@sentropic/llm-mesh 0.33.0 → 0.34.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/enrollment/muse-code.d.ts +9 -0
- package/dist/enrollment/muse-code.d.ts.map +1 -1
- package/dist/enrollment/muse-code.js +22 -1
- package/dist/enrollment/muse-code.js.map +1 -1
- package/dist/service/custodian-refresh.d.ts +52 -0
- package/dist/service/custodian-refresh.d.ts.map +1 -0
- package/dist/service/custodian-refresh.js +51 -0
- package/dist/service/custodian-refresh.js.map +1 -0
- package/dist/service/facade.d.ts +18 -0
- package/dist/service/facade.d.ts.map +1 -1
- package/dist/service/facade.js +15 -1
- package/dist/service/facade.js.map +1 -1
- package/dist/service/local-account-transport-service.d.ts +88 -2
- package/dist/service/local-account-transport-service.d.ts.map +1 -1
- package/dist/service/local-account-transport-service.js +382 -10
- package/dist/service/local-account-transport-service.js.map +1 -1
- package/dist/service/reauth-alert.d.ts +29 -0
- package/dist/service/reauth-alert.d.ts.map +1 -0
- package/dist/service/reauth-alert.js +2 -0
- package/dist/service/reauth-alert.js.map +1 -0
- package/package.json +1 -1
|
@@ -7,6 +7,15 @@ export declare const MUSE_VERIFICATION_URL = "https://accountscenter.meta.com/mu
|
|
|
7
7
|
export declare const MUSE_KEY_MINT_URL = "https://api.meta.ai/muse-code/key";
|
|
8
8
|
export declare const MUSE_KEY_MINT_API_VERSION = "1.0.0";
|
|
9
9
|
export declare const MUSE_NATIVE_CONFIG_VERSION = "muse-device-flow-v1";
|
|
10
|
+
/**
|
|
11
|
+
* A refresh failure that must NOT defer: the token endpoint already answered
|
|
12
|
+
* (a new grant may have been issued and the old one consumed) and only the
|
|
13
|
+
* post-rotation key mint failed. Replaying the old grant is unsafe, so the
|
|
14
|
+
* custodian treats this as fail-closed toward `reauth_required`.
|
|
15
|
+
*/
|
|
16
|
+
export declare class MusePostRotationError extends Error {
|
|
17
|
+
constructor(message: string);
|
|
18
|
+
}
|
|
10
19
|
export interface MuseCodeEnrollmentOptions {
|
|
11
20
|
clientId?: string;
|
|
12
21
|
fetchFn?: typeof fetch;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"muse-code.d.ts","sourceRoot":"","sources":["../../src/enrollment/muse-code.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EAEjB,kBAAkB,EAClB,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AACxD,eAAO,MAAM,6BAA6B,qDAAmD,CAAC;AAC9F,eAAO,MAAM,qBAAqB,6CAA2C,CAAC;AAC9E,eAAO,MAAM,cAAc,qBAAqB,CAAC;AACjD,eAAO,MAAM,qBAAqB,+CAA+C,CAAC;AAClF,eAAO,MAAM,iBAAiB,sCAAsC,CAAC;AACrE,eAAO,MAAM,yBAAyB,UAAU,CAAC;AACjD,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAEhE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAWD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAwB3B;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAK;gBAET,OAAO,GAAE,yBAA8B;IAK7C,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAiEtD,SAAS;YAoCT,UAAU;IAIxB,OAAO,CAAC,eAAe;IAoBjB,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,WAAW,SAAK,GACf,OAAO,CAAC,mBAAmB,CAAC;IAkCzB,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IASrE,OAAO,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAO1E,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"muse-code.d.ts","sourceRoot":"","sources":["../../src/enrollment/muse-code.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EAEjB,kBAAkB,EAClB,YAAY,EACZ,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AAExB,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AACxD,eAAO,MAAM,6BAA6B,qDAAmD,CAAC;AAC9F,eAAO,MAAM,qBAAqB,6CAA2C,CAAC;AAC9E,eAAO,MAAM,cAAc,qBAAqB,CAAC;AACjD,eAAO,MAAM,qBAAqB,+CAA+C,CAAC;AAClF,eAAO,MAAM,iBAAiB,sCAAsC,CAAC;AACrE,eAAO,MAAM,yBAAyB,UAAU,CAAC;AACjD,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAEhE;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAWD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAwB3B;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAK;gBAET,OAAO,GAAE,yBAA8B;IAK7C,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAiEtD,SAAS;YAoCT,UAAU;IAIxB,OAAO,CAAC,eAAe;IAoBjB,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,WAAW,SAAK,GACf,OAAO,CAAC,mBAAmB,CAAC;IAkCzB,QAAQ,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IASrE,OAAO,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAO1E,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+CzD,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlD"}
|
|
@@ -24,6 +24,18 @@ export const MUSE_VERIFICATION_URL = 'https://accountscenter.meta.com/muse_code/
|
|
|
24
24
|
export const MUSE_KEY_MINT_URL = 'https://api.meta.ai/muse-code/key';
|
|
25
25
|
export const MUSE_KEY_MINT_API_VERSION = '1.0.0';
|
|
26
26
|
export const MUSE_NATIVE_CONFIG_VERSION = 'muse-device-flow-v1';
|
|
27
|
+
/**
|
|
28
|
+
* A refresh failure that must NOT defer: the token endpoint already answered
|
|
29
|
+
* (a new grant may have been issued and the old one consumed) and only the
|
|
30
|
+
* post-rotation key mint failed. Replaying the old grant is unsafe, so the
|
|
31
|
+
* custodian treats this as fail-closed toward `reauth_required`.
