@framers/agentos-ext-account-sources 0.6.0 → 0.7.0

package/dist/sync/SourceRevocations.d.ts

@@ -0,0 +1,311 @@
+/**
+ * @fileoverview Fenced purge and revocation recovery for account sources. One short transaction blocks the owner,
+ * moves the connection, records a purge marker and moves the grant's refresh token into a sealed revoke-only queue;
+ * the purge completes in a recoverable transaction of its own; an account-independent worker revokes queued tokens
+ * before a fixed deadline. A durable grant lease serializes refreshes across workers, and the grant an authorization
+ * exchange returns is either installed or queued for revocation, never lost.
+ * @module account-sources/sync/SourceRevocations
+ */
+import type { StorageAdapter } from '@framers/sql-storage-adapter';
+import type { SourceOwnerScope } from '@framers/agentos/cognition/library';
+import { SealedTokenStore, type OAuthTokenSet, type SealedBytesStore, type SealingKeys, type RedirectOAuthFlow } from '@framers/agentos/auth';
+import type { SourceSyncScope } from './types.js';
+import type { SqlAccountSourceSyncStore, SourceSyncHandle } from './SqlAccountSourceSyncStore.js';
+import type { SourceSyncLifecycle } from './AccountSourceSync.js';
+/** The key a connection's grant is kept under in the host's sealed-value rows, inside its `sourceGrantNamespace`. */
+export declare const SOURCE_GRANT_KEY = "grant";
+/**
+ * The sealed-store namespace of one connection's grant, naming its tenant, owner and connection: a sealed grant
+ * copied to another connection's row does not open. Initial installation, refresh and the transfer to the revoke-only
+ * queue all use it with `SOURCE_GRANT_KEY`.
+ */
+export declare function sourceGrantNamespace(scope: SourceSyncScope): string;
+/** Why a connection stopped: a disconnect, the account's deletion, a refused grant or a grant without its scope. */
+export type SourceRevocationReason = 'disconnect' | 'account_deleted' | 'grant_rejected' | 'insufficient_scope';
+/**
+ * A connection's lifecycle notice for authenticated controls: whether its local purge is still pending, and where
+ * revoking its grant stands. `not_needed` when there was no grant to revoke, `pending` while the queue holds it,
+ * `confirmed` once the provider answered the revocation with a success, and `permission_removal_required` when it
+ * could not be revoked, so the account owner removes the permission at the provider. The local purge completes
+ * whatever the revocation's outcome.
+ */
+export interface SourceRevocationNotice {
+    readonly localPending: boolean;
+    readonly revocation: 'not_needed' | 'pending' | 'confirmed' | 'permission_removal_required';
+}
+/**
+ * What one `revokeBatch` did: the revocations it sent, those confirmed, those deferred to a retry, the queued tokens
+ * erased at their deadline together with the exchanges whose deadline passed with no outcome, and the queued tokens
+ * that could not be opened.
+ */
+export interface SourceRevocationBatch {
+    readonly attempted: number;
+    readonly confirmed: number;
+    readonly deferred: number;
+    readonly expired: number;
+    readonly unreadable: number;
+}
+/** A content-free lifecycle event: a fixed state and a count, never a scope, a token or a provider's text. */
+export interface SourceRevocationEvent {
+    readonly kind: 'source_revocation';
+    readonly state: 'fenced' | 'purged' | 'confirmed' | 'deferred' | 'expired' | 'unreadable';
+    readonly n: number;
+}
+/**
+ * What the lifecycle runs with: the synchronization store, the sealing keys, the host's sealed-value binding and a
+ * revocation-only provider flow, with an optional table prefix, clock and event sink.
+ *
+ * @typeParam Prepared - The store's prepared value for one document.
+ */
+export interface SourceRevocationOptions<Prepared> {
+    /** Prefix of the lifecycle tables, the one given to `sourceRevocationSchema`; `agentos_source_revoke` unless given. */
+    readonly tablePrefix?: string;
+    /** The synchronization store whose connections the lifecycle stops and purges. */
+    readonly store: SqlAccountSourceSyncStore<Prepared>;
+    /** The current key seals queued tokens; it and every previous key open them and the host's grants. */
+    readonly keys: SealingKeys;
+    /** Same sealed-value table used by initial grant installation; every operation uses tx. */
+    readonly values: (tx: StorageAdapter, scope: SourceSyncScope) => SealedBytesStore;
+    /** Construct a null-store provider flow. Its capped fetch must honor this signal. */
+    readonly revoker: (signal: AbortSignal) => Pick<RedirectOAuthFlow, 'revoke'>;
+    /** Current time as integer UTC epoch milliseconds; `Date.now` unless given. */
+    readonly clock?: () => number;
+    /** Receives content-free events; a sink that throws is ignored. */
+    readonly events?: (event: SourceRevocationEvent) => void;
+}
+/**
+ * One authorization code exchange begun for a connection: an opaque id, the connection, the generation its grant
+ * may be installed into, and when it began and ends, in UTC epoch milliseconds. It holds no authorization code,
+ * state, PKCE verifier, address or credential.
