@spine-event-engine/auth 2.0.0-snapshot.25 → 2.0.0-snapshot.28

package/dist/sessions/persistent-token-revocations.js

@@ -0,0 +1,422 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+import { createHash } from "node:crypto";
+import { create } from "@bufbuild/protobuf";
+import { Time } from "@spine-event-engine/core/time";
+import { TokenRevocationSchema } from "@spine-event-engine/proto/auth";
+import { ColumnTypes, defaultQueryCandidateLimit, RecordColumn, RecordSpec, } from "@spine-event-engine/storage";
+import { StoragePreparations } from "@spine-event-engine/storage/provider";
+import { SessionRecords } from "./session-record.js";
+/**
+ * Atomic scoped revocations retained through the last token-acceptance instant.
+ */
+export class PersistentTokenRevocations {
+    /**
+     * Declares immediate revocation capability to signed sessions.
+     */
+    kind = "supported";
+    #issuer;
+    #audience;
+    #scope;
+    #storage;
+    #clock;
+    #closed = false;
+    #active = 0;
+    #drained;
+    #closing;
+    /**
+     * Binds one acquired handle to its scope and trusted maintenance clock.
+     * @param options Validated placement and scope.
+     * @param storage Selected record handle.
+     */
+    constructor(options, storage) {
+        this.#issuer = options.issuer;
+        this.#audience = options.audience;
+        this.#scope = RevocationKeys.scope(options.issuer, options.audience);
+        this.#storage = storage;
+        this.#clock = options.clock ?? Time.currentTime;
+    }
+    /**
+     * Acquires and optionally prepares the selected indexed record family.
+     * With `createMissingStructures: false`, creation and later operations never
+     * check or create physical structures. Missing structures fail through ordinary
+     * storage operations. The default prepares the selected structure before return.
+     * @param options Shared factory, group, scope and preparation policy.
+     * @returns Ready revocation source, or a non-preparing handle when explicitly requested.
+     */
+    static async create(options) {
+        RevocationKeys.nonempty(options.issuer, "issuer");
+        RevocationKeys.nonempty(options.audience, "audience");
+        const storage = options.storageFactory.createRecordStorage(context, spec, options.group, {
+            prepareOnAccess: false,
+        });
+        try {
+            if (!storage.atomicCompareAndSet)
+                throw new Error("Token revocations require atomic compare-and-set.");
+            if (options.createMissingStructures !== false)
+                await StoragePreparations.for(options.storageFactory).prepareRecord(context, spec, options.group, "create");
+            return new PersistentTokenRevocations(options, storage);
+        }
+        catch (error) {
+            try {
+                storage.close();
+            }
+            catch (closeError) {
+                throw new AggregateError([error, closeError], "Revocation preparation and cleanup failed.");
+            }
+            throw error;
+        }
+    }
+    /**
+     * Reads the exact scoped token identifier by primary key.
+     * @param jti Token ID produced by the signed-session strategy.
+     * @returns Whether the scoped revocation is still within its inclusive deadline.
+     */
+    isRevoked(jti) {
+        return this.#run(async () => {
+            const id = RevocationKeys.id(this.#issuer, this.#audience, jti);
+            const found = await this.#storage.read(id);
+            this.#checkOpen();
+            if (found?.issuer !== this.#issuer ||
+                found.audience !== this.#audience ||
+                found.tokenId !== jti)
+                return false;
+            return (SessionRecords.compare(SessionRecords.deadline(this.#clock()), RevocationKeys.deadline(found)) <= 0);
+        });
+    }
+    /**
+     * Stores the maximum full last-acceptance deadline through atomic CAS.
+     * @param jti Token ID produced by the signed-session strategy.
+     * @param expiresAt Inclusive last valid instant, already including strategy skew.
+     * @returns Completion after a deadline no shorter than the supplied instant is stored.
