@framers/agentos-ext-account-sources 0.6.1 → 0.7.0

package/README.md

@@ -1,6 +1,6 @@
 # @framers/agentos-ext-account-sources
 
-A person's own accounts as sources. This library defines `AccountSourceConnector` and the `SourceRef` every passage carries, with helpers for line ranges, links, bounded body reads, requests under the shared public-sources limiter and the cache lifetime of a read, the contracts, pure rules, PostgreSQL store and coordinator of a durable, resumable synchronization, and weighted request quotas that every worker shares.
+A person's own accounts as sources. This library defines `AccountSourceConnector` and the `SourceRef` every passage carries, with helpers for line ranges, links, bounded body reads, requests under the shared public-sources limiter and the cache lifetime of a read, the contracts, pure rules, PostgreSQL store and coordinator of a durable, resumable synchronization, weighted request quotas that every worker shares, and the fenced purge and revocation recovery of a connection's grant.
 
 Install `@framers/agentos-ext-account-sources` with its peer `@framers/agentos` 0.13.134 or later. Node.js 20.19 or later is required. The runtime dependencies are `@framers/agentos-ext-public-sources` and `@framers/sql-storage-adapter`.
 
@@ -15,7 +15,7 @@ An `AccountSourceConnector` exposes its `kind` and four operations:
 
 A selection holds account item ids. A read carries text or bytes with a media type, the item and its attribution. A gone item names its id and the reason: `removed`, `no_access` or `not_owned`.
 
-Connectors obtain their grants through AgentOS's auth module and store them through its sealed token store. This library holds no grants and performs no sealing.
+Connectors obtain their grants through AgentOS's auth module and store them through its sealed token store. The connector interface holds no grant. The revocation lifecycle seals a stopped grant's refresh token into its revoke-only queue with the same module's sealing (see [Revocation and purge](#revocation-and-purge)).
 
 ## Attribution
 
@@ -293,7 +293,7 @@ for (const sql of sourceSyncCoordinatorSchema()) await db.exec(sql);
 
 const sync = new AccountSourceSync<PreparedPassages>({
   store,     // the SqlAccountSourceSyncStore above
-  lifecycle, // the host's purge recovery and grant-loss handoff
+  lifecycle, // purge recovery and the grant-loss handoff: a SourceRevocations (below)
   // Builds the connector bound to this lease; it sends no request while building.
   provider: async (currentHandle) => connectorFor(scope, currentHandle).sync,
   // Embeds outside any transaction; the store commits the result with its document.
@@ -339,6 +339,72 @@ With an `events` sink the coordinator reports `started` at the claim, `progress`
 
 The coordinator uses three store methods besides those above. `reserveOperation(handle, key)` counts an attempt at the anchor read, a reconcile's look at the committed cursor or a page before it is sent, and answers `{ kind: 'attempt', attempt }`, or `{ kind: 'deferred', reason, retryAt }` while a recorded wait has not passed or after five attempts that recorded nothing. `deferOperation(handle, key, attempt, reason, retryAt)` records the wait after a retriable failure when that attempt is still the one reserved. `pendingRetry(handle)` answers the earliest wait among the cycle's reads.
 
