import type { ConnectionId, ScopeId } from "@executor-js/sdk/core"; import { oauth2ClientSecretSlot } from "./store";import type { ConfiguredHeaderValue, OpenApiSourceBindingValue } from "./types"; export type BindingRowForCredentialStatus = {  readonly slot: string;  readonly scopeId: ScopeId;  readonly value: OpenApiSourceBindingValue;}; export type SourceForCredentialStatus = {  readonly config: {    readonly headers?: Record<string, ConfiguredHeaderValue>;    readonly oauth2?: {      readonly securitySchemeName: string;      readonly flow: "authorizationCode" | "clientCredentials";      readonly clientIdSlot: string;      readonly clientSecretSlot: string | null;      readonly connectionSlot: string;    };  };}; const scopeRank = (ranks: ReadonlyMap<string, number>, scopeId: ScopeId): number =>  ranks.get(scopeId) ?? Number.MAX_SAFE_INTEGER; export const effectiveBindingForScope = (  rows: readonly BindingRowForCredentialStatus[],  slot: string,  targetScope: ScopeId,  ranks: ReadonlyMap<string, number>,): BindingRowForCredentialStatus | null =>  rows    .filter(      (row) => row.slot === slot && scopeRank(ranks, row.scopeId) >= scopeRank(ranks, targetScope),    )    .sort((a, b) => scopeRank(ranks, a.scopeId) - scopeRank(ranks, b.scopeId))[0] ?? null; const hasSecretBinding = (  rows: readonly BindingRowForCredentialStatus[],  slot: string,  targetScope: ScopeId,  ranks: ReadonlyMap<string, number>,) => effectiveBindingForScope(rows, slot, targetScope, ranks)?.value.kind === "secret"; const hasConnectionBinding = (  rows: readonly BindingRowForCredentialStatus[],  slot: string,  targetScope: ScopeId,  ranks: ReadonlyMap<string, number>,  liveConnectionIds?: ReadonlySet<string>,) => {  const binding = effectiveBindingForScope(rows, slot, targetScope, ranks);  if (binding?.value.kind !== "connection") return false;  return liveConnectionIds ? liveConnectionIds.has(binding.value.connectionId) : true;}; const effectiveClientSecretSlot = (oauth2: {  readonly securitySchemeName: string;  readonly clientSecretSlot: string | null;}): string => oauth2.clientSecretSlot ?? oauth2ClientSecretSlot(oauth2.securitySchemeName); export function missingCredentialLabels(  source: SourceForCredentialStatus,  bindings: readonly BindingRowForCredentialStatus[],  targetScope: ScopeId,  ranks: ReadonlyMap<string, number>,  options?: {    readonly liveConnectionIds?: ReadonlySet<string> | readonly ConnectionId[];  },): string[] {  const missing: string[] = [];  const rawLiveConnectionIds = options?.liveConnectionIds;  const liveConnectionIds = rawLiveConnectionIds    ? rawLiveConnectionIds instanceof Set      ? rawLiveConnectionIds      : new Set(rawLiveConnectionIds)    : undefined;   for (const [headerName, value] of Object.entries(source.config.headers ?? {})) {    if (typeof value === "string") continue;    if (!hasSecretBinding(bindings, value.slot, targetScope, ranks)) {      missing.push(headerName);    }  }   const oauth2 = source.config.oauth2;  if (!oauth2) return missing;   if (!hasSecretBinding(bindings, oauth2.clientIdSlot, targetScope, ranks)) {    missing.push("Client ID");  }   const clientSecretSlot = effectiveClientSecretSlot(oauth2);  if (!hasSecretBinding(bindings, clientSecretSlot, targetScope, ranks)) {    missing.push("Client Secret");  }   if (    !hasConnectionBinding(bindings, oauth2.connectionSlot, targetScope, ranks, liveConnectionIds)  ) {    missing.push(oauth2.flow === "clientCredentials" ? "OAuth client connection" : "OAuth sign-in");  }   return missing;}