+     */
+    revoke(jti, expiresAt) {
+        return this.#run(async () => {
+            const proposed = this.#record(jti, expiresAt);
+            for (;;) {
+                this.#checkOpen();
+                const current = await this.#storage.read(proposed.id);
+                this.#checkOpen();
+                if (current !== undefined && RevocationKeys.compare(current, proposed) >= 0)
+                    return;
+                const updated = current === undefined
+                    ? proposed
+                    : create(TokenRevocationSchema, { ...current, whenExpires: proposed.whenExpires });
+                if (await this.#storage.compareAndSet(proposed.id, current, updated)) {
+                    this.#checkOpen();
+                    return;
+                }
+            }
+        });
+    }
+    /**
+     * Removes records strictly before an application-selected trusted cutoff.
+     * A record at the cutoff remains, because its token is still valid there.
+     * Concurrently extended records survive conditional deletion; a changed
+     * candidate may require a later invocation. Failure or cancellation rejects
+     * after any already completed removals.
+     * @param cutoff Current-or-earlier exact maintenance cutoff.
+     * @param signal Optional maintenance cancellation.
+     * @returns Number of confirmed removals in this invocation.
+     */
+    purgeExpired(cutoff, signal) {
+        return this.#run(async () => {
+            const valid = SessionRecords.deadline(cutoff);
+            signal?.throwIfAborted();
+            if (SessionRecords.compare(valid, SessionRecords.deadline(this.#clock())) > 0)
+                throw new RangeError("Purge cutoff cannot be later than the trusted clock.");
+            return this.#purge(valid, signal);
+        });
+    }
+    /**
+     * Closes the selected handle after fencing and draining admitted work.
+     * The shared factory remains open.
+     * @returns Completion after the selected handle is closed.
+     */
+    close() {
+        if (this.#closing !== undefined)
+            return this.#closing;
+        this.#closed = true;
+        this.#closing = this.#finishClose();
+        return this.#closing;
+    }
+    /**
+     * Builds one complete scoped record with its exact supplied deadline.
+     * @param jti Token identifier to revoke.
+     * @param expiresAt Full last-acceptance deadline.
+     * @returns Complete persisted record.
+     */
+    #record(jti, expiresAt) {
+        return create(TokenRevocationSchema, {
+            id: RevocationKeys.id(this.#issuer, this.#audience, jti),
+            issuer: this.#issuer,
+            audience: this.#audience,
+            tokenId: jti,
+            whenExpires: SessionRecords.deadline(expiresAt),
+        });
+    }
+    /**
+     * Completes closure after admitted storage operations settle.
+     * @returns Completion after handle release.
+     */
+    async #finishClose() {
+        if (this.#active > 0)
+            await new Promise((resolve) => (this.#drained = resolve));
+        this.#storage.close();
+    }
+    /**
+     * Admits one operation while the handle is open and tracks its settlement.
+     * @typeParam T Operation result.
+     * @param work Storage operation to run.
+     * @returns Settled operation result.
+     */
+    async #run(work) {
+        this.#checkOpen();
+        this.#active += 1;
+        try {
+            return await work();
+        }
+        finally {
+            this.#active -= 1;
+            if (this.#active === 0)
+                this.#drained?.();
+        }
+    }
+    /**
+     * Rejects work after closure, including loops resumed from awaited storage.
+     */
+    #checkOpen() {
+        if (this.#closed)
+            throw new Error("Token revocations are closed.");
+    }
+    /**
+     * Traverses flow-scoped indexed expiry groups before the cutoff.
+     * @param cutoff Strict maintenance cutoff.
+     * @param signal Optional cancellation.
+     * @returns Number of confirmed removals.
+     */
+    async #purge(cutoff, signal) {
+        const lower = RevocationKeys.lower(this.#scope);
+        const upper = RevocationKeys.upper(this.#scope, cutoff);
+        let completed;
+        let removed = 0;
+        for (;;) {
+            signal?.throwIfAborted();
+            this.#checkOpen();
+            const key = await this.#nextExpiry(lower, upper, completed);
+            signal?.throwIfAborted();
+            this.#checkOpen();
+            if (key === undefined)
+                return removed;
+            const [count, raced] = await this.#purgeTie(key, cutoff, signal);
+            removed += count;
+            if (raced)
+                return removed;
+            completed = key;
+        }
+    }
+    /**
+     * Selects the next exact indexed expiry in this issuer/audience scope.
+     * @param lower First possible key in scope.
+     * @param upper Strict cutoff key in scope.
+     * @param completed Last drained expiry key.