+### Revocation and purge
+
+```ts
+import { SourceRevocations, sourceRevocationSchema } from '@framers/agentos-ext-account-sources';
+
+// The host's migration, with the store's and the coordinator's schemas.
+for (const sql of sourceRevocationSchema()) await db.exec(sql);
+
+const revocations = new SourceRevocations<PreparedPassages>(db, {
+  store,                                     // the SqlAccountSourceSyncStore above
+  keys,                                      // SealingKeys: the current key seals, previous keys still open
+  values: (tx, scope) => grantRows(tx, scope), // the host's sealed-value rows, on the transaction given
+  revoker: (signal) => revocationFlow(signal), // a provider flow without a store; its fetch honors the signal
+});
+// It is the coordinator's lifecycle binding: new AccountSourceSync({ store, lifecycle: revocations, ... }).
+
+// A disconnect from an authenticated request, at the generation that request saw.
+const notice = await revocations.disconnect(scope, generation);
+// null when the generation moved on; otherwise { localPending, revocation }
+
+// An account-independent job, at least once a minute.
+await revocations.revokeBatch();
+```
+
+`SourceRevocations` stops a connection and completes what the stop leaves: the purge of its sources and of every result derived from them, and the revocation of its grant at the provider. `sourceRevocationSchema(prefix)` answers eight statements for the host's migration, under a prefix of a lower-case letter and at most 27 lower-case letters, digits or underscores (`agentos_source_revoke` unless given): the owner's block marker, each connection's stop intent, the revoke-only queue and its due index, the grant lease, and the authorization exchanges with two indexes. No table references an account table, so removing an account cannot erase an outstanding revocation, and the rows hold opaque ids, times, fixed states, attempt counts and sealed refresh tokens only. The service needs a PostgreSQL adapter with transactions and runs no DDL.
+
+The host wires it in four places. The store's `active` binding answers true only when the account is live and `permits(tx, owner)` holds, so an owner whose stop is still purging, or who was deleted, has no sources. Authorization start and grant installation check `canConnect(tx, owner)` under the owner fence. The grant is saved with `new SealedTokenStore(values(tx, scope), keys, { namespace: sourceGrantNamespace(scope) })` under `SOURCE_GRANT_KEY`, the row every lifecycle step reads. A grant operation such as a refresh runs through `withGrant`.
+
+`disconnect(scope, generation)`, `loseGrant(handle, reason)` and `deleteOwner(owner)` each commit in one short transaction the owner's fence, the connection's stop (`disconnected`, or `needs_reconnecting` for a lost grant), a purge barrier, a content-free stop intent, the grant's refresh token moved into the revoke-only queue, sealed under the current key and bound to its queue row, and the deletion of the active grant and its lease. `disconnect` takes the generation the authenticated request saw and answers null for another one; `loseGrant` takes the coordinator's exact current handle and answers false for a stale one; `deleteOwner` stops every connection of the owner, also when there is none, and keeps the owner blocked for good. Call it before the host removes any source, credential or account row. A grant that cannot be opened is deleted all the same, and its queue row records it as unreadable. The purge then runs in a transaction of its own; when it fails, the committed stop keeps the owner blocked, and `recover(scope)` completes it. The coordinator's `maintain` calls `recover` for every connection, paused ones included. None of these methods calls the provider.
+
+`revokeBatch(limit?, signal?)` is the account-independent worker. It claims due queue rows, one worker per row, opens each token and revokes it with the revoker's `revoke` outside any transaction, within 15 seconds. A success confirms the row and erases its ciphertext. A failure is retried after 1, 2, 4, 8 and then 15 minutes, whatever status the provider answered. Each token's deadline is 23 hours and 59 minutes after it was queued, and neither a retry, a restart nor a repeated disconnect or deletion moves it: at the deadline the ciphertext is erased and the row records that the permission must be removed at the provider. A token that does not open, because its ciphertext was moved to another row or its key is gone, is erased the same way and never sent. A worker whose claim expired cannot settle a row another worker claimed since. The batch answers `{ attempted, confirmed, deferred, expired, unreadable }`. The database erases nothing on its own when a deadline passes: reads and dispatch stop at the deadline, and erasure needs the worker to run, so schedule it at least once a minute.
+
+`status(scope)` answers `{ localPending, revocation }`, with `revocation` one of `not_needed`, `pending`, `confirmed` and `permission_removal_required`; the local purge completes whatever the revocation's outcome. A provider can revoke a whole grant rather than one connection's, so `canConnect` stays false while a revocation of the owner's is pending, or expired or unreadable and not yet acknowledged. `acknowledgeRemoval(scope)` records the account owner's statement that the permission was removed at the provider, after which a new grant may begin; it is an attestation, never a confirmation. `compact()` removes, a day after their deadline, terminal rows that nothing refers to.