+ */
+export interface SourceGrantExchange {
+    readonly id: string;
+    readonly scope: SourceSyncScope;
+    readonly generation: number;
+    readonly startedAt: number;
+    readonly endsAt: number;
+}
+/**
+ * What settling an exchange did with its grant: `installed` in the connection's sealed binding, `cleanup_pending`
+ * when the grant went to the revoke-only queue instead, and `permission_removal_required` when it could be neither,
+ * so the account owner removes the permission at the provider.
+ */
+export type SourceGrantExchangeOutcome = {
+    readonly kind: 'installed';
+} | {
+    readonly kind: 'cleanup_pending';
+} | {
+    readonly kind: 'permission_removal_required';
+};
+/**
+ * The lifecycle of a grant an authorization exchange returns before it is installed: the exchange is recorded before
+ * its request is sent, the returned grant is sealed into the revoke-only queue before it is installed, and a grant
+ * that is not installed is revoked from that queue or reported as needing the account owner's removal.
+ */
+export interface SourceUninstalledGrantLifecycle {
+    beginExchange(tx: StorageAdapter, scope: SourceSyncScope, generation: number, exchangeId: string): Promise<SourceGrantExchange | null>;
+    settleExchange(exchange: SourceGrantExchange, grant: OAuthTokenSet, install: (tx: StorageAdapter, grant: OAuthTokenSet) => Promise<boolean>): Promise<SourceGrantExchangeOutcome>;
+    endExchange(exchange: SourceGrantExchange, outcome: 'not_dispatched' | 'revoked' | 'unconfirmed'): Promise<void>;
+    mayInstallExchange(tx: StorageAdapter, exchange: SourceGrantExchange): Promise<boolean>;
+}
+/**
+ * PostgreSQL DDL for the migration-owned lifecycle tables: the owner's block marker, the per-connection stop
+ * intent, the revoke-only queue and its due index, the grant lease, and the authorization exchanges with their two
+ * indexes. The service never runs them: the host's migration does. No table references an account table, so
+ * removing an account cannot erase an outstanding revocation, and the rows hold opaque ids, times, fixed states,
+ * attempt counts and sealed refresh tokens only.
+ *
+ * @param prefix - Table-name prefix: a lower-case letter, then at most 27 lower-case letters, digits or underscores.
+ * @returns The eight statements, in the order they must run.
+ * @throws {Error} `invalid_source_revocation_prefix` when the prefix does not have that form.
+ */
+export declare function sourceRevocationSchema(prefix?: string): readonly string[];
+/**
+ * Adapter-owned lifecycle recovery. No method logs or returns a queued credential.
+ *
+ * `disconnect`, `loseGrant` and `deleteOwner` commit the owner's fence, the connection's stop, a purge marker and the
+ * transfer of the grant's refresh token to the revoke-only queue in one transaction, before any provider call; the
+ * purge of sources and every result derived from them completes in a transaction of its own, which `recover`
+ * resumes after a failure. `revokeBatch` revokes queued tokens on its own schedule, independent of accounts, until
+ * each token's deadline, 23 hours and 59 minutes after it was queued. `withGrant` serializes refreshes across
+ * workers under a durable lease. The exchange methods record an authorization exchange before its request is sent
+ * and either install the grant it returns or queue it for revocation. Every check of `canConnect`, `permits` and
+ * `mayInstallExchange` belongs inside the owner fence of the host's transaction.
+ *
+ * @typeParam Prepared - The store's prepared value for one document.
+ */
+export declare class SourceRevocations<Prepared = unknown> implements SourceSyncLifecycle, SourceUninstalledGrantLifecycle {
+    private readonly db;
+    private readonly options;
+    private readonly t;
+    private readonly store;
+    private readonly clock;
+    /**
+     * @param db - A PostgreSQL adapter with transactions, on the database of the store's tables.
+     * @param options - The store, keys, sealed-value binding and revoker, with an optional prefix, clock and sink.
+     * @throws {Error} `source_revocation_requires_postgres` for another kind of adapter or one without transactions,
+     *   and `invalid_source_revocation_prefix` for a malformed prefix.
