the\n * comparison.\n */\nexport class StaleObjectError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, {\n      code: 'STALE_OBJECT',\n      category: 'conflict',\n      suggestedAction: 'Re-read the record and retry with the fresh lastModifiedDate.',\n      ...options,\n    });\n    this.name = 'StaleObjectError';\n  }\n}\n\n/**\n * A deliberate-act refusal (section 19.5 R4): a destructive or\n * approval-gated operation was invoked without its exact confirmation flag.\n */\nexport class ConfirmationRequiredError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'CONFIRMATION_REQUIRED', category: 'policy', ...options });\n    this.name = 'ConfirmationRequiredError';\n  }\n}\n\n/**\n * Issue #9 (P1): the vendor defines no DELETE for the requested resource —\n * a `recovery` delete refused PRE-SEARCH (zero wire). The note carries the\n * spec-derived boundary sentence (plan.deleteBoundaries) + the UI-only\n * cleanup remedy. Never a raw vendor 405: the boundary is known locally\n * (the vendored spec audit) and the refusal happens before any request.\n */\nexport class DeleteBoundaryError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'DELETE_BOUNDARY', category: 'policy', ...options });\n    this.name = 'DeleteBoundaryError';\n  }\n}\n\n/**\n * Issue #9 (P1): a matched record's id is NOT representable as a safe JS\n * integer (beyond Number.MAX_SAFE_INTEGER) — the match CANNOT be addressed\n * through the SDK's typed delete surface. Never a silent skip: the op\n * refuses with this code (delete) or marks the match id null (find) so the\n * caller sees the unaddressable record and can clean it up via the UI.\n */\nexport class MarkerUnsafeIdError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'MARKER_UNSAFE_ID', category: 'policy', ...options });\n    this.name = 'MarkerUnsafeIdError';\n  }\n}\n\n/**\n * Issue #9: the recovery's bounded search TRIPPED its match cap (more\n * matches exist than `limit`) — the op refuses instead of returning a\n * silently truncated (or silently empty) result. Retry with a higher\n * `limit` (max 100) or a narrower `marker` / `filter`.\n */\nexport class RecoveryTruncatedError extends AutotaskError {\n  constructor(message: string, options: AutotaskErrorOptions = {}) {\n    super(message, { code: 'RECOVERY_TRUNCATED', category: 'policy', ...options });\n    this.name = 'RecoveryTruncatedError';\n  }\n}\n\n/** The status-derived machine code for each documented class. */\nfunction defaultCodeForClass(Ctor: ErrorCtor): string {\n  switch (Ctor) {\n    case BadRequestError: return 'BAD_REQUEST';\n    case UnauthorizedError: return 'UNAUTHORIZED';\n    case ForbiddenError: return 'FORBIDDEN';\n    case NotFoundError: return 'NOT_FOUND';\n    case ConflictError: return 