@modelprofile.com/authswitch-signin 10.4.0

package/dist_ts_signin/signin.grants.js

@@ -0,0 +1,408 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+import * as plugins from './plugins.js';
+import { parseOpenAiTokenClaims, revokeOpenAiRefreshToken } from './signin.protocol.js';
+import { openAiTokensOfCredential, refreshOpenAiCredential } from './signin.credential.js';
+/** A grant failure. Its message is fixed and names no token. */
+export class OpenAiGrantError extends Error {
+    code;
+    details;
+    constructor(code, details = {}) {
+        super(`OpenAI grant operation failed (${code}).`);
+        this.code = code;
+        this.details = details;
+        this.name = 'OpenAiGrantError';
+    }
+}
+/** Codex refreshes an access token that expires within five minutes (`CHATGPT_ACCESS_TOKEN_REFRESH_WINDOW_MINUTES`). */
+const ACCESS_REFRESH_WINDOW_MS = 5 * 60 * 1000;
+/** Codex refreshes tokens older than eight days even while the access token is valid (`TOKEN_REFRESH_INTERVAL`). */
+const TOKEN_REFRESH_INTERVAL_MS = 8 * 24 * 60 * 60 * 1000;
+/** One refresh request is bounded by thirty seconds; an attempt is given up thirty seconds after that. */
+const REFRESH_REQUEST_TIMEOUT_MS = 30_000;
+const REFRESH_ATTEMPT_LEASE_MS = 60_000;
+const DEFAULT_MIN_VALIDITY_MS = 60_000;
+const MAX_MIN_VALIDITY_MS = 3_600_000;
+const MAX_RESOLVE_ROUNDS = 8;
+const MAX_WRITE_ROUNDS = 4;
+const MAX_GRANT_ID_BYTES = 512;
+const isoTime = (value) => {
+    if (typeof value !== 'string')
+        return NaN;
+    const time = Date.parse(value);
+    return Number.isFinite(time) && new Date(time).toISOString() === value ? time : NaN;
+};
+const isCount = (value, minimum) => typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum;
+const requireGrantId = (grantId) => {
+    if (typeof grantId !== 'string' || !grantId || Buffer.byteLength(grantId, 'utf8') > MAX_GRANT_ID_BYTES) {
+        throw new OpenAiGrantError('invalid_argument');
+    }
+    return grantId;
+};
+/** The identity and expiry a credential's access token states; `null` when it states none of them usable. */
+const accessFactsOf = (credential) => {
+    try {
+        openAiTokensOfCredential(credential);
+        const access = parseOpenAiTokenClaims(credential.accessToken);
+        const identity = parseOpenAiTokenClaims(credential.idToken);
+        const accountId = access.chatgptAccountId ?? identity.chatgptAccountId;
+        const userId = access.chatgptUserId ?? identity.chatgptUserId;
+        if (!accountId || !userId || !access.expiresAt)
+            return null;
+        if (identity.chatgptAccountId !== undefined && identity.chatgptAccountId !== accountId)
+            return null;
+        return { accountId, userId, isFedrampAccount: access.chatgptAccountIsFedramp, expiresAt: access.expiresAt };
+    }
+    catch {
+        return null;
+    }
+};
+/** A stored record this manager would have written; anything else is refused before it is used. */
+const checkRecord = (record) => {
+    const valid = record !== null && typeof record === 'object'
+        && isCount(record.revision, 1) && isCount(record.generation, 1) && isCount(record.retryCount, 0)
+        && ['active', 'refresh_uncertain', 'reauth_required'].includes(record.state)
+        && typeof record.accountId === 'string' && record.accountId.length > 0
+        && typeof record.userId === 'string' && record.userId.length > 0
+        && typeof record.isFedrampAccount === 'boolean'
+        && Number.isFinite(isoTime(record.accessExpiresAt)) && Number.isFinite(isoTime(record.refreshedAt))
+        && (record.retryAt === null || Number.isFinite(isoTime(record.retryAt)))
+        && (record.state === 'refresh_uncertain'
+            ? record.attempt !== null && typeof record.attempt === 'object' && typeof record.attempt.id === 'string'
+                && record.attempt.id.length > 0 && Number.isFinite(isoTime(record.attempt.expiresAt))
+            : record.attempt === null)
+        && (record.state === 'reauth_required'
+            ? ['refresh_failed', 'refresh_interrupted', 'identity_changed'].includes(record.reauthReason ?? '')
+            : record.reauthReason === null);
+    if (!valid)
+        throw new OpenAiGrantError('invalid_record');
+    const facts = accessFactsOf(record.credential);
+    if (!facts || facts.accountId !== record.accountId || facts.userId !== record.userId
+        || facts.isFedrampAccount !== record.isFedrampAccount || facts.expiresAt !== record.accessExpiresAt) {
+        throw new OpenAiGrantError('invalid_record');
+    }
+    return record;
+};
+/**
+ * Keeps ChatGPT sign-ins usable for any number of processes that share one store: it answers current access for
+ * each request, refreshes the tokens when they are due or the provider rejected exactly the current generation,
+ * and never sends a refresh token whose outcome is unknown a second time. Within a process one refresh per grant
+ * runs at a time; across processes the store's compare-and-set on the revision decides, and a process that finds
+ * another's refresh in flight waits for its outcome. It holds no credential of its own: every call reads the
+ * store, and no error, status or return value carries a refresh or ID token.