+
+`withGrant(handle, work, signal?)` runs one grant operation under a durable 30-second grant lease, without holding a transaction over the network; another worker gets `rate_limited` until the lease expires, and the lease is never renewed. `work` receives a `SealedTokenStore` and a signal that aborts after 15 seconds. Every load and save through that store, and the final return, recheck the sync handle and the lease, so after a disconnect or once the lease has expired a held token can be neither saved nor returned (`grant_rejected`).
+
+```ts
+// The callback's transaction consumes the authenticated start and records the exchange, or rolls back.
+const exchange = await db.transaction(async (tx) => {
+  const start = await consumeStart(tx, callback);
+  const begun = start && await revocations.beginExchange(tx, scope, start.generation, start.exchangeId);
+  if (!begun) throw new Error('start_refused');
+  return begun;
+});
+// Only after that commit does the code exchange reach the provider.
+// When it returns no grant: endExchange(exchange, 'not_dispatched' | 'revoked' | 'unconfirmed').
+const grant = await exchangeCode(callback);
+const outcome = await revocations.settleExchange(exchange, grant, async (tx, granted) => {
+  await new SealedTokenStore(grantRows(tx, scope), keys, { namespace: sourceGrantNamespace(scope) })
+    .save(SOURCE_GRANT_KEY, granted);
+  await new SqlAccountSourceSyncStore(tx, { bindings }).control(scope, { type: 'grant_ready', use });
+  return finishStart(tx, exchange.id);
+});
+// outcome.kind: 'installed', 'cleanup_pending' or 'permission_removal_required'
+```
+
+An authorization code exchange returns a grant before anything is installed, and a cancellation, a disconnect, the account's deletion or a failed installation must not leave that grant at the provider unrecorded. `beginExchange(tx, scope, generation, exchangeId)` runs in the host transaction that consumes the authenticated start. It answers the exchange only when the connection is `connecting` at that generation and `canConnect` holds, so one exchange is in flight per owner; otherwise it answers null, and the host rolls the consumption back. The exchange's row holds opaque ids and times, never a code, a state, a PKCE verifier, an address or a credential. The exchange ends 60 seconds after it begins, and while it is open `canConnect` is false.
+
+`settleExchange(exchange, grant, install)` first seals the grant's refresh token into the revoke-only queue, held there until the exchange ends, so a crash cannot lose it. When `mayInstallExchange(tx, exchange)` holds (this exact exchange is open and before its end, the connection is still `connecting` at its generation with no grant installed, and nothing else keeps the owner from a new grant), `install` runs in the owner's transaction: it saves the grant, records `grant_ready` and finishes the start, and the same commit removes the held token. When the exchange may not install, or `install` answers anything but true, throws or finishes after the end, the whole installation rolls back and the held token is due for revocation at once; after a crash it is due when the exchange ends, and `revokeBatch` revokes it under its own deadline. A grant that arrives for an exchange already recorded as unconfirmed is neither installed nor revoked: a newer grant at the provider could share its permission, so the notice stands.
+
+`endExchange(exchange, outcome)` records an exchange that returned no grant: `not_dispatched` when the request never left the process, `revoked` when the provider flow revoked a grant it refused and the provider confirmed it, and `unconfirmed` otherwise, as after a timeout, an aborted connection or an unreadable answer. An open exchange whose end passes with nothing recorded, because its worker stopped, becomes unconfirmed at the next `revokeBatch`, counted in `expired`. A recorded outcome is never weakened. An unconfirmed exchange, or a returned grant whose revocation expired or could not be opened, makes `status` answer `permission_removal_required` and keeps `canConnect` false until `acknowledgeRemoval`. Exchange rows survive the account's deletion, and `compact` removes them a day after their end once nothing about them is pending.
+
+With an `events` sink the service reports `fenced` after a stop's transaction, `purged` after its purge, and `confirmed`, `deferred`, `expired` and `unreadable` from `revokeBatch`, each as `{ kind: 'source_revocation', state, n }`, with no scope, token or provider text. A sink that throws is ignored.
+
+The service uses five store methods besides those above. `stageStop(scope, event, stage, expected)` and `stageOwnerStop(owner, stage)` commit a stop and run the service's writes in its transaction; `completeStop(scope, generation, complete)` runs the purge's completion once the barrier is gone; `withCurrentHandle(handle, work)` runs grant storage work with the handle checked; and `lockState(tx, scope)` reads the connection's state in a host transaction after taking the owner fence's lock and then the connection's.
+
 ## License
 
