@framers/agentos-ext-gmail-source 0.4.0 → 0.5.1

package/README.md

@@ -1,8 +1,8 @@
 # Gmail source
 
-This library provides read-only Gmail authorization on the AgentOS redirect grant and sealed-token contracts, text helpers that sanitize and trim mail before it is stored (see Text ingestion below), a bounded mapper that turns one thread response into a sanitized source document (see Thread documents below), and a capped read-only API client that sends every call through the host's quota and grant services (see Read-only API below). It requests the sole Gmail read-only scope, offline access and incremental consent. It exports no send, reply, label-modification or attachment-download tool.
+This library provides read-only Gmail authorization on the AgentOS redirect grant and sealed-token contracts, text helpers that sanitize and trim mail before it is stored (see Text ingestion below), a bounded mapper that turns one thread response into a sanitized source document (see Thread documents below), a capped read-only API client that sends every call through the host's quota and grant services (see Read-only API below), and a connector that binds them to durable account-source synchronization (see Connector and durable synchronization below). It requests the sole Gmail read-only scope, offline access and incremental consent. It exports no send, reply, label-modification or attachment-download tool.
 
-Install it next to `@framers/agentos` 0.13.134 or later and `@framers/agentos-ext-account-sources` 0.7.0 or later. Both are peer dependencies with a floor and no upper bound. Node.js 20.19 or later is required.
+Install it next to `@framers/agentos` 0.13.146 or later, whose HTML loader strips tags in linear time, and `@framers/agentos-ext-account-sources` 0.7.0 or later. Both are peer dependencies with a floor and no upper bound. Node.js 20.19 or later is required.
 
 ```ts
 import { GmailOAuthFlow } from '@framers/agentos-ext-gmail-source';
@@ -30,9 +30,9 @@ Construct `GmailOAuthFlow(client, store, options)` on the server. `client` conta
 
 `begin({ redirectUri })` returns the authorization URL, state and PKCE verifier. Keep state and verifier under a short-lived, single-use record tied to the signed-in account. `complete(input)` checks state, exchanges the code and verifies the granted scope and refresh material. It returns credentials in memory and does not persist them. The host must atomically consume the start and recheck account liveness and generation before installing the sealed grant. Do not log callback URLs, credentials or errors from arbitrary provider middleware.
 
-Construct a flow for each scheduled token operation, with that operation's sealed store and abort signal, call `accessToken`, and discard the flow at the end of the operation. A store scoped to one operation must never be retained for another worker. The host's durable lifecycle owns disconnect, purge, refresh exclusion across workers and revocation. `forget` on an independently held flow is not a cross-worker lifecycle operation.
+Construct a flow for each scheduled token operation, with that operation's sealed store and abort signal, call `accessToken`, and discard the flow at the end of the operation. A store scoped to one operation must never be retained for another worker. The host's durable lifecycle owns disconnect, purge, refresh exclusion across workers and revocation. `forget` on an independently held flow is not a cross-worker lifecycle operation. `accessToken` checks the read-only scope, before Google is asked, on the grant its own call read in the key's turn, the one a refresh renews, so neither another writer between two reads nor calls for other keys can change its outcome; a token held in memory is used only while the store holds the grant it came with, refresh token and scope alike.
 
-OAuth responses are capped at 65,536 bytes and must finish within 15 seconds. Parent cancellation stops dispatch and body consumption. Fixed `GmailOAuthFault` reasons contain no provider message or credential. When an exchange succeeds and `complete` does not return the grant, because the grant fails the checks or because the parent cancelled before `complete` returned, the flow asks Google to revoke the grant before it throws. That revocation has the same byte cap and a 15-second deadline of its own, and the parent's cancellation does not stop it. The fault's `cleanup` field then reads `confirmed` or `unconfirmed`. An unconfirmed outcome needs a provider-permission removal instruction. It does not authorize retaining the grant.
+OAuth responses are capped at 65,536 bytes and must finish within 15 seconds. An answer past the cap is refused at once: the rest of Google's stream is cancelled without waiting for the cancellation to settle, and the Gmail API's answers are read the same way. Parent cancellation stops dispatch and body consumption. `revoke(token)` resolves when Google revokes the token, and when Google answers that the token is already expired or revoked: Google answers such a token with 400 and `invalid_token`, where RFC 7009 section 2.2 answers 200, and either way the token no longer works. So the revoke-only queue confirms the revocation of a grant the person already removed at Google rather than retrying it to its deadline and then asking for a permission removal. Revoke a grant's refresh token to end the grant: Google answers an expired access token the same way while its refresh token stays valid. Every other answer that is not a success throws `OAuthGrantRefused` with reason `revoke`. Fixed `GmailOAuthFault` reasons contain no provider message or credential. When an exchange succeeds and `complete` does not return the grant, because the grant fails the checks or because the parent cancelled before `complete` returned, the flow asks Google to revoke the grant before it throws. That revocation has the same byte cap and a 15-second deadline of its own, and the parent's cancellation does not stop it. The fault's `cleanup` field then reads `confirmed` or `unconfirmed`; Google's answer that the grant is already expired or revoked reads `confirmed`. An unconfirmed outcome needs a provider-permission removal instruction. It does not authorize retaining the grant.
 
 The host supplies informed consent, cache permission, retention policy, account isolation and a truthful availability state. Authorization alone does not establish permission to store or send mailbox content to a model. Do not infer those permissions from this package's successful tests.
 
@@ -129,6 +129,46 @@ const changes = await api.history(profile.historyId, 100, null, signal); // { ki
 
 One provider operation makes one attempt, with one fresh-token retry permitted after 401. Every HTTP dispatch is separately metered. Token refreshes also use the one-unit profile reservation as conservative local accounting; this does not assert a Gmail quota cost for the OAuth endpoint. The durable account-source coordinator owns retry episodes, exponential backoff and exhaustion. The client persists provider waits through the quota service and never sleeps or buys capacity. A quota deferral, or a start that missed the quota's send window, sends nothing and throws `rate_limited` with the time to try again; only a reused attempt id is `invalid_response`. A retry time the client hands back is always after its own clock, even when the quota's database clock lags it; give the client the clock the host's sync store reads (`Date.now` for both unless given). Unknown errors become fixed failures without retaining their messages or causes.
 
+Each operation refreshes the grant unless the client has a `tokenHolder`: a memory-only `{ current: null }` slot that the clients of one sync lease share. A held access token is reused only while `currentHandle` answers the lease it was obtained under (the same connection, generation and lease token) and that lease has not expired by the client's clock; a 401 drops it, and the repeat refreshes as before. A reused token skips the grant operation, so check the sync handle before and after each call, as the connector does. Give each lease a new holder and never persist or log it. `GmailSourceConnector` makes one for each connector, so a sync cycle refreshes the grant once.
+
 A canonical thread 404 means gone. History 404 means the history anchor expired and bounded recovery is required. Domain policy is a fixed failure. Missing or explicitly invalid grants and insufficient scope are passed to the coordinator's fenced grant-loss lifecycle. Client configuration errors and transient network/provider failures are not reported as revoked mailboxes. Oversized successful thread responses are counted skips; oversized control pages fail without a cursor advance. Response streams are capped before decoding and are cancelled on size, deadline or caller cancellation.
 
 The client performs no storage write, purge, logging, model request or attachment fetch. Its successful result is still untrusted source material and needs the host's fresh owner/generation/expiry checks before storage, preparation or delivery. Limits are defensive library policy, not provider maxima; hosts must record any live compatibility failure before changing them.
+
+## Connector and durable synchronization
+
+```ts
+import { runGmailSourceSync, verifyGmailSource } from '@framers/agentos-ext-gmail-source';
+
+const options = {
+  scope, // the connection's tenant, owner and connection ids
+  coordinator: { store, prepare, clock }, // the released AccountSourceSync options without provider and lifecycle
+  revocations, // the host's SourceRevocations on the same tables
+  connector: {
+    api: { client, quota, projectKey: 'project-1', bounds, limits }, // as for GmailApi, without the handle and keys
+    mailbox, // the host's private identity binding: key(handle) and accept(handle, address)
+    bootstrapQuotaKey, // a stable keyed hash for the owner, never an address
+    permission: async (request) => cachePermission, // the evidenced permission for a read, or null
+    sourceDetailUrl: (scope, sourceId) => detailPath(sourceId), // an authenticated relative path, never a Gmail link
+  },
+};
+
+// Once, after the host installed the grant and recorded its generation as grant-ready.
+const verification = await verifyGmailSource(options, generation, signal); // { kind: 'verified' }, or why not
+// Each scheduled or requested sync. The run's connector is disposed when the run ends.
+const result = await runGmailSourceSync(options, 'scheduled', signal);
+```
+
+`GmailSourceConnector(options)` implements the original selected-id account-source interface and exposes the additive `sync` provider. It performs no document commit. Supply the released SQL sync store, revocation service, API configuration, dynamic current-handle getter, private mailbox binding, cache-permission callback, trusted relative detail-path builder and a stable opaque owner probe key. Every network operation uses the existing grant and quota services. The API clients it builds for one lease share one access token in memory, so a sync cycle refreshes the grant once; a 401 or a new lease refreshes it again, and disposal drops it. Never capture the first handle in a getter: source application can refresh the owner ticket.
+
+The mailbox binding is server-only. Both callbacks run under the exact handle's transaction through the released store. `key(handle)` reads the existing stable mailbox key or returns null before initial acceptance. `accept(handle, address)` compares or atomically creates the host's private identity binding and returns its stable key; null refuses the identity. It cannot replace an existing identity on reconnect. Store any display address sealed, never in a source, telemetry field or URL. The initial profile is charged to a stable owner probe key; all content uses the accepted mailbox key. The shared project budget applies to both.
+
+The connector verifies the mailbox before its first content operation even when a resumed coordinator skips `begin`. A fresh `begin` reads a new profile anchor before enumeration. Raw profile identity is passed only to the private binding. The connector retains no profile address. Each cycle can hold one sanitized label snapshot under its independent response expiry. Expired or refused names are omitted without repeated label requests. Cancellation, failure, cycle/generation changes and disposal clear the snapshot. Call `dispose()` in a finally block for direct use.
+
+The original `list`, `read` and `changesSince` methods operate only on selected ids, bounded by the smaller retained and per-lease changed-item allowance and a hard ceiling of 100. Empty ids never enumerate a mailbox. Initial selected changes capture an anchor before reading the selection. Incremental selected changes drain bounded history and then reread only selected changed ids. A partial history, expired anchor, retry, skipped read or stale fence returns no successful cursor. Only a canonical missing thread is reported as removed. An empty selection with a null cursor returns an empty-string sentinel which must never be used with a nonempty selection or persisted as a provider history id.
+
+Use `runGmailSourceSync(options, trigger, signal?)` for durable ingestion. Its options supply scope, coordinator configuration without a provider/lifecycle, the revocation service and connector configuration without a store/current-handle/clock/revocation service. The function constructs the released account-source coordinator, supplies this connector's sync provider and disposes the connector when the run ends. The coordinator alone owns candidate bounds, work persistence, retry episodes, history completion, reconciliation and generation-fenced application. A returned document is always passed through the released store's current policy and expiry checks. Do not persist a facade SourceRead directly and lose the full sync document's cache/provenance envelope.
+
+After a host atomically installs a candidate sealed grant under an authenticated one-use start, transitions that same generation to grant-ready and records pending identity verification, it may call `verifyGmailSource(options, expectedGeneration, signal?)`. This claims a real lease, verifies the profile, binds identity and releases the lease without fetching content or advancing any cursor. Busy means another lease exists, not identity approval. A scheduled worker also verifies identity before content. Failed or cancelled authorization cannot install a grant after its generation was fenced. Hosts must clean up exchanged grants that could not be installed. Never create a synthetic handle to bypass the grant service.
+
+`revoke()` invokes the released immediate fence/purge lifecycle and disposes the connector. Provider confirmation is a separate status from the revocation service; the account-independent queue worker performs that request. Run maintenance and expiry even while polling is paused. All source-derived results retain private ownership and deletion/expiry restrictions. This package exposes no send, reply, attachment download or general URL fetch.

package/dist/GmailOAuthFlow.d.ts

@@ -2,7 +2,8 @@
  * @fileoverview Google's read-only Gmail grant on the AgentOS redirect OAuth flow: the read-only scope alone, asked for
  * offline and incrementally with consent, for registered callbacks only; granted scopes and refresh material checked
  * before a grant is accepted; every token and revocation call capped at 65,536 bytes, bounded by one 15-second
- * deadline and stopped by the caller's cancellation, except the revocation of a grant the flow will not hand back.