+ */
+export class OpenAiGrantManager {
+    store;
+    fetcher;
+    now;
+    waitIntervalMs;
+    refreshes = new Map();
+    constructor(options) {
+        if (!options || typeof options.store !== 'object' || options.store === null) {
+            throw new OpenAiGrantError('invalid_argument');
+        }
+        const waitIntervalMs = options.waitIntervalMs ?? 250;
+        if (!Number.isSafeInteger(waitIntervalMs) || waitIntervalMs < 1 || waitIntervalMs > 10_000) {
+            throw new OpenAiGrantError('invalid_argument');
+        }
+        this.store = options.store;
+        this.fetcher = options.fetch;
+        this.now = options.now ?? (() => Date.now());
+        this.waitIntervalMs = waitIntervalMs;
+    }
+    /** The record a new sign-in starts: generation one, active. */
+    recordOf(result, revision, generation) {
+        const facts = result && typeof result === 'object' ? accessFactsOf(result.credential) : null;
+        if (!facts)
+            throw new OpenAiGrantError('invalid_argument');
+        return {
+            revision, generation, state: 'active', credential: result.credential,
+            accountId: facts.accountId, userId: facts.userId, isFedrampAccount: facts.isFedrampAccount,
+            accessExpiresAt: facts.expiresAt, refreshedAt: new Date(this.now()).toISOString(),
+            retryAt: null, retryCount: 0, attempt: null, reauthReason: null,
+        };
+    }
+    statusOf(record) {
+        let plan = null;
+        try {
+            plan = parseOpenAiTokenClaims(record.credential.idToken).chatgptPlanType ?? null;
+        }
+        catch {
+            plan = null;
+        }
+        return {
+            revision: record.revision, generation: record.generation, state: record.state,
+            reauthReason: record.reauthReason, accountId: record.accountId, isFedrampAccount: record.isFedrampAccount,
+            plan, accessExpiresAt: record.accessExpiresAt, refreshedAt: record.refreshedAt, retryAt: record.retryAt,
+        };
+    }
+    async load(grantId) {
+        const record = await this.store.load(grantId);
+        return record === null ? null : checkRecord(record);
+    }
+    /** Stores the grant a device sign-in produced. Throws `OpenAiGrantError` `contended` when a grant exists under the id. */
+    async create(grantId, result) {
+        requireGrantId(grantId);
+        const record = this.recordOf(result, 1, 1);
+        if (await this.store.create(grantId, record) !== 'stored')
+            throw new OpenAiGrantError('contended');
+        return this.statusOf(record);
+    }
+    /**
+     * Replaces a grant with a new sign-in, over the revision the caller read: a grant that needs a new sign-in is
+     * repaired this way. The generation keeps rising, so a 401 of the old tokens cannot be mistaken for the new.
+     * The replaced tokens are not revoked.
+     */
+    async replace(grantId, expectedRevision, result) {
+        requireGrantId(grantId);
+        if (!isCount(expectedRevision, 1))
+            throw new OpenAiGrantError('invalid_argument');
+        const current = await this.load(grantId);
+        if (!current)
+            throw new OpenAiGrantError('not_found');
+        if (current.revision !== expectedRevision)
+            throw new OpenAiGrantError('contended');
+        const record = this.recordOf(result, current.revision + 1, current.generation + 1);
+        if (await this.store.compareAndSet(grantId, expectedRevision, record) !== 'stored') {
+            throw new OpenAiGrantError('contended');
+        }
+        return this.statusOf(record);
+    }
+    /** The grant's state without any token; `null` when there is none. */
+    async status(grantId) {
+        requireGrantId(grantId);
+        const record = await this.load(grantId);
+        return record ? this.statusOf(record) : null;
+    }
+    isDue(record, minValidityMs) {
+        const now = this.now();
+        return Date.parse(record.accessExpiresAt) <= now + Math.max(minValidityMs, ACCESS_REFRESH_WINDOW_MS)
+            || Date.parse(record.refreshedAt) <= now - TOKEN_REFRESH_INTERVAL_MS;
+    }
+    async wait(signal) {
+        if (signal?.aborted)
+            throw new OpenAiGrantError('aborted');
+        let timer;
+        let onAbort;
+        try {
+            await new Promise((resolve, reject) => {
+                timer = setTimeout(resolve, this.waitIntervalMs);
+                if (signal) {
+                    onAbort = () => reject(new OpenAiGrantError('aborted'));
+                    signal.addEventListener('abort', onAbort, { once: true });
+                }
+            });
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            if (onAbort)
+                signal?.removeEventListener('abort', onAbort);
+        }
+    }
+    /** Waits for a promise, or rejects `aborted` as soon as the signal fires; the promise runs on regardless. */
+    async awaitOrAbort(task, signal) {
+        if (!signal)
+            return task;
+        if (signal.aborted)
+            throw new OpenAiGrantError('aborted');
+        let onAbort;
+        try {
+            await Promise.race([task, new Promise((_resolve, reject) => {
+                    onAbort = () => reject(new OpenAiGrantError('aborted'));
+                    signal.addEventListener('abort', onAbort, { once: true });
+                })]);
+        }
+        finally {
+            if (onAbort)
+                signal.removeEventListener('abort', onAbort);
+        }
+    }
+    /** Moves a record on over the revision it was read at; `false` when it moved meanwhile. */
+    async write(grantId, current, change) {
+        const next = { ...current, ...change, revision: current.revision + 1 };
+        return await this.store.compareAndSet(grantId, current.revision, next) === 'stored';
+    }
+    /**
+     * Current access for one provider request. The access stays valid for `minValidityMs` at least; tokens that
+     * are due, or whose generation the provider just rejected, are refreshed first.