 Apache-2.0. This pack carries a copy of the repository's license.

package/dist/index.d.ts

@@ -19,4 +19,6 @@ export { SourceQuota, sourceQuotaSchema, sourceRetryAt, type SourceQuotaMethod,
 /** The resumable synchronization coordinator, its lifecycle binding and the migration of its control state. */
 export { AccountSourceSync, type AccountSourceSyncOptions, type SourceSyncLifecycle, type SourceSyncRunResult, type SourceSyncMaintenanceResult, } from './sync/AccountSourceSync.js';
 export { sourceSyncCoordinatorSchema, type SourceSyncOperationAttempt, type SourceSyncOperationState, } from './sync/coordinatorState.js';
+/** Fenced purge, the grant lease, the bounded revoke-only queue and the cleanup of grants that exchanges return. */
+export { SourceRevocations, sourceRevocationSchema, sourceGrantNamespace, SOURCE_GRANT_KEY, type SourceRevocationOptions, type SourceRevocationReason, type SourceRevocationNotice, type SourceRevocationBatch, type SourceRevocationEvent, type SourceGrantExchange, type SourceGrantExchangeOutcome, type SourceUninstalledGrantLifecycle, } from './sync/SourceRevocations.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,cAAc,YAAY,CAAC;AAC3B,yDAAyD;AACzD,cAAc,gBAAgB,CAAC;AAC/B,8DAA8D;AAC9D,cAAc,iBAAiB,CAAC;AAChC,oEAAoE;AACpE,cAAc,cAAc,CAAC;AAC7B,0EAA0E;AAC1E,cAAc,kBAAkB,CAAC;AACjC,yEAAyE;AACzE,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,wGAAwG;AACxG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,yBAAyB,EACzB,KAAK,wBAAwB,EAAE,KAAK,mBAAmB,EAAE,KAAK,yBAAyB,EACvF,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAC3E,KAAK,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,KAAK,iBAAiB,GAC3E,MAAM,qCAAqC,CAAC;AAC7C,2GAA2G;AAC3G,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAC7C,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EACvE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,KAAK,qBAAqB,GACpG,MAAM,uBAAuB,CAAC;AAC/B,+GAA+G;AAC/G,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAAE,KAAK,mBAAmB,EACvD,KAAK,mBAAmB,EAAE,KAAK,2BAA2B,GAC3D,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,2BAA2B,EAC3B,KAAK,0BAA0B,EAAE,KAAK,wBAAwB,GAC/D,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,cAAc,YAAY,CAAC;AAC3B,yDAAyD;AACzD,cAAc,gBAAgB,CAAC;AAC/B,8DAA8D;AAC9D,cAAc,iBAAiB,CAAC;AAChC,oEAAoE;AACpE,cAAc,cAAc,CAAC;AAC7B,0EAA0E;AAC1E,cAAc,kBAAkB,CAAC;AACjC,yEAAyE;AACzE,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,wGAAwG;AACxG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,yBAAyB,EACzB,KAAK,wBAAwB,EAAE,KAAK,mBAAmB,EAAE,KAAK,yBAAyB,EACvF,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAC3E,KAAK,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,KAAK,iBAAiB,GAC3E,MAAM,qCAAqC,CAAC;AAC7C,2GAA2G;AAC3G,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAC7C,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EACvE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,KAAK,qBAAqB,GACpG,MAAM,uBAAuB,CAAC;AAC/B,+GAA+G;AAC/G,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAAE,KAAK,mBAAmB,EACvD,KAAK,mBAAmB,EAAE,KAAK,2BAA2B,GAC3D,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,2BAA2B,EAC3B,KAAK,0BAA0B,EAAE,KAAK,wBAAwB,GAC/D,MAAM,4BAA4B,CAAC;AACpC,oHAAoH;AACpH,OAAO,EACL,iBAAiB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,gBAAgB,EACjF,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,KAAK,sBAAsB,EACtF,KAAK,qBAAqB,EAAE,KAAK,qBAAqB,EACtD,KAAK,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,KAAK,+BAA+B,GAChG,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -19,4 +19,6 @@ export { SourceQuota, sourceQuotaSchema, sourceRetryAt, } from './sync/SourceQuo
 /** The resumable synchronization coordinator, its lifecycle binding and the migration of its control state. */
 export { AccountSourceSync, } from './sync/AccountSourceSync.js';
 export { sourceSyncCoordinatorSchema, } from './sync/coordinatorState.js';
+/** Fenced purge, the grant lease, the bounded revoke-only queue and the cleanup of grants that exchanges return. */
+export { SourceRevocations, sourceRevocationSchema, sourceGrantNamespace, SOURCE_GRANT_KEY, } from './sync/SourceRevocations.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,cAAc,YAAY,CAAC;AAC3B,yDAAyD;AACzD,cAAc,gBAAgB,CAAC;AAC/B,8DAA8D;AAC9D,cAAc,iBAAiB,CAAC;AAChC,oEAAoE;AACpE,cAAc,cAAc,CAAC;AAC7B,0EAA0E;AAC1E,cAAc,kBAAkB,CAAC;AACjC,yEAAyE;AACzE,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,wGAAwG;AACxG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,yBAAyB,GAI1B,MAAM,qCAAqC,CAAC;AAC7C,2GAA2G;AAC3G,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,aAAa,GAG9C,MAAM,uBAAuB,CAAC;AAC/B,+GAA+G;AAC/G,OAAO,EACL,iBAAiB,GAGlB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,2BAA2B,GAE5B,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,cAAc,YAAY,CAAC;AAC3B,yDAAyD;AACzD,cAAc,gBAAgB,CAAC;AAC/B,8DAA8D;AAC9D,cAAc,iBAAiB,CAAC;AAChC,oEAAoE;AACpE,cAAc,cAAc,CAAC;AAC7B,0EAA0E;AAC1E,cAAc,kBAAkB,CAAC;AACjC,yEAAyE;AACzE,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,wGAAwG;AACxG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,yBAAyB,GAI1B,MAAM,qCAAqC,CAAC;AAC7C,2GAA2G;AAC3G,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,aAAa,GAG9C,MAAM,uBAAuB,CAAC;AAC/B,+GAA+G;AAC/G,OAAO,EACL,iBAAiB,GAGlB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,2BAA2B,GAE5B,MAAM,4BAA4B,CAAC;AACpC,oHAAoH;AACpH,OAAO,EACL,iBAAiB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,gBAAgB,GAIlF,MAAM,6BAA6B,CAAC"}