|
|
32
|
+
*/
|
|
33
|
+
export class MusePostRotationError extends Error {
|
|
34
|
+
constructor(message) {
|
|
35
|
+
super(message);
|
|
36
|
+
this.name = 'MusePostRotationError';
|
|
37
|
+
}
|
|
38
|
+
}
|
|
27
39
|
const textOf = (value) => typeof value === 'string' && value.trim().length > 0 ? value.trim() : null;
|
|
28
40
|
/**
|
|
29
41
|
* Shared Meta key-mint wire (POST /muse-code/key, JSON { dca_token } +
|
|
@@ -235,7 +247,16 @@ export class MuseCodeEnrollmentProvider {
|
|
|
235
247
|
if (!accessToken) {
|
|
236
248
|
throw new Error('Muse token refresh returned no access token');
|
|
237
249
|
}
|
|
238
|
-
|
|
250
|
+
// The token endpoint already answered: a mint failure from here on is
|
|
251
|
+
// post-rotation, so it carries a typed signal instead of a plain status
|
|
252
|
+
// string (a `(503)` inside would otherwise look like a safe retry).
|
|
253
|
+
let minted;
|
|
254
|
+
try {
|
|
255
|
+
minted = await this.mintApiKey(accessToken);
|
|
256
|
+
}
|
|
257
|
+
catch (error) {
|
|
258
|
+
throw new MusePostRotationError(error instanceof Error ? error.message : String(error));
|
|
259
|
+
}
|
|
239
260
|
const credential = this.buildCredential({
|
|
240
261
|
apiKey: minted.apiKey,
|
|
241
262
|
email: minted.email,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"muse-code.js","sourceRoot":"","sources":["../../src/enrollment/muse-code.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,0DAA0D;AAC1D,kEAAkE;AAClE,sEAAsE;AACtE,8DAA8D;AAC9D,6EAA6E;AAC7E,gFAAgF;AAChF,oEAAoE;AACpE,+DAA+D;AAC/D,0EAA0E;AAC1E,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAa9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACxD,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,gBAAgB,6BAA6B,CAAC;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,qBAAqB,CAAC;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,4CAA4C,CAAC;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,OAAO,CAAC;AACjD,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"muse-code.js","sourceRoot":"","sources":["../../src/enrollment/muse-code.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,0DAA0D;AAC1D,kEAAkE;AAClE,sEAAsE;AACtE,8DAA8D;AAC9D,6EAA6E;AAC7E,gFAAgF;AAChF,oEAAoE;AACpE,+DAA+D;AAC/D,0EAA0E;AAC1E,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAa9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACxD,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,gBAAgB,6BAA6B,CAAC;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,gBAAgB,qBAAqB,CAAC;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,4CAA4C,CAAC;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,OAAO,CAAC;AACjD,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAaD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE,CAC/C,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAO7E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,UAAwB,KAAK;IAE7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,eAAe,EAAE,yBAAyB;YAC1C,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGrC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,OAAO,0BAA0B;IACpB,QAAQ,CAAS;IACjB,OAAO,CAAe;IACtB,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IACrD,QAAQ,GAAG,CAAC,CAAC;IAErB,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA2B;QACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnB,MAAM,YAAY,GAAG,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7F,8DAA8D;QAC9D,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;SACnE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAOrC,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,eAAe,GACnB,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC;eACtC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;eAChC,qBAAqB,CAAC;QAC3B,MAAM,cAAc,GAClB,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC;YAC1D,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI;YACzB,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC;YAC9D,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE;YAC9B,KAAK,EAAE;gBACL,YAAY;gBACZ,UAAU,EAAE,MAAM;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,EAAE;gBAChB,SAAS,EAAE,EAAE;gBACb,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,0BAA0B;gBACzC,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;aACpE;YACD,UAAU;YACV,cAAc;SACf,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,YAAY;YACZ,eAAe;YACf,QAAQ;YACR,cAAc;YACd,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACpE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,UAAkB;QAKxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAClD,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC;YACD,IAAI,KAAK,KAAK,uBAAuB;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACpE,IAAI,KAAK,KAAK,WAAW;gBAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAC1D,IAAI,KAAK,KAAK,eAAe;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAClE,IAAI,KAAK,KAAK,eAAe;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIrC,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,WAAmB;QAC1C,OAAO,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAEO,eAAe,CAAC,KAKvB;QACC,qEAAqE;QACrE,oDAAoD;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QAC7C,MAAM,SAAS,GAAG,aAAa,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAClG,OAAO;YACL,SAAS;YACT,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACnF,uBAAuB,EAAE,0BAA0B;YACnD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,YAAoB,EACpB,WAAW,GAAG,EAAE;QAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,YAAY,YAAY,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC;YAC7C,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW;YACX,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW;SAC7C,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;QAC9D,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY;YACZ,YAAY;SACb,CAAC,CAAC;QACH,sEAAsE;QACtE,8DAA8D;QAC9D,OAAO;YACL,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK,EAAE,SAAS,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,SAAS,GAAG;YACvD,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YAClC,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA8B;QAC3C,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,YAAY,+BAA+B,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,GAAG,CAAC,UAAU,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAA8B;QAC1C,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIrC,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,sEAAsE;QACtE,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,MAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,SAAS;YACxD,YAAY,EAAE,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;SACjF,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;CACF"}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Proactive custodian refresh policy (Lot 1).
