@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.1

package/dist/src/plugin/account-blocks.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Account access blocks (Google "verification required" and "account
+ * ineligible") as plain data, with no host SDK, client or storage import,
+ * so any host composition can share them.
+ *
+ * Two kinds of record carry the same block fields: the pre-store pool
+ * file's `AccountMetadataV3` (fields absent or set) and the repository's
+ * `ProviderMetadata` (fields absent, `null` or set). Readers here accept
+ * both; a `null` means the same as an absent field.
+ *
+ * The two blocks are mutually exclusive: marking one clears the other.
+ * For repository rows the rule is applied by the repository itself, under
+ * the row lock, from an `AccessVerdict`; `accessVerdictFromProbe` builds
+ * that verdict. The `markLegacy*`/`clearLegacy*` helpers below apply the
+ * same rule in place to a pre-store record.
+ */
+import type { AccessVerdict } from '@cortexkit/antigravity-auth-core';
+/** The block fields both record kinds share. */
+export interface AccessBlockFields {
+    enabled?: boolean | null;
+    verificationRequired?: boolean | null;
+    verificationRequiredAt?: number | null;
+    verificationRequiredReason?: string | null;
+    verificationUrl?: string | null;
+    accountIneligible?: boolean | null;
+    accountIneligibleAt?: number | null;
+    accountIneligibleReason?: string | null;
+    eligibilityStateUpdatedAt?: number | null;
+}
+export type AccountAccessBlock = {
+    kind: 'none';
+} | {
+    kind: 'verification-required';
+    reason?: string;
+    verificationUrl?: string;
+    at?: number;
+} | {
+    kind: 'ineligible';
+    reason?: string;
+    at?: number;
+};
+/** The outcome of one access probe against the Antigravity endpoint. */
+export type VerificationProbeResult = {
+    status: 'ok';
+    message: string;
+} | {
+    status: 'ineligible';
+    message: string;
+} | {
+    status: 'verification-required';
+    message: string;
+    verifyUrl?: string;
+} | {
+    status: 'error';
+    message: string;
+};
+/**
+ * The block a record shows. Ineligibility wins when a record written by an
+ * older build carries both flags, because it is the stronger refusal.
+ */
+export declare function accessBlockOf(fields: AccessBlockFields | undefined): AccountAccessBlock;
+export declare function isAccessBlocked(fields: AccessBlockFields | undefined): boolean;
+/**
+ * The repository verdict for a probe result observed at `observedAt`, or
+ * `undefined` when the probe proved nothing about access (`error`). An `ok`
+ * probe clears both blocks; `enableIfBlocked` asks the repository to
+ * re-enable the row only when it was disabled by a block, never a row the
+ * user disabled.
+ */
+export declare function accessVerdictFromProbe(result: VerificationProbeResult, observedAt: number, enableIfBlocked: boolean): AccessVerdict | undefined;
+/** A pre-store record the legacy helpers change in place. */
+export interface LegacyAccessBlockRecord {
+    enabled?: boolean;
+    verificationRequired?: boolean;
+    verificationRequiredAt?: number;
+    verificationRequiredReason?: string;
+    verificationUrl?: string;
+    accountIneligible?: boolean;
+    accountIneligibleAt?: number;
+    accountIneligibleReason?: string;
+    eligibilityStateUpdatedAt?: number;
+}
+/**
+ * Marks a pre-store record as needing verification and disables it,
+ * clearing any ineligibility. Returns whether anything changed.
+ */
+export declare function markLegacyVerificationRequired(account: LegacyAccessBlockRecord, reason: string, verifyUrl: string | undefined, now: number): boolean;
+/**
+ * Marks a pre-store record ineligible and disables it, clearing any
+ * verification requirement. Returns whether anything changed.
+ */
+export declare function markLegacyIneligible(account: LegacyAccessBlockRecord, reason: string, now: number): boolean;
+/**
+ * Clears both blocks on a pre-store record. With `enableIfBlocked` it
+ * re-enables the record only when a block was set, so a record the user
+ * disabled stays disabled.
+ */
+export declare function clearLegacyAccessBlocks(account: LegacyAccessBlockRecord, enableIfBlocked: boolean, now: number): {
+    changed: boolean;
+    wasAccessBlocked: boolean;
+};
+//# sourceMappingURL=account-blocks.d.ts.map

package/dist/src/plugin/account-blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-blocks.d.ts","sourceRoot":"","sources":["../../../src/plugin/account-blocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAErE,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,oBAAoB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IACrC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,iBAAiB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IAClC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ,GACD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAExD,wEAAwE;AACxE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzC;IACE,MAAM,EAAE,uBAAuB,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAMxC;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACpC,kBAAkB,CAuBpB;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACpC,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,uBAAuB,EAC/B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,OAAO,GACvB,aAAa,GAAG,SAAS,CAmB3B;AAED,6DAA6D;AAC7D,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,GACV,OAAO,CA8CT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAsBT;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,uBAAuB,EAChC,eAAe,EAAE,OAAO,EACxB,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,CA2CjD"}

package/dist/src/plugin/account-blocks.js

@@ -0,0 +1,196 @@
+/**
+ * Account access blocks (Google "verification required" and "account
+ * ineligible") as plain data, with no host SDK, client or storage import,
+ * so any host composition can share them.