+     */
+    constructor(db: StorageAdapter, options: SourceRevocationOptions<Prepared>);
+    private now;
+    private emit;
+    private stored;
+    private grant;
+    private context;
+    /**
+     * Combine with fresh host account liveness in the sync store's active binding. False while a stop's purge is
+     * pending for the owner and, for good, once the owner was deleted; it does not authenticate an account.
+     */
+    permits(tx: StorageAdapter, scope: SourceOwnerScope): Promise<boolean>;
+    /**
+     * Check under the owner fence both at authorization start and grant installation. False when `permits` is, while a
+     * revocation of the owner's is pending or ended without confirmation and is not acknowledged, and while an exchange
+     * of the owner's is in flight or its returned grant awaits the same conditions.
+     */
+    canConnect(tx: StorageAdapter, scope: SourceOwnerScope): Promise<boolean>;
+    /**
+     * Whether a stop's revocation or an exchange keeps the owner from a new grant, leaving out the exchange `except`.
+     * A revocation pending in the queue, or one that expired or could not be opened before the owner acknowledged the
+     * permission's removal, keeps it; so does an exchange in flight, one whose returned grant is in the queue under the
+     * same conditions, and one whose outcome is unconfirmed and not acknowledged.
+     */
+    private barrier;
+    /**
+     * The connection's notice for authenticated controls: whether its purge is pending, and the more pressing of the
+     * revocation of its last stopped grant and the cleanup of the grant its newest exchange returned.
+     */
+    status(scope: SourceSyncScope): Promise<SourceRevocationNotice>;
+    private block;
+    private stage;
+    private canReplaceQueue;
+    /**
+     * Disconnects the connection at the generation the authenticated request saw: fences it, queues its grant for
+     * revocation and clears the active grant in one transaction, then purges its sources and every result derived
+     * from them. No provider call happens here.
+     *
+     * @returns The connection's notice, or null when the generation has moved on, which changes nothing.
+     * @throws {SourceSyncFault} `storage_unavailable` when a step fails: the committed stop stays, and `recover`
+     *   completes its purge.
+     */
+    disconnect(scope: SourceSyncScope, generation: number): Promise<SourceRevocationNotice | null>;
+    /**
+     * The coordinator's handoff of a refused grant: with the run's exact current handle, the connection moves to
+     * `needs_reconnecting` and its grant is queued for revocation in one transaction, then purged as `disconnect` does.
+     *
+     * @returns Whether the handle was current and the grant was fenced; a stale handle changes nothing.
+     */
+    loseGrant(handle: SourceSyncHandle, reason: 'grant_rejected' | 'insufficient_scope'): Promise<boolean>;
+    /**
+     * Account deletion: blocks the owner for good and stops every connection of the owner, queueing each grant for
+     * revocation, in one transaction, also when the owner has no connection; then purges them. Call it before the host
+     * removes any source, credential or account row. Queued revocations outlive the account.
+     */
+    deleteOwner(scope: SourceOwnerScope): Promise<void>;
+    /** Recover every pending intent for the owner. No grant or account row is required. */
+    recover(scope: SourceSyncScope): Promise<void>;
+    private recoverOwner;
+    /**
+     * Owner-authenticated attestation; never describe it as provider confirmation. The account owner confirms having
+     * removed the permission at the provider for the connection's revocation that expired or could not be opened, and
+     * for its exchanges whose outcome is unconfirmed or whose returned grant's revocation ended the same way; a new
+     * grant may then begin. A pending or confirmed revocation is not acknowledged.
+     *
+     * @returns Whether anything was acknowledged.
+     */
+    acknowledgeRemoval(scope: SourceSyncScope): Promise<boolean>;
+    /**
+     * Runs one server-side grant operation, such as a refresh, under a durable 30-second grant lease, without holding a
+     * transaction over the network. `work` builds the provider flow on the sealed store it is given and must honor the
+     * signal, which aborts after 15 seconds or with `parent`. Every load and save through that store, and the final
+     * return, recheck the sync handle and the grant lease in a short transaction, so a disconnect or an expired lease
+     * makes a held token's save or return fail. The lease is never renewed; after it expires another worker may take
+     * a new one. Access tokens stay in memory.
+     *
+     * @returns What `work` answered.
+     * @throws {SourceSyncFault} `rate_limited` while another worker holds the lease, with its expiry as `retryAt`;
+     *   `grant_rejected` for a stale handle, a lost lease or a disconnect; `cancelled` when `parent` aborted first;
+     *   `storage_unavailable` for any other failure. A provider refusal (`OAuthGrantRefused`) passes through.