|
|
3
|
+
*
|
|
4
|
+
* The custodian used to refresh only reactively, when an access token was
|
|
5
|
+
* already expired at acquire time. This module decides when a mesh-managed
|
|
6
|
+
* account must be renewed *before* expiry: inside a skew window computed
|
|
7
|
+
* from the credential TTL (25 % of TTL remaining by default, at least
|
|
8
|
+
* 10 minutes). A refresh failure flips the account to `reauth_required`
|
|
9
|
+
* early, so the route diagnostics carry the reauth signal without waiting
|
|
10
|
+
* for a business call to fail.
|
|
11
|
+
*
|
|
12
|
+
* Pure functions only: the service owns clocks, providers and persistence.
|
|
13
|
+
*/
|
|
14
|
+
export interface CustodianRefreshPolicy {
|
|
15
|
+
/** Fraction of TTL remaining that opens the refresh window (0.25). */
|
|
16
|
+
skewRatio: number;
|
|
17
|
+
/** Floor for the refresh window in ms (600_000 = 10 min). */
|
|
18
|
+
minSkewMs: number;
|
|
19
|
+
}
|
|
20
|
+
export declare const DEFAULT_CUSTODIAN_REFRESH_POLICY: CustodianRefreshPolicy;
|
|
21
|
+
/** Clamp a host-supplied policy to safe bounds; invalid fields fall back. */
|
|
22
|
+
export declare function sanitizeCustodianRefreshPolicy(policy?: CustodianRefreshPolicy): CustodianRefreshPolicy;
|
|
23
|
+
export interface RefreshWindowInput {
|
|
24
|
+
expiresAtMs: number;
|
|
25
|
+
/** Credential issuance instant; NaN/undefined falls back to the floor window. */
|
|
26
|
+
issuedAtMs?: number;
|
|
27
|
+
nowMs: number;
|
|
28
|
+
}
|
|
29
|
+
/** Width of the proactive refresh window for a credential TTL. */
|
|
30
|
+
export declare function refreshSkewMs(ttlMs: number, policy?: CustodianRefreshPolicy): number;
|
|
31
|
+
/** True when the credential must be renewed now, before it expires. */
|
|
32
|
+
export declare function shouldRefreshProactively(input: RefreshWindowInput, policy?: CustodianRefreshPolicy): boolean;
|
|
33
|
+
export type CustodianAccountAction = 'refreshed' | 'refresh-failed-reauth' | 'refresh-deferred-retry' | 'refresh-in-flight' | 'expired-no-grant' | 'skipped-healthy' | 'skipped-external' | 'skipped-no-grant' | 'skipped-no-expiry' | 'already-reauth';
|
|
34
|
+
export interface CustodianAccountReport {
|
|
35
|
+
/** Diagnostic hash of the account id; never the raw id, never a secret. */
|
|
36
|
+
accountRef: string;
|
|
37
|
+
transportProviderId: string;
|
|
38
|
+
ownerScopeRef: string;
|
|
39
|
+
action: CustodianAccountAction;
|
|
40
|
+
readiness: 'ready' | 'reauth-required';
|
|
41
|
+
expiredAt?: string;
|
|
42
|
+
/** Upcoming expiry (future): the plannable rotation window for grant-less credentials. */
|
|
43
|
+
expiresAt?: string;
|
|
44
|
+
}
|
|
45
|
+
export interface CustodianRefreshReport {
|
|
46
|
+
at: string;
|
|
47
|
+
checked: number;
|
|
48
|
+
refreshed: number;
|
|
49
|
+
reauthRequired: number;
|
|
50
|
+
accounts: CustodianAccountReport[];
|
|
51
|
+
}
|
|
52
|
+
//# sourceMappingURL=custodian-refresh.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"custodian-refresh.d.ts","sourceRoot":"","sources":["../../src/service/custodian-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,gCAAgC,EAAE,sBAG9C,CAAC;AAEF,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAC5C,MAAM,CAAC,EAAE,sBAAsB,GAC9B,sBAAsB,CAYxB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,sBAAyD,GAChE,MAAM,CAGR;AAED,uEAAuE;AACvE,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,kBAAkB,EACzB,MAAM,GAAE,sBAAyD,GAChE,OAAO,CAST;AAED,MAAM,MAAM,sBAAsB,GAC9B,WAAW,GACX,uBAAuB,GACvB,wBAAwB,GACxB,mBAAmB,GACnB,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,MAAM,WAAW,sBAAsB;IACrC,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC"}
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Proactive custodian refresh policy (Lot 1).
|
|
3
|
+
*
|
|
4
|
+
* The custodian used to refresh only reactively, when an access token was
|
|
5
|
+
* already expired at acquire time. This module decides when a mesh-managed
|
|
6
|
+
* account must be renewed *before* expiry: inside a skew window computed
|
|
7
|
+
* from the credential TTL (25 % of TTL remaining by default, at least
|
|
8
|
+
* 10 minutes). A refresh failure flips the account to `reauth_required`
|
|
9
|
+
* early, so the route diagnostics carry the reauth signal without waiting
|
|
10
|
+
* for a business call to fail.
|
|
11
|
+
*
|
|
12
|
+
* Pure functions only: the service owns clocks, providers and persistence.