+ *
+ * Two kinds of record carry the same block fields: the pre-store pool
+ * file's `AccountMetadataV3` (fields absent or set) and the repository's
+ * `ProviderMetadata` (fields absent, `null` or set). Readers here accept
+ * both; a `null` means the same as an absent field.
+ *
+ * The two blocks are mutually exclusive: marking one clears the other.
+ * For repository rows the rule is applied by the repository itself, under
+ * the row lock, from an `AccessVerdict`; `accessVerdictFromProbe` builds
+ * that verdict. The `markLegacy*`/`clearLegacy*` helpers below apply the
+ * same rule in place to a pre-store record.
+ */
+function present(value) {
+    return value === null ? undefined : value;
+}
+/**
+ * The block a record shows. Ineligibility wins when a record written by an
+ * older build carries both flags, because it is the stronger refusal.
+ */
+export function accessBlockOf(fields) {
+    if (fields === undefined)
+        return { kind: 'none' };
+    if (fields.accountIneligible === true) {
+        const reason = present(fields.accountIneligibleReason);
+        const at = present(fields.accountIneligibleAt);
+        return {
+            kind: 'ineligible',
+            ...(reason !== undefined ? { reason } : {}),
+            ...(at !== undefined ? { at } : {}),
+        };
+    }
+    if (fields.verificationRequired === true) {
+        const reason = present(fields.verificationRequiredReason);
+        const verificationUrl = present(fields.verificationUrl);
+        const at = present(fields.verificationRequiredAt);
+        return {
+            kind: 'verification-required',
+            ...(reason !== undefined ? { reason } : {}),
+            ...(verificationUrl !== undefined ? { verificationUrl } : {}),
+            ...(at !== undefined ? { at } : {}),
+        };
+    }
+    return { kind: 'none' };
+}
+export function isAccessBlocked(fields) {
+    return accessBlockOf(fields).kind !== 'none';
+}
+/**
+ * The repository verdict for a probe result observed at `observedAt`, or
+ * `undefined` when the probe proved nothing about access (`error`). An `ok`
+ * probe clears both blocks; `enableIfBlocked` asks the repository to
+ * re-enable the row only when it was disabled by a block, never a row the
+ * user disabled.
+ */
+export function accessVerdictFromProbe(result, observedAt, enableIfBlocked) {
+    switch (result.status) {
+        case 'verification-required': {
+            const reason = result.message.trim();
+            const url = result.verifyUrl?.trim();
+            return {
+                kind: 'verification-required',
+                observedAt,
+                ...(reason ? { reason } : {}),
+                ...(url ? { verificationUrl: url } : {}),
+            };
+        }
+        case 'ineligible':
+            return { kind: 'ineligible', observedAt, reason: result.message };
+        case 'ok':
+            return { kind: 'cleared', observedAt, enable: enableIfBlocked };
+        case 'error':
+            return undefined;
+    }
+}
+/**
+ * Marks a pre-store record as needing verification and disables it,
+ * clearing any ineligibility. Returns whether anything changed.
+ */
+export function markLegacyVerificationRequired(account, reason, verifyUrl, now) {
+    let changed = false;
+    const wasVerificationRequired = account.verificationRequired === true;
+    if (!wasVerificationRequired) {
+        account.verificationRequired = true;
+        changed = true;
+    }
+    if (!wasVerificationRequired ||
+        account.verificationRequiredAt === undefined) {
+        account.verificationRequiredAt = now;
+        changed = true;
+    }
+    if (account.accountIneligible === true ||
+        account.accountIneligibleAt !== undefined ||
+        account.accountIneligibleReason !== undefined) {
+        account.accountIneligible = false;
+        account.accountIneligibleAt = undefined;
+        account.accountIneligibleReason = undefined;
+        account.eligibilityStateUpdatedAt = now;
+        changed = true;
+    }
+    if (account.accountIneligible === undefined) {
+        account.accountIneligible = false;
+        changed = true;
+    }
+    const normalizedReason = reason.trim();
+    if (account.verificationRequiredReason !== normalizedReason) {
+        account.verificationRequiredReason = normalizedReason;
+        changed = true;
+    }
+    const normalizedUrl = verifyUrl?.trim();
+    if (normalizedUrl && account.verificationUrl !== normalizedUrl) {
+        account.verificationUrl = normalizedUrl;
+        changed = true;
+    }
+    if (account.enabled !== false) {
+        account.enabled = false;
+        changed = true;
+    }
+    return changed;
+}
+/**
+ * Marks a pre-store record ineligible and disables it, clearing any
+ * verification requirement. Returns whether anything changed.
