@sentropic/llm-mesh 0.32.4 → 0.34.0

package/dist/service/custodian-refresh.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Proactive custodian refresh policy (Lot 1).
+ *
+ * The custodian used to refresh only reactively, when an access token was
+ * already expired at acquire time. This module decides when a mesh-managed
+ * account must be renewed *before* expiry: inside a skew window computed
+ * from the credential TTL (25 % of TTL remaining by default, at least
+ * 10 minutes). A refresh failure flips the account to `reauth_required`
+ * early, so the route diagnostics carry the reauth signal without waiting
+ * for a business call to fail.
+ *
+ * Pure functions only: the service owns clocks, providers and persistence.
+ */
+export interface CustodianRefreshPolicy {
+    /** Fraction of TTL remaining that opens the refresh window (0.25). */
+    skewRatio: number;
+    /** Floor for the refresh window in ms (600_000 = 10 min). */
+    minSkewMs: number;
+}
+export declare const DEFAULT_CUSTODIAN_REFRESH_POLICY: CustodianRefreshPolicy;
+/** Clamp a host-supplied policy to safe bounds; invalid fields fall back. */
+export declare function sanitizeCustodianRefreshPolicy(policy?: CustodianRefreshPolicy): CustodianRefreshPolicy;
+export interface RefreshWindowInput {
+    expiresAtMs: number;
+    /** Credential issuance instant; NaN/undefined falls back to the floor window. */
+    issuedAtMs?: number;
+    nowMs: number;
+}
+/** Width of the proactive refresh window for a credential TTL. */
+export declare function refreshSkewMs(ttlMs: number, policy?: CustodianRefreshPolicy): number;
+/** True when the credential must be renewed now, before it expires. */
+export declare function shouldRefreshProactively(input: RefreshWindowInput, policy?: CustodianRefreshPolicy): boolean;
+export type CustodianAccountAction = 'refreshed' | 'refresh-failed-reauth' | 'refresh-deferred-retry' | 'refresh-in-flight' | 'expired-no-grant' | 'skipped-healthy' | 'skipped-external' | 'skipped-no-grant' | 'skipped-no-expiry' | 'already-reauth';
+export interface CustodianAccountReport {
+    /** Diagnostic hash of the account id; never the raw id, never a secret. */
+    accountRef: string;
+    transportProviderId: string;
+    ownerScopeRef: string;
+    action: CustodianAccountAction;
+    readiness: 'ready' | 'reauth-required';
+    expiredAt?: string;
+    /** Upcoming expiry (future): the plannable rotation window for grant-less credentials. */
+    expiresAt?: string;
+}
+export interface CustodianRefreshReport {
+    at: string;
+    checked: number;
+    refreshed: number;
+    reauthRequired: number;
+    accounts: CustodianAccountReport[];
+}
+//# sourceMappingURL=custodian-refresh.d.ts.map

package/dist/service/custodian-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custodian-refresh.d.ts","sourceRoot":"","sources":["../../src/service/custodian-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,gCAAgC,EAAE,sBAG9C,CAAC;AAEF,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAC5C,MAAM,CAAC,EAAE,sBAAsB,GAC9B,sBAAsB,CAYxB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,sBAAyD,GAChE,MAAM,CAGR;AAED,uEAAuE;AACvE,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,MAAM,GAAE,sBAAyD,GAChE,OAAO,CAST;AAED,MAAM,MAAM,sBAAsB,GAC9B,WAAW,GACX,uBAAuB,GACvB,wBAAwB,GACxB,mBAAmB,GACnB,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,MAAM,WAAW,sBAAsB;IACrC,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC"}

package/dist/service/custodian-refresh.js

@@ -0,0 +1,51 @@
+/**
+ * Proactive custodian refresh policy (Lot 1).
+ *
+ * The custodian used to refresh only reactively, when an access token was
+ * already expired at acquire time. This module decides when a mesh-managed
+ * account must be renewed *before* expiry: inside a skew window computed
+ * from the credential TTL (25 % of TTL remaining by default, at least
+ * 10 minutes). A refresh failure flips the account to `reauth_required`
+ * early, so the route diagnostics carry the reauth signal without waiting
+ * for a business call to fail.
+ *
+ * Pure functions only: the service owns clocks, providers and persistence.