|
|
13
|
+
*/
|
|
14
|
+
export const DEFAULT_CUSTODIAN_REFRESH_POLICY = {
|
|
15
|
+
skewRatio: 0.25,
|
|
16
|
+
minSkewMs: 600_000,
|
|
17
|
+
};
|
|
18
|
+
/** Clamp a host-supplied policy to safe bounds; invalid fields fall back. */
|
|
19
|
+
export function sanitizeCustodianRefreshPolicy(policy) {
|
|
20
|
+
const fallback = DEFAULT_CUSTODIAN_REFRESH_POLICY;
|
|
21
|
+
const skewRatio = policy?.skewRatio;
|
|
22
|
+
const minSkewMs = policy?.minSkewMs;
|
|
23
|
+
return {
|
|
24
|
+
skewRatio: Number.isFinite(skewRatio) && skewRatio > 0 && skewRatio <= 1
|
|
25
|
+
? skewRatio
|
|
26
|
+
: fallback.skewRatio,
|
|
27
|
+
minSkewMs: Number.isFinite(minSkewMs) && minSkewMs >= 0
|
|
28
|
+
? minSkewMs
|
|
29
|
+
: fallback.minSkewMs,
|
|
30
|
+
};
|
|
31
|
+
}
|
|
32
|
+
/** Width of the proactive refresh window for a credential TTL. */
|
|
33
|
+
export function refreshSkewMs(ttlMs, policy = DEFAULT_CUSTODIAN_REFRESH_POLICY) {
|
|
34
|
+
if (!Number.isFinite(ttlMs) || ttlMs <= 0)
|
|
35
|
+
return policy.minSkewMs;
|
|
36
|
+
return Math.min(ttlMs, Math.max(policy.minSkewMs, ttlMs * policy.skewRatio));
|
|
37
|
+
}
|
|
38
|
+
/** True when the credential must be renewed now, before it expires. */
|
|
39
|
+
export function shouldRefreshProactively(input, policy = DEFAULT_CUSTODIAN_REFRESH_POLICY) {
|
|
40
|
+
const { expiresAtMs, nowMs } = input;
|
|
41
|
+
if (!Number.isFinite(expiresAtMs))
|
|
42
|
+
return false;
|
|
43
|
+
if (expiresAtMs <= nowMs)
|
|
44
|
+
return true;
|
|
45
|
+
const issuedAtMs = input.issuedAtMs;
|
|
46
|
+
const ttlMs = issuedAtMs !== undefined && Number.isFinite(issuedAtMs)
|
|
47
|
+
? expiresAtMs - issuedAtMs
|
|
48
|
+
: Number.NaN;
|
|
49
|
+
return expiresAtMs - nowMs <= refreshSkewMs(ttlMs, policy);
|
|
50
|
+
}
|
|
51
|
+
//# sourceMappingURL=custodian-refresh.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"custodian-refresh.js","sourceRoot":"","sources":["../../src/service/custodian-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,CAAC,MAAM,gCAAgC,GAA2B;IACtE,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,OAAO;CACnB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B,CAC5C,MAA+B;IAE/B,MAAM,QAAQ,GAAG,gCAAgC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAK,SAAoB,GAAG,CAAC,IAAK,SAAoB,IAAI,CAAC;YAC9F,CAAC,CAAE,SAAoB;YACvB,CAAC,CAAC,QAAQ,CAAC,SAAS;QACtB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAK,SAAoB,IAAI,CAAC;YACjE,CAAC,CAAE,SAAoB;YACvB,CAAC,CAAC,QAAQ,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AASD,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,SAAiC,gCAAgC;IAEjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB,CACtC,KAAyB,EACzB,SAAiC,gCAAgC;IAEjE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,WAAW,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QACnE,CAAC,CAAC,WAAW,GAAG,UAAU;QAC1B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACf,OAAO,WAAW,GAAG,KAAK,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC"}
|
package/dist/service/facade.d.ts
CHANGED
|
@@ -6,6 +6,11 @@ import type { SeatOnboardingV1 } from '../enrollment/seat-onboarding.js';
|
|
|
6
6
|
import type { LlmMesh } from '../mesh.js';
|
|
7
7
|
import { type InMemoryRoutePlannerOptions } from '../route-planner.js';
|
|
8
8
|
import type { RoutePlanner } from '../routing-contracts.js';
|
|
9
|
+
import type { CustodianRefreshPolicy, CustodianRefreshReport } from './custodian-refresh.js';
|
|
10
|
+
import type { ReauthAlertSink } from './reauth-alert.js';
|
|
11
|
+
export type { CustodianAccountAction, CustodianAccountReport, CustodianRefreshPolicy, CustodianRefreshReport, } from './custodian-refresh.js';
|
|
12
|
+
export type { ReauthAlertEvent, ReauthAlertReason, ReauthAlertSink, } from './reauth-alert.js';
|
|
13
|
+
export type { LocalAccountTransportServiceOptions } from './local-account-transport-service.js';
|
|
9
14
|
export interface ProviderRequest {
|
|
10
15
|
modelId: string;
|
|
11
16
|
contents: unknown[];
|
|
@@ -59,12 +64,22 @@ export interface KeyringAdapter {
|
|
|
59
64
|
export interface ConfigResolver {
|
|
60
65
|
resolveConfig(configRef: string): Promise<Record<string, unknown>>;
|
|
61
66
|
}
|
|
67
|
+
export interface CustodianOptions {
|
|
68
|
+
/** Injected clock (ms); defaults to Date.now. Tests pin it. */
|
|
69
|
+
now?: () => number;
|
|
70
|
+
/** Reauth alert sink (D4: conductor h2a + owner re-auth); never receives secrets. */
|
|
71
|
+
reauthAlert?: ReauthAlertSink;
|
|
72
|
+
/** Proactive refresh skew policy; defaults to 25 % TTL / 10 min floor. */
|
|
73
|
+
refreshPolicy?: CustodianRefreshPolicy;
|
|
74
|
+
}
|
|
62
75
|
export interface FacadeOptions {
|
|
63
76
|
configResolver: ConfigResolver;
|
|
64
77
|
keyring?: KeyringAdapter;
|
|
65
78
|
mode: 'cli' | 'portal';
|
|
66
79
|
/** Explicit owner used only to bind pre-ownerScope local keyring records. */
|
|
67
80
|
legacyAccountOwnerScopeRef?: string;
|
|
81
|
+
/** Lot 1 custodian loop options (clock, reauth sink, skew policy). */
|
|
82
|
+
custodian?: CustodianOptions;
|
|
68
83
|
}
|
|
69
84
|
export interface AccountOwnerInput {
|
|
70
85
|