+ */
+export function markLegacyIneligible(account, reason, now) {
+    const normalizedReason = reason.trim() || 'Google marked this account as ineligible.';
+    const changed = account.accountIneligible !== true ||
+        account.accountIneligibleReason !== normalizedReason ||
+        account.verificationRequired === true ||
+        account.verificationRequiredAt !== undefined ||
+        account.verificationRequiredReason !== undefined ||
+        account.verificationUrl !== undefined ||
+        account.enabled !== false;
+    account.accountIneligible = true;
+    account.accountIneligibleAt = now;
+    account.accountIneligibleReason = normalizedReason;
+    account.eligibilityStateUpdatedAt = now;
+    account.verificationRequired = false;
+    account.verificationRequiredAt = undefined;
+    account.verificationRequiredReason = undefined;
+    account.verificationUrl = undefined;
+    account.enabled = false;
+    return changed;
+}
+/**
+ * Clears both blocks on a pre-store record. With `enableIfBlocked` it
+ * re-enables the record only when a block was set, so a record the user
+ * disabled stays disabled.
+ */
+export function clearLegacyAccessBlocks(account, enableIfBlocked, now) {
+    const wasVerificationRequired = account.verificationRequired === true;
+    const wasIneligible = account.accountIneligible === true;
+    const wasAccessBlocked = wasVerificationRequired || wasIneligible;
+    let changed = false;
+    if (account.verificationRequired !== false) {
+        account.verificationRequired = false;
+        changed = true;
+    }
+    if (account.verificationRequiredAt !== undefined) {
+        account.verificationRequiredAt = undefined;
+        changed = true;
+    }
+    if (account.verificationRequiredReason !== undefined) {
+        account.verificationRequiredReason = undefined;
+        changed = true;
+    }
+    if (account.verificationUrl !== undefined) {
+        account.verificationUrl = undefined;
+        changed = true;
+    }
+    if (account.accountIneligible !== false) {
+        account.accountIneligible = false;
+        changed = true;
+    }
+    if (account.accountIneligibleAt !== undefined) {
+        account.accountIneligibleAt = undefined;
+        changed = true;
+    }
+    if (account.accountIneligibleReason !== undefined) {
+        account.accountIneligibleReason = undefined;
+        changed = true;
+    }
+    if (wasIneligible || account.eligibilityStateUpdatedAt !== undefined) {
+        account.eligibilityStateUpdatedAt = now;
+        changed = true;
+    }
+    if (enableIfBlocked && wasAccessBlocked && account.enabled === false) {
+        account.enabled = true;
+        changed = true;
+    }
+    return { changed, wasAccessBlocked };
+}
+//# sourceMappingURL=account-blocks.js.map

package/dist/src/plugin/account-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-blocks.js","sourceRoot":"","sources":["../../../src/plugin/account-blocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAsCH,SAAS,OAAO,CAAI,KAA2B;IAC7C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAqC;IAErC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACjD,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC9C,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAA;QACzD,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QACvD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACjD,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAAqC;IAErC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAA;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA+B,EAC/B,UAAkB,EAClB,eAAwB;IAExB,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,uBAAuB,CAAC,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YACpC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAA;YACpC,OAAO;gBACL,IAAI,EAAE,uBAAuB;gBAC7B,UAAU;gBACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAA;QACH,CAAC;QACD,KAAK,YAAY;YACf,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;QACnE,KAAK,IAAI;YACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QACjE,KAAK,OAAO;YACV,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAeD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAgC,EAChC,MAAc,EACd,SAA6B,EAC7B,GAAW;IAEX,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,MAAM,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAA;IAErE,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAA;QACnC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IACE,CAAC,uBAAuB;QACxB,OAAO,CAAC,sBAAsB,KAAK,SAAS,EAC5C,CAAC;QACD,OAAO,CAAC,sBAAsB,GAAG,GAAG,CAAA;QACpC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IACE,OAAO,CAAC,iBAAiB,KAAK,IAAI;QAClC,OAAO,CAAC,mBAAmB,KAAK,SAAS;QACzC,OAAO,CAAC,uBAAuB,KAAK,SAAS,EAC7C,CAAC;QACD,OAAO,CAAC,iBAAiB,GAAG,KAAK,CAAA;QACjC,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAA;QACvC,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAA;QAC3C,OAAO,CAAC,yBAAyB,GAAG,GAAG,CAAA;QACvC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,CAAC,iBAAiB,GAAG,KAAK,CAAA;QACjC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IACtC,IAAI,OAAO,CAAC,0BAA0B,KAAK,gBAAgB,EAAE,CAAC;QAC5D,OAAO,CAAC,0BAA0B,GAAG,gBAAgB,CAAA;QACrD,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,MAAM,aAAa,GAAG,SAAS,EAAE,IAAI,EAAE,CAAA;IACvC,IAAI,aAAa,IAAI,OAAO,CAAC,eAAe,KAAK,aAAa,EAAE,CAAC;QAC/D,OAAO,CAAC,eAAe,GAAG,aAAa,CAAA;QACvC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO,CAAC,OAAO,GAAG,KAAK,CAAA;QACvB,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgC,EAChC,MAAc,EACd,GAAW;IAEX,MAAM,gBAAgB,GACpB,MAAM,CAAC,IAAI,EAAE,IAAI,2CAA2C,CAAA;IAC9D,MAAM,OAAO,GACX,OAAO,CAAC,iBAAiB,KAAK,IAAI;QAClC,OAAO,CAAC,uBAAuB,KAAK,gBAAgB;QACpD,OAAO,CAAC,oBAAoB,KAAK,IAAI;QACrC,OAAO,CAAC,sBAAsB,KAAK,SAAS;QAC5C,OAAO,CAAC,0BAA0B,KAAK,SAAS;QAChD,OAAO,CAAC,eAAe,KAAK,SAAS;QACrC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAA;IAE3B,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAA;IAChC,OAAO,CAAC,mBAAmB,GAAG,GAAG,CAAA;IACjC,OAAO,CAAC,uBAAuB,GAAG,gBAAgB,CAAA;IAClD,OAAO,CAAC,yBAAyB,GAAG,GAAG,CAAA;IACvC,OAAO,CAAC,oBAAoB,GAAG,KAAK,CAAA;IACpC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAA;IAC1C,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAA;IAC9C,OAAO,CAAC,eAAe,GAAG,SAAS,CAAA;IACnC,OAAO,CAAC,OAAO,GAAG,KAAK,CAAA;IACvB,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAgC,EAChC,eAAwB,EACxB,GAAW;IAEX,MAAM,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAA;IACrE,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAA;IACxD,MAAM,gBAAgB,GAAG,uBAAuB,IAAI,aAAa,CAAA;IACjE,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,IAAI,OAAO,CAAC,oBAAoB,KAAK,KAAK,EAAE,CAAC;QAC3C,OAAO,CAAC,oBAAoB,GAAG,KAAK,CAAA;QACpC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAA;QAC1C,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,0BAA0B,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAA;QAC9C,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,CAAC,eAAe,GAAG,SAAS,CAAA;QACnC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;QACxC,OAAO,CAAC,iBAAiB,GAAG,KAAK,CAAA;QACjC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAA;QACvC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAA;QAC3C,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,aAAa,IAAI,OAAO,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;QACrE,OAAO,CAAC,yBAAyB,GAAG,GAAG,CAAA;QACvC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,IAAI,eAAe,IAAI,gBAAgB,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACrE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAA;QACtB,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAA;AACtC,CAAC"}

package/dist/src/plugin/accounts.d.ts

@@ -1,8 +1,92 @@
-import { type AccountManagerOptions, AccountManager as CoreAccountManager } from '@cortexkit/antigravity-auth-core';
+import { type AccountManagerOptions, type AccountRepository, type AccountRepositoryRead, AccountManager as CoreAccountManager, type ManagedAccount as CoreManagedAccount, type OAuthAuthDetails as CoreOAuthAuthDetails, type ProjectContextResult, type RowRef } from '@cortexkit/antigravity-auth-core';
+import { type CapturedLocalGrant, StaleLocalGrantError } from './shared/local-grant';
 import { loadAccounts } from './storage';
 import type { OAuthAuthDetails } from './types';
 export type { AccountModelFamily as ModelFamily, AccountSessionIdentity, CooldownReason, HeaderStyle, ManagedAccount, RateLimitReason, } from '@cortexkit/antigravity-auth-core';
 export { calculateBackoffMs, computeSoftQuotaCacheTtlMs, parseRateLimitReason, resolveQuotaGroup, } from '@cortexkit/antigravity-auth-core';
+/**
+ * Thrown when the account store cannot serve accounts: a migration or a
+ * multi-row operation is pending, or a store file is unreadable. Routing
+ * must stop here; nothing falls back to the pool file or to an empty pool.