+ * deadline and stopped by the caller's cancellation, except the revocation of a grant the flow will not hand back. A
+ * token Google answers as already expired or revoked counts as revoked.
  * @module agentos-ext-gmail-source/GmailOAuthFlow
  */
 import { RedirectOAuthFlow, type IOAuthTokenStore, type OAuthTokenSet, type RedirectOAuthConfig, type RedirectBegin, type RedirectCompleteInput } from '@framers/agentos/auth';
@@ -22,6 +23,8 @@ export declare class GmailOAuthFlow extends RedirectOAuthFlow {
     private readonly signal?;
     /** The fetch and stand-in endpoints of a withheld grant's revocation, without the caller's signal. */
     private readonly withheld;
+    /** Each `accessToken` call's own record of what its read of the store found. */
+    private readonly reads;
     /**
      * @param client The dedicated client and its registered callback addresses (one to sixteen).
      * @param store Where the grant is kept, a namespaced `SealedTokenStore` on a server; null for a flow that only
@@ -60,19 +63,31 @@ export declare class GmailOAuthFlow extends RedirectOAuthFlow {
      */
     private revokeWithheld;
     /**
-     * Refreshes and checks the answer: a scope it returns must be the read-only scope alone, and a refresh token it
-     * returns must be usable. An omitted scope keeps the kept grant's checked scope.
+     * Refreshes the grant the core flow has just read in the key's turn for this `accessToken` call, once that read is
+     * found to hold the read-only scope alone (any other grant, or a refresh outside such a call, throws `scope` before
+     * Google is asked), then checks the answer: a scope it returns must be the read-only scope alone, and a refresh token
+     * it returns must be usable. An omitted scope keeps the kept grant's checked scope.
      */
     protected refreshTokens(refreshToken: string): Promise<OAuthTokenSet>;
     /** Keeps an accepted grant under `key` after the exchange's checks; the store receives its refresh token and scope. */
     keep(key: string, tokens: OAuthTokenSet): Promise<void>;
     /**
      * An access token for the grant kept under `key`, refreshed when needed, only while the kept scope is the read-only
-     * scope alone. Throws `OAuthGrantRefused` with reason `missing` when nothing is kept or the grant changes during the
-     * refresh, and with reason `refresh` when Google refuses it.
+     * scope alone. Each call checks the scope of the grant its own read answered in the key's turn, the one a refresh
+     * renews, so neither another writer between two reads nor calls for other keys can change its outcome. A token held
+     * in memory is used only while the store holds the grant it came with, refresh token and scope alike, and a held grant
+     * always holds the read-only scope alone. Throws `OAuthGrantRefused` with reason `missing` when nothing is kept or the
+     * grant changes during the refresh, and with reason `refresh` when Google refuses it; `GmailOAuthFault` `scope` when
+     * the kept grant holds another scope.
      */
     accessToken(key: string): Promise<string>;
-    /** Revokes a token at Google; an answer that is not a success throws `OAuthGrantRefused` with reason `revoke`. */
+    /**
+     * Revokes a token at Google. It resolves when Google revokes the token, and when Google answers that the token is
+     * already expired or revoked (400 with `invalid_token`), as RFC 7009 section 2.2 answers 200 for an invalid token:
+     * either way the token no longer works. Revoke a grant's refresh token to end the grant; Google answers an expired
+     * access token the same way while its refresh token stays valid. Any other answer that is not a success throws
+     * `OAuthGrantRefused` with reason `revoke`, the status and Google's error when it is an allowlisted OAuth error code.
+     */
     revoke(token: string): Promise<void>;
 }
 //# sourceMappingURL=GmailOAuthFlow.d.ts.map

package/dist/GmailOAuthFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GmailOAuthFlow.d.ts","sourceRoot":"","sources":["../src/GmailOAuthFlow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,iBAAiB,EAAqB,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAC/E,KAAK,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,qBAAqB,EACzE,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACkC,KAAK,gBAAgB,EAClC,KAAK,iBAAiB,EACjD,MAAM,YAAY,CAAC;AAgKpB;;;;;;GAMG;AACH,qBAAa,cAAe,SAAQ,iBAAiB;IACnD,yBAAyB;IACzB,QAAQ,CAAC,UAAU,WAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc;IACtC,sGAAsG;IACtG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C;;;;;;OAMG;gBACS,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,EAAE,OAAO,GAAE,iBAAsB;IAYrG,uGAAuG;IACvG,SAAS,CAAC,SAAS,IAAI,mBAAmB;IAK1C,+DAA+D;IAC/D,OAAO,CAAC,MAAM;IACd,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAGhB;;;;OAIG;IACM,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa;IAO/E;;;;OAIG;IACY,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC;IAQ7E;;;OAGG;cACsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAOpF;;;;OAIG;YACW,cAAc;IAO5B;;;OAGG;cACsB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAKpF,uHAAuH;IACxG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAGtE;;;;OAIG;IACY,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxD,kHAAkH;IACnG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAIpD"}
+{"version":3,"file":"GmailOAuthFlow.d.ts","sourceRoot":"","sources":["../src/GmailOAuthFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,iBAAiB,EAAqB,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAC/E,KAAK,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,qBAAqB,EACzE,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACkC,KAAK,gBAAgB,EAClC,KAAK,iBAAiB,EACjD,MAAM,YAAY,CAAC;AA6LpB;;;;;;GAMG;AACH,qBAAa,cAAe,SAAQ,iBAAiB;IACnD,yBAAyB;IACzB,QAAQ,CAAC,UAAU,WAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc;IACtC,sGAAsG;IACtG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD;;;;;;OAMG;gBACS,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,EAAE,OAAO,GAAE,iBAAsB;IAcrG,uGAAuG;IACvG,SAAS,CAAC,SAAS,IAAI,mBAAmB;IAK1C,+DAA+D;IAC/D,OAAO,CAAC,MAAM;IACd,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAGhB;;;;OAIG;IACM,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa;IAO/E;;;;OAIG;IACY,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC;IAQ7E;;;OAGG;cACsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAOpF;;;;OAIG;YACW,cAAc;IAO5B;;;;;OAKG;cACsB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAMpF,uHAAuH;IACxG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAGtE;;;;;;;;OAQG;IACY,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxD;;;;;;OAMG;IACY,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUpD"}

package/dist/GmailOAuthFlow.js

@@ -2,9 +2,11 @@
  * @fileoverview Google's read-only Gmail grant on the AgentOS redirect OAuth flow: the read-only scope alone, asked for
  * offline and incrementally with consent, for registered callbacks only; granted scopes and refresh material checked
  * before a grant is accepted; every token and revocation call capped at 65,536 bytes, bounded by one 15-second
- * deadline and stopped by the caller's cancellation, except the revocation of a grant the flow will not hand back.