package/dist/sync/SourceRevocations.d.ts

@@ -0,0 +1,311 @@
+/**
+ * @fileoverview Fenced purge and revocation recovery for account sources. One short transaction blocks the owner,
+ * moves the connection, records a purge marker and moves the grant's refresh token into a sealed revoke-only queue;
+ * the purge completes in a recoverable transaction of its own; an account-independent worker revokes queued tokens
+ * before a fixed deadline. A durable grant lease serializes refreshes across workers, and the grant an authorization
+ * exchange returns is either installed or queued for revocation, never lost.
+ * @module account-sources/sync/SourceRevocations
+ */
+import type { StorageAdapter } from '@framers/sql-storage-adapter';
+import type { SourceOwnerScope } from '@framers/agentos/cognition/library';
+import { SealedTokenStore, type OAuthTokenSet, type SealedBytesStore, type SealingKeys, type RedirectOAuthFlow } from '@framers/agentos/auth';
+import type { SourceSyncScope } from './types.js';
+import type { SqlAccountSourceSyncStore, SourceSyncHandle } from './SqlAccountSourceSyncStore.js';
+import type { SourceSyncLifecycle } from './AccountSourceSync.js';
+/** The key a connection's grant is kept under in the host's sealed-value rows, inside its `sourceGrantNamespace`. */
+export declare const SOURCE_GRANT_KEY = "grant";
+/**
+ * The sealed-store namespace of one connection's grant, naming its tenant, owner and connection: a sealed grant
+ * copied to another connection's row does not open. Initial installation, refresh and the transfer to the revoke-only
+ * queue all use it with `SOURCE_GRANT_KEY`.
+ */
+export declare function sourceGrantNamespace(scope: SourceSyncScope): string;
+/** Why a connection stopped: a disconnect, the account's deletion, a refused grant or a grant without its scope. */
+export type SourceRevocationReason = 'disconnect' | 'account_deleted' | 'grant_rejected' | 'insufficient_scope';
+/**
+ * A connection's lifecycle notice for authenticated controls: whether its local purge is still pending, and where
+ * revoking its grant stands. `not_needed` when there was no grant to revoke, `pending` while the queue holds it,
+ * `confirmed` once the provider answered the revocation with a success, and `permission_removal_required` when it
+ * could not be revoked, so the account owner removes the permission at the provider. The local purge completes
+ * whatever the revocation's outcome.
+ */
+export interface SourceRevocationNotice {
+    readonly localPending: boolean;
+    readonly revocation: 'not_needed' | 'pending' | 'confirmed' | 'permission_removal_required';
+}
+/**
+ * What one `revokeBatch` did: the revocations it sent, those confirmed, those deferred to a retry, the queued tokens
+ * erased at their deadline together with the exchanges whose deadline passed with no outcome, and the queued tokens
+ * that could not be opened.
+ */
+export interface SourceRevocationBatch {
+    readonly attempted: number;
+    readonly confirmed: number;
+    readonly deferred: number;
+    readonly expired: number;
+    readonly unreadable: number;
+}
+/** A content-free lifecycle event: a fixed state and a count, never a scope, a token or a provider's text. */
+export interface SourceRevocationEvent {
+    readonly kind: 'source_revocation';
+    readonly state: 'fenced' | 'purged' | 'confirmed' | 'deferred' | 'expired' | 'unreadable';
+    readonly n: number;
+}
+/**
+ * What the lifecycle runs with: the synchronization store, the sealing keys, the host's sealed-value binding and a
+ * revocation-only provider flow, with an optional table prefix, clock and event sink.
+ *
+ * @typeParam Prepared - The store's prepared value for one document.
+ */
+export interface SourceRevocationOptions<Prepared> {
+    /** Prefix of the lifecycle tables, the one given to `sourceRevocationSchema`; `agentos_source_revoke` unless given. */
+    readonly tablePrefix?: string;
+    /** The synchronization store whose connections the lifecycle stops and purges. */
+    readonly store: SqlAccountSourceSyncStore<Prepared>;
+    /** The current key seals queued tokens; it and every previous key open them and the host's grants. */
+    readonly keys: SealingKeys;
+    /** Same sealed-value table used by initial grant installation; every operation uses tx. */
+    readonly values: (tx: StorageAdapter, scope: SourceSyncScope) => SealedBytesStore;
+    /** Construct a null-store provider flow. Its capped fetch must honor this signal. */
+    readonly revoker: (signal: AbortSignal) => Pick<RedirectOAuthFlow, 'revoke'>;
+    /** Current time as integer UTC epoch milliseconds; `Date.now` unless given. */
+    readonly clock?: () => number;
+    /** Receives content-free events; a sink that throws is ignored. */
+    readonly events?: (event: SourceRevocationEvent) => void;
+}
+/**
+ * One authorization code exchange begun for a connection: an opaque id, the connection, the generation its grant
+ * may be installed into, and when it began and ends, in UTC epoch milliseconds. It holds no authorization code,
+ * state, PKCE verifier, address or credential.
+ */
+export interface SourceGrantExchange {
+    readonly id: string;
+    readonly scope: SourceSyncScope;
+    readonly generation: number;
+    readonly startedAt: number;
+    readonly endsAt: number;
+}
+/**
+ * What settling an exchange did with its grant: `installed` in the connection's sealed binding, `cleanup_pending`
+ * when the grant went to the revoke-only queue instead, and `permission_removal_required` when it could be neither,
+ * so the account owner removes the permission at the provider.
+ */
+export type SourceGrantExchangeOutcome = {
+    readonly kind: 'installed';
+} | {
+    readonly kind: 'cleanup_pending';
+} | {
+    readonly kind: 'permission_removal_required';
+};
+/**
+ * The lifecycle of a grant an authorization exchange returns before it is installed: the exchange is recorded before
+ * its request is sent, the returned grant is sealed into the revoke-only queue before it is installed, and a grant
+ * that is not installed is revoked from that queue or reported as needing the account owner's removal.
+ */
+export interface SourceUninstalledGrantLifecycle {
+    beginExchange(tx: StorageAdapter, scope: SourceSyncScope, generation: number, exchangeId: string): Promise<SourceGrantExchange | null>;
+    settleExchange(exchange: SourceGrantExchange, grant: OAuthTokenSet, install: (tx: StorageAdapter, grant: OAuthTokenSet) => Promise<boolean>): Promise<SourceGrantExchangeOutcome>;
+    endExchange(exchange: SourceGrantExchange, outcome: 'not_dispatched' | 'revoked' | 'unconfirmed'): Promise<void>;
+    mayInstallExchange(tx: StorageAdapter, exchange: SourceGrantExchange): Promise<boolean>;
+}
+/**
+ * PostgreSQL DDL for the migration-owned lifecycle tables: the owner's block marker, the per-connection stop
+ * intent, the revoke-only queue and its due index, the grant lease, and the authorization exchanges with their two