+ */
+export declare class AccountStoreNotReadyError extends Error {
+    readonly read: Exclude<AccountRepositoryRead, {
+        status: 'ready';
+    }>;
+    constructor(read: Exclude<AccountRepositoryRead, {
+        status: 'ready';
+    }>);
+}
+/**
+ * Builds a manager over the account repository from one read. Every account
+ * the manager holds carries the `RowRef` of the row it was read from: the
+ * row id, the credential epoch and the exact recorded identity (an absent
+ * identity matches only an absent one). Every write the manager makes about
+ * the account is fenced on that ref, so a write for a credential the row
+ * has since replaced is refused; positions are never used.
+ * Refreshes go through `refreshAccount`, the repository's per-account
+ * refresh, so different accounts refresh concurrently while one account's
+ * refreshes are serialized.
+ */
+export declare function loadAccountManagerFromRepository(repository: AccountRepository, options?: Partial<Omit<AccountManagerOptions, 'store' | 'storagePath' | 'repository'>>): Promise<CoreAccountManager>;
+/**
+ * Token and project operations for accounts of a repository-backed manager,
+ * for the shared request engine's local source: the refresh token is stored
+ * locally and refreshed here. A vault-backed location never uses these; it
+ * obtains a fresh token and project for every send.
+ */
+export interface LocalAccountCredentials {
+    /** Capture the selected row; resolution may adopt only that row's current credential. */
+    captureGrant(request: {
+        account: CoreManagedAccount;
+        accessToken: string;
+    }): Extract<CapturedLocalGrant, {
+        source: 'store';
+    }>;
+    /**
+     * Refreshes the locally stored refresh token of `account` through the
+     * repository, fenced on the ref the account was loaded with, and returns
+     * its updated credential. A refresh
+     * the store refused, or one where Google answered for another account,
+     * returns `undefined`: no bearer is handed out for it. Failures (Google's
+     * error answers included, see `isInvalidGrant`) are thrown.
+     */
+    refresh(account: CoreManagedAccount): Promise<CoreOAuthAuthDetails | undefined>;
+    /** Resolves the Antigravity project a request is sent under, using the cached project context. */
+    ensureProject(auth: CoreOAuthAuthDetails): Promise<ProjectContextResult>;
+    /** True when a refresh failure is `invalid_grant`: the refresh token is invalid or revoked. */
+    isInvalidGrant(error: unknown): boolean;
+    /**
+     * Check a captured bearer immediately before sending it. `ref` is the
+     * original row ID, credential epoch and authenticated identity captured
+     * with that token, not the account object's potentially changed ref.
+     *
+     * The manager must still hold the enabled selected account at that ref.
+     * One fresh repository read must show the same enabled row, a credential
+     * the native store marks usable, and present Antigravity provider metadata.
+     * Recheck the held account after the read because it may change during it.
+     * A different stored token at the unchanged ref raises
+     * `LocalGrantSupersededError`; other refusals raise `StaleAccountGrantError`.
+     * The held account must also still carry the captured token.
+     *
+     * This is a dispatch snapshot, not a lease or network lock. It never changes
+     * the prepared bearer, and the row can still change after the check returns.
+     */
+    assertGrantCurrent(request: {
+        account: CoreManagedAccount;
+        accessToken: string;
+        ref: RowRef;
+    }): Promise<void>;
+}
+/** The selected account no longer holds the credential a grant was made for. */
+export declare class StaleAccountGrantError extends StaleLocalGrantError {
+    constructor();
+}
+export declare function createLocalAccountCredentials(manager: CoreAccountManager, dependencies: {
+    /** The repository `manager` was loaded from. */
+    repository: Pick<AccountRepository, 'read'>;
+    ensureProject?: (auth: CoreOAuthAuthDetails) => Promise<ProjectContextResult>;
+}): LocalAccountCredentials;
 export declare class AccountManager extends CoreAccountManager {
     constructor(authFallback?: OAuthAuthDetails, stored?: Awaited<ReturnType<typeof loadAccounts>>, options?: Partial<AccountManagerOptions>);
     static loadFromDisk(authFallback?: OAuthAuthDetails): Promise<AccountManager>;