'CONFLICT';\n    case UnprocessableEntityError: return 'VALIDATION_FAILED';\n    case RateLimitError: return 'RATE_LIMITED';\n    default: return 'SERVER_ERROR';\n  }\n}\n\n/** Type guard for the hierarchy. */\nexport function isAutotaskError(err: unknown): err is AutotaskError {\n  return err instanceof AutotaskError;\n}\n"],"mappings":";AAkBO,IAAM,aAAqB,CAAC;AAG5B,IAAM,WAAW;AAOjB,IAAM,0BAA6C;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,SAAS,aAAa,KAAqB;AACzC,SAAO,IAAI,YAAY,EAAE,QAAQ,SAAS,EAAE;AAC9C;AAEA,IAAM,qBAA0C,IAAI,IAAY,wBAAwB,IAAI,YAAY,CAAC;AAGlG,SAAS,uBAAuB,MAAc,iBAA8C;AACjG,QAAM,aAAa,aAAa,IAAI;AACpC,MAAI,mBAAmB,IAAI,UAAU,EAAG,QAAO;AAC/C,MAAI,oBAAoB,OAAW,QAAO;AAC1C,SAAO,gBAAgB,KAAK,CAAC,UAAU,aAAa,KAAK,MAAM,UAAU;AAC3E;AAGA,SAAS,cAAc,OAAkD;AACvE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAQO,SAAS,aAAa,OAAgB,iBAA8C;AACzF,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,SAAS,aAAa,MAAM,eAAe,CAAC;AAAA,EAChE;AACA,MAAI,cAAc,KAAK,GAAG;AACxB,UAAM,MAA+B,CAAC;AACtC,eAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC/C,UAAI,GAAG,IAAI,uBAAuB,KAAK,eAAe,IAAI,WAAW,aAAa,MAAM,eAAe;AAAA,IACzG;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;AC9BO,IAAM,yBAA4C;AAAA,EACvD;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAOO,IAAM,2BAA8C;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQO,IAAM,+BAAkD;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,aAAa,IAAI,IAAY,sBAAsB;AACzD,IAAM,eAAe,oBAAI,IAAY,CAAC,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAanG,SAASA,eAAc,OAAkD;AACvE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAOO,SAAS,oBAAoB,MAAc,QAAkC;AAClF,SAAO,WAAW,IAAI,IAAI,KAAM,OAAO,sBAAsB,aAAa,IAAI,IAAI;AACpF;AASO,SAAS,mBAAmB,OAAgB,QAAkC;AACnF,QAAM,WAAW,OAAO;AACxB,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,UAAU,mBAAmB,OAAO,MAAM,CAAC;AAAA,EAC/D;AACA,MAAI,CAACA,eAAc,KAAK,EAAG,QAAO;AAClC,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,UAAM,SAAS,WAAW,IAAI,GAAG,KAAM,YAAY,aAAa,IAAI,GAAG;AACvE,QAAI,GAAG,IAAI,SAAS,WAAW,mBAAmB,OAAO,MAAM;AAAA,EACjE;AACA,SAAO;AACT;;;ACpHA,SAAS,SAAS,OAAkD;AAClE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EAEA,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO,QAAQ,QAAQ;AAC5B,SAAK,WAAW,QAAQ,YAAY;AACpC,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,YAAY,QAAQ;AACzB,SAAK,aAAa,QAAQ;AAC1B,SAAK,cAAc,QAAQ;AAC3B,SAAK,cAAc,QAAQ;AAC3B,SAAK,kBAAkB,QAAQ;AAC/B,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,MAAM,QAAQ;AACnB,SAAK,UAAU,QAAQ;AACvB,UAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA,EAClD;AACF;AAEO,IAAM,sBAAN,cAAkC,cAAc;AAAA,EACrD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,gBAAgB,UAAU,cAAc,GAAG,QAAQ,CAAC;AAC3E,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,uBAAN,cAAmC,cAAc;AAAA,EACtD