ownerScope: string;
|
|
@@ -76,6 +91,9 @@ export interface RemoveAccountResult {
|
|
|
76
91
|
export interface LlmMeshAccountAdministration {
|
|
77
92
|
listAccounts(input: AccountOwnerInput): Promise<readonly AccountPublic[]>;
|
|
78
93
|
removeAccount(accountId: string, input: AccountOwnerInput): Promise<RemoveAccountResult>;
|
|
94
|
+
runCustodianRefreshCycle(): Promise<CustodianRefreshReport>;
|
|
95
|
+
startCustodianLoop(intervalMs: number, onReport?: (report: CustodianRefreshReport) => void, onError?: (error: unknown) => void): () => void;
|
|
96
|
+
stopCustodianLoop(): void;
|
|
79
97
|
}
|
|
80
98
|
export interface LlmMeshFacade {
|
|
81
99
|
/** Trusted in-process inputs only; keep codes and credential JSON out of agent tools. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"facade.d.ts","sourceRoot":"","sources":["../../src/service/facade.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EAEpB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAWzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACiB,KAAK,2BAA2B,EACvD,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"facade.d.ts","sourceRoot":"","sources":["../../src/service/facade.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EAEpB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAWzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACiB,KAAK,2BAA2B,EACvD,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EACV,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,YAAY,EACV,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAEhG,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,SAAS;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EAAE,CAAC;CACL;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IACE,IAAI,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IACE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC5C,CAAC;AAEN,MAAM,WAAW,eAAe;IAC9B,OAAO,CACL,WAAW,EAAE,2BAA2B,EACxC,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,WAAW,GAClB,aAAa,CAAC,aAAa,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,iBAAiB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,qFAAqF;IACrF,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,cAAc,CAAC;IAC/B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAC;IACvB,6EAA6E;IAC7E,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sEAAsE;IACtE,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,IAAI,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC1E,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAShC,wBAAwB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5D,kBAAkB,CAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,EACnD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,MAAM,IAAI,CAAC;IACd,iBAAiB,IAAI,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,wBAAwB,CAAC,CACvB,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GACxD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,8BAA8B,CAAC,CAC7B,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAC5C,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC,MAAM,CACJ,UAAU,EAAE,0BAA0B,EACtC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEvE,kBAAkB,CAChB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAGjC,wBAAwB,CACtB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAGjC,wBAAwB,CACtB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAIjC,gBAAgB,CAAC,KAAK,EAAE;QACtB,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAI7F,gBAAgB,CAAC,KAAK,EAAE;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC3E,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5C,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACnF,OAAO,CAAC,WAAW,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGjE,UAAU,CAAC,UAAU,EAAE,0BAA0B,GAAG,eAAe,CAAC;IACpE,kBAAkB,CAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC,EAC7C,OAAO,CAAC,EAAE,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,GACvD,YAAY,CAAC;CACjB;AAED,MAAM,WAAW,2BACf,SAAQ,aAAa,EAAE,4BAA4B;CAAG;AAExD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,2BAA2B,CAyGvF"}
|
package/dist/service/facade.js
CHANGED
|
@@ -29,7 +29,12 @@ export function createLlmMeshFacade(options) {
|
|
|
29
29
|
['muse-code', new MuseCodeEnrollmentProvider()],
|
|
30
30
|
['mistral-vibe', new MistralVibeEnrollmentProvider()],
|
|
31
31
|
]);
|
|
32
|
-
const
|
|
32
|
+
const serviceOptions = {
|
|
33
|
+
...(options.custodian?.now ? { now: options.custodian.now } : {}),
|
|
34
|
+
...(options.custodian?.reauthAlert ? { reauthAlert: options.custodian.reauthAlert } : {}),
|
|
35
|
+
...(options.custodian?.refreshPolicy ? { refreshPolicy: options.custodian.refreshPolicy } : {}),
|
|
36
|
+
};
|
|
37
|
+
const service = new LocalAccountTransportService(keyring, providers, options.configResolver, options.legacyAccountOwnerScopeRef, serviceOptions);
|
|
33
38
|
return {
|
|
34
39
|
async completeClaudeEnrollment(enrollmentId, code, ownerScopeRef) {
|
|
35
40
|
return service.completeClaudeEnrollment(enrollmentId, code, ownerScopeRef);
|
|
@@ -76,6 +81,15 @@ export function createLlmMeshFacade(options) {
|
|
|
76
81
|
async release(acquisition) {
|
|
77
82
|