package/dist/src/plugin/accounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../src/plugin/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAC1B,cAAc,IAAI,kBAAkB,EACrC,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EAEL,YAAY,EAGb,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE/C,YAAY,EACV,kBAAkB,IAAI,WAAW,EACjC,sBAAsB,EACtB,cAAc,EACd,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,kCAAkC,CAAA;AAqBzC,qBAAa,cAAe,SAAQ,kBAAkB;gBAElD,YAAY,CAAC,EAAE,gBAAgB,EAC/B,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,EACjD,OAAO,GAAE,OAAO,CAAC,qBAAqB,CAAM;WAiBjC,YAAY,CACvB,YAAY,CAAC,EAAE,gBAAgB,GAC9B,OAAO,CAAC,cAAc,CAAC;CAG3B"}
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../src/plugin/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,cAAc,IAAI,kBAAkB,EACpC,KAAK,cAAc,IAAI,kBAAkB,EACzC,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,KAAK,oBAAoB,EACzB,KAAK,MAAM,EAEZ,MAAM,kCAAkC,CAAA;AAIzC,OAAO,EACL,KAAK,kBAAkB,EAEvB,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,YAAY,EAGb,MAAM,WAAW,CAAA;AAElB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE/C,YAAY,EACV,kBAAkB,IAAI,WAAW,EACjC,sBAAsB,EACtB,cAAc,EACd,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,kCAAkC,CAAA;AAoCzC;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,qBAAqB,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;gBAEtD,IAAI,EAAE,OAAO,CAAC,qBAAqB,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;CAWtE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,OAAO,CACd,IAAI,CAAC,qBAAqB,EAAE,OAAO,GAAG,aAAa,GAAG,YAAY,CAAC,CAC/D,GACL,OAAO,CAAC,kBAAkB,CAAC,CAU7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,yFAAyF;IACzF,YAAY,CAAC,OAAO,EAAE;QACpB,OAAO,EAAE,kBAAkB,CAAA;QAC3B,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,kBAAkB,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IACpD;;;;;;;OAOG;IACH,OAAO,CACL,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC5C,kGAAkG;IAClG,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACxE,+FAA+F;IAC/F,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAA;IACvC;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,OAAO,EAAE;QAC1B,OAAO,EAAE,kBAAkB,CAAA;QAC3B,WAAW,EAAE,MAAM,CAAA;QACnB,GAAG,EAAE,MAAM,CAAA;KACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAED,gFAAgF;AAChF,qBAAa,sBAAuB,SAAQ,oBAAoB;;CAK/D;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,kBAAkB,EAC3B,YAAY,EAAE;IACZ,gDAAgD;IAChD,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IAC3C,aAAa,CAAC,EAAE,CACd,IAAI,EAAE,oBAAoB,KACvB,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACnC,GACA,uBAAuB,CAiEzB;AAED,qBAAa,cAAe,SAAQ,kBAAkB;gBAElD,YAAY,CAAC,EAAE,gBAAgB,EAC/B,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,EACjD,OAAO,GAAE,OAAO,CAAC,qBAAqB,CAAM;WAYjC,YAAY,CACvB,YAAY,CAAC,EAAE,gBAAgB,GAC9B,OAAO,CAAC,cAAc,CAAC;CAG3B"}

package/dist/src/plugin/accounts.js

@@ -1,7 +1,18 @@
-import { AccountManager as CoreAccountManager, } from '@cortexkit/antigravity-auth-core';
+import { AccountManager as CoreAccountManager, sameRowRef, } from '@cortexkit/antigravity-auth-core';
 import { debugLogToFile } from './debug';
+import { ensureProjectContext } from './project';
+import { LocalGrantSupersededError, StaleLocalGrantError, } from './shared/local-grant';
 import { getStoragePath, loadAccounts, saveAccounts, saveAccountsReplace, } from './storage';
+import { isInvalidGrantFailure } from './token';
 export { calculateBackoffMs, computeSoftQuotaCacheTtlMs, parseRateLimitReason, resolveQuotaGroup, } from '@cortexkit/antigravity-auth-core';
+/**
+ * The pre-store pool-file binding. Every function it calls first runs the
+ * migration's `assertLegacyAccountStorageWritable`, which refuses
+ * (`LegacyAccountPoolRetiredError`) once a canonical store pointer is
+ * published and its journal is not an inactive rollback, or when store
+ * files exist without a journal. A manager built on it never writes a
+ * retired pool file.
+ */
 const openCodeStore = {
     load: async () => loadAccounts(),
     saveMerged: async (_path, next) => {
@@ -20,6 +31,120 @@ const openCodeStore = {
     },
     clear: async () => { },
 };
+function defaultDiagnostic(message, fields) {
+    debugLogToFile(fields ? `${message} ${JSON.stringify(fields)}` : message);
+}
+/**
+ * Thrown when the account store cannot serve accounts: a migration or a
+ * multi-row operation is pending, or a store file is unreadable. Routing
+ * must stop here; nothing falls back to the pool file or to an empty pool.