+ * indexes. The service never runs them: the host's migration does. No table references an account table, so
+ * removing an account cannot erase an outstanding revocation, and the rows hold opaque ids, times, fixed states,
+ * attempt counts and sealed refresh tokens only.
+ *
+ * @param prefix - Table-name prefix: a lower-case letter, then at most 27 lower-case letters, digits or underscores.
+ * @returns The eight statements, in the order they must run.
+ * @throws {Error} `invalid_source_revocation_prefix` when the prefix does not have that form.
+ */
+export declare function sourceRevocationSchema(prefix?: string): readonly string[];
+/**
+ * Adapter-owned lifecycle recovery. No method logs or returns a queued credential.
+ *
+ * `disconnect`, `loseGrant` and `deleteOwner` commit the owner's fence, the connection's stop, a purge marker and the
+ * transfer of the grant's refresh token to the revoke-only queue in one transaction, before any provider call; the
+ * purge of sources and every result derived from them completes in a transaction of its own, which `recover`
+ * resumes after a failure. `revokeBatch` revokes queued tokens on its own schedule, independent of accounts, until
+ * each token's deadline, 23 hours and 59 minutes after it was queued. `withGrant` serializes refreshes across
+ * workers under a durable lease. The exchange methods record an authorization exchange before its request is sent
+ * and either install the grant it returns or queue it for revocation. Every check of `canConnect`, `permits` and
+ * `mayInstallExchange` belongs inside the owner fence of the host's transaction.
+ *
+ * @typeParam Prepared - The store's prepared value for one document.
+ */
+export declare class SourceRevocations<Prepared = unknown> implements SourceSyncLifecycle, SourceUninstalledGrantLifecycle {
+    private readonly db;
+    private readonly options;
+    private readonly t;
+    private readonly store;
+    private readonly clock;
+    /**
+     * @param db - A PostgreSQL adapter with transactions, on the database of the store's tables.
+     * @param options - The store, keys, sealed-value binding and revoker, with an optional prefix, clock and sink.
+     * @throws {Error} `source_revocation_requires_postgres` for another kind of adapter or one without transactions,
+     *   and `invalid_source_revocation_prefix` for a malformed prefix.
+     */
+    constructor(db: StorageAdapter, options: SourceRevocationOptions<Prepared>);
+    private now;
+    private emit;
+    private stored;
+    private grant;
+    private context;
+    /**
+     * Combine with fresh host account liveness in the sync store's active binding. False while a stop's purge is
+     * pending for the owner and, for good, once the owner was deleted; it does not authenticate an account.
+     */
+    permits(tx: StorageAdapter, scope: SourceOwnerScope): Promise<boolean>;
+    /**
+     * Check under the owner fence both at authorization start and grant installation. False when `permits` is, while a
+     * revocation of the owner's is pending or ended without confirmation and is not acknowledged, and while an exchange
+     * of the owner's is in flight or its returned grant awaits the same conditions.
+     */
+    canConnect(tx: StorageAdapter, scope: SourceOwnerScope): Promise<boolean>;
+    /**
+     * Whether a stop's revocation or an exchange keeps the owner from a new grant, leaving out the exchange `except`.
+     * A revocation pending in the queue, or one that expired or could not be opened before the owner acknowledged the
+     * permission's removal, keeps it; so does an exchange in flight, one whose returned grant is in the queue under the
+     * same conditions, and one whose outcome is unconfirmed and not acknowledged.
+     */
+    private barrier;
+    /**
+     * The connection's notice for authenticated controls: whether its purge is pending, and the more pressing of the
+     * revocation of its last stopped grant and the cleanup of the grant its newest exchange returned.
+     */
+    status(scope: SourceSyncScope): Promise<SourceRevocationNotice>;
+    private block;
+    private stage;
+    private canReplaceQueue;
+    /**
+     * Disconnects the connection at the generation the authenticated request saw: fences it, queues its grant for
+     * revocation and clears the active grant in one transaction, then purges its sources and every result derived
+     * from them. No provider call happens here.
+     *
+     * @returns The connection's notice, or null when the generation has moved on, which changes nothing.
+     * @throws {SourceSyncFault} `storage_unavailable` when a step fails: the committed stop stays, and `recover`
+     *   completes its purge.
+     */
+    disconnect(scope: SourceSyncScope, generation: number): Promise<SourceRevocationNotice | null>;
+    /**
+     * The coordinator's handoff of a refused grant: with the run's exact current handle, the connection moves to
+     * `needs_reconnecting` and its grant is queued for revocation in one transaction, then purged as `disconnect` does.
+     *
+     * @returns Whether the handle was current and the grant was fenced; a stale handle changes nothing.
+     */
+    loseGrant(handle: SourceSyncHandle, reason: 'grant_rejected' | 'insufficient_scope'): Promise<boolean>;
+    /**
+     * Account deletion: blocks the owner for good and stops every connection of the owner, queueing each grant for
+     * revocation, in one transaction, also when the owner has no connection; then purges them. Call it before the host
+     * removes any source, credential or account row. Queued revocations outlive the account.
+     */
+    deleteOwner(scope: SourceOwnerScope): Promise<void>;
+    /** Recover every pending intent for the owner. No grant or account row is required. */
+    recover(scope: SourceSyncScope): Promise<void>;
+    private recoverOwner;
+    /**
+     * Owner-authenticated attestation; never describe it as provider confirmation. The account owner confirms having
+     * removed the permission at the provider for the connection's revocation that expired or could not be opened, and
+     * for its exchanges whose outcome is unconfirmed or whose returned grant's revocation ended the same way; a new
+     * grant may then begin. A pending or confirmed revocation is not acknowledged.
+     *
+     * @returns Whether anything was acknowledged.
+     */
+    acknowledgeRemoval(scope: SourceSyncScope): Promise<boolean>;
+    /**
+     * Runs one server-side grant operation, such as a refresh, under a durable 30-second grant lease, without holding a
+     * transaction over the network. `work` builds the provider flow on the sealed store it is given and must honor the
+     * signal, which aborts after 15 seconds or with `parent`. Every load and save through that store, and the final