+ */
+export const DEFAULT_CUSTODIAN_REFRESH_POLICY = {
+    skewRatio: 0.25,
+    minSkewMs: 600_000,
+};
+/** Clamp a host-supplied policy to safe bounds; invalid fields fall back. */
+export function sanitizeCustodianRefreshPolicy(policy) {
+    const fallback = DEFAULT_CUSTODIAN_REFRESH_POLICY;
+    const skewRatio = policy?.skewRatio;
+    const minSkewMs = policy?.minSkewMs;
+    return {
+        skewRatio: Number.isFinite(skewRatio) && skewRatio > 0 && skewRatio <= 1
+            ? skewRatio
+            : fallback.skewRatio,
+        minSkewMs: Number.isFinite(minSkewMs) && minSkewMs >= 0
+            ? minSkewMs
+            : fallback.minSkewMs,
+    };
+}
+/** Width of the proactive refresh window for a credential TTL. */
+export function refreshSkewMs(ttlMs, policy = DEFAULT_CUSTODIAN_REFRESH_POLICY) {
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0)
+        return policy.minSkewMs;
+    return Math.min(ttlMs, Math.max(policy.minSkewMs, ttlMs * policy.skewRatio));
+}
+/** True when the credential must be renewed now, before it expires. */
+export function shouldRefreshProactively(input, policy = DEFAULT_CUSTODIAN_REFRESH_POLICY) {
+    const { expiresAtMs, nowMs } = input;
+    if (!Number.isFinite(expiresAtMs))
+        return false;
+    if (expiresAtMs <= nowMs)
+        return true;
+    const issuedAtMs = input.issuedAtMs;
+    const ttlMs = issuedAtMs !== undefined && Number.isFinite(issuedAtMs)
+        ? expiresAtMs - issuedAtMs
+        : Number.NaN;
+    return expiresAtMs - nowMs <= refreshSkewMs(ttlMs, policy);
+}
+//# sourceMappingURL=custodian-refresh.js.map

package/dist/service/custodian-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custodian-refresh.js","sourceRoot":"","sources":["../../src/service/custodian-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,CAAC,MAAM,gCAAgC,GAA2B;IACtE,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,OAAO;CACnB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B,CAC5C,MAA+B;IAE/B,MAAM,QAAQ,GAAG,gCAAgC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAK,SAAoB,GAAG,CAAC,IAAK,SAAoB,IAAI,CAAC;YAC9F,CAAC,CAAE,SAAoB;YACvB,CAAC,CAAC,QAAQ,CAAC,SAAS;QACtB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAK,SAAoB,IAAI,CAAC;YACjE,CAAC,CAAE,SAAoB;YACvB,CAAC,CAAC,QAAQ,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AASD,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,SAAiC,gCAAgC;IAEjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB,CACtC,KAAyB,EACzB,SAAiC,gCAAgC;IAEjE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,WAAW,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnE,CAAC,CAAC,WAAW,GAAG,UAAU;QAC1B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACf,OAAO,WAAW,GAAG,KAAK,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC"}

package/dist/service/facade.d.ts

@@ -1,9 +1,16 @@
 import type { AccountTransportAcquireInput, AccountTransportAcquisition } from '../account-transports.js';
 import type { AccountTransportProviderId } from '../auth.js';
 import type { AccountPublic, EnrollmentCompletion, EnrollmentSession, StartEnrollmentInput } from '../enrollment/contracts.js';
+import type { SeatBundleV1 } from '../enrollment/seat-bundle.js';
+import type { SeatOnboardingV1 } from '../enrollment/seat-onboarding.js';
 import type { LlmMesh } from '../mesh.js';
 import { type InMemoryRoutePlannerOptions } from '../route-planner.js';
 import type { RoutePlanner } from '../routing-contracts.js';
+import type { CustodianRefreshPolicy, CustodianRefreshReport } from './custodian-refresh.js';
+import type { ReauthAlertSink } from './reauth-alert.js';
+export type { CustodianAccountAction, CustodianAccountReport, CustodianRefreshPolicy, CustodianRefreshReport, } from './custodian-refresh.js';
+export type { ReauthAlertEvent, ReauthAlertReason, ReauthAlertSink, } from './reauth-alert.js';
+export type { LocalAccountTransportServiceOptions } from './local-account-transport-service.js';
 export interface ProviderRequest {
     modelId: string;
     contents: unknown[];
@@ -57,12 +64,22 @@ export interface KeyringAdapter {
 export interface ConfigResolver {
     resolveConfig(configRef: string): Promise<Record<string, unknown>>;
 }
+export interface CustodianOptions {
+    /** Injected clock (ms); defaults to Date.now. Tests pin it. */
+    now?: () => number;
+    /** Reauth alert sink (D4: conductor h2a + owner re-auth); never receives secrets. */
+    reauthAlert?: ReauthAlertSink;
+    /** Proactive refresh skew policy; defaults to 25 % TTL / 10 min floor. */
+    refreshPolicy?: CustodianRefreshPolicy;
+}
 export interface FacadeOptions {
     configResolver: ConfigResolver;
     keyring?: KeyringAdapter;
     mode: 'cli' | 'portal';
     /** Explicit owner used only to bind pre-ownerScope local keyring records. */
     legacyAccountOwnerScopeRef?: string;
+    /** Lot 1 custodian loop options (clock, reauth sink, skew policy). */
+    custodian?: CustodianOptions;
 }
 export interface AccountOwnerInput {