+     * @returns Next candidate expiry key, if any.
+     */
+    async #nextExpiry(lower, upper, completed) {
+        const entries = await this.#storage.queryPlanEntries({
+            predicate: {
+                kind: "all",
+                predicates: [
+                    { kind: "comparison", column: "expires_order", operator: "lessThan", value: upper },
+                    {
+                        kind: "comparison",
+                        column: "expires_order",
+                        operator: completed === undefined ? "greaterOrEqual" : "greaterThan",
+                        value: completed ?? lower,
+                    },
+                ],
+            },
+            order: [{ column: "expires_order", direction: "asc" }],
+            limit: 1,
+        });
+        const first = entries[0];
+        return first === undefined ? undefined : RevocationKeys.order(first.record);
+    }
+    /**
+     * Pages one exact expiry group by immutable storage ID.
+     * @param key Selected exact expiry key.
+     * @param cutoff Strict maintenance cutoff.
+     * @param signal Optional cancellation.
+     * @returns Removed count and whether a candidate changed concurrently.
+     */
+    async #purgeTie(key, cutoff, signal) {
+        let after;
+        let removed = 0;
+        let raced = false;
+        for (;;) {
+            signal?.throwIfAborted();
+            const entries = await this.#storage.queryEntries({
+                filters: [{ column: "expires_order", value: key }],
+                sort: [{ field: "id" }],
+                limit: defaultQueryCandidateLimit,
+                ...(after === undefined ? {} : { after }),
+            });
+            signal?.throwIfAborted();
+            this.#checkOpen();
+            if (entries.length === 0)
+                return [removed, raced];
+            for (const entry of entries) {
+                const result = await this.#removeEligible(entry.record, cutoff, signal);
+                if (result === true)
+                    removed += 1;
+                if (result === false)
+                    raced = true;
+            }
+            const last = entries.at(-1);
+            if (last === undefined)
+                return [removed, raced];
+            after = { id: last.id, values: [{ field: "id", value: last.id }] };
+        }
+    }
+    /**
+     * Conditionally removes one scoped record still strictly before the cutoff.
+     * @param candidate Selected record snapshot.
+     * @param cutoff Strict maintenance cutoff.
+     * @param signal Optional cancellation.
+     * @returns True if removed, false if changed, undefined if ineligible.
+     */
+    async #removeEligible(candidate, cutoff, signal) {
+        signal?.throwIfAborted();
+        this.#checkOpen();
+        if (candidate.issuer !== this.#issuer ||
+            candidate.audience !== this.#audience ||
+            RevocationKeys.compareDeadline(candidate, cutoff) >= 0)
+            return undefined;
+        const removed = await this.#storage.compareAndSet(candidate.id, candidate, undefined);
+        signal?.throwIfAborted();
+        this.#checkOpen();
+        return removed;
+    }
+}
+/**
+ * Exact scope, identity and expiry encodings for signed revocations.
+ */
+const RevocationKeys = Object.freeze({
+    /**
+     * Validates an identifier without imposing a new length policy.
+     *
+     * @param value Identifier supplied by the selected strategy or application.
+     * @param name Error context.
+     * @returns Validated identifier.
+     */
+    nonempty(value, name) {
+        if (typeof value !== "string" || value.length === 0)
+            throw new TypeError(`${name} must be nonempty.`);
+        return value;
+    },
+    /**
+     * Creates the unambiguous issuer and audience scope digest.
+     *
+     * @param issuer Issuing service.
+     * @param audience Recipient.
+     * @returns Fixed scope prefix for indexed expiry.
+     */
+    scope(issuer, audience) {
+        return createHash("sha256")
+            .update(JSON.stringify([issuer, audience]))
+            .digest();
+    },
+    /**
+     * Creates the scoped token-ID digest for primary lookup.
+     *
+     * @param issuer Issuing service.
+     * @param audience Recipient.
+     * @param jti Token identifier.
+     * @returns Fixed storage ID.
+     */
+    id(issuer, audience, jti) {
+        RevocationKeys.nonempty(jti, "jti");
+        return createHash("sha256")
+            .update(JSON.stringify([issuer, audience, jti]))
+            .digest("hex");
+    },
+    /**
+     * Encodes the first possible expiry in a scope.