+ */
+export class AccountStoreNotReadyError extends Error {
+    read;
+    constructor(read) {
+        super(read.status === 'error'
+            ? `The account store's ${read.file} file cannot be read: ${read.reason}`
+            : read.status === 'management-pending'
+                ? `An account ${read.management.kind} operation is pending; resume it before using the accounts`
+                : 'The account store is waiting for its migration to finish; run `antigravity-auth migrate --offline`');
+        this.name = 'AccountStoreNotReadyError';
+        this.read = read;
+    }
+}
+/**
+ * Builds a manager over the account repository from one read. Every account
+ * the manager holds carries the `RowRef` of the row it was read from: the
+ * row id, the credential epoch and the exact recorded identity (an absent
+ * identity matches only an absent one). Every write the manager makes about
+ * the account is fenced on that ref, so a write for a credential the row
+ * has since replaced is refused; positions are never used.
+ * Refreshes go through `refreshAccount`, the repository's per-account
+ * refresh, so different accounts refresh concurrently while one account's
+ * refreshes are serialized.
+ */
+export async function loadAccountManagerFromRepository(repository, options = {}) {
+    const read = await repository.read();
+    if (read.status !== 'ready')
+        throw new AccountStoreNotReadyError(read);
+    return CoreAccountManager.fromRepository(read, {
+        repository,
+        now: options.now,
+        random: options.random,
+        pid: options.pid ?? process.pid,
+        onDiagnostic: options.onDiagnostic ?? defaultDiagnostic,
+    });
+}
+/** The selected account no longer holds the credential a grant was made for. */
+export class StaleAccountGrantError extends StaleLocalGrantError {
+    constructor() {
+        super();
+        this.name = 'StaleAccountGrantError';
+    }
+}
+export function createLocalAccountCredentials(manager, dependencies) {
+    const heldLocally = (account, ref) => account.ref !== undefined &&
+        sameRowRef(account.ref, ref) &&
+        account.enabled !== false &&
+        manager.getAccounts().includes(account);
+    const readCurrentRow = async (ref) => {
+        const read = await dependencies.repository.read();
+        const row = read.status === 'ready'
+            ? read.rows.find((candidate) => sameRowRef(candidate.ref, ref))
+            : undefined;
+        if (row === undefined ||
+            !row.enabled ||
+            !row.usable ||
+            row.credential === undefined ||
+            row.metadata.status !== 'present')
+            throw new StaleAccountGrantError();
+        return row;
+    };
+    const local = {
+        captureGrant({ account, accessToken }) {
+            const ref = account.ref === undefined
+                ? undefined
+                : Object.freeze({ ...account.ref });
+            return {
+                source: 'store',
+                check: () => {
+                    if (ref === undefined)
+                        throw new StaleAccountGrantError();
+                    return local.assertGrantCurrent({ account, accessToken, ref });
+                },
+                async resolveCurrent() {
+                    if (ref === undefined || !heldLocally(account, ref))
+                        throw new StaleAccountGrantError();
+                    const row = await readCurrentRow(ref);
+                    if (!heldLocally(account, ref) ||
+                        !manager.adoptCurrentRow(account, row))
+                        throw new StaleAccountGrantError();
+                },
+            };
+        },
+        async refresh(account) {
+            const outcome = await manager.refreshAccount(account);
+            if (outcome.status !== 'rotated')
+                return undefined;
+            return manager.toAuthDetails(account);
+        },
+        ensureProject: dependencies.ensureProject ?? ensureProjectContext,
+        isInvalidGrant: isInvalidGrantFailure,
+        async assertGrantCurrent({ account, accessToken, ref }) {
+            if (!heldLocally(account, ref))
+                throw new StaleAccountGrantError();
+            const row = await readCurrentRow(ref);
+            // Recheck the selected account and its original row ref after the read.
+            // Checking cannot adopt a newer stored token or change a prepared bearer.
+            if (!heldLocally(account, ref))
+                throw new StaleAccountGrantError();
+            if (row.credential?.accessToken !== accessToken)
+                throw new LocalGrantSupersededError();
+            if (account.access !== accessToken)
+                throw new StaleAccountGrantError();
+        },
+    };
+    return local;
+}
 export class AccountManager extends CoreAccountManager {
     constructor(authFallback, stored, options = {}) {
         super(authFallback, stored, {
@@ -28,8 +153,7 @@ export class AccountManager extends CoreAccountManager {
             now: options.now,
             random: options.random,
             pid: options.pid ?? process.pid,
-            onDiagnostic: options.onDiagnostic ??