     ownerScope: string;
@@ -74,6 +91,9 @@ export interface RemoveAccountResult {
 export interface LlmMeshAccountAdministration {
     listAccounts(input: AccountOwnerInput): Promise<readonly AccountPublic[]>;
     removeAccount(accountId: string, input: AccountOwnerInput): Promise<RemoveAccountResult>;
+    runCustodianRefreshCycle(): Promise<CustodianRefreshReport>;
+    startCustodianLoop(intervalMs: number, onReport?: (report: CustodianRefreshReport) => void, onError?: (error: unknown) => void): () => void;
+    stopCustodianLoop(): void;
 }
 export interface LlmMeshFacade {
     /** Trusted in-process inputs only; keep codes and credential JSON out of agent tools. */
@@ -88,12 +108,20 @@ export interface LlmMeshFacade {
     importSeatBundle(input: {
         bundle: unknown;
         ownerScope: string;
+        onboarding?: unknown;
     }): Promise<{
         accountId: string;
         seatRef: string;
         generation: number;
         idempotent: boolean;
     }>;
+    exportSeatBundle(input: {
+        accountId: string;
+        ownerScope: string;
+    }): Promise<{
+        bundle: SeatBundleV1;
+        onboarding: SeatOnboardingV1 | null;
+    }>;
     cancel(enrollmentId: string): Promise<void>;
     acquire(input: AccountTransportAcquireInput): Promise<AccountTransportAcquisition>;
     release(acquisition: AccountTransportAcquisition): Promise<void>;

package/dist/service/facade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facade.d.ts","sourceRoot":"","sources":["../../src/service/facade.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EAEpB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AAWpC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACiB,KAAK,2BAA2B,EACvD,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,SAAS;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EAAE,CAAC;CACL;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IACE,IAAI,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IACE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC5C,CAAC;AAEN,MAAM,WAAW,eAAe;IAC9B,OAAO,CACL,WAAW,EAAE,2BAA2B,EACxC,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,WAAW,GAClB,aAAa,CAAC,aAAa,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,iBAAiB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,cAAc,CAAC;IAC/B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvB,6EAA6E;IAC7E,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,IAAI,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC1E,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,wBAAwB,CAAC,CACvB,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GACxD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,8BAA8B,CAAC,CAC7B,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAC5C,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC,MAAM,CACJ,UAAU,EAAE,0BAA0B,EACtC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEvE,kBAAkB,CAChB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAGjC,wBAAwB,CACtB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAGjC,wBAAwB,CACtB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAGjC,gBAAgB,CAAC,KAAK,EAAE;QACtB,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5C,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACnF,OAAO,CAAC,WAAW,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGjE,UAAU,CAAC,UAAU,EAAE,0BAA0B,GAAG,eAAe,CAAC;IACpE,kBAAkB,CAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC,EAC7C,OAAO,CAAC,EAAE,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,GACvD,YAAY,CAAC;CACjB;AAED,MAAM,WAAW,2BACf,SAAQ,aAAa,EAAE,4BAA4B;CAAG;AAExD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,2BAA2B,CAuFvF"}
+{"version":3,"file":"facade.d.ts","sourceRoot":"","sources":["../../src/service/facade.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EAEpB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAWzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACiB,KAAK,2BAA2B,EACvD,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EACV,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,YAAY,EACV,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAEhG,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,SAAS;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EAAE,CAAC;CACL;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IACE,IAAI,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IACE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC5C,CAAC;AAEN,MAAM,WAAW,eAAe;IAC9B,OAAO,CACL,WAAW,EAAE,2BAA2B,EACxC,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,WAAW,GAClB,aAAa,CAAC,aAAa,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,iBAAiB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,qFAAqF;IACrF,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,cAAc,CAAC;IAC/B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvB,6EAA6E;IAC7E,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sEAAsE;IACtE,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,IAAI,