+     */
+    withGrant<T>(handle: SourceSyncHandle, work: (tokens: SealedTokenStore, signal: AbortSignal) => Promise<T>, parent?: AbortSignal): Promise<T>;
+    private expireQueue;
+    private claimRevoke;
+    private settleRevoke;
+    /**
+     * Schedule independently of accounts, source scopes and provider polling, at least every minute. Erases queued
+     * tokens whose deadline has passed and records exchanges whose deadline passed with no outcome as unconfirmed, then
+     * claims up to `limit` due tokens, one worker per token, and revokes each outside any transaction with the
+     * provider flow's `revoke`, 15 seconds at most. A success confirms it; a failure retries after 1, 2, 4, 8, then 15
+     * minutes, never past the deadline; a token that does not open is erased. A worker whose claim expired cannot
+     * settle a token another worker claimed since.
+     *
+     * @param limit - At most this many tokens, an integer from 1 to 100; 20 unless given.
+     * @param parent - Stops the batch: no request starts after it aborts.
+     * @throws {SourceSyncFault} `invalid_response` for another limit and `storage_unavailable` when the store fails.
+     */
+    revokeBatch(limit?: number, parent?: AbortSignal): Promise<SourceRevocationBatch>;
+    /**
+     * Remove unreferenced terminal diagnostics, never usable credentials or restore markers: a day after their
+     * deadline, exchanges that installed, ended, were acknowledged or whose returned grant's revocation was confirmed,
+     * then terminal queue rows no stop or exchange refers to, at most 1,000 of each a call.
+     *
+     * @returns How many rows were removed.
+     */
+    compact(): Promise<number>;
+    /** Records exchanges whose deadline passed with no grant returned as unconfirmed: their outcome is unknown. */
+    private lapseExchanges;
+    /** Takes the owner's lifecycle row lock, creating the row unblocked when missing; exchange changes take it first. */
+    private lockOwner;
+    private checkExchange;
+    /** The exchange's row under its lock, or null when no row matches every field of the exchange. */
+    private exchangeRow;
+    /** What a settled exchange did with its grant, from its row and its queued token's state. */
+    private exchangeOutcome;
+    /**
+     * Records an authorization exchange before its request is sent. Call it inside the host transaction that consumes
+     * the authenticated start, under the owner fence: it answers null, and the caller rolls that whole transaction
+     * back, unless the connection is `connecting` at `generation` and `canConnect` holds, so one exchange at a time is
+     * in flight for the owner and none while a revocation of the owner's is pending or unacknowledged. The exchange's
+     * marker holds opaque ids and times only, and the exchange ends 60 seconds after it begins: a grant returned later
+     * is not installed. Send the request only after the transaction commits.
+     *
+     * @param exchangeId - The host's opaque id for this attempt, 1 to 512 characters, never reused.
+     * @returns The exchange, or null.
+     * @throws {SourceSyncFault} `invalid_response` for a malformed scope, generation or id.
+     */
+    beginExchange(tx: StorageAdapter, scope: SourceSyncScope, generation: number, exchangeId: string): Promise<SourceGrantExchange | null>;
+    /**
+     * Whether this exact exchange may install its grant now, read under the owner fence in the installing transaction:
+     * its marker is open and holds its sealed grant for installation, its deadline has not passed, the connection is
+     * still `connecting` at its generation with no grant installed, `permits` holds, and no other revocation or
+     * exchange keeps the owner from a new grant. It recognizes only the matching live attempt, never an older or newer
+     * one.
+     */
+    mayInstallExchange(tx: StorageAdapter, exchange: SourceGrantExchange): Promise<boolean>;
+    /**
+     * Settles the grant an exchange returned. First the grant's refresh token is sealed into the revoke-only queue,
+     * held there until the exchange's end, so a crash cannot lose it. Then, when `mayInstallExchange` holds, `install`
+     * runs in the owner's transaction: it saves the grant under `sourceGrantNamespace` and `SOURCE_GRANT_KEY`, records
+     * the connection's ready state and finishes the host's start, and the same commit removes the held token. If the
+     * exchange may not install, `install` answers anything but true, throws or finishes after the deadline, the whole
+     * installation rolls back and the held token becomes due for revocation at once; if this process stops first, it
+     * becomes due at the exchange's end. A stale, cancelled or deleted exchange never runs `install`. An exchange that
+     * already ended or was recorded unconfirmed takes no token: its notice stands. A grant with no usable refresh token
+     * records the exchange unconfirmed.