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,GAAG;AAAA,IACL,CAAC;AACD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,uBAAN,cAAmC,cAAc;AAAA,EACtD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,GAAG;AAAA,IACL,CAAC;AACD,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,qBAAN,cAAiC,cAAc;AAAA,EACpD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,WAAW,UAAU,WAAW,WAAW,OAAO,GAAG,QAAQ,CAAC;AACrF,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,wBAAN,cAAoC,cAAc;AAAA,EACvD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,qBAAqB,UAAU,UAAU,WAAW,OAAO,GAAG,QAAQ,CAAC;AAC9F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EACjD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,eAAe,UAAU,cAAc,GAAG,QAAQ,CAAC;AAC1E,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,cAAgC,cAAc;AAAA,EACnD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,gBAAgB,UAAU,QAAQ,GAAG,QAAQ,CAAC;AACrE,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iBAAN,cAA6B,cAAc;AAAA,EAChD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,aAAa,UAAU,QAAQ,GAAG,QAAQ,CAAC;AAClE,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,gBAAN,cAA4B,cAAc;AAAA,EAC/C,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,aAAa,UAAU,aAAa,GAAG,QAAQ,CAAC;AACvE,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,gBAAN,cAA4B,cAAc;AAAA,EAC/C,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,YAAY,UAAU,YAAY,GAAG,QAAQ,CAAC;AACrE,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,2BAAN,cAAuC,cAAc;AAAA,EAC1D,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,qBAAqB,UAAU,cAAc,GAAG,QAAQ,CAAC;AAChF,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iBAAN,cAA6B,cAAc;AAAA;AAAA,EAEhD;AAAA;AAAA,EAEA;AAAA,EAEA,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,gBAAgB,UAAU,cAAc,WAAW,MAAM,GAAG,QAAQ,CAAC;AAC5F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,cAAN,cAA0B,cAAc;AAAA,EAC7C,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,gBAAgB,UAAU,UAAU,WAAW,MAAM,GAAG,QAAQ,CAAC;AACxF,SAAK,OAAO;AAAA,EACd;AACF;AAeO,IAAM,6BAAN,cAAyC,cAAc;AAAA,EAC5D,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,2BAA2B,UAAU,UAAU,WAAW,MAAM,GAAG,QAAQ,CAAC;AACnG,SAAK,OAAO;AAAA,EACd;AACF;AAWO,IAAM,qBAAN,cAAiC,cAAc;AAAA,EACpD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,kBAAkB,UAAU,UAAU,GAAG,QAAQ,CAAC;AACzE,SAAK,OAAO;AAAA,EACd;AACF;AAcO,IAAM,sBAAN,cAAkC,cAAc;AAAA;AAAA,EAErD;AAAA;AAAA,EAEA;AAAA,EAEA,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,wBAAwB,UAAU,UAAU,WAAW,MAAM,GAAG,QAAQ,CAAC;AAChG,SAAK,OAAO;AAAA,EACd;AACF;AAaO,IAAM,wBAAN,cAAoC,cAAc;AAAA,EACvD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,sBAAsB,UAAU,UAAU,WAAW,OAAO,GAAG,QAAQ,CAAC;AAC/F,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,cAAc;AAAA,EACjD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS;AAAA,MACb,MAAM,QAAQ,SAAS,SAAY,yBAAyB,QAAQ;AAAA,MACpE,UAAU;AAAA,MACV,GAAG;AAAA,IACL,CAAC;AACD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,uBAAN,cAAmC,cAAc;AAAA,EACtD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,iBACE,QAAQ,mBACR;AAAA,MACF,GAAG;AAAA,IACL,CAAC;AACD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,cAAgC,cAAc;AAAA,EACnD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,iBACE,QAAQ,mBACR;AAAA,MACF,GAAG;AAAA,IACL,CAAC;AACD,SAAK,OAAO;AAAA,EACd;AACF;AAoBA,IAAM,yBAAyB;AAExB,SAAS,kBAAkB,MAA+C;AAC/E,MAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,QAAQ,KAAK,MAAM,EAAG,QAAO;AAC3D,QAAM,MAA0B,CAAC;AACjC,aAAW,SAAS,KAAK,QAAQ;AAC/B,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAMC,QAAyB,EAAE,SAAS,MAAM;AAChD,YAAM,IAAI,uBAAuB,KAAK,KAAK;AAC3C,UAAI,EAAG,CAAAA,MAAK,QAAQ,EAAE,CAAC;AACvB,UAAI,KAAKA,KAAI;AACb;AAAA,IACF;AACA,QAAI,CAAC,SAAS,KAAK,EAAG;AACtB,UAAM,OAAyB,CAAC;AAChC,QAAI,OAAO,MAAM,YAAY,SAAU,MAAK,UAAU,MAAM;AAC5D,QAAI,OAAO,MAAM,UAAU,SAAU,MAAK,QAAQ,MAAM;AACxD,QAAI,OAAO,MAAM,SAAS,SAAU,MAAK,OAAO,MAAM;AACtD,QAAI,KAAK,YAAY,UAAa,KAAK,UAAU,UAAa,KAAK,SAAS,QAAW;AACrF,UAAI,KAAK,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO;AACT;AASA,IAAM,mCAAsD,CAAC,yBAAyB;AAS/E,SAAS,yBAAyB,SAAkD;AACzF,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO,QAAQ;AAAA,IACb,CAAC,UAAU,MAAM,YAAY,UAAa,iCAAiC,KAAK,CAAC,WAAW,OAAO,KAAK,MAAM,OAAiB,CAAC;AAAA,EAClI;AACF;AAGA,SAAS,kBAAkB,OAAiC;AAC1D,QAAM,QAAkB,CAAC;AACzB,MAAI,MAAM,KAAM,OAAM,KAAK,IAAI,MAAM,IAAI,GAAG;AAC5C,MAAI,MAAM,MAAO,OAAM,KAAK,UAAU,MAAM,KAAK,IAAI;AACrD,MAAI,MAAM,QAAS,OAAM,KAAK,MAAM,OAAO;AAC3C,SAAO,MAAM,KAAK,GAAG;AACvB;AAMO,SAAS,mBAAmB,MAAmC;AACpE,QAAM,UAAU,kBAAkB,IAAI;AACtC,MAAI,WAAW,QAAQ,SAAS,GAAG;AACjC,UAAM,YAAY,QAAQ,IAAI,iBAAiB,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACjF,QAAI,UAAU,SAAS,EAAG,QAAO,UAAU,KAAK,KAAK;AAAA,EACvD;AACA,MAAI,SAAS,IAAI,KAAK,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,KAAK,EAAE,SAAS,GAAG;AACxF,WAAO,KAAK,QAAQ,KAAK;AAAA,EAC3B;AACA,SAAO;AACT;AAOA,SAAS,cAAc,MAAuB;AAC5C,SAAO,iCAAiC,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI;AACtE;AAMA,SAAS,oBAAoB,QAAkC;AAC7D,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAA,IACL,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO;AAAA,IACjB;AACE,aAAO,UAAU,OAAO,SAAS,MAAM,cAAc;AAAA,EACzD;AACF;AAEA,SAAS,qBAAqB,QAAwB;AACpD,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO;AAAA,IACjB;AAAS,aAAO,2CAA2C,MAAM;AAAA,EACnE;AACF;AAGA,IAAM,2BAA2B;AAQjC,SAAS,iBAAiB,MAAmC;AAC3D,QAAM,WAAW,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,IAAI;AACtE,MAAI,aAAa,UAAa,aAAa,UAAU,aAAa,QAAQ,aAAa,KAAM,QAAO;AACpG,SAAO,SAAS,SAAS,2BAA2B,SAAS,MAAM,GAAG,wBAAwB,IAAI;AACpG;AAgBA,IAAM,2BACJ;AACF,IAAM,wBACJ;AAGK,IAAM,2BACX;AASF,SAAS,4BACP,YACqC