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC1E,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAShC,wBAAwB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5D,kBAAkB,CAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,EACnD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,MAAM,IAAI,CAAC;IACd,iBAAiB,IAAI,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,wBAAwB,CAAC,CACvB,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GACxD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,8BAA8B,CAAC,CAC7B,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAC5C,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC,MAAM,CACJ,UAAU,EAAE,0BAA0B,EACtC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEvE,kBAAkB,CAChB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAGjC,wBAAwB,CACtB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAGjC,wBAAwB,CACtB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAIjC,gBAAgB,CAAC,KAAK,EAAE;QACtB,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAI7F,gBAAgB,CAAC,KAAK,EAAE;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC3E,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5C,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACnF,OAAO,CAAC,WAAW,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGjE,UAAU,CAAC,UAAU,EAAE,0BAA0B,GAAG,eAAe,CAAC;IACpE,kBAAkB,CAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC,EAC7C,OAAO,CAAC,EAAE,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,GACvD,YAAY,CAAC;CACjB;AAED,MAAM,WAAW,2BACf,SAAQ,aAAa,EAAE,4BAA4B;CAAG;AAExD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,2BAA2B,CAyGvF"}

package/dist/service/facade.js

@@ -29,7 +29,12 @@ export function createLlmMeshFacade(options) {
         ['muse-code', new MuseCodeEnrollmentProvider()],
         ['mistral-vibe', new MistralVibeEnrollmentProvider()],
     ]);
-    const service = new LocalAccountTransportService(keyring, providers, options.configResolver, options.legacyAccountOwnerScopeRef);
+    const serviceOptions = {
+        ...(options.custodian?.now ? { now: options.custodian.now } : {}),
+        ...(options.custodian?.reauthAlert ? { reauthAlert: options.custodian.reauthAlert } : {}),
+        ...(options.custodian?.refreshPolicy ? { refreshPolicy: options.custodian.refreshPolicy } : {}),
+    };
+    const service = new LocalAccountTransportService(keyring, providers, options.configResolver, options.legacyAccountOwnerScopeRef, serviceOptions);
     return {
         async completeClaudeEnrollment(enrollmentId, code, ownerScopeRef) {
             return service.completeClaudeEnrollment(enrollmentId, code, ownerScopeRef);
@@ -58,6 +63,9 @@ export function createLlmMeshFacade(options) {
         async importSeatBundle(input) {
             return service.importSeatBundle(input);
         },
+        async exportSeatBundle(input) {
+            return service.exportSeatBundle(input);
+        },
         async cancel(enrollmentId) {
             return service.cancel(enrollmentId);
         },
@@ -73,6 +81,15 @@ export function createLlmMeshFacade(options) {
         async release(acquisition) {
             return service.release(acquisition);
         },
+        async runCustodianRefreshCycle() {
+            return service.runCustodianRefreshCycle();
+        },
+        startCustodianLoop(intervalMs, onReport, onError) {
+            return service.startCustodianLoop(intervalMs, onReport, onError);
+        },
+        stopCustodianLoop() {
+            service.stopCustodianLoop();
+        },
         getAdapter(providerId) {
             if (providerId === 'cloud-code') {
                 return new CloudCodeProviderAdapter();

package/dist/service/facade.js.map

@@ -1 +1 @@
-{"version":3,"file":"facade.js","sourceRoot":"","sources":["../../src/service/facade.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEpF,OAAO,EACL,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAuI7B,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,GAAG,CAA6B;QACpD;YACE,YAAY;YACZ,IAAI,2BAA2B,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;SAC5E;QACD,CAAC,OAAO,EAAE,IAAI,uBAAuB,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAClF,CAAC,aAAa,EAAE,IAAI,4BAA4B,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACtC,CAAC,WAAW,EAAE,IAAI,0BAA0B,EAAE,CAAC;QAC/C,CAAC,cAAc,EAAE,IAAI,6BAA6B,EAAE,CAAC;KACtD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,4BAA4B,CAC9C,OAAO,EACP,SAAS,EACT,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,0BAA0B,CACnC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa;YAC9D,OAAO,OAAO,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,8BAA8B,CAAC,cAAc,EAAE,aAAa;YAChE,OAAO,OAAO,CAAC,8BAA8B,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK;YAC5B,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,YAAY;YAChC,OAAO,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,YAAY;YAClC,OAAO,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa;YACxD,OAAO,OAAO,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