+     *
+     * @returns What became of the grant.
+     * @throws {SourceSyncFault} `invalid_response` for a malformed exchange, `storage_unavailable` when the store fails.
+     */
+    settleExchange(exchange: SourceGrantExchange, grant: OAuthTokenSet, install: (tx: StorageAdapter, grant: OAuthTokenSet) => Promise<boolean>): Promise<SourceGrantExchangeOutcome>;
+    /**
+     * Records how an exchange ended when it returned no grant to settle: `not_dispatched` when its request never left
+     * the process, `revoked` when the provider flow revoked a grant it refused and the provider confirmed it, and
+     * `unconfirmed` for anything else after the request could have left, such as a timeout, an aborted connection, an
+     * unreadable answer or a revocation that was not confirmed. Only an open exchange holding no returned grant takes
+     * an ending, and a recorded outcome is never weakened. An unconfirmed exchange keeps new grants blocked until the
+     * account owner acknowledges the permission's removal.
+     *
+     * @throws {SourceSyncFault} `invalid_response` for a malformed exchange or another outcome.
+     */
+    endExchange(exchange: SourceGrantExchange, outcome: 'not_dispatched' | 'revoked' | 'unconfirmed'): Promise<void>;
+}
+//# sourceMappingURL=SourceRevocations.d.ts.map

package/dist/sync/SourceRevocations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SourceRevocations.d.ts","sourceRoot":"","sources":["../../src/sync/SourceRevocations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,iBAAiB,EACpF,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAmB,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,qHAAqH;AACrH,eAAO,MAAM,gBAAgB,UAAU,CAAC;AACxC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAEnE;AACD,oHAAoH;AACpH,MAAM,MAAM,sBAAsB,GAAG,YAAY,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAChH;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,6BAA6B,CAAC;CAC7F;AACD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AACD,8GAA8G;AAC9G,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;IAC1F,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AACD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB,CAAC,QAAQ;IAC/C,uHAAuH;IACvH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpD,sGAAsG;IACtG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,KAAK,gBAAgB,CAAC;IAClF,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC7E,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;CAC1D;AACD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AACD;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAA;CAAE,CAAC;AACrD;;;;GAIG;AACH,MAAM,WAAW,+BAA+B;IAC9C,aAAa,CACX,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAC1C,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GACrC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACvC,cAAc,CACZ,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EACnD,OAAO,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,GACtE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvC,WAAW,CACT,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,aAAa,GACpD,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzF;AAgDD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,SAA0B,GAAG,SAAS,MAAM,EAAE,CA6B1F;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAiB,CAAC,QAAQ,GAAG,OAAO,CAAE,YAAW,mBAAmB,EAAE,+BAA+B;IAUpG,OAAO,CAAC,QAAQ,CAAC,EAAE;IAAkB,OAAO,CAAC,QAAQ,CAAC,OAAO;IATzE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA4B;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsC;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC;;;;;OAKG;gBAC0B,EAAE,EAAE,cAAc,EAAmB,OAAO,EAAE,uBAAuB,CAAC,QAAQ,CAAC;IAI5G,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,IAAI;YAGE,MAAM;IAIpB,OAAO,CAAC,KAAK;IAGb,OAAO,CAAC,OAAO;IAEf;;;OAGG;IACG,OAAO,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5E;;;;OAIG;IACG,UAAU,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAI/E;;;;;OAKG;YACW,OAAO;IAYrB;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC;YAevD,KAAK;YAKL,KAAK;YAiCL,eAAe;IAI7B;;;;;;;;OAQG;IACG,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAOpG;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ5G;;;;OAIG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzD,uFAAuF;IACjF,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;YACtC,YAAY;IAoB1B;;;;;;;OAOG;IACG,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAyBlE;;;;;;;;;;;;OAYG;IACG,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,EACzC,IAAI,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;YAgD1F,WAAW;YAOX,WAAW;YAYX,YAAY;IAY1B;;;;;;;;;;;OAWG;IACG,WAAW,CAAC,KAAK,SAAK,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA6CnF;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAehC,+GAA+G;YACjG,cAAc;IAO5B,qHAAqH;YACvG,SAAS;IAKvB,OAAO,CAAC,aAAa;IAOrB,kGAAkG;YACpF,WAAW;IAMzB,6FAA6F;YAC/E,eAAe;IAO7B;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAChF,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAkB1D;;;;;;OAMG;IACG,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAe7F;;;;;;;;;;;;;OAaG;IACG,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EACtE,OAAO,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAkD/G;;;;;;;;;OASG;IACG,WAAW,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAavH"}