return service.release(acquisition);
|
|
78
83
|
},
|
|
84
|
+
async runCustodianRefreshCycle() {
|
|
85
|
+
return service.runCustodianRefreshCycle();
|
|
86
|
+
},
|
|
87
|
+
startCustodianLoop(intervalMs, onReport, onError) {
|
|
88
|
+
return service.startCustodianLoop(intervalMs, onReport, onError);
|
|
89
|
+
},
|
|
90
|
+
stopCustodianLoop() {
|
|
91
|
+
service.stopCustodianLoop();
|
|
92
|
+
},
|
|
79
93
|
getAdapter(providerId) {
|
|
80
94
|
if (providerId === 'cloud-code') {
|
|
81
95
|
return new CloudCodeProviderAdapter();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"facade.js","sourceRoot":"","sources":["../../src/service/facade.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEpF,OAAO,EACL,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"facade.js","sourceRoot":"","sources":["../../src/service/facade.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEpF,OAAO,EACL,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AA6L7B,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,GAAG,CAA6B;QACpD;YACE,YAAY;YACZ,IAAI,2BAA2B,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;SAC5E;QACD,CAAC,OAAO,EAAE,IAAI,uBAAuB,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAClF,CAAC,aAAa,EAAE,IAAI,4BAA4B,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACtC,CAAC,WAAW,EAAE,IAAI,0BAA0B,EAAE,CAAC;QAC/C,CAAC,cAAc,EAAE,IAAI,6BAA6B,EAAE,CAAC;KACtD,CAAC,CAAC;IAEH,MAAM,cAAc,GAAwC;QAC1D,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,4BAA4B,CAC9C,OAAO,EACP,SAAS,EACT,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,0BAA0B,EAClC,cAAc,CACf,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa;YAC9D,OAAO,OAAO,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,8BAA8B,CAAC,cAAc,EAAE,aAAa;YAChE,OAAO,OAAO,CAAC,8BAA8B,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK;YAC5B,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,YAAY;YAChC,OAAO,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,YAAY;YAClC,OAAO,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa;YACxD,OAAO,OAAO,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,aAAa;YAClD,OAAO,OAAO,CAAC,wBAAwB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW;YACrE,OAAO,OAAO,CAAC,wBAAwB,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,KAAK;YAC1B,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,KAAK;YAC1B,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,YAAY;YACvB,OAAO,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK;YAClC,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,WAAW;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,wBAAwB;YAC5B,OAAO,OAAO,CAAC,wBAAwB,EAAE,CAAC;QAC5C,CAAC;QACD,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO;YAC9C,OAAO,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC;QACD,iBAAiB;YACf,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,CAAC;QACD,UAAU,CAAC,UAAU;YACnB,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAChC,OAAO,IAAI,wBAAwB,EAAE,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,wBAAwB,CAAC,CAAC;QACrE,CAAC;QACD,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,EAAE;YAC3C,OAAO,IAAI,oBAAoB,CAAC;gBAC9B,GAAG,YAAY;gBACf,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,11 +1,31 @@
|
|
|
1
|
-
import { type AccountTransportAccount, type AccountTransportAcquireInput, type AccountTransportAcquisition } from '../account-transports.js';
|
|
1
|
+
import { AccountTransportAcquireError, type AccountTransportAccount, type AccountTransportAcquireInput, type AccountTransportAcquisition } from '../account-transports.js';
|
|
2
2
|
import type { AccountPublic, EnrollmentCompletion, EnrollmentProvider, EnrollmentSession, StartEnrollmentInput } from '../enrollment/contracts.js';
|
|
3
3
|
import type { ConfigResolver, KeyringAdapter } from './facade.js';
|
|
4
4
|
import type { LlmMesh } from '../mesh.js';
|
|
5
5
|
import { type SeatBundleV1 } from '../enrollment/seat-bundle.js';
|
|
6
6
|
import { type SeatOnboardingV1 } from '../enrollment/seat-onboarding.js';
|
|
7
7
|
import type { AccountDirectoryPort } from '../routing-contracts.js';
|
|
8
|
+
import { type CustodianRefreshPolicy, type CustodianRefreshReport } from './custodian-refresh.js';
|
|
9
|
+
import type { ReauthAlertSink } from './reauth-alert.js';
|
|
10
|
+
export interface LocalAccountTransportServiceOptions {
|
|
11
|
+
/** Injected clock (ms); defaults to Date.now. Tests pin it. */
|
|
12
|
+
now?: () => number;
|
|
13
|
+
/** Reauth alert sink (D4); never called with secrets. Defaults to no-op. */
|
|
14
|
+
reauthAlert?: ReauthAlertSink;
|
|
15
|
+
/** Proactive refresh skew policy; defaults to 25 % TTL / 10 min floor. */
|
|
16
|
+
refreshPolicy?: CustodianRefreshPolicy;
|
|
17
|
+
}
|
|
8
18
|
export type SeatExportUnavailableReason = 'not-a-seat' | 'record-missing' | 'lineage-mismatch' | 'owner-mismatch' | 'record-invalid';
|
|
19
|
+
/**
|
|
20
|
+
* A refresh failure that must NOT flip the account: the grant was provably
|
|
21
|
+
* not consumed (an explicit 429/5xx token-endpoint response, or a typed local
|
|
22
|
+
* preparation failure before any provider request), so a retry is safe.