+ * deadline and stopped by the caller's cancellation, except the revocation of a grant the flow will not hand back. A
+ * token Google answers as already expired or revoked counts as revoked.
  * @module agentos-ext-gmail-source/GmailOAuthFlow
  */
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { RedirectOAuthFlow, OAuthGrantRefused, } from '@framers/agentos/auth';
 import { readCapped, ReadCapExceeded } from '@framers/agentos-ext-account-sources';
 import { GMAIL_READONLY_SCOPE, GmailOAuthFault, } from './types.js';
@@ -92,7 +94,8 @@ function abortable(work, signal, stopped, discard) {
 function cancel(response) { void response.body?.cancel().catch(() => { }); }
 /**
  * Reads a body through the released byte cap. The bridge stream turns the signal's abort into a fixed fault, even
- * while no bytes arrive, and passes a cancellation through to the provider's stream.
+ * while no bytes arrive, and passes a cancellation on to the provider's stream without waiting for it to settle, so the
+ * cap's refusal and the deadline never wait on a stream whose cancellation does not end.
  */
 async function boundedBody(response, signal, stopped) {
     if (signal.aborted) {
@@ -136,10 +139,8 @@ async function boundedBody(response, signal, stopped) {
                 }
             }
         },
-        async cancel() { closed = true; try {
-            await reader.cancel();
-        }
-        catch { /* No provider text escapes. */ } },
+        // Asked for, not awaited: `readCapped` awaits this cancellation before it throws past the cap.
+        cancel() { closed = true; void reader.cancel().catch(() => { }); },
     });
     try {
         return await readCapped(new Response(bridge, { headers: response.headers }), maxBytes);
@@ -226,6 +227,33 @@ function normalize(tokens, refreshRequired, scopeRequired) {
     return { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken, expiresAt: tokens.expiresAt,
         metadata: scope === undefined ? undefined : { scope: GMAIL_READONLY_SCOPE } };
 }
+/**
+ * The caller's store as the core flow reads it. A read made for an `accessToken` call notes on that call's own record
+ * whether the grant it answered holds the read-only scope alone. The core reads the grant and refreshes it in the key's
+ * turn, within the call, so the refresh checks the very grant it renews, whatever other calls read meanwhile. The
+ * record ends with its call; a read made for `forget` notes nothing.
+ */
+function notingStore(store, reads) {
+    return {
+        async load(key) {
+            const kept = await store.load(key);
+            const read = reads.getStore();
+            if (read !== undefined)
+                read.scopeOnly = kept !== null && scopeOnly(kept.metadata?.scope);
+            return kept;
+        },
+        save: (key, tokens) => store.save(key, tokens),
+        clear: (key) => store.clear(key),
+    };
+}
+/** The `error` code an answer's JSON object names, and undefined for any other body. */
+async function answeredError(response) {
+    const parsed = await response.json().catch(() => undefined);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        return undefined;
+    const { error } = parsed;
+    return typeof error === 'string' ? error : undefined;
+}
 /**
  * Google's read-only Gmail grant on the core redirect flow. `begin` asks for the read-only scope alone, offline, with
  * incremental authorization and consent, for a registered callback; `complete` accepts only that scope with refresh
@@ -241,6 +269,8 @@ export class GmailOAuthFlow extends RedirectOAuthFlow {
     signal;
     /** The fetch and stand-in endpoints of a withheld grant's revocation, without the caller's signal. */
     withheld;
+    /** Each `accessToken` call's own record of what its read of the store found. */
+    reads;
     /**
      * @param client The dedicated client and its registered callback addresses (one to sixteen).
      * @param store Where the grant is kept, a namespaced `SealedTokenStore` on a server; null for a flow that only
@@ -250,7 +280,9 @@ export class GmailOAuthFlow extends RedirectOAuthFlow {
      */
     constructor(client, store, options = {}) {
         const chosen = selectedEndpoints(options);
-        super(store, oauthFetch(options, chosen));
+        const reads = new AsyncLocalStorage();
+        super(store === null ? null : notingStore(store, reads), oauthFetch(options, chosen));
+        this.reads = reads;
         if (!tokenString(client.clientId) || !tokenString(client.clientSecret)
             || !Array.isArray(client.redirectUris) || client.redirectUris.length === 0 || client.redirectUris.length > 16) {
             throw new GmailOAuthFault('configuration');
@@ -337,11 +369,15 @@ export class GmailOAuthFlow extends RedirectOAuthFlow {
         }
     }
     /**
-     * Refreshes and checks the answer: a scope it returns must be the read-only scope alone, and a refresh token it
-     * returns must be usable. An omitted scope keeps the kept grant's checked scope.
+     * Refreshes the grant the core flow has just read in the key's turn for this `accessToken` call, once that read is
+     * found to hold the read-only scope alone (any other grant, or a refresh outside such a call, throws `scope` before
+     * Google is asked), then checks the answer: a scope it returns must be the read-only scope alone, and a refresh token
+     * it returns must be usable. An omitted scope keeps the kept grant's checked scope.
      */
     async refreshTokens(refreshToken) {
         this.active();
+        if (this.reads.getStore()?.scopeOnly !== true)
+            throw new GmailOAuthFault('scope');
         const tokens = normalize(await super.refreshTokens(refreshToken), false, false);
         this.active();
         return tokens;
@@ -354,28 +390,39 @@ export class GmailOAuthFlow extends RedirectOAuthFlow {
     }
     /**
      * An access token for the grant kept under `key`, refreshed when needed, only while the kept scope is the read-only
-     * scope alone. Throws `OAuthGrantRefused` with reason `missing` when nothing is kept or the grant changes during the
-     * refresh, and with reason `refresh` when Google refuses it.