;AACrC,MAAI,eAAe,OAAW,QAAO;AACrC,QAAM,aAAa,WAAW,iBAC1B,wBACA,GAAG,wBAAwB,KAAK,WAAW,WAAW,wBAAwB;AAClF,SAAO,EAAE,YAAY,aAAa,yBAAyB;AAC7D;AAMO,SAAS,aACd,MACA,OACqC;AACrC,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,EAAE,GAAG,MAAM,GAAG,MAAM;AAC7B;AAEA,SAAS,yBAAyB,QAAoC;AACpE,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO,UAAU,MAAM,uDAAuD;AAAA,EAClF;AACF;AAoBO,SAAS,gBACd,QACA,MACA,KACA,WACA,qBAAqB,MACrB,YACe;AACf,QAAM,WAAW,mBAAmB,MAAM,EAAE,mBAAmB,CAAC;AAChE,MAAI,SAAS,mBAAmB,QAAQ;AAGxC,MAAI,WAAW,UAAa,OAAO,SAAS,0BAA0B;AACpE,aAAS,OAAO,MAAM,GAAG,wBAAwB;AAAA,EACnD;AACA,QAAM,SAAS,WAAW,SAAY,iBAAiB,QAAQ,IAAI;AACnE,QAAM,UACJ,WAAW,WAAW,SAAY,GAAG,qBAAqB,MAAM,CAAC,KAAK,MAAM,KAAK,qBAAqB,MAAM;AAC9G,QAAM,SAAS,oBAAoB,MAAM;AACzC,QAAM,OAAkB,UAAU;AAClC,QAAM,OAAO,WAAW,OAAO,oBAAoB,MAAM,IAAI,QAAQ,MAAM;AAC3E,QAAM,UAAU,kBAAkB,QAAQ;AAC1C,QAAM,uBACH,SAAS,QAAQ,KAAK,OAAO,SAAS,SAAS,WAAW,SAAS,OAAO,YAC1E,UAAU,CAAC,GAAG,QAAQ;AAMzB,QAAM,oBAAoB,WAAW,MAAM,4BAA4B,UAAU,IAAI;AACrF,QAAM,eAAe,aAAa,QAAW,iBAAiB;AAC9D,QAAM,MAAM,IAAI,KAAK,SAAS;AAAA,IAC5B,MAAM,wBAAwB,UAAa,cAAc,mBAAmB,IAAI,sBAAsB;AAAA,IACtG,YAAY;AAAA,IACZ,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,WAAW,WAAW,OAAO,UAAU;AAAA,IACvC,iBAAiB,yBAAyB,MAAM;AAAA,IAChD,GAAI,iBAAiB,SAAY,EAAE,SAAS,aAAa,IAAI,CAAC;AAAA,EAChE,CAAC;AACD,MAAI,SAAS,cAAe,KAAI,OAAO;AAMvC,MAAI,UAAU,OAAO,yBAAyB,OAAO,GAAG;AACtD,QAAI,YAAY;AAChB,QAAI,UAAU,aAAa,IAAI,SAAS,EAAE,eAAe,KAAK,CAAC;AAC/D,UAAM,MAAM,cAAc,SAAY,UAAU,QAAQ,GAAG,IAAI;AAC/D,UAAM,WAAW,cAAc,UAAa,MAAM,IAAI,UAAU,MAAM,GAAG,GAAG,IAAI;AAChF,QAAI,kBACF,wEACC,aAAa,SACV,WAAW,QAAQ,sEACnB;AAAA,EACR;AACA,SAAO;AACT;AAQO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EAClD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,iBAAiB;AAAA,MACjB,GAAG;AAAA,IACL,CAAC;AACD,SAAK,OAAO;AAAA,EACd;AACF;AAMO,IAAM,4BAAN,cAAwC,cAAc;AAAA,EAC3D,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,yBAAyB,UAAU,UAAU,GAAG,QAAQ,CAAC;AAChF,SAAK,OAAO;AAAA,EACd;AACF;AASO,IAAM,sBAAN,cAAkC,cAAc;AAAA,EACrD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,mBAAmB,UAAU,UAAU,GAAG,QAAQ,CAAC;AAC1E,SAAK,OAAO;AAAA,EACd;AACF;AASO,IAAM,sBAAN,cAAkC,cAAc;AAAA,EACrD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,oBAAoB,UAAU,UAAU,GAAG,QAAQ,CAAC;AAC3E,SAAK,OAAO;AAAA,EACd;AACF;AAQO,IAAM,yBAAN,cAAqC,cAAc;AAAA,EACxD,YAAY,SAAiB,UAAgC,CAAC,GAAG;AAC/D,UAAM,SAAS,EAAE,MAAM,sBAAsB,UAAU,UAAU,GAAG,QAAQ,CAAC;AAC7E,SAAK,OAAO;AAAA,EACd;AACF;AAGA,SAAS,oBAAoB,MAAyB;AACpD,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAiB,aAAO;AAAA,IAC7B,KAAK;AAAmB,aAAO;AAAA,IAC/B,KAAK;AAAgB,aAAO;AAAA,IAC5B,KAAK;AAAe,aAAO;AAAA,IAC3B,KAAK;AAAe,aAAO;AAAA,IAC3B,KAAK;AAA0B,aAAO;AAAA,IACtC,KAAK;AAAgB,aAAO;AAAA,IAC5B;AAAS,aAAO;AAAA,EAClB;AACF;AAGO,SAAS,gBAAgB,KAAoC;AAClE,SAAO,eAAe;AACxB;","names":["isPlainRecord","item"]}