+     * return, recheck the sync handle and the grant lease in a short transaction, so a disconnect or an expired lease
+     * makes a held token's save or return fail. The lease is never renewed; after it expires another worker may take
+     * a new one. Access tokens stay in memory.
+     *
+     * @returns What `work` answered.
+     * @throws {SourceSyncFault} `rate_limited` while another worker holds the lease, with its expiry as `retryAt`;
+     *   `grant_rejected` for a stale handle, a lost lease or a disconnect; `cancelled` when `parent` aborted first;
+     *   `storage_unavailable` for any other failure. A provider refusal (`OAuthGrantRefused`) passes through.
+     */
+    withGrant<T>(handle: SourceSyncHandle, work: (tokens: SealedTokenStore, signal: AbortSignal) => Promise<T>, parent?: AbortSignal): Promise<T>;
+    private expireQueue;
+    private claimRevoke;
+    private settleRevoke;
+    /**
+     * Schedule independently of accounts, source scopes and provider polling, at least every minute. Erases queued
+     * tokens whose deadline has passed and records exchanges whose deadline passed with no outcome as unconfirmed, then
+     * claims up to `limit` due tokens, one worker per token, and revokes each outside any transaction with the
+     * provider flow's `revoke`, 15 seconds at most. A success confirms it; a failure retries after 1, 2, 4, 8, then 15
+     * minutes, never past the deadline; a token that does not open is erased. A worker whose claim expired cannot
+     * settle a token another worker claimed since.
+     *
+     * @param limit - At most this many tokens, an integer from 1 to 100; 20 unless given.
+     * @param parent - Stops the batch: no request starts after it aborts.
+     * @throws {SourceSyncFault} `invalid_response` for another limit and `storage_unavailable` when the store fails.
+     */
+    revokeBatch(limit?: number, parent?: AbortSignal): Promise<SourceRevocationBatch>;
+    /**
+     * Remove unreferenced terminal diagnostics, never usable credentials or restore markers: a day after their
+     * deadline, exchanges that installed, ended, were acknowledged or whose returned grant's revocation was confirmed,
+     * then terminal queue rows no stop or exchange refers to, at most 1,000 of each a call.
+     *
+     * @returns How many rows were removed.
+     */
+    compact(): Promise<number>;
+    /** Records exchanges whose deadline passed with no grant returned as unconfirmed: their outcome is unknown. */
+    private lapseExchanges;
+    /** Takes the owner's lifecycle row lock, creating the row unblocked when missing; exchange changes take it first. */
+    private lockOwner;
+    private checkExchange;
+    /** The exchange's row under its lock, or null when no row matches every field of the exchange. */
+    private exchangeRow;
+    /** What a settled exchange did with its grant, from its row and its queued token's state. */
+    private exchangeOutcome;
+    /**
+     * Records an authorization exchange before its request is sent. Call it inside the host transaction that consumes
+     * the authenticated start, under the owner fence: it answers null, and the caller rolls that whole transaction
+     * back, unless the connection is `connecting` at `generation` and `canConnect` holds, so one exchange at a time is
+     * in flight for the owner and none while a revocation of the owner's is pending or unacknowledged. The exchange's
+     * marker holds opaque ids and times only, and the exchange ends 60 seconds after it begins: a grant returned later
+     * is not installed. Send the request only after the transaction commits.
+     *
+     * @param exchangeId - The host's opaque id for this attempt, 1 to 512 characters, never reused.
+     * @returns The exchange, or null.
+     * @throws {SourceSyncFault} `invalid_response` for a malformed scope, generation or id.
+     */
+    beginExchange(tx: StorageAdapter, scope: SourceSyncScope, generation: number, exchangeId: string): Promise<SourceGrantExchange | null>;
+    /**
+     * Whether this exact exchange may install its grant now, read under the owner fence in the installing transaction:
+     * its marker is open and holds its sealed grant for installation, its deadline has not passed, the connection is
+     * still `connecting` at its generation with no grant installed, `permits` holds, and no other revocation or
+     * exchange keeps the owner from a new grant. It recognizes only the matching live attempt, never an older or newer
+     * one.
+     */
+    mayInstallExchange(tx: StorageAdapter, exchange: SourceGrantExchange): Promise<boolean>;
+    /**
+     * Settles the grant an exchange returned. First the grant's refresh token is sealed into the revoke-only queue,
+     * held there until the exchange's end, so a crash cannot lose it. Then, when `mayInstallExchange` holds, `install`
+     * runs in the owner's transaction: it saves the grant under `sourceGrantNamespace` and `SOURCE_GRANT_KEY`, records
+     * the connection's ready state and finishes the host's start, and the same commit removes the held token. If the
+     * exchange may not install, `install` answers anything but true, throws or finishes after the deadline, the whole
+     * installation rolls back and the held token becomes due for revocation at once; if this process stops first, it
+     * becomes due at the exchange's end. A stale, cancelled or deleted exchange never runs `install`. An exchange that
+     * already ended or was recorded unconfirmed takes no token: its notice stands. A grant with no usable refresh token
+     * records the exchange unconfirmed.
+     *
+     * @returns What became of the grant.
+     * @throws {SourceSyncFault} `invalid_response` for a malformed exchange, `storage_unavailable` when the store fails.
+     */
+    settleExchange(exchange: SourceGrantExchange, grant: OAuthTokenSet, install: (tx: StorageAdapter, grant: OAuthTokenSet) => Promise<boolean>): Promise<SourceGrantExchangeOutcome>;
+    /**
+     * Records how an exchange ended when it returned no grant to settle: `not_dispatched` when its request never left
+     * the process, `revoked` when the provider flow revoked a grant it refused and the provider confirmed it, and
+     * `unconfirmed` for anything else after the request could have left, such as a timeout, an aborted connection, an
+     * unreadable answer or a revocation that was not confirmed. Only an open exchange holding no returned grant takes
+     * an ending, and a recorded outcome is never weakened. An unconfirmed exchange keeps new grants blocked until the
+     * account owner acknowledges the permission's removal.
+     *
+     * @throws {SourceSyncFault} `invalid_response` for a malformed exchange or another outcome.
+     */
+    endExchange(exchange: SourceGrantExchange, outcome: 'not_dispatched' | 'revoked' | 'unconfirmed'): Promise<void>;
+}
+//# sourceMappingURL=SourceRevocations.d.ts.map