+     * scope alone. Each call checks the scope of the grant its own read answered in the key's turn, the one a refresh
+     * renews, so neither another writer between two reads nor calls for other keys can change its outcome. A token held
+     * in memory is used only while the store holds the grant it came with, refresh token and scope alike, and a held grant
+     * always holds the read-only scope alone. Throws `OAuthGrantRefused` with reason `missing` when nothing is kept or the
+     * grant changes during the refresh, and with reason `refresh` when Google refuses it; `GmailOAuthFault` `scope` when
+     * the kept grant holds another scope.
      */
     async accessToken(key) {
         this.active();
         if (this.store === null)
             throw new GmailOAuthFault('configuration');
-        const saved = await this.store.load(key);
-        if (saved === null)
-            throw new OAuthGrantRefused('missing');
-        if (!scopeOnly(saved.metadata?.scope))
-            throw new GmailOAuthFault('scope');
-        const token = await super.accessToken(key);
+        const token = await this.reads.run({}, () => super.accessToken(key));
         this.active();
         return token;
     }
-    /** Revokes a token at Google; an answer that is not a success throws `OAuthGrantRefused` with reason `revoke`. */
+    /**
+     * Revokes a token at Google. It resolves when Google revokes the token, and when Google answers that the token is
+     * already expired or revoked (400 with `invalid_token`), as RFC 7009 section 2.2 answers 200 for an invalid token:
+     * either way the token no longer works. Revoke a grant's refresh token to end the grant; Google answers an expired
+     * access token the same way while its refresh token stays valid. Any other answer that is not a success throws
+     * `OAuthGrantRefused` with reason `revoke`, the status and Google's error when it is an allowlisted OAuth error code.
+     */
     async revoke(token) {
         this.active();
         if (!tokenString(token))
             throw new GmailOAuthFault('configuration');
-        await super.revoke(token);
+        const response = await this.fetchImpl(this.endpoints.revoke, { method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ token }).toString() });
+        if (!response.ok) {
+            const error = await answeredError(response);
+            if (response.status !== 400 || error !== 'invalid_token')
+                throw new OAuthGrantRefused('revoke', response.status, error);
+        }
         this.active();
     }
 }

package/dist/GmailOAuthFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"GmailOAuthFlow.js","sourceRoot":"","sources":["../src/GmailOAuthFlow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,iBAAiB,EAAE,iBAAiB,GAErC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,oBAAoB,EAAE,eAAe,GAEtC,MAAM,YAAY,CAAC;AAEpB,yEAAyE;AACzE,MAAM,SAAS,GAAwB,MAAM,CAAC,MAAM,CAAC;IACnD,aAAa,EAAE,8CAA8C;IAC7D,KAAK,EAAE,qCAAqC;IAC5C,MAAM,EAAE,sCAAsC;CAC/C,CAAC,CAAC;AACH,+CAA+C;AAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,+DAA+D;AAC/D,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,uFAAuF;AACvF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;OAC7E,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClF,mFAAmF;AACnF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC;AACnE,CAAC;AACD;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAa,EAAE,WAAoB;IACnD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;IACnF,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;WACjD,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;WAChG,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC1G,OAAO,GAAG,CAAC;AACb,CAAC;AACD,iGAAiG;AACjG,SAAS,iBAAiB,CAAC,OAA0B;IACnD,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/F,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AACD,2FAA2F;AAC3F,SAAS,SAAS,CAAI,IAAgB,EAAE,MAAmB,EAAE,OAA8B,EACzF,OAA4B;IAC5B,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,OAAO;YAAE,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAClB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACvC,IAAI,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,EAAE,CAAC,KAAc,EAAE,EAAE;YACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AACD,uEAAuE;AACvE,SAAS,MAAM,CAAC,QAAkB,IAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,QAAkB,EAAE,MAAmB,EAChE,OAA8B;IAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IAAC,IAAI,MAAM,GAAG,KAAK,CAAC;IAC7D,IAAI,IAAiB,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;QAC5C,KAAK,CAAC,UAAU;YACd,IAAI,GAAG,GAAG,EAAE;gBACV,IAAI,MAAM;oBAAE,OAAO;gBACnB,MAAM,GAAG,IAAI,CAAC;gBAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnF,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,OAAO;gBAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,MAAM;oBAAE,OAAO;gBACnB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC;oBAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;;oBACjD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,EAAE,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC;oBAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;gBAAC,CAAC;YAChH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC;KAC3G,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC;YAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iDAAiD,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AACD;;;;GAIG;AACH,SAAS,UAAU,CAAC,OAA0B,EAAE,MAA2B;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACxH,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAC9G,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAC/D,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC9E,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACrF,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,KAAK,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,OAAO,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;gBAC7E,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,EAC3F,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAAC,MAAM,OAAO,EAAE,CAAC;YAAC,CAAC;YACrE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;gBACzG,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAAC,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtE,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,OAAO,EAAE,CAAC;YAC/C,OAAO,IAAI,QAAQ,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAC1E,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,KAAK,CAAC;YAClD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,OAAO,EAAE,CAAC;YAC/C,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;YACtF,MAAM,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AACD;;;GAGG;AACH,SAAS,SAAS,CAAC,MAAqB,EAAE,eAAwB,EAAE,aAAsB;IACxF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7G,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC;IACrC,IAAI,CAAC,aAAa,IAAI,KAAK,KAAK,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IACpG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;QACtG,QAAQ,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;AAClF,CAAC;AACD;;;;;;GAMG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,yBAAyB;IAChB,UAAU,GAAG,OAAO,CAAC;IACb,MAAM,CAAmB;IACzB,SAAS,CAAsB;IAC/B,MAAM,CAAe;IACtC,sGAAsG;IACrF,QAAQ,CAAoB;IAC7C;;;;;;OAMG;IACH,YAAY,MAAwB,EAAE,KAA8B,EAAE,UAA6B,EAAE;QACnG,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC;eACjE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChH,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY;YAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,uGAAuG;IAC7F,SAAS;QACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