+     *
+     * @param scope Fixed issuer/audience digest.
+     * @returns Lower indexed bound.
+     */
+    lower(scope) {
+        return Buffer.concat([scope, Buffer.alloc(12)]);
+    },
+    /**
+     * Encodes one exact deadline within a scope.
+     *
+     * @param scope Fixed issuer/audience digest.
+     * @param cutoff Exact deadline.
+     * @returns Indexed bound.
+     */
+    upper(scope, cutoff) {
+        return Buffer.concat([scope, SessionRecords.orderKey(cutoff)]);
+    },
+    /**
+     * Encodes a record's scope and exact deadline for indexed ordering.
+     *
+     * @param record Complete scoped revocation.
+     * @returns Indexed order key.
+     */
+    order(record) {
+        return RevocationKeys.upper(RevocationKeys.scope(record.issuer, record.audience), RevocationKeys.deadline(record));
+    },
+    /**
+     * Reads one complete required deadline.
+     *
+     * @param record Revocation to check.
+     * @returns Validated exact deadline.
+     */
+    deadline(record) {
+        if (record.whenExpires === undefined)
+            throw new Error("Revocation has no deadline.");
+        return SessionRecords.deadline(record.whenExpires);
+    },
+    /**
+     * Compares two revocation records by exact deadline.
+     *
+     * @param left Current record.
+     * @param right Proposed record.
+     * @returns Exact timestamp ordering.
+     */
+    compare(left, right) {
+        return SessionRecords.compare(RevocationKeys.deadline(left), RevocationKeys.deadline(right));
+    },
+    /**
+     * Compares a record's exact deadline with an application cutoff.
+     *
+     * @param record Current revocation.
+     * @param cutoff Trusted maintenance cutoff.
+     * @returns Exact timestamp ordering.
+     */
+    compareDeadline(record, cutoff) {
+        return SessionRecords.compare(RevocationKeys.deadline(record), cutoff);
+    },
+});
+const context = { name: "__AUTH_TOKEN_REVOCATIONS__", multitenant: false };
+const spec = new RecordSpec({
+    recordType: TokenRevocationSchema,
+    idKind: "string",
+    extractId: (record) => record.id,
+    columns: [new RecordColumn("expires_order", ColumnTypes.fixedBytes(44), RevocationKeys.order)],
+    indexes: [{ name: "expiry", columns: ["expires_order", "id"] }],
+});
+//# sourceMappingURL=persistent-token-revocations.js.map

package/dist/sessions/persistent-token-revocations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistent-token-revocations.js","sourceRoot":"","sources":["../../src/sessions/persistent-token-revocations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAwB,MAAM,gCAAgC,CAAC;AAC7F,OAAO,EACL,WAAW,EACX,0BAA0B,EAC1B,YAAY,EACZ,UAAU,GAMX,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAG3E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAyCrD;;GAEG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACM,IAAI,GAAG,WAAoB,CAAC;IAE5B,OAAO,CAAS;IAEhB,SAAS,CAAS;IAElB,MAAM,CAAa;IAEnB,QAAQ,CAAyC;IAEjD,MAAM,CAAkB;IAEjC,OAAO,GAAG,KAAK,CAAC;IAEhB,OAAO,GAAG,CAAC,CAAC;IAEZ,QAAQ,CAA2B;IAEnC,QAAQ,CAA4B;IAEpC;;;;OAIG;IACH,YACE,OAA0C,EAC1C,OAA+C;QAE/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC;IAClD,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,OAA0C;QAE1C,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClD,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE;YACvF,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,mBAAmB;gBAC9B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,IAAI,OAAO,CAAC,uBAAuB,KAAK,KAAK;gBAC3C,MAAM,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,aAAa,CACjE,OAAO,EACP,IAAI,EACJ,OAAO,CAAC,KAAK,EACb,QAAQ,CACT,CAAC;YACJ,OAAO,IAAI,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,4CAA4C,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,IACE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO;gBAC9B,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS;gBACjC,KAAK,CAAC,OAAO,KAAK,GAAG;gBAErB,OAAO,KAAK,CAAC;YACf,OAAO,CACL,cAAc,CAAC,OAAO,CACpB,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EACtC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC/B,IAAI,CAAC,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAW,EAAE,SAAoB;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC9C,SAAS,CAAC;gBACR,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACtD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClB,IAAI,OAAO,KAAK,SAAS,IAAI,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC;oBAAE,OAAO;gBACpF,MAAM,OAAO,GACX,OAAO,KAAK,SAAS;oBACnB,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;gBACvF,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;oBACrE,IAAI,CAAC,UAAU,EAAE,CAAC;oBAClB,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