,aAAa;YAClD,OAAO,OAAO,CAAC,wBAAwB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW;YACrE,OAAO,OAAO,CAAC,wBAAwB,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,KAAK;YAC1B,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,YAAY;YACvB,OAAO,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK;YAClC,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,WAAW;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QACD,UAAU,CAAC,UAAU;YACnB,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAChC,OAAO,IAAI,wBAAwB,EAAE,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,wBAAwB,CAAC,CAAC;QACrE,CAAC;QACD,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,EAAE;YAC3C,OAAO,IAAI,oBAAoB,CAAC;gBAC9B,GAAG,YAAY;gBACf,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"facade.js","sourceRoot":"","sources":["../../src/service/facade.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEpF,OAAO,EACL,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AA6L7B,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,GAAG,CAA6B;QACpD;YACE,YAAY;YACZ,IAAI,2BAA2B,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;SAC5E;QACD,CAAC,OAAO,EAAE,IAAI,uBAAuB,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAClF,CAAC,aAAa,EAAE,IAAI,4BAA4B,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACtC,CAAC,WAAW,EAAE,IAAI,0BAA0B,EAAE,CAAC;QAC/C,CAAC,cAAc,EAAE,IAAI,6BAA6B,EAAE,CAAC;KACtD,CAAC,CAAC;IAEH,MAAM,cAAc,GAAwC;QAC1D,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,4BAA4B,CAC9C,OAAO,EACP,SAAS,EACT,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,0BAA0B,EAClC,cAAc,CACf,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa;YAC9D,OAAO,OAAO,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,8BAA8B,CAAC,cAAc,EAAE,aAAa;YAChE,OAAO,OAAO,CAAC,8BAA8B,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK;YAC5B,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,YAAY;YAChC,OAAO,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,YAAY;YAClC,OAAO,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa;YACxD,OAAO,OAAO,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,aAAa;YAClD,OAAO,OAAO,CAAC,wBAAwB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW;YACrE,OAAO,OAAO,CAAC,wBAAwB,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,KAAK;YAC1B,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,KAAK;YAC1B,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,YAAY;YACvB,OAAO,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK;YAClC,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,WAAW;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,wBAAwB;YAC5B,OAAO,OAAO,CAAC,wBAAwB,EAAE,CAAC;QAC5C,CAAC;QACD,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO;YAC9C,OAAO,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC;QACD,iBAAiB;YACf,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,CAAC;QACD,UAAU,CAAC,UAAU;YACnB,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAChC,OAAO,IAAI,wBAAwB,EAAE,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,wBAAwB,CAAC,CAAC;QACrE,CAAC;QACD,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,EAAE;YAC3C,OAAO,IAAI,oBAAoB,CAAC;gBAC9B,GAAG,YAAY;gBACf,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/service/local-account-transport-service.d.ts

@@ -1,8 +1,47 @@
-import { type AccountTransportAccount, type AccountTransportAcquireInput, type AccountTransportAcquisition } from '../account-transports.js';
+import { AccountTransportAcquireError, type AccountTransportAccount, type AccountTransportAcquireInput, type AccountTransportAcquisition } from '../account-transports.js';
 import type { AccountPublic, EnrollmentCompletion, EnrollmentProvider, EnrollmentSession, StartEnrollmentInput } from '../enrollment/contracts.js';
 import type { ConfigResolver, KeyringAdapter } from './facade.js';
 import type { LlmMesh } from '../mesh.js';
+import { type SeatBundleV1 } from '../enrollment/seat-bundle.js';
+import { type SeatOnboardingV1 } from '../enrollment/seat-onboarding.js';
 import type { AccountDirectoryPort } from '../routing-contracts.js';
+import { type CustodianRefreshPolicy, type CustodianRefreshReport } from './custodian-refresh.js';
+import type { ReauthAlertSink } from './reauth-alert.js';
+export interface LocalAccountTransportServiceOptions {
+    /** Injected clock (ms); defaults to Date.now. Tests pin it. */
+    now?: () => number;
+    /** Reauth alert sink (D4); never called with secrets. Defaults to no-op. */
+    reauthAlert?: ReauthAlertSink;
+    /** Proactive refresh skew policy; defaults to 25 % TTL / 10 min floor. */
+    refreshPolicy?: CustodianRefreshPolicy;
+}
+export type SeatExportUnavailableReason = 'not-a-seat' | 'record-missing' | 'lineage-mismatch' | 'owner-mismatch' | 'record-invalid';
+/**
+ * A refresh failure that must NOT flip the account: the grant was provably
+ * not consumed (an explicit 429/5xx token-endpoint response, or a typed local
+ * preparation failure before any provider request), so a retry is safe.