,oBAAoB,CAAC;YAC7G,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;YACxF,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;IACzE,CAAC;IACD,+DAA+D;IACvD,MAAM,KAAW,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5F,iFAAiF;IACzE,QAAQ,CAAC,GAAW;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC1F,CAAC;IACD;;;;OAIG;IACM,KAAK,CAAC,KAAgD;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC;eACxF,CAAC,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QAClH,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,oBAAoB,CAAC;YACjF,WAAW,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;IACD;;;;OAIG;IACM,KAAK,CAAC,QAAQ,CAAC,KAA4B;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;eAChF,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QAC9G,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD;;;OAGG;IACgB,KAAK,CAAC,YAAY,CAAC,MAAqB;QACzD,IAAI,CAAC;YAAC,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAC7C,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CAAC,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,EAC5F,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAAC,MAAqB;QAChD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY;YAClE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,aAAa,CAAC;QACzC,IAAI,CAAC;YAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,WAAW,CAAC;QAAC,CAAC;QACrG,MAAM,CAAC;YAAC,OAAO,aAAa,CAAC;QAAC,CAAC;IACjC,CAAC;IACD;;;OAGG;IACgB,KAAK,CAAC,aAAa,CAAC,YAAoB;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC;IAC/B,CAAC;IACD,uHAAuH;IAC9G,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,MAAqB;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrF,CAAC;IACD;;;;OAIG;IACM,KAAK,CAAC,WAAW,CAAC,GAAW;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,KAAK,CAAC;IAC1E,CAAC;IACD,kHAAkH;IACzG,KAAK,CAAC,MAAM,CAAC,KAAa;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACnF,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"GmailOAuthFlow.js","sourceRoot":"","sources":["../src/GmailOAuthFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACL,iBAAiB,EAAE,iBAAiB,GAErC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,oBAAoB,EAAE,eAAe,GAEtC,MAAM,YAAY,CAAC;AAEpB,yEAAyE;AACzE,MAAM,SAAS,GAAwB,MAAM,CAAC,MAAM,CAAC;IACnD,aAAa,EAAE,8CAA8C;IAC7D,KAAK,EAAE,qCAAqC;IAC5C,MAAM,EAAE,sCAAsC;CAC/C,CAAC,CAAC;AACH,+CAA+C;AAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,+DAA+D;AAC/D,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,uFAAuF;AACvF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;OAC7E,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClF,mFAAmF;AACnF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC;AACnE,CAAC;AACD;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAa,EAAE,WAAoB;IACnD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;IACnF,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;WACjD,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;WAChG,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC1G,OAAO,GAAG,CAAC;AACb,CAAC;AACD,iGAAiG;AACjG,SAAS,iBAAiB,CAAC,OAA0B;IACnD,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/F,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AACD,2FAA2F;AAC3F,SAAS,SAAS,CAAI,IAAgB,EAAE,MAAmB,EAAE,OAA8B,EACzF,OAA4B;IAC5B,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,OAAO;YAAE,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAClB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACvC,IAAI,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,EAAE,CAAC,KAAc,EAAE,EAAE;YACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AACD,uEAAuE;AACvE,SAAS,MAAM,CAAC,QAAkB,IAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,QAAkB,EAAE,MAAmB,EAChE,OAA8B;IAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IAAC,IAAI,MAAM,GAAG,KAAK,CAAC;IAC7D,IAAI,IAAiB,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;QAC5C,KAAK,CAAC,UAAU;YACd,IAAI,GAAG,GAAG,EAAE;gBACV,IAAI,MAAM;oBAAE,OAAO;gBACnB,MAAM,GAAG,IAAI,CAAC;gBAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnF,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,OAAO;gBAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,MAAM;oBAAE,OAAO;gBACnB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC;oBAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;;oBACjD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,EAAE,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC;oBAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;gBAAC,CAAC;YAChH,CAAC;QACH,CAAC;QACD,+FAA+F;QAC/F,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;KACnG,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC;YAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iDAAiD,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AACD;;;;GAIG;AACH,SAAS,UAAU,CAAC,OAA0B,EAAE,MAA2B;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACxH,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAC9G,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAC/D,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC9E,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACrF,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,KAAK,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,OAAO,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;gBAC7E,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,EAC3F,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAAC,MAAM,OAAO,EAAE,CAAC;YAAC,CAAC;YACrE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;gBACzG,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAAC,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtE,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,OAAO,EAAE,CAAC;YAC/C,OAAO,IAAI,QAAQ,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAC1E,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,KAAK,CAAC;YAClD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,OAAO,EAAE,CAAC;YAC/C,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;YACtF,MAAM,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AACD;;;GAGG;AACH,SAAS,SAAS,CAAC,MAAqB,EAAE,eAAwB,EAAE,aAAsB;IACxF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7G,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC;IACrC,IAAI,CAAC,aAAa,IAAI,KAAK,KAAK,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IACpG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;QACtG,QAAQ,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;AAClF,CAAC;AAGD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAuB,EAAE,KAAmC;IAC/E,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;KACjC,CAAC;AACJ,CAAC;AACD,wFAAwF;AACxF,KAAK,UAAU,aAAa,CAAC,QAAkB;IAC7C,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,MAAM,EAAE,KAAK,EAAE,GAAG,MAA6B,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AACD;;;;;;GAMG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,yBAAyB;IAChB,UAAU,GAAG,OAAO,CAAC;IACb,MAAM,CAAmB;IACzB,SAAS,CAAsB;IAC/B,MAAM,CAAe;IACtC,sGAAsG;IACrF,QAAQ,CAAoB;IAC7C,gFAAgF;IAC/D,KAAK,CAA+B;IACrD;;;;;;OAMG;IACH,YAAY,MAAwB,EAAE,KAA8B,EAAE,UAA6B,EAAE;QACnG,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAa,CAAC;QACjD,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC;eACjE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChH,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY;YAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,uGAAuG;IAC7F,SAAS;QACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,oBAAoB,CAAC;YAC7G,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;YACxF,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;IACzE,CAAC;IACD,+DAA+D;IACvD,MAAM,KAAW,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5F,iFAAiF;IACzE,QAAQ,CAAC,GAAW