,YAAY,CAAC,MAAiB,EAAE,MAAoB;QAClD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC;gBAC3E,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,GAAW,EAAE,SAAoB;QACvC,OAAO,MAAM,CAAC,qBAAqB,EAAE;YACnC,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;YACxD,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG;YACZ,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CAAI,IAAsB;QAClC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAClB,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC;gBAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,MAAiB,EAAE,MAAoB;QAClD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,SAAiC,CAAC;QACtC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,SAAS,CAAC;YACR,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YACtC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACjE,OAAO,IAAI,KAAK,CAAC;YACjB,IAAI,KAAK;gBAAE,OAAO,OAAO,CAAC;YAC1B,SAAS,GAAG,GAAG,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CACf,KAAiB,EACjB,KAAiB,EACjB,SAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnD,SAAS,EAAE;gBACT,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE;oBACnF;wBACE,IAAI,EAAE,YAAY;wBAClB,MAAM,EAAE,eAAe;wBACvB,QAAQ,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa;wBACpE,KAAK,EAAE,SAAS,IAAI,KAAK;qBAC1B;iBACF;aACF;YACD,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACtD,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CACb,GAAe,EACf,MAAiB,EACjB,MAAoB;QAEpB,IAAI,KAA6C,CAAC;QAClD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,SAAS,CAAC;YACR,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;gBAClD,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACvB,KAAK,EAAE,0BAA0B;gBACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACxE,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC,CAAC;gBAClC,IAAI,MAAM,KAAK,KAAK;oBAAE,KAAK,GAAG,IAAI,CAAC;YACrC,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAChD,KAAK,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CACnB,SAA0B,EAC1B,MAAiB,EACjB,MAAoB;QAEpB,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IACE,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO;YACjC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS;YACrC,cAAc,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC;YAEtD,OAAO,SAAS,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACtF,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAa,EAAE,IAAY;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACjD,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAc,EAAE,QAAgB;QACpC,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC1C,MAAM,EAAE,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,EAAE,CAAC,MAAc,EAAE,QAAgB,EAAE,GAAW;QAC9C,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;aAC/C,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAiB;QACrB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAiB,EAAE,MAAiB;QACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAuB;QAC3B,OAAO,cAAc,CAAC,KAAK,CACzB,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EACpD,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAChC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,MAAuB;QAC9B,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrF,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAqB,EAAE,KAAsB;QACnD,OAAO,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,MAAuB,EAAE,MAAiB;QACxD,OAAO,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,4BAA4B,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC3F,MAAM,IAAI,GAAG,IAAI,UAAU,CAA0B;IACnD,UAAU,EAAE,qBAAqB;IACjC,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE;IAChC,OAAO,EAAE,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9F,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;CAChE,CAAC,CAAC"}

package/dist/sessions/session-lifetime.d.ts

@@ -0,0 +1,67 @@
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+/**
+ * Tracks process-local operation lifetimes by authenticated session identity.
+ */
+export declare class SessionLifetimes {
+    #private;
+    /**
+     * Creates a registry using the strategy's trusted clock for exact expiry.
+     *
+     * @param clock Returns current Unix milliseconds, or undefined on failure.
+     */
+    constructor(clock: () => number | undefined);
+    /**
+     * Registers before the authoritative validity read.
+     *
+     * @param identity Authenticated stable session or token identity.
+     * @param operation Host-managed operation lifetime.
+     * @returns Monitor removed when the operation ends.
+     */
+    register(identity: string, operation: AbortSignal): SessionMonitor;
+    /**
+     * Stops current process operations for a stable authenticated identity.