+ * Extends {@link AccountTransportAcquireError} so `acquire()` callers keep
+ * their handling unchanged.
+ */
+export declare class RefreshDeferredError extends AccountTransportAcquireError {
+    constructor();
+}
+/** Typed refusal for exportSeatBundle; the code is `seat-export-unavailable:<reason>`. */
+export declare class SeatExportUnavailableError extends Error {
+    readonly code: string;
+    constructor(reason: SeatExportUnavailableReason, detail: string);
+}
+/** Versioned seat record persisted beside the envelope/public pair (design §6 item 1). */
+export interface StoredSeatRecord {
+    version: 1;
+    bundle: SeatBundleV1;
+    onboarding: SeatOnboardingV1 | null;
+    storedAt: string;
+}
+export interface SeatExport {
+    bundle: SeatBundleV1;
+    onboarding: SeatOnboardingV1 | null;
+}
 export declare class LocalAccountTransportService {
     private readonly keyring;
     private readonly providers;
@@ -18,11 +57,26 @@ export declare class LocalAccountTransportService {
     private readonly claimedOwnerScopes;
     /** enrollmentId → providerId, so poll completion reaches the owning provider. */
     private readonly enrollmentProviders;
+    /**
+     * Last credential issuance per account (enrollment, restore, or refresh).
+     * The proactive window is derived from this issuance age, never from the
+     * enrollment age: a refreshed credential restarts its own TTL.
+     */
+    private readonly credentialIssuedAtMs;
     private readonly pendingClaudeAccounts;
     private claudePersistenceTail;
     private readonly claudeSessions;
     private routeAttemptSequence;
-    constructor(keyring: KeyringAdapter, providers: Map<string, EnrollmentProvider>, configResolver: ConfigResolver, legacyAccountOwnerScopeRef?: string | undefined);
+    /** Account ids already alerted for their current reauth_required epoch. */
+    private readonly alertedReauth;
+    /** Account ids already warned about an upcoming no-grant expiry (once per enrollment). */
+    private readonly warnedExpiringNoGrant;
+    private custodianTimer;
+    private custodianTickInFlight;
+    private custodianLoopGeneration;
+    private readonly serviceOptions;
+    constructor(keyring: KeyringAdapter, providers: Map<string, EnrollmentProvider>, configResolver: ConfigResolver, legacyAccountOwnerScopeRef?: string | undefined, options?: LocalAccountTransportServiceOptions);
+    private nowMs;
     enroll(providerId: string, input: StartEnrollmentInput): Promise<EnrollmentSession>;
     completeClaudeEnrollment(enrollmentId: string, code: string, ownerScopeRef: string): Promise<EnrollmentCompletion>;
     completeClaudeCredentialImport(credentialJson: string, ownerScopeRef: string): Promise<EnrollmentCompletion>;
@@ -43,12 +97,32 @@ export declare class LocalAccountTransportService {
     importSeatBundle(input: {
         bundle: unknown;
         ownerScope: string;
+        onboarding?: unknown;
     }): Promise<{
         accountId: string;
         seatRef: string;
         generation: number;
         idempotent: boolean;
     }>;
+    /**
+     * L5 facade export beside importSeatBundle. Trusted in-process use only.
+     * Refuses with a typed `seat-export-unavailable:<reason>` unless the
+     * account carries the external seat marker and a seat record whose
+     * lineage equals the current marker tuple. On success the stored bundle
+     * and block are re-validated (consumer authority, refresh-material scan,
+     * block binding) and returned verbatim from the record — no synthesized
+     * field, no refresh material, no native files, ever.
+     */
+    exportSeatBundle(input: {
+        accountId: string;
+        ownerScope: string;
+    }): Promise<SeatExport>;
+    /** §3.4 binding of an onboarding block against its bundle; null when bound. */
+    private onboardingBindingError;
+    private seatRecordKey;
+    private writeSeatRecord;
+    private readSeatRecord;
+    private backfillSeatRecordIfMissing;
     private hasClaudeGrant;
     private persistClaudeCompletion;
     cancel(enrollmentId: string): Promise<void>;
@@ -96,5 +170,56 @@ export declare class LocalAccountTransportService {
     private readPublicRecord;
     private restorePersistedAccounts;
     private markReauthRequired;
+    /** Secret-free custody event for an account (diagnostic ref only). */
+    private buildCustodyAlertEvent;
+    /**
+     * Emit the D4 reauth alert once per reauth_required epoch. The event is
+     * secret-free (diagnostic account ref only); a throwing sink never breaks
+     * the custodian. A fresh `active` status clears the epoch.