;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC1F,CAAC;IACD;;;;OAIG;IACM,KAAK,CAAC,KAAgD;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC;eACxF,CAAC,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QAClH,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,oBAAoB,CAAC;YACjF,WAAW,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;IACD;;;;OAIG;IACM,KAAK,CAAC,QAAQ,CAAC,KAA4B;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;eAChF,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QAC9G,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD;;;OAGG;IACgB,KAAK,CAAC,YAAY,CAAC,MAAqB;QACzD,IAAI,CAAC;YAAC,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAC7C,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CAAC,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,EAC5F,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAAC,MAAqB;QAChD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY;YAClE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,aAAa,CAAC;QACzC,IAAI,CAAC;YAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,WAAW,CAAC;QAAC,CAAC;QACrG,MAAM,CAAC;YAAC,OAAO,aAAa,CAAC;QAAC,CAAC;IACjC,CAAC;IACD;;;;;OAKG;IACgB,KAAK,CAAC,aAAa,CAAC,YAAoB;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC;IAC/B,CAAC;IACD,uHAAuH;IAC9G,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,MAAqB;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrF,CAAC;IACD;;;;;;;;OAQG;IACM,KAAK,CAAC,WAAW,CAAC,GAAW;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,KAAK,CAAC;IACpG,CAAC;IACD;;;;;;OAMG;IACM,KAAK,CAAC,MAAM,CAAC,KAAa;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM;YAC3E,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,eAAe;gBAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;CACF"}

package/dist/GmailSourceConnector.d.ts

@@ -0,0 +1,161 @@
+import { type ResumableAccountSourceConnector, type AccountSourceSyncProvider, type SourceSelection, type SourceItem, type SourceRead, type SourceGone, type SourceChanges, type SourceSyncRequest, type SourceSyncScope, type SourceSyncHandle, type SourceSyncSkipReason, type SourceCachePermission, type SqlAccountSourceSyncStore, type SourceRevocations } from '@framers/agentos-ext-account-sources';
+import { type GmailApiOptions } from './gmail.js';
+/** All callbacks are server-only and use the exact current handle's owner transaction. */
+export interface GmailMailboxBinding {
+    /** Return the stable opaque mailbox key, or null before first profile acceptance. */
+    key(handle: SourceSyncHandle): Promise<string | null>;
+    /** Compare or create the private identity binding; null refuses any content access. */
+    accept(handle: SourceSyncHandle, emailAddress: string): Promise<string | null>;
+}
+/**
+ * What a `GmailSourceConnector` is built from: trusted server configuration and the host's released account-source
+ * services, never values from a browser request.
+ *
+ * @typeParam Prepared - The host's prepared-document type of its sync store and revocation service.
+ */
+export interface GmailSourceConnectorOptions<Prepared = unknown> {
+    /**
+     * The API client's configuration without the values the connector supplies itself: the current handle, the quota
+     * key of the mailbox, the revocation service, the clock and the lease's access-token holder.
+     */
+    readonly api: Omit<GmailApiOptions<Prepared>, 'currentHandle' | 'mailboxKey' | 'revocations' | 'clock' | 'tokenHolder'>;
+    /** The released SQL sync store: its snapshot and its exact-handle transaction. */
+    readonly store: Pick<SqlAccountSourceSyncStore<Prepared>, 'snapshot' | 'withCurrentHandle'>;
+    /** The released revocation service: its grant operation and the fenced disconnect `revoke` uses. */
+    readonly revocations: Pick<SourceRevocations<Prepared>, 'withGrant' | 'disconnect'>;
+    /** Answers the handle that holds this connection's lease now; never a getter of the first handle. */
+    readonly currentHandle: () => SourceSyncHandle;
+    /** The host's private mailbox identity binding. */
+    readonly mailbox: GmailMailboxBinding;
+    /**
+     * A stable opaque quota key for the identity probe before a mailbox is bound: 1 to 512 letters, digits, `:`, `_` or
+     * `-`, derived by the host with a server secret, never an address or a key that rotates with a connection.
+     */
+    readonly bootstrapQuotaKey: string;
+    /** The host's evidenced cache permission for one read; null records a `not_permitted` skip without a request. */
+    readonly permission: (request: SourceSyncRequest) => Promise<SourceCachePermission | null>;
+    /** The host's trusted, authenticated relative source-detail path for one thread; never a Gmail link. */
+    readonly sourceDetailUrl: (scope: SourceSyncScope, sourceId: string) => string;
+    /** Current time as integer UTC epoch milliseconds, the clock the sync store reads; `Date.now` unless given. */
+    readonly clock?: () => number;
+}
+/**
+ * A connector's fixed refusal; its message is `gmail_connector_<reason>`. `configuration` for an invalid option or
+ * clock, `selection` for a malformed or oversized selection or cursor, `history_bound` when selected history did not
+ * finish within its page budget, `busy` for an operation that overlaps another on the same connector, and `skipped`
+ * for a selected read that was deliberately not retained, with the skip reason in `skip`.
+ */
+export declare class GmailConnectorFault extends Error {
+    readonly reason: 'configuration' | 'selection' | 'history_bound' | 'busy' | 'skipped';
+    readonly skip: SourceSyncSkipReason | null;
+    /**
+     * @param reason Why the connector refused.
+     * @param skip The skip reason of a `skipped` refusal, otherwise null.
+     */
+    constructor(reason: 'configuration' | 'selection' | 'history_bound' | 'busy' | 'skipped', skip?: SourceSyncSkipReason | null);
+}
+/**
+ * One serial connector per active lease. Store, quota and grant services own durability.
+ *
+ * Every operation, original or `sync`, runs alone on the connector within at most 90 seconds and one second before
+ * the lease expires. It checks the exact current handle, the connection's generation, barrier, pause flag and policy
+ * before its work, and the handle again after it, so a late result of a superseded lease is refused. The first content
+ * operation of each lease, and every `begin`, reads the profile and passes its address only to the host's binding.
+ * The clients the connector builds for one lease share one access token, so a cycle refreshes the grant once. Call
+ * `dispose()` when the run ends.
+ *
+ * @typeParam Prepared - The host's prepared-document type of its sync store and revocation service.
+ */
+export declare class GmailSourceConnector<Prepared = unknown> implements ResumableAccountSourceConnector {
+    private readonly options;
+    /** The account-source kind. */
+    readonly kind = "gmail";
+    /** The resumable provider the account-source coordinator drives; it commits nothing. */
+    readonly sync: AccountSourceSyncProvider;
+    private disposed;
+    private controller;
+    private verified;
+    private api;
+    private labelContext;
+    private labelPermission;
+    private labelAttempted;
+    private labels;
+    private labelTimer;
+    private readonly tokens;
+    private readonly clock;
+    /**
+     * @param options The API configuration, the host's store, revocation service, current-handle getter, mailbox
+     * binding, owner probe key, permission callback, detail-path builder and optional clock. Construction sends nothing.