+     *
+     * @param identity Stable session or scoped token identity.
+     */
+    invalidate(identity: string): void;
+    /**
+     * Stops every retained operation before strategy close drains work.
+     */
+    close(): void;
+}
+/**
+ * One operation's invalidation signal and exact expiry timer.
+ */
+export declare class SessionMonitor {
+    #private;
+    /**
+     * Captures one host operation and its removal callback.
+     *
+     * @param operation Host cancellation signal.
+     * @param clock Strategy's trusted clock.
+     * @param onRemove Removes this monitor from the identity registry.
+     */
+    constructor(operation: AbortSignal, clock: () => number | undefined, onRemove: () => void);
+    /**
+     * Returns the captured invalidation signal.
+     *
+     * @returns Signal that aborts when this operation loses authority.
+     */
+    get signal(): AbortSignal;
+    /**
+     * Attaches host termination after registration.
+     */
+    attach(): void;
+    /**
+     * Accepts a resolved deadline only while the operation remains live.
+     *
+     * @param deadline Exact session expiry from the authoritative read.
+     * @returns Whether the session may be forwarded now.
+     */
+    ready(deadline: Timestamp): boolean;
+    /**
+     * Stops the local operation and releases its listener and timer.
+     */
+    release: () => void;
+}
+//# sourceMappingURL=session-lifetime.d.ts.map

package/dist/sessions/session-lifetime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-lifetime.d.ts","sourceRoot":"","sources":["../../src/sessions/session-lifetime.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD;;GAEG;AACH,qBAAa,gBAAgB;;IAO3B;;;;OAIG;gBACS,KAAK,EAAE,MAAM,MAAM,GAAG,SAAS;IAI3C;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,cAAc;IAalE;;;;OAIG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAIlC;;OAEG;IACH,KAAK,IAAI,IAAI;CAgBd;AAED;;GAEG;AACH,qBAAa,cAAc;;IAazB;;;;;;OAMG;gBACS,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI;IAMzF;;;;OAIG;IACH,IAAI,MAAM,IAAI,WAAW,CAExB;IAED;;OAEG;IACH,MAAM,IAAI,IAAI;IAKd;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,SAAS,GAAG,OAAO;IAOnC;;OAEG;IACH,OAAO,QAAO,IAAI,CAOhB;CAuBH"}

package/dist/sessions/session-lifetime.js

@@ -0,0 +1,165 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+/**
+ * Tracks process-local operation lifetimes by authenticated session identity.
+ */
+export class SessionLifetimes {
+    #clock;
+    #active = new Map();
+    #closed = false;
+    /**
+     * Creates a registry using the strategy's trusted clock for exact expiry.
+     *
+     * @param clock Returns current Unix milliseconds, or undefined on failure.
+     */
+    constructor(clock) {
+        this.#clock = clock;
+    }
+    /**
+     * Registers before the authoritative validity read.
+     *
+     * @param identity Authenticated stable session or token identity.
+     * @param operation Host-managed operation lifetime.
+     * @returns Monitor removed when the operation ends.
+     */
+    register(identity, operation) {
+        operation.throwIfAborted();
+        if (this.#closed)
+            throw new Error("Session strategy is closed.");
+        const monitor = new SessionMonitor(operation, this.#clock, () => {
+            this.#remove(identity, monitor);
+        });
+        const group = this.#active.get(identity) ?? new Set();
+        group.add(monitor);
+        this.#active.set(identity, group);
+        monitor.attach();
+        return monitor;
+    }
+    /**
+     * Stops current process operations for a stable authenticated identity.
+     *
+     * @param identity Stable session or scoped token identity.
+     */
+    invalidate(identity) {
+        for (const monitor of [...(this.#active.get(identity) ?? [])])
+            monitor.release();
+    }
+    /**
+     * Stops every retained operation before strategy close drains work.
+     */
+    close() {
+        this.#closed = true;
+        for (const identity of [...this.#active.keys()])
+            this.invalidate(identity);
+    }
+    /**
+     * Removes one completed monitor without affecting sibling operations.
+     *
+     * @param identity Stable identity used at registration.
+     * @param monitor Completed operation monitor.