-                ((message, fields) => debugLogToFile(fields ? `${message} ${JSON.stringify(fields)}` : message)),
+            onDiagnostic: options.onDiagnostic ?? defaultDiagnostic,
         });
     }
     static async loadFromDisk(authFallback) {

package/dist/src/plugin/accounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../src/plugin/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,cAAc,IAAI,kBAAkB,GACrC,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,GACpB,MAAM,WAAW,CAAA;AAWlB,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,kCAAkC,CAAA;AAEzC,MAAM,aAAa,GAAmC;IACpD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,EAAE;IAChC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QACxB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI;YACxC,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,CAAC;SACf,CAAA;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAA;QAC3C,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;CACtB,CAAA;AAED,MAAM,OAAO,cAAe,SAAQ,kBAAkB;IACpD,YACE,YAA+B,EAC/B,MAAiD,EACjD,UAA0C,EAAE;QAE5C,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa;YACrC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,cAAc,EAAE;YACpD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC/B,YAAY,EACV,OAAO,CAAC,YAAY;gBACpB,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACnB,cAAc,CACZ,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAC1D,CAAC;SACP,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,YAA+B;QAE/B,OAAO,IAAI,cAAc,CAAC,YAAY,EAAE,MAAM,YAAY,EAAE,CAAC,CAAA;IAC/D,CAAC;CACF"}
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../src/plugin/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,cAAc,IAAI,kBAAkB,EAKpC,UAAU,GACX,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAEL,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,GACpB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAW/C,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,kCAAkC,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,aAAa,GAAgD;IACjE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,EAAE;IAChC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QACxB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI;YACxC,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,CAAC;SACf,CAAA;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAA;QAC3C,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;CACtB,CAAA;AAED,SAAS,iBAAiB,CACxB,OAAe,EACf,MAAgC;IAEhC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,CAAqD;IAElE,YAAY,IAAyD;QACnE,KAAK,CACH,IAAI,CAAC,MAAM,KAAK,OAAO;YACrB,CAAC,CAAC,uBAAuB,IAAI,CAAC,IAAI,yBAAyB,IAAI,CAAC,MAAM,EAAE;YACxE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,oBAAoB;gBACpC,CAAC,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,IAAI,4DAA4D;gBAChG,CAAC,CAAC,oGAAoG,CAC3G,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,UAA6B,EAC7B,UAEI,EAAE;IAEN,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAA;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;QAAE,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAA;IACtE,OAAO,kBAAkB,CAAC,cAAc,CAAC,IAAI,EAAE;QAC7C,UAAU;QACV,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC/B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,iBAAiB;KACxD,CAAC,CAAA;AACJ,CAAC;AAoDD,gFAAgF;AAChF,MAAM,OAAO,sBAAuB,SAAQ,oBAAoB;IAC9D;QACE,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAA2B,EAC3B,YAMC;IAED,MAAM,WAAW,GAAG,CAAC,OAA2B,EAAE,GAAW,EAAW,EAAE,CACxE,OAAO,CAAC,GAAG,KAAK,SAAS;QACzB,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC;QAC5B,OAAO,CAAC,OAAO,KAAK,KAAK;QACzB,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QACjD,MAAM,GAAG,GACP,IAAI,CAAC,MAAM,KAAK,OAAO;YACrB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC,CAAC,SAAS,CAAA;QACf,IACE,GAAG,KAAK,SAAS;YACjB,CAAC,GAAG,CAAC,OAAO;YACZ,CAAC,GAAG,CAAC,MAAM;YACX,GAAG,CAAC,UAAU,KAAK,SAAS;YAC5B,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS;YAEjC,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,MAAM,KAAK,GAA4B;QACrC,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE;YACnC,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,KAAK,SAAS;gBACvB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;YACvC,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG,EAAE;oBACV,IAAI,GAAG,KAAK,SAAS;wBAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;oBACzD,OAAO,KAAK,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;gBAChE,CAAC;gBACD,KAAK,CAAC,cAAc;oBAClB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;wBACjD,MAAM,IAAI,sBAAsB,EAAE,CAAA;oBACpC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;oBACrC,IACE,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;wBAC1B,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC;wBAEtC,MAAM,IAAI,sBAAsB,EAAE,CAAA;gBACtC,CAAC;aACF,CAAA;QACH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAClD,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACvC,CAAC;QACD,aAAa,EAAE,YAAY,CAAC,aAAa,IAAI,oBAAoB;QACjE,cAAc,EAAE,qBAAqB;QACrC,KAAK,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE;YACpD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;gBAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;YAClE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAA;YACrC,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;gBAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;YAClE,IAAI,GAAG,CAAC,UAAU,EAAE,WAAW,KAAK,WAAW;gBAC7C,MAAM,IAAI,yBAAyB,EAAE,CAAA;YACvC,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;gBAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACxE,CAAC;KACF,CAAA;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,kBAAkB;IACpD,YACE,YAA+B,EAC/B,MAAiD,EACjD,UAA0C,EAAE;QAE5C,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa;YACrC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,cAAc,EAAE;YACpD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC/B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,iBAAiB;SACxD,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,YAA+B;QAE/B,OAAO,IAAI,cAAc,CAAC,YAAY,EAAE,MAAM,YAAY,EAAE,CAAC,CAAA;IAC/D,CAAC;CACF"}