+     * @throws {GmailConnectorFault} `configuration` for a malformed owner probe key.
+     */
+    constructor(options: GmailSourceConnectorOptions<Prepared>);
+    private now;
+    private clearLabels;
+    /**
+     * Ends the connector: aborts the operation in flight and drops the label snapshot, the verified identity, the API
+     * clients and the held access token. Every later call throws `cancelled`. Call it in a `finally` block.
+     */
+    dispose(): void;
+    private stored;
+    private current;
+    private fenced;
+    private context;
+    private operation;
+    private makeApi;
+    private needApi;
+    private verifyIdentity;
+    private cycleLabels;
+    private readDocument;
+    private selection;
+    private selected;
+    /**
+     * Reads the selected threads, freshly mapped; an empty selection enumerates nothing.
+     *
+     * @param selection Thread ids, at most the smaller of 100, the retained-document limit and the changed-per-lease
+     * limit.
+     * @param signal Cancels the call.
+     * @returns The read items and the threads Gmail no longer holds.
+     * @throws {GmailConnectorFault} `selection` before any request for a malformed or oversized selection, `skipped`
+     * for a thread that was not retained.
+     * @throws {SourceSyncFault} A fixed failure, including a retry with its time.
+     */
+    list(selection: SourceSelection, signal?: AbortSignal): Promise<{
+        items: SourceItem[];
+        gone: SourceGone[];
+    }>;
+    /**
+     * Reads one thread by its id; the caller's title, size and version are not trusted.
+     *
+     * @param item The thread to read.
+     * @param signal Cancels the call.
+     * @returns The freshly mapped read, or `removed` when Gmail no longer holds the thread.
+     * @throws {GmailConnectorFault} `selection` for a malformed id, `skipped` for a thread that was not retained.
+     * @throws {SourceSyncFault} A fixed failure, including a retry with its time.
+     */
+    read(item: SourceItem, signal?: AbortSignal): Promise<SourceRead | SourceGone>;
+    /**
+     * The selected threads changed since a cursor. With a null cursor it reads the profile's history id first and then
+     * the whole selection, answering that id; with a cursor it drains history within the page budget and rereads only
+     * the selected threads it names. An empty selection answers the given cursor, or the empty-string sentinel for a
+     * null one, without a request; never persist that sentinel or pass it with a nonempty selection.
+     *
+     * @param fromCursor A history id from an earlier call, or null.
+     * @param selection The thread ids, bounded as for `list`.
+     * @param signal Cancels the call.
+     * @returns The changed and removed selected threads and the cursor reached; only a fully successful call answers one.
+     * @throws {GmailConnectorFault} `selection` for a malformed cursor or selection, `history_bound` when history did not
+     * finish within the page budget, `skipped` for a thread that was not retained.
+     * @throws {SourceSyncFault} `history_expired` for an expired cursor, or another fixed failure.
+     */
+    changesSince(fromCursor: string | null, selection: SourceSelection, signal?: AbortSignal): Promise<SourceChanges>;
+    /**
+     * Disposes the connector and runs the released fenced disconnect for the current generation: the local purge and
+     * the queueing of the grant for the revocation worker. Resolving does not mean Google has confirmed the
+     * revocation; the revocation service's `status` reports that.
+     *
+     * @throws {SourceSyncFault} `grant_rejected` when the generation has moved on, `storage_unavailable` while the
+     * local purge is still pending.
+     */
+    revoke(): Promise<void>;
+}
+//# sourceMappingURL=GmailSourceConnector.d.ts.map

package/dist/GmailSourceConnector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GmailSourceConnector.d.ts","sourceRoot":"","sources":["../src/GmailSourceConnector.ts"],"names":[],"mappings":"AAUA,OAAO,EAEL,KAAK,+BAA+B,EAAE,KAAK,yBAAyB,EACpE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAC3F,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACnE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,KAAK,yBAAyB,EACrF,KAAK,iBAAiB,EACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAY,KAAK,eAAe,EAA2C,MAAM,YAAY,CAAC;AAErG,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,qFAAqF;IACrF,GAAG,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtD,uFAAuF;IACvF,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAChF;AACD;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B,CAAC,QAAQ,GAAG,OAAO;IAC7D;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,YAAY,GAAG,aAAa,GAAG,OAAO,GAAG,aAAa,CAAC,CAAC;IACxH,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,mBAAmB,CAAC,CAAC;IAC5F,oGAAoG;IACpG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC,CAAC;IACpF,qGAAqG;IACrG,QAAQ,CAAC,aAAa,EAAE,MAAM,gBAAgB,CAAC;IAC/C,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,iHAAiH;IACjH,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC3F,wGAAwG;IACxG,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/E,+GAA+G;IAC/G,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AACD;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAKhC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,GAAG,eAAe,GAAG,MAAM,GAAG,SAAS;IAC/F,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI;IAL5C;;;OAGG;gBACkB,MAAM,EAAE,eAAe,GAAG,WAAW,GAAG,eAAe,GAAG,MAAM,GAAG,SAAS,EACtF,IAAI,GAAE,oBAAoB,GAAG,IAAW;CAGpD;AAeD;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAoB,CAAC,QAAQ,GAAG,OAAO,CAAE,YAAW,+BAA+B;IAsBlF,OAAO,CAAC,QAAQ,CAAC,OAAO;IArBpC,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,WAAW;IACxB,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,GAAG,CAAmC;IAC9C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,UAAU,CAA8C;IAEhE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC;;;;OAIG;gBAC0B,OAAO,EAAE,2BAA2B,CAAC,QAAQ,CAAC;IAmB3E,OAAO,CAAC,GAAG;IAGX,OAAO,CAAC,WAAW;IAKnB;;;OAGG;IACH,OAAO,IAAI,IAAI;YAKD,MAAM;IAOpB,OAAO,CAAC,OAAO;YASD,MAAM;YAON,OAAO;YAQP,SAAS;IA0CvB,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,OAAO;YAMD,cAAc;YAiBd,WAAW;YAyBX,YAAY;IAa1B,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,QAAQ;IAMhB;;;;;;;;;;OAUG;IACG,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAAC,IAAI,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAWlH;;;;;;;;OAQG;IACG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAOpF;;;;;;;;;;;;;OAaG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAkCvH;;;;;;;OAOG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAM9B"}