|
|
23
|
+
* Extends {@link AccountTransportAcquireError} so `acquire()` callers keep
|
|
24
|
+
* their handling unchanged.
|
|
25
|
+
*/
|
|
26
|
+
export declare class RefreshDeferredError extends AccountTransportAcquireError {
|
|
27
|
+
constructor();
|
|
28
|
+
}
|
|
9
29
|
/** Typed refusal for exportSeatBundle; the code is `seat-export-unavailable:<reason>`. */
|
|
10
30
|
export declare class SeatExportUnavailableError extends Error {
|
|
11
31
|
readonly code: string;
|
|
@@ -37,11 +57,26 @@ export declare class LocalAccountTransportService {
|
|
|
37
57
|
private readonly claimedOwnerScopes;
|
|
38
58
|
/** enrollmentId → providerId, so poll completion reaches the owning provider. */
|
|
39
59
|
private readonly enrollmentProviders;
|
|
60
|
+
/**
|
|
61
|
+
* Last credential issuance per account (enrollment, restore, or refresh).
|
|
62
|
+
* The proactive window is derived from this issuance age, never from the
|
|
63
|
+
* enrollment age: a refreshed credential restarts its own TTL.
|
|
64
|
+
*/
|
|
65
|
+
private readonly credentialIssuedAtMs;
|
|
40
66
|
private readonly pendingClaudeAccounts;
|
|
41
67
|
private claudePersistenceTail;
|
|
42
68
|
private readonly claudeSessions;
|
|
43
69
|
private routeAttemptSequence;
|
|
44
|
-
|
|
70
|
+
/** Account ids already alerted for their current reauth_required epoch. */
|
|
71
|
+
private readonly alertedReauth;
|
|
72
|
+
/** Account ids already warned about an upcoming no-grant expiry (once per enrollment). */
|
|
73
|
+
private readonly warnedExpiringNoGrant;
|
|
74
|
+
private custodianTimer;
|
|
75
|
+
private custodianTickInFlight;
|
|
76
|
+
private custodianLoopGeneration;
|
|
77
|
+
private readonly serviceOptions;
|
|
78
|
+
constructor(keyring: KeyringAdapter, providers: Map<string, EnrollmentProvider>, configResolver: ConfigResolver, legacyAccountOwnerScopeRef?: string | undefined, options?: LocalAccountTransportServiceOptions);
|
|
79
|
+
private nowMs;
|
|
45
80
|
enroll(providerId: string, input: StartEnrollmentInput): Promise<EnrollmentSession>;
|
|
46
81
|
completeClaudeEnrollment(enrollmentId: string, code: string, ownerScopeRef: string): Promise<EnrollmentCompletion>;
|
|
47
82
|
completeClaudeCredentialImport(credentialJson: string, ownerScopeRef: string): Promise<EnrollmentCompletion>;
|
|
@@ -135,5 +170,56 @@ export declare class LocalAccountTransportService {
|
|
|
135
170
|
private readPublicRecord;
|
|
136
171
|
private restorePersistedAccounts;
|
|
137
172
|
private markReauthRequired;
|
|
173
|
+
/** Secret-free custody event for an account (diagnostic ref only). */
|
|
174
|
+
private buildCustodyAlertEvent;
|
|
175
|
+
/**
|
|
176
|
+
* Emit the D4 reauth alert once per reauth_required epoch. The event is
|
|
177
|
+
* secret-free (diagnostic account ref only); a throwing sink never breaks
|
|
178
|
+
* the custodian. A fresh `active` status clears the epoch.
|
|
179
|
+
*/
|
|
180
|
+
private emitReauthAlert;
|
|
181
|
+
/**
|
|
182
|
+
* Warn once per enrollment that a grant-less credential is about to
|
|
183
|
+
* expire. Re-enrollment is the only rotation path, so the warning opens
|
|
184
|
+
* the plannable window the expiry flip alone cannot give. It uses its own
|
|
185
|
+
* epoch: the later `expired-no-grant` flip must still alert.
|
|
186
|
+
*/
|
|
187
|
+
private emitExpiringNoGrantWarning;
|
|
188
|
+
/**
|
|
189
|
+
* Proactive custodian cycle (Lot 1): refresh every mesh-managed account
|
|
190
|
+
* inside its skew window before expiry, flip `reauth_required` early on
|
|
191
|
+
* definitive refresh failure and alert (D4). Only provably unconsumed
|
|
192
|
+
* failures defer without flipping: explicit 429/5xx token-endpoint
|
|
193
|
+
* responses and typed local preparation failures. Timeouts, resets,
|
|
194
|
+
* mint/persistence failures after a possible rotation, and unknown shapes
|
|
195
|
+
* flip fail-closed: the grant may already be consumed.
|
|
196
|
+
*
|
|
197
|
+
* Externally custodied seats never refresh here and are skipped; an
|
|
198
|
+
* unknown or elapsed expiry reads reauth-required (it awaits the next
|
|
199
|
+
* import) without flipping a status the custodian never owns. A
|
|
200
|
+
* CLI-imported Muse credential carries no refresh grant yet IS renewable
|
|
201
|
+
* (the mesh re-reads the CLI store), so it follows the grant path. Static
|
|
202
|
+
* keys with no refresh grant (Vibe long-lived keys, Muse direct keys)
|
|
203
|
+
* are skipped: their rotation path is re-enrollment, not refresh. They
|
|
204
|
+
* warn once inside the refresh window (`expiring-no-grant`, with the
|
|
205
|
+
* upcoming expiry in the report) and flip on expiry.