+     */
+    #remove(identity, monitor) {
+        const group = this.#active.get(identity);
+        group?.delete(monitor);
+        if (group?.size === 0)
+            this.#active.delete(identity);
+    }
+}
+/**
+ * One operation's invalidation signal and exact expiry timer.
+ */
+export class SessionMonitor {
+    #operation;
+    #clock;
+    #onRemove;
+    #controller = new AbortController();
+    #timer;
+    #deadline;
+    /**
+     * Captures one host operation and its removal callback.
+     *
+     * @param operation Host cancellation signal.
+     * @param clock Strategy's trusted clock.
+     * @param onRemove Removes this monitor from the identity registry.
+     */
+    constructor(operation, clock, onRemove) {
+        this.#operation = operation;
+        this.#clock = clock;
+        this.#onRemove = onRemove;
+    }
+    /**
+     * Returns the captured invalidation signal.
+     *
+     * @returns Signal that aborts when this operation loses authority.
+     */
+    get signal() {
+        return this.#controller.signal;
+    }
+    /**
+     * Attaches host termination after registration.
+     */
+    attach() {
+        this.#operation.addEventListener("abort", this.release, { once: true });
+        if (this.#operation.aborted)
+            this.release();
+    }
+    /**
+     * Accepts a resolved deadline only while the operation remains live.
+     *
+     * @param deadline Exact session expiry from the authoritative read.
+     * @returns Whether the session may be forwarded now.
+     */
+    ready(deadline) {
+        if (this.#controller.signal.aborted || this.#operation.aborted)
+            return false;
+        this.#deadline = deadline.seconds * 1000000000n + BigInt(deadline.nanos);
+        this.#schedule();
+        return !this.#controller.signal.aborted;
+    }
+    /**
+     * Stops the local operation and releases its listener and timer.
+     */
+    release = () => {
+        if (this.#controller.signal.aborted)
+            return;
+        this.#controller.abort();
+        this.#operation.removeEventListener("abort", this.release);
+        if (this.#timer !== undefined)
+            clearTimeout(this.#timer);
+        this.#timer = undefined;
+        this.#onRemove();
+    };
+    /**
+     * Schedules only the remaining interval, respecting platform timer range.
+     */
+    #schedule() {
+        const now = this.#clock();
+        const deadline = this.#deadline;
+        if (now === undefined || deadline === undefined) {
+            this.release();
+            return;
+        }
+        const remaining = deadline - BigInt(now) * 1000000n;
+        if (remaining <= 0n) {
+            this.release();
+            return;
+        }
+        const milliseconds = (remaining + 999999n) / 1000000n;
+        const delay = Number(milliseconds > 2147483647n ? 2147483647n : milliseconds);
+        this.#timer = setTimeout(() => {
+            this.#schedule();
+        }, delay);
+    }
+}
+//# sourceMappingURL=session-lifetime.js.map

package/dist/sessions/session-lifetime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-lifetime.js","sourceRoot":"","sources":["../../src/sessions/session-lifetime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAClB,MAAM,CAA2B;IAEjC,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IAE1D,OAAO,GAAG,KAAK,CAAC;IAEhB;;;;OAIG;IACH,YAAY,KAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,QAAgB,EAAE,SAAsB;QAC/C,SAAS,CAAC,cAAc,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YAC9D,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAkB,CAAC;QACtE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,QAAgB;QACzB,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,QAAgB,EAAE,OAAuB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,KAAK,EAAE,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IAChB,UAAU,CAAc;IAExB,MAAM,CAA2B;IAEjC,SAAS,CAAa;IAEtB,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;IAE7C,MAAM,CAA4C;IAElD,SAAS,CAAqB;IAE9B;;;;;;OAMG;IACH,YAAY,SAAsB,EAAE,KAA+B,EAAE,QAAoB;QACvF,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAmB;QACvB,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,OAAO,GAAG,WAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,OAAO,GAAG,GAAS,EAAE;QACnB,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAC5C,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC,CAAC;IAEF;;OAEG;IACH,SAAS;QACP,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,QAAU,CAAC;QACtD,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,SAAS,GAAG,OAAQ,CAAC,GAAG,QAAU,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,GAAG,WAAc,CAAC,CAAC,CAAC,WAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF"}