+     * Throws `OpenAiGrantError`: `reauth_required` when only a new sign-in helps, `access_not_fresh` when the
+     * service could not renew the tokens yet.
+     */
+    async resolveAccess(grantId, options = {}) {
+        requireGrantId(grantId);
+        const minValidityMs = options.minValidityMs ?? DEFAULT_MIN_VALIDITY_MS;
+        const rejected = options.rejectedGeneration;
+        if (!Number.isSafeInteger(minValidityMs) || minValidityMs < 0 || minValidityMs > MAX_MIN_VALIDITY_MS
+            || (rejected !== undefined && !isCount(rejected, 1))) {
+            throw new OpenAiGrantError('invalid_argument');
+        }
+        let refreshedOnce = false;
+        for (let round = 0; round < MAX_RESOLVE_ROUNDS; round++) {
+            if (options.signal?.aborted)
+                throw new OpenAiGrantError('aborted');
+            const record = await this.load(grantId);
+            if (!record)
+                throw new OpenAiGrantError('not_found');
+            if (rejected !== undefined && rejected > record.generation)
+                throw new OpenAiGrantError('invalid_argument');
+            if (record.state === 'reauth_required') {
+                throw new OpenAiGrantError('reauth_required', { reauthReason: record.reauthReason ?? 'refresh_failed' });
+            }
+            if (record.state === 'refresh_uncertain') {
+                await this.settleAttempt(grantId, record, options.signal);
+                continue;
+            }
+            const rejectedCurrent = rejected === record.generation;
+            const expiresAt = Date.parse(record.accessExpiresAt);
+            const usable = !rejectedCurrent && expiresAt > this.now() + minValidityMs;
+            if (!this.isDue(record, minValidityMs) && usable) {
+                return {
+                    accessToken: record.credential.accessToken, accountId: record.accountId,
+                    isFedrampAccount: record.isFedrampAccount, expiresAt: record.accessExpiresAt, generation: record.generation,
+                };
+            }
+            const retryAt = record.retryAt === null ? null : Date.parse(record.retryAt);
+            if (refreshedOnce || (retryAt !== null && retryAt > this.now())) {
+                // The service was asked and could not renew the tokens yet. Access that is still good enough serves.
+                if (usable) {
+                    return {
+                        accessToken: record.credential.accessToken, accountId: record.accountId,
+                        isFedrampAccount: record.isFedrampAccount, expiresAt: record.accessExpiresAt, generation: record.generation,
+                    };
+                }
+                throw new OpenAiGrantError('access_not_fresh', record.retryAt === null ? {} : { retryAt: record.retryAt });
+            }
+            await this.awaitOrAbort(this.refresh(grantId, record), options.signal);
+            refreshedOnce = true;
+        }
+        throw new OpenAiGrantError('contended');
+    }
+    /**
+     * Refreshes a grant that is due (by its access expiry or its age) and answers its state; one that is not due is
+     * left as it is. For a periodic job, so a sign-in that no request uses stays alive.
+     */
+    async keepFresh(grantId, options = {}) {
+        requireGrantId(grantId);
+        try {
+            await this.resolveAccess(grantId, { signal: options.signal, minValidityMs: 0 });
+        }
+        catch (error) {
+            if (!(error instanceof OpenAiGrantError) || !['reauth_required', 'access_not_fresh', 'not_found'].includes(error.code)) {
+                throw error;
+            }
+        }
+        return this.status(grantId);
+    }
+    /**
+     * A record whose refresh may have been sent: this process waits for its own attempt; another process's attempt
+     * is waited for until the record moves on or the attempt's lease passes, and then the grant needs a new sign-in.
+     */
+    async settleAttempt(grantId, record, signal) {
+        const own = this.refreshes.get(grantId);
+        if (own) {
+            await this.awaitOrAbort(own, signal);
+            return;
+        }
+        let current = record;
+        while (current && current.revision === record.revision) {
+            if (!current.attempt || Date.parse(current.attempt.expiresAt) <= this.now()) {
+                await this.write(grantId, current, {
+                    state: 'reauth_required', reauthReason: 'refresh_interrupted', attempt: null, retryAt: null,
+                });
+                return;
+            }
+            await this.wait(signal);
+            current = await this.load(grantId);
+        }
+    }
+    /** One refresh per grant in this process; a caller that stops waiting leaves it running to its end. */
+    refresh(grantId, record) {
+        const prior = this.refreshes.get(grantId);
+        if (prior)
+            return prior;
+        const task = this.performRefresh(grantId, record)
+            .finally(() => { if (this.refreshes.get(grantId) === task)
+            this.refreshes.delete(grantId); });
+        this.refreshes.set(grantId, task);
+        return task;
+    }
+    async performRefresh(grantId, initial) {
+        const attemptId = plugins.crypto.randomUUID();
+        const attempt = { id: attemptId, expiresAt: new Date(this.now() + REFRESH_ATTEMPT_LEASE_MS).toISOString() };
+        // The marker is stored before the refresh token is sent: a process that dies after this point leaves a
+        // record that can only lead to a new sign-in, never to a second use of the same refresh token.