|
|
206
|
+
*/
|
|
207
|
+
runCustodianRefreshCycle(): Promise<CustodianRefreshReport>;
|
|
208
|
+
/**
|
|
209
|
+
* Start the custodian loop: an immediate cycle, then one every `intervalMs`
|
|
210
|
+
* with a small random stagger (two replicas started together must not fire
|
|
211
|
+
* in lockstep on single-use refresh grants). Ticks never overlap; the timer
|
|
212
|
+
* is unref'd so it cannot hold the process open.
|
|
213
|
+
*
|
|
214
|
+
* The host MUST run exactly one loop per owner scope: this library holds no
|
|
215
|
+
* distributed lock, so two live loops would race on rotating grants
|
|
216
|
+
* (multi-replica custody belongs to the Lot 2 host). Cycle and
|
|
217
|
+
* report-listener failures surface through `onError`; without it a dead
|
|
218
|
+
* keyring would tick silently.
|
|
219
|
+
*
|
|
220
|
+
* Returns a stop function; `stopCustodianLoop()` stops it as well.
|
|
221
|
+
*/
|
|
222
|
+
startCustodianLoop(intervalMs: number, onReport?: (report: CustodianRefreshReport) => void, onError?: (error: unknown) => void): () => void;
|
|
223
|
+
stopCustodianLoop(): void;
|
|
138
224
|
}
|
|
139
225
|
//# sourceMappingURL=local-account-transport-service.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"local-account-transport-service.d.ts","sourceRoot":"","sources":["../../src/service/local-account-transport-service.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"local-account-transport-service.d.ts","sourceRoot":"","sources":["../../src/service/local-account-transport-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAE5B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACV,aAAa,EAGb,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EAGjB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAS1C,OAAO,EAGL,KAAK,YAAY,EAElB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAuC,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE9F,MAAM,WAAW,mCAAmC;IAClD,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,sBAAsB,CAAC;CACxC;AAyBD,MAAM,MAAM,2BAA2B,GACnC,YAAY,GACZ,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,4BAA4B;;CAIrE;AA0BD,0FAA0F;AAC1F,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM;CAKhE;AAED,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAwCD,qBAAa,4BAA4B;IA+BrC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAjC9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8C;IAC1E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkD;IAClF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IACjE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA6B;IACvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IACjE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,qBAAqB,CAAoC;IACjE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8C;IAC7E,OAAO,CAAC,oBAAoB,CAAK;IACjC,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,uBAAuB,CAAK;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsC;gBAGlD,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAC1C,cAAc,EAAE,cAAc,EAC9B,0BAA0B,CAAC,oBAAQ,EACpD,OAAO,CAAC,EAAE,mCAAmC;IAM/C,OAAO,CAAC,KAAK;IAKP,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmBnF,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAC/D,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyBjD,8BAA8B,CAAC,cAAc,EAAE,MAAM,EACzD,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAcjD,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiEpE,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA6DtE,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAyD1B,wBAAwB,CAC5B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IA8D1B,wBAAwB,CAC5B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,WAAW,SAAK,GACf,OAAO,CAAC,oBAAoB,CAAC;IAoEhC;;;;;;;;OAQG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IA+H5F;;;;;;;;OAQG;IACG,gBAAgB,CAAC,KAAK,EAAE;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,CAAC;IAwEvB,+EAA+E;IAC/E,OAAO,CAAC,sBAAsB;IAuB9B,OAAO,CAAC,aAAa;YAIP,eAAe;YAcf,cAAc;YAoBd,2BAA2B;YAS3B,cAAc;YAoBd,uBAAuB;IAuD/B,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW3C,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC;IA0BnE,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAuChD,eAAe,CACb,OAAO,EAAE,uBAAuB,EAChC,aAAa,SAAW,EACxB,iBAAiB,CAAC,EAAE,MAAM,GACzB,IAAI;IAsBD,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA2ElF,OAAO,CAAC,WAAW,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC,GAAG,oBAAoB;YAsB3E,oBAAoB;IAoDlC,OAAO,CAAC,mBAAmB;IAM3B;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;YAOR,iBAAiB;IAgC/B,OAAO,CAAC,YAAY;IAgDpB,OAAO,CAAC,oBAAoB;YAOd,kBAAkB;YAIlB,YAAY;YAiGZ,iBAAiB;YA6CjB,iBAAiB;YAajB,mBAAmB;IA8BjC,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,aAAa;YAIP,cAAc;YAiBd,iBAAiB;YAgBjB,uBAAuB;YAgBvB,oBAAoB;YAkBpB,gBAAgB;YAMhB,qBAAqB;YAOrB,6BAA6B;YAK7B,2BAA2B;IAqBzC,OAAO,CAAC,oBAAoB;YAMd,yBAAyB;YAazB,gBAAgB;YAmBhB,wBAAwB;YAkFxB,kBAAkB;IAkBhC,sEAAsE;IACtE,OAAO,CAAC,sBAAsB;IAuB9B;;;;OAIG;YACW,eAAe;IAiB7B;;;;;OAKG;YACW,0BAA0B;IAexC;;;;;;;;;;;;;;;;;;OAkBG;IACG,wBAAwB,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAkIjE;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,EACnD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,MAAM,IAAI;IA4Cb,iBAAiB,IAAI,IAAI;CAO1B"}
|