package/dist/sync/SourceRevocations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SourceRevocations.d.ts","sourceRoot":"","sources":["../../src/sync/SourceRevocations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,iBAAiB,EACpF,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,eAAe,EAAmB,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,qHAAqH;AACrH,eAAO,MAAM,gBAAgB,UAAU,CAAC;AACxC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAEnE;AACD,oHAAoH;AACpH,MAAM,MAAM,sBAAsB,GAAG,YAAY,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAChH;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,6BAA6B,CAAC;CAC7F;AACD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AACD,8GAA8G;AAC9G,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;IAC1F,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AACD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB,CAAC,QAAQ;IAC/C,uHAAuH;IACvH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpD,sGAAsG;IACtG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,KAAK,gBAAgB,CAAC;IAClF,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC7E,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;CAC1D;AACD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AACD;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAA;CAAE,CAAC;AACrD;;;;GAIG;AACH,MAAM,WAAW,+BAA+B;IAC9C,aAAa,CACX,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAC1C,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GACrC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACvC,cAAc,CACZ,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EACnD,OAAO,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,GACtE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvC,WAAW,CACT,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,aAAa,GACpD,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzF;AAgDD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,SAA0B,GAAG,SAAS,MAAM,EAAE,CA6B1F;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAiB,CAAC,QAAQ,GAAG,OAAO,CAAE,YAAW,mBAAmB,EAAE,+BAA+B;IAUpG,OAAO,CAAC,QAAQ,CAAC,EAAE;IAAkB,OAAO,CAAC,QAAQ,CAAC,OAAO;IATzE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA4B;IAC9C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsC;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC;;;;;OAKG;gBAC0B,EAAE,EAAE,cAAc,EAAmB,OAAO,EAAE,uBAAuB,CAAC,QAAQ,CAAC;IAI5G,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,IAAI;YAGE,MAAM;IAIpB,OAAO,CAAC,KAAK;IAGb,OAAO,CAAC,OAAO;IAEf;;;OAGG;IACG,OAAO,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5E;;;;OAIG;IACG,UAAU,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAI/E;;;;;OAKG;YACW,OAAO;IAYrB;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC;YAevD,KAAK;YAKL,KAAK;YAiCL,eAAe;IAI7B;;;;;;;;OAQG;IACG,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAOpG;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ5G;;;;OAIG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzD,uFAAuF;IACjF,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;YACtC,YAAY;IAoB1B;;;;;;;OAOG;IACG,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAyBlE;;;;;;;;;;;;OAYG;IACG,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,EACzC,IAAI,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;YAgD1F,WAAW;YAOX,WAAW;YAYX,YAAY;IAY1B;;;;;;;;;;;OAWG;IACG,WAAW,CAAC,KAAK,SAAK,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA6CnF;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAehC,+GAA+G;YACjG,cAAc;IAO5B,qHAAqH;YACvG,SAAS;IAKvB,OAAO,CAAC,aAAa;IAOrB,kGAAkG;YACpF,WAAW;IAMzB,6FAA6F;YAC/E,eAAe;IAO7B;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAChF,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAkB1D;;;;;;OAMG;IACG,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAe7F;;;;;;;;;;;;;OAaG;IACG,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,aAAa,EACtE,OAAO,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAkD/G;;;;;;;;;OASG;IACG,WAAW,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAavH"}