+     */
+    private emitReauthAlert;
+    /**
+     * Warn once per enrollment that a grant-less credential is about to
+     * expire. Re-enrollment is the only rotation path, so the warning opens
+     * the plannable window the expiry flip alone cannot give. It uses its own
+     * epoch: the later `expired-no-grant` flip must still alert.
+     */
+    private emitExpiringNoGrantWarning;
+    /**
+     * Proactive custodian cycle (Lot 1): refresh every mesh-managed account
+     * inside its skew window before expiry, flip `reauth_required` early on
+     * definitive refresh failure and alert (D4). Only provably unconsumed
+     * failures defer without flipping: explicit 429/5xx token-endpoint
+     * responses and typed local preparation failures. Timeouts, resets,
+     * mint/persistence failures after a possible rotation, and unknown shapes
+     * flip fail-closed: the grant may already be consumed.
+     *
+     * Externally custodied seats never refresh here and are skipped; an
+     * unknown or elapsed expiry reads reauth-required (it awaits the next
+     * import) without flipping a status the custodian never owns. A
+     * CLI-imported Muse credential carries no refresh grant yet IS renewable
+     * (the mesh re-reads the CLI store), so it follows the grant path. Static
+     * keys with no refresh grant (Vibe long-lived keys, Muse direct keys)
+     * are skipped: their rotation path is re-enrollment, not refresh. They
+     * warn once inside the refresh window (`expiring-no-grant`, with the
+     * upcoming expiry in the report) and flip on expiry.
+     */
+    runCustodianRefreshCycle(): Promise<CustodianRefreshReport>;
+    /**
+     * Start the custodian loop: an immediate cycle, then one every `intervalMs`
+     * with a small random stagger (two replicas started together must not fire
+     * in lockstep on single-use refresh grants). Ticks never overlap; the timer
+     * is unref'd so it cannot hold the process open.
+     *
+     * The host MUST run exactly one loop per owner scope: this library holds no
+     * distributed lock, so two live loops would race on rotating grants
+     * (multi-replica custody belongs to the Lot 2 host). Cycle and
+     * report-listener failures surface through `onError`; without it a dead
+     * keyring would tick silently.
+     *
+     * Returns a stop function; `stopCustodianLoop()` stops it as well.
+     */
+    startCustodianLoop(intervalMs: number, onReport?: (report: CustodianRefreshReport) => void, onError?: (error: unknown) => void): () => void;
+    stopCustodianLoop(): void;
 }
 //# sourceMappingURL=local-account-transport-service.d.ts.map

package/dist/service/local-account-transport-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-account-transport-service.d.ts","sourceRoot":"","sources":["../../src/service/local-account-transport-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACV,aAAa,EAGb,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EAGjB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAgB1C,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AA+DjC,qBAAa,4BAA4B;IAiBrC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAnB9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8C;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkD;IAClF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IACjE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA6B;IACvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IACjE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,qBAAqB,CAAoC;IACjE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8C;IAC7E,OAAO,CAAC,oBAAoB,CAAK;gBAGd,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC1C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,CAAC,oBAAQ;IAMhD,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmBnF,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAC/D,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyBjD,8BAA8B,CAAC,cAAc,EAAE,MAAM,EACzD,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAcjD,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiEpE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA6DtE,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAyD1B,wBAAwB,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IA8D1B,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,WAAW,SAAK,GACf,OAAO,CAAC,oBAAoB,CAAC;IAoEhC;;;;;;;;OAQG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;YA0G9E,cAAc;YAoBd,uBAAuB;IAsD/B,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW3C,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC;IA0BnE,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAqChD,eAAe,CACb,OAAO,EAAE,uBAAuB,EAChC,aAAa,SAAW,EACxB,iBAAiB,CAAC,EAAE,MAAM,GACzB,IAAI;IAYD,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA2ElF,OAAO,CAAC,WAAW,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC,GAAG,oBAAoB;YAsB3E,oBAAoB;IAoDlC,OAAO,CAAC,mBAAmB;IAM3B;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;YAOR,iBAAiB;IAgC/B,OAAO,CAAC,YAAY;IAgDpB,OAAO,CAAC,oBAAoB;YAOd,kBAAkB;YAIlB,YAAY;YAuFZ,iBAAiB;YA6CjB,iBAAiB;YAajB,mBAAmB;IA8BjC,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,aAAa;YAIP,cAAc;YAiBd,iBAAiB;YAgBjB,uBAAuB;YAgBvB,oBAAoB;YAkBpB,gBAAgB;YAMhB,qBAAqB;YAOrB,6BAA6B;YAK7B,2BAA2B;IAqBzC,OAAO,CAAC,oBAAoB;YAMd,yBAAyB;YAYzB,gBAAgB;YAmBhB,wBAAwB;YAwExB,kBAAkB;CAOjC"}
+{"version":3,"file":"local-account-transport-service.d.ts","sourceRoot":"","sources":["../../src/service/local-account-transport-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAE5B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACV,aAAa,EAGb,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EAGjB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAS1C,OAAO,EAGL,KAAK,YAAY,EAElB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAuC,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9F,MAAM,WAAW,mCAAmC;IAClD,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,sBAAsB,CAAC;CACxC;AAyBD,MAAM,MAAM,2BAA2B,GACnC,YAAY,GACZ,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,4BAA4B;;CAIrE;AA0BD,0FAA0F;AAC1F,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM;CAKhE;AAED,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAwCD,qBAAa,4BAA4B;IA+BrC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAjC9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8C;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkD;IAClF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IACjE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA6B;IACvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IACjE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,qBAAqB,CAAoC;IACjE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8C;IAC7E,OAAO,CAAC,oBAAoB,CAAK;IACjC,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,uBAAuB,CAAK;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsC;gBAGlD,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC1C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,CAAC,oBAAQ,EACpD,OAAO,CAAC,EAAE,mCAAmC;IAM/C,OAAO,CAAC,KAAK;IAKP,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmBnF,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAC/D,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyBjD,8BAA8B,CAAC,cAAc,EAAE,MAAM,EACzD,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAcjD,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiEpE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA6DtE,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAyD1B,wBAAwB,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IA8D1B,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,WAAW,SAAK,GACf,OAAO,CAAC,oBAAoB,CAAC;IAoEhC;;;;;;;;OAQG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IA+H5F;;;;;;;;OAQG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,CAAC;IAwEvB,+EAA+E;IAC/E,OAAO,CAAC,sBAAsB;IAuB9B,OAAO,CAAC,aAAa;YAIP,eAAe;YAcf,cAAc;YAoBd,2BAA2B;YAS3B,cAAc;YAoBd,uBAAuB;IAuD/B,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW3C,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC;IA0BnE,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAuChD,eAAe,CACb,OAAO,EAAE,uBAAuB,EAChC,aAAa,SAAW,EACxB,iBAAiB,CAAC,EAAE,MAAM,GACzB,IAAI;IAsBD,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA2ElF,OAAO,CAAC,WAAW,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC,GAAG,oBAAoB;YAsB3E,oBAAoB;IAoDlC,OAAO,CAAC,mBAAmB;IAM3B;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;YAOR,iBAAiB;IAgC/B,OAAO,CAAC,YAAY;IAgDpB,OAAO,CAAC,oBAAoB;YAOd,kBAAkB;YAIlB,YAAY;YAiGZ,iBAAiB;YA6CjB,iBAAiB;YAajB,mBAAmB;IA8BjC,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,aAAa;YAIP,cAAc;YAiBd,iBAAiB;YAgBjB,uBAAuB;YAgBvB,oBAAoB;YAkBpB,gBAAgB;YAMhB,qBAAqB;YAOrB,6BAA6B;YAK7B,2BAA2B;IAqBzC,OAAO,CAAC,oBAAoB;YAMd,yBAAyB;YAazB,gBAAgB;YAmBhB,wBAAwB;YAkFxB,kBAAkB;IAkBhC,sEAAsE;IACtE,OAAO,CAAC,sBAAsB;IAuB9B;;;;OAIG;YACW,eAAe;IAiB7B;;;;;OAKG;YACW,0BAA0B;IAexC;;;;;;;;;;;;;;;;;;OAkBG;IACG,wBAAwB,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAkIjE;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,EACnD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,MAAM,IAAI;IA4Cb,iBAAiB,IAAI,IAAI;CAO1B"}