+        if (!await this.write(grantId, initial, { state: 'refresh_uncertain', attempt, retryAt: null }))
+            return;
+        const marked = { ...initial, state: 'refresh_uncertain', attempt, retryAt: null,
+            revision: initial.revision + 1 };
+        const result = await refreshOpenAiCredential(initial.credential, {
+            fetch: this.fetcher, signal: AbortSignal.timeout(REFRESH_REQUEST_TIMEOUT_MS), now: () => new Date(this.now()),
+        });
+        const current = await this.load(grantId);
+        if (!current || current.revision !== marked.revision || current.attempt?.id !== attemptId)
+            return;
+        if (result.success) {
+            const facts = accessFactsOf(result.credential);
+            if (!facts || facts.accountId !== initial.accountId || facts.userId !== initial.userId) {
+                await this.write(grantId, current, {
+                    state: 'reauth_required', reauthReason: 'identity_changed', attempt: null, retryAt: null,
+                });
+                return;
+            }
+            await this.write(grantId, current, {
+                state: 'active', credential: result.credential, generation: current.generation + 1,
+                isFedrampAccount: facts.isFedrampAccount, accessExpiresAt: facts.expiresAt,
+                refreshedAt: new Date(this.now()).toISOString(), retryAt: null, retryCount: 0, attempt: null,
+                reauthReason: null,
+            });
+            return;
+        }
+        if (result.requestOutcome === 'notSent') {
+            const backoffMs = Math.min(30_000 * 2 ** Math.min(current.retryCount, 10), 1_800_000);
+            const retryMs = Math.max(backoffMs, Math.min(result.retryAfterMs ?? 0, 3_600_000));
+            await this.write(grantId, current, {
+                state: 'active', attempt: null, retryAt: new Date(this.now() + retryMs).toISOString(),
+                retryCount: current.retryCount + 1,
+            });
+            return;
+        }
+        await this.write(grantId, current, {
+            state: 'reauth_required', reauthReason: 'refresh_failed', attempt: null, retryAt: null,
+        });
+    }
+    /**
+     * Removes a grant and then asks the service to revoke its refresh token. The grant is removed whatever the
+     * service answers; `revocation` says what it answered. `removed: false` when there was no grant.
+     */
+    async remove(grantId, options = {}) {
+        requireGrantId(grantId);
+        for (let round = 0; round < MAX_WRITE_ROUNDS; round++) {
+            const record = await this.store.load(grantId);
+            if (!record)
+                return { removed: false, revocation: null };
+            if (!isCount(record.revision, 1))
+                throw new OpenAiGrantError('invalid_record');
+            if (await this.store.remove(grantId, record.revision) !== 'removed')
+                continue;
+            let token = null;
+            try {
+                token = openAiTokensOfCredential(record.credential).refreshToken;
+            }
+            catch {
+                token = null;
+            }
+            if (token === null)
+                return { removed: true, revocation: 'failed' };
+            try {
+                await revokeOpenAiRefreshToken(token, { fetch: this.fetcher, signal: options.signal });
+            }
+            catch {
+                return { removed: true, revocation: 'failed' };
+            }
+            const current = record.state === 'active' && record.attempt === null;
+            return { removed: true, revocation: current ? 'confirmed' : 'unconfirmed' };
+        }
+        throw new OpenAiGrantError('contended');
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbmluLmdyYW50cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NpZ25pbi9zaWduaW4uZ3JhbnRzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLDJKQUEySjtBQUUzSixPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsd0JBQXdCLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUN4RixPQUFPLEVBQUUsd0JBQXdCLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQXFIM0YsZ0VBQWdFO0FBQ2hFLE1BQU0sT0FBTyxnQkFBaUIsU0FBUSxLQUFLO0lBRXZCO0lBQ0E7SUFGbEIsWUFDa0IsSUFBMkIsRUFDM0IsVUFBeUUsRUFBRTtRQUUzRixLQUFLLENBQUMsa0NBQWtDLElBQUksSUFBSSxDQUFDLENBQUM7UUFIbEMsU0FBSSxHQUFKLElBQUksQ0FBdUI7UUFDM0IsWUFBTyxHQUFQLE9BQU8sQ0FBb0U7UUFHM0YsSUFBSSxDQUFDLElBQUksR0FBRyxrQkFBa0IsQ0FBQztJQUNqQyxDQUFDO0NBQ0Y7QUFVRCx3SEFBd0g7QUFDeEgsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztBQUMvQyxvSEFBb0g7QUFDcEgsTUFBTSx5QkFBeUIsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDO0FBQzFELDBHQUEwRztBQUMxRyxNQUFNLDBCQUEwQixHQUFHLE1BQU0sQ0FBQztBQUMxQyxNQUFNLHdCQUF3QixHQUFHLE1BQU0sQ0FBQztBQUN4QyxNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQztBQUN2QyxNQUFNLG1CQUFtQixHQUFHLFNBQVMsQ0FBQztBQUN0QyxNQUFNLGtCQUFrQixHQUFHLENBQUMsQ0FBQztBQUM3QixNQUFNLGdCQUFnQixHQUFHLENBQUMsQ0FBQztBQUMzQixNQUFNLGtCQUFrQixHQUFHLEdBQUcsQ0FBQztBQUUvQixNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWMsRUFBVSxFQUFFO0lBQ3pDLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUTtRQUFFLE9BQU8sR0FBRyxDQUFDO0lBQzFDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDL0IsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRSxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7QUFDdEYsQ0FBQyxDQUFDO0FBRUYsTUFBTSxPQUFPLEdBQUcsQ0FBQyxLQUFjLEVBQUUsT0FBZSxFQUFtQixFQUFFLENBQ25FLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssSUFBSSxPQUFPLENBQUM7QUFFL0UsTUFBTSxjQUFjLEdBQUcsQ0FBQyxPQUFlLEVBQVUsRUFBRTtJQUNqRCxJQUFJLE9BQU8sT0FBTyxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsR0FBRyxrQkFBa0IsRUFBRSxDQUFDO1FBQ3ZHLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFDRCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUM7QUFFRiw2R0FBNkc7QUFDN0csTUFBTSxhQUFhLEdBQUcsQ0FBQyxVQUFrQyxFQUVoRCxFQUFFO0lBQ1QsSUFBSSxDQUFDO1FBQ0gsd0JBQXdCLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDckMsTUFBTSxNQUFNLEdBQUcsc0JBQXNCLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzlELE1BQU0sUUFBUSxHQUFHLHNCQUFzQixDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM1RCxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsZ0JBQWdCLElBQUksUUFBUSxDQUFDLGdCQUFnQixDQUFDO1FBQ3ZFLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxhQUFhLElBQUksUUFBUSxDQUFDLGFBQWEsQ0FBQztRQUM5RCxJQUFJLENBQUMsU0FBUyxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUM1RCxJQUFJLFFBQVEsQ0FBQyxnQkFBZ0IsS0FBSyxTQUFTLElBQUksUUFBUSxDQUFDLGdCQUFnQixLQUFLLFNBQVM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUNwRyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLENBQUMsdUJBQXVCLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUM5RyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxJQUFJLENBQUM7SUFBQyxDQUFDO0FBQzFCLENBQUMsQ0FBQztBQUVGLG1HQUFtRztBQUNuRyxNQUFNLFdBQVcsR0FBRyxDQUFDLE1BQTBCLEVBQXNCLEVBQUU7SUFDckUsTUFBTSxLQUFLLEdBQUcsTUFBTSxLQUFLLElBQUksSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRO1dBQ3RELE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztXQUM3RixDQUFDLFFBQVEsRUFBRSxtQkFBbUIsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO1dBQ3pFLE9BQU8sTUFBTSxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUNuRSxPQUFPLE1BQU0sQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDN0QsT0FBTyxNQUFNLENBQUMsZ0JBQWdCLEtBQUssU0FBUztXQUM1QyxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLENBQUMsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7V0FDaEcsQ0FBQyxNQUFNLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztXQUNyRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEtBQUssbUJBQW1CO1lBQ3RDLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxPQUFPLE1BQU0sQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLE9BQU8sTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssUUFBUTttQkFDbkcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ3ZGLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQztXQUN6QixDQUFDLE1BQU0sQ0FBQyxLQUFLLEtBQUssaUJBQWlCO1lBQ3BDLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixFQUFFLHFCQUFxQixFQUFFLGtCQUFrQixDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxZQUFZLElBQUksRUFBRSxDQUFDO1lBQ25HLENBQUMsQ0FBQyxNQUFNLENBQUMsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQ3BDLElBQUksQ0FBQyxLQUFLO1FBQUUsTUFBTSxJQUFJLGdCQUFnQixDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDekQsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUMvQyxJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxNQUFNO1dBQy9FLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxNQUFNLENBQUMsZ0JBQWdCLElBQUksS0FBSyxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsZUFBZSxFQUFFLENBQUM7UUFDdEcsTUFBTSxJQUFJLGdCQUFnQixDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLE9BQU8sa0JBQWtCO0lBQ1osS0FBSyxDQUFvQjtJQUN6QixPQUFPLENBQTJCO0lBQ2xDLEdBQUcsQ0FBZTtJQUNsQixjQUFjLENBQVM7SUFDdkIsU0FBUyxHQUFHLElBQUksR0FBRyxFQUF5QixDQUFDO0lBRTlELFlBQVksT0FBbUM7UUFDN0MsSUFBSSxDQUFDLE9BQU8sSUFBSSxPQUFPLE9BQU8sQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxLQUFLLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDNUUsTUFBTSxJQUFJLGdCQUFnQixDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFDakQsQ0FBQztRQUNELE1BQU0sY0FBYyxHQUFHLE9BQU8sQ0FBQyxjQUFjLElBQUksR0FBRyxDQUFDO1FBQ3JELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGNBQWMsQ0FBQyxJQUFJLGNBQWMsR0FBRyxDQUFDLElBQUksY0FBYyxHQUFHLE1BQU0sRUFBRSxDQUFDO1lBQzNGLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQ2pELENBQUM7UUFDRCxJQUFJLENBQUMsS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUM7UUFDM0IsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDO1FBQzdCLElBQUksQ0FBQyxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQzdDLElBQUksQ0FBQyxjQUFjLEdBQUcsY0FBYyxDQUFDO0lBQ3ZDLENBQUM7SUFFRCwrREFBK0Q7SUFDdkQsUUFBUSxDQUFDLE1BQTBCLEVBQUUsUUFBZ0IsRUFBRSxVQUFrQjtRQUMvRSxNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDN0YsSUFBSSxDQUFDLEtBQUs7WUFBRSxNQUFNLElBQUksZ0JBQWdCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUMzRCxPQUFPO1lBQ0wsUUFBUSxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtZQUNwRSxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVMsRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxLQUFLLENBQUMsZ0JBQWdCO1lBQzFGLGVBQWUsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFLFdBQVcsRUFBRSxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxXQUFXLEVBQUU7WUFDakYsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLElBQUk7U0FDaEUsQ0FBQztJQUNKLENBQUM7SUFFTyxRQUFRLENBQUMsTUFBMEI7UUFDekMsSUFBSSxJQUFJLEdBQWtCLElBQUksQ0FBQztRQUMvQixJQUFJLENBQUM7WUFBQyxJQUFJLEdBQUcsc0JBQXNCLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxlQUFlLElBQUksSUFBSSxDQUFDO1FBQUMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUFDLElBQUksR0FBRyxJQUFJLENBQUM7UUFBQyxDQUFDO1FBQ2hILE9BQU87WUFDTCxRQUFRLEVBQUUsTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUs7WUFDN0UsWUFBWSxFQUFFLE1BQU0sQ0FBQyxZQUFZLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxDQUFDLGdCQUFnQjtZQUN6RyxJQUFJLEVBQUUsZUFBZSxFQUFFLE1BQU0sQ0FBQyxlQUFlLEVBQUUsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO1NBQ3hHLENBQUM7SUFDSixDQUFDO0lBRU8sS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFlO1FBQ2hDLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDOUMsT0FBTyxNQUFNLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBRUQsMEhBQTBIO0lBQ25ILEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBZSxFQUFFLE1BQTBCO1FBQzdELGNBQWMsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4QixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDM0MsSUFBSSxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsS0FBSyxRQUFRO1lBQUUsTUFBTSxJQUFJLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ25HLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUMvQixDQUFDO0lBRUQ7Ozs7T0FJRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBZSxFQUFFLGdCQUF3QixFQUFFLE1BQTBCO1FBQ3hGLGNBQWMsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4QixJQUFJLENBQUMsT0FBTyxDQUFDLGdCQUFnQixFQUFFLENBQUMsQ0FBQztZQUFFLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQ2xGLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN6QyxJQUFJLENBQUMsT0FBTztZQUFFLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUN0RCxJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssZ0JBQWdCO1lBQUUsTUFBTSxJQUFJLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ25GLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxVQUFVLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDbkYsSUFBSSxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLENBQUMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNuRixNQUFNLElBQUksZ0JBQWdCLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDMUMsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUMvQixDQUFDO0lBRUQsc0VBQXNFO0lBQy9ELEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBZTtRQUNqQyxjQUFjLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDeEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDL0MsQ0FBQztJQUVPLEtBQUssQ0FBQyxNQUEwQixFQUFFLGFBQXFCO1FBQzdELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN2QixPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxJQUFJLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLGFBQWEsRUFBRSx3QkFBd0IsQ0FBQztlQUMvRixJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsSUFBSSxHQUFHLEdBQUcseUJBQXlCLENBQUM7SUFDekUsQ0FBQztJQUVPLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBK0I7UUFDaEQsSUFBSSxNQUFNLEVBQUUsT0FBTztZQUFFLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMzRCxJQUFJLEtBQWdELENBQUM7UUFDckQsSUFBSSxPQUFpQyxDQUFDO1FBQ3RDLElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxPQUFPLENBQU8sQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7Z0JBQzFDLEtBQUssR0FBRyxVQUFVLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztnQkFDakQsSUFBSSxNQUFNLEVBQUUsQ0FBQztvQkFDWCxPQUFPLEdBQUcsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksZ0JBQWdCLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztvQkFDeEQsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDNUQsQ0FBQztZQUNILENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsSUFBSSxLQUFLO2dCQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMvQixJQUFJLE9BQU87Z0JBQUUsTUFBTSxFQUFFLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUM3RCxDQUFDO0lBQ0gsQ0FBQztJQUVELDZHQUE2RztJQUNyRyxLQUFLLENBQUMsWUFBWSxDQUFDLElBQW1CLEVBQUUsTUFBK0I7UUFDN0UsSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPLElBQUksQ0FBQztRQUN6QixJQUFJLE1BQU0sQ0FBQyxPQUFPO1lBQUUsTUFBTSxJQUFJLGdCQUFnQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzFELElBQUksT0FBaUMsQ0FBQztRQUN0QyxJQUFJLENBQUM7WUFDSCxNQUFNLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsSUFBSSxPQUFPLENBQVEsQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLEVBQUU7b0JBQ2hFLE9BQU8sR0FBRyxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO29CQUN4RCxNQUFNLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO2dCQUM1RCxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDUCxDQUFDO2dCQUFTLENBQUM7WUFDVCxJQUFJLE9BQU87Z0JBQUUsTUFBTSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUM1RCxDQUFDO0lBQ0gsQ0FBQztJQUVELDJGQUEyRjtJQUNuRixLQUFLLENBQUMsS0FBSyxDQUFDLE9BQWUsRUFBRSxPQUEyQixFQUM5RCxNQUFtQztRQUNuQyxNQUFNLElBQUksR0FBdUIsRUFBRSxHQUFHLE9BQU8sRUFBRSxHQUFHLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVEsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMzRixPQUFPLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLEtBQUssUUFBUSxDQUFDO0lBQ3RGLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNJLEtBQUssQ0FBQyxhQUFhLENBQUMsT0FBZSxFQUFFLFVBQXNDLEVBQUU7UUFDbEYsY0FBYyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3hCLE1BQU0sYUFBYSxHQUFHLE9BQU8sQ0FBQyxhQUFhLElBQUksdUJBQXVCLENBQUM7UUFDdkUsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1FBQzVDLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGFBQWEsQ0FBQyxJQUFJLGFBQWEsR0FBRyxDQUFDLElBQUksYUFBYSxHQUFHLG1CQUFtQjtlQUMvRixDQUFDLFFBQVEsS0FBSyxTQUFTLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN2RCxNQUFNLElBQUksZ0JBQWdCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUNqRCxDQUFDO1FBQ0QsSUFBSSxhQUFhLEdBQUcsS0FBSyxDQUFDO1FBQzFCLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxrQkFBa0IsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3hELElBQUksT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPO2dCQUFFLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNuRSxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDeEMsSUFBSSxDQUFDLE1BQU07Z0JBQUUsTUFBTSxJQUFJLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQ3JELElBQUksUUFBUSxLQUFLLFNBQVMsSUFBSSxRQUFRLEdBQUcsTUFBTSxDQUFDLFVBQVU7Z0JBQUUsTUFBTSxJQUFJLGdCQUFnQixDQUFDLGtCQUFrQixDQUFDLENBQUM7WUFDM0csSUFBSSxNQUFNLENBQUMsS0FBSyxLQUFLLGlCQUFpQixFQUFFLENBQUM7Z0JBQ3ZDLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxpQkFBaUIsRUFBRSxFQUFFLFlBQVksRUFBRSxNQUFNLENBQUMsWUFBWSxJQUFJLGdCQUFnQixFQUFFLENBQUMsQ0FBQztZQUMzRyxDQUFDO1lBQ0QsSUFBSSxNQUFNLENBQUMsS0FBSyxLQUFLLG1CQUFtQixFQUFFLENBQUM7Z0JBQ3pDLE1BQU0sSUFBSSxDQUFDLGFBQWEsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDMUQsU0FBUztZQUNYLENBQUM7WUFDRCxNQUFNLGVBQWUsR0FBRyxRQUFRLEtBQUssTUFBTSxDQUFDLFVBQVUsQ0FBQztZQUN2RCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsQ0FBQztZQUNyRCxNQUFNLE1BQU0sR0FBRyxDQUFDLGVBQWUsSUFBSSxTQUFTLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLGFBQWEsQ0FBQztZQUMxRSxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsYUFBYSxDQUFDLElBQUksTUFBTSxFQUFFLENBQUM7Z0JBQ2pELE9BQU87b0JBQ0wsV0FBVyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsV0FBVyxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUztvQkFDdkUsZ0JBQWdCLEVBQUUsTUFBTSxDQUFDLGdCQUFnQixFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsZUFBZSxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtpQkFDNUcsQ0FBQztZQUNKLENBQUM7WUFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUM1RSxJQUFJLGFBQWEsSUFBSSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksT0FBTyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLENBQUM7Z0JBQ2hFLHFHQUFxRztnQkFDckcsSUFBSSxNQUFNLEVBQUUsQ0FBQztvQkFDWCxPQUFPO3dCQUNMLFdBQVcsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFdBQVcsRUFBRSxTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVM7d0JBQ3ZFLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxnQkFBZ0IsRUFBRSxTQUFTLEVBQUUsTUFBTSxDQUFDLGVBQWUsRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7cUJBQzVHLENBQUM7Z0JBQ0osQ0FBQztnQkFDRCxNQUFNLElBQUksZ0JBQWdCLENBQUMsa0JBQWtCLEVBQUUsTUFBTSxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7WUFDN0csQ0FBQztZQUNELE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDdkUsYUFBYSxHQUFHLElBQUksQ0FBQztRQUN2QixDQUFDO1FBQ0QsTUFBTSxJQUFJLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzFDLENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsU0FBUyxDQUFDLE9BQWUsRUFBRSxVQUFvQyxFQUFFO1FBQzVFLGNBQWMsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4QixJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLENBQUMsQ0FBQyxLQUFLLFlBQVksZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUMsaUJBQWlCLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO2dCQUN2SCxNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFFRDs7O09BR0c7SUFDSyxLQUFLLENBQUMsYUFBYSxDQUFDLE9BQWUsRUFBRSxNQUEwQixFQUFFLE1BQStCO1FBQ3RHLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3hDLElBQUksR0FBRyxFQUFFLENBQUM7WUFDUixNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ3JDLE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxPQUFPLEdBQThCLE1BQU0sQ0FBQztRQUNoRCxPQUFPLE9BQU8sSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN2RCxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUM7Z0JBQzVFLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFO29CQUNqQyxLQUFLLEVBQUUsaUJBQWlCLEVBQUUsWUFBWSxFQUFFLHFCQUFxQixFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLElBQUk7aUJBQzVGLENBQUMsQ0FBQztnQkFDSCxPQUFPO1lBQ1QsQ0FBQztZQUNELE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUN4QixPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3JDLENBQUM7SUFDSCxDQUFDO0lBRUQsdUdBQXVHO0lBQy9GLE9BQU8sQ0FBQyxPQUFlLEVBQUUsTUFBMEI7UUFDekQsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDMUMsSUFBSSxLQUFLO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDeEIsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDO2FBQzlDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxLQUFLLElBQUk7WUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2hHLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNsQyxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFTyxLQUFLLENBQUMsY0FBYyxDQUFDLE9BQWUsRUFBRSxPQUEyQjtRQUN2RSxNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQzlDLE1BQU0sT0FBTyxHQUFHLEVBQUUsRUFBRSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLHdCQUF3QixDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQztRQUM1Ryx1R0FBdUc7UUFDdkcsK0ZBQStGO1FBQy9GLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxFQUFFLEtBQUssRUFBRSxtQkFBbUIsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO1lBQUUsT0FBTztRQUN4RyxNQUFNLE1BQU0sR0FBdUIsRUFBRSxHQUFHLE9BQU8sRUFBRSxLQUFLLEVBQUUsbUJBQW1CLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJO1lBQ2pHLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ25DLE1BQU0sTUFBTSxHQUFHLE1BQU0sdUJBQXVCLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRTtZQUMvRCxLQUFLLEVBQUUsSUFBSSxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQywwQkFBMEIsQ0FBQyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7U0FDOUcsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3pDLElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLFFBQVEsS0FBSyxNQUFNLENBQUMsUUFBUSxJQUFJLE9BQU8sQ0FBQyxPQUFPLEVBQUUsRUFBRSxLQUFLLFNBQVM7WUFBRSxPQUFPO1FBQ2xHLElBQUksTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ25CLE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDL0MsSUFBSSxDQUFDLEtBQUssSUFBSSxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU8sQ0FBQyxTQUFTLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQ3ZGLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFO29CQUNqQyxLQUFLLEVBQUUsaUJBQWlCLEVBQUUsWUFBWSxFQUFFLGtCQUFrQixFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLElBQUk7aUJBQ3pGLENBQUMsQ0FBQztnQkFDSCxPQUFPO1lBQ1QsQ0FBQztZQUNELE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFO2dCQUNqQyxLQUFLLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxHQUFHLENBQUM7Z0JBQ2xGLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxnQkFBZ0IsRUFBRSxlQUFlLEVBQUUsS0FBSyxDQUFDLFNBQVM7Z0JBQzFFLFdBQVcsRUFBRSxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLElBQUk7Z0JBQzVGLFlBQVksRUFBRSxJQUFJO2FBQ25CLENBQUMsQ0FBQztZQUNILE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFDdEYsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsWUFBWSxJQUFJLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQ25GLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFO2dCQUNqQyxLQUFLLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxPQUFPLENBQUMsQ0FBQyxXQUFXLEVBQUU7Z0JBQ3JGLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxHQUFHLENBQUM7YUFDbkMsQ0FBQyxDQUFDO1lBQ0gsT0FBTztRQUNULENBQUM7UUFDRCxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLE9BQU8sRUFBRTtZQUNqQyxLQUFLLEVBQUUsaUJBQWlCLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLElBQUk7U0FDdkYsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBZSxFQUFFLFVBQW9DLEVBQUU7UUFHekUsY0FBYyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3hCLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxnQkFBZ0IsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3RELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDOUMsSUFBSSxDQUFDLE1BQU07Z0JBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxDQUFDO1lBQ3pELElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7Z0JBQUUsTUFBTSxJQUFJLGdCQUFnQixDQUFDLGdCQUFnQixDQUFDLENBQUM7WUFDL0UsSUFBSSxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssU0FBUztnQkFBRSxTQUFTO1lBQzlFLElBQUksS0FBSyxHQUFrQixJQUFJLENBQUM7WUFDaEMsSUFBSSxDQUFDO2dCQUFDLEtBQUssR0FBRyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsWUFBWSxDQUFDO1lBQUMsQ0FBQztZQUFDLE1BQU0sQ0FBQztnQkFBQyxLQUFLLEdBQUcsSUFBSSxDQUFDO1lBQUMsQ0FBQztZQUNqRyxJQUFJLEtBQUssS0FBSyxJQUFJO2dCQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsQ0FBQztZQUNuRSxJQUFJLENBQUM7Z0JBQ0gsTUFBTSx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDekYsQ0FBQztZQUFDLE1BQU0sQ0FBQztnQkFDUCxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLENBQUM7WUFDakQsQ0FBQztZQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDO1lBQ3JFLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDOUUsQ0FBQztRQUNELE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUMxQyxDQUFDO0NBQ0YifQ==

package/dist_ts_signin/signin.interfaces.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The shapes of one ChatGPT sign-in: the credential it produces, the access that credential grants, what its
+ * claims say about the account, and the outcome of a refresh. Inference with an access token is FlexHarness's
+ * `/openai`, not this.
+ */
+/** Whether a failed request reached the provider: `notSent` never did, `outcomeUnknown` may have. */
+export type TOpenAiRequestOutcome = 'notSent' | 'outcomeUnknown';
+/**
+ * A ChatGPT sign-in with its rotating refresh token. This exact shape is what the authority seals, so a stored
+ * credential keeps reading back across releases.
+ */
+export interface IOpenAiOAuthCredential {
+    kind: 'chatgptOAuth';
+    providerId: 'openai';
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+    /** When this credential was last refreshed; strictly increasing across refreshes. */
+    lastRefreshAt?: string;
+}
+/** Access to one ChatGPT workspace, with the workspace and residency its issuer states. */
+export interface IOpenAiAccess {
+    accessToken: string;
+    accountId: string;
+    isFedrampAccount: boolean;
+}
+/** What a sign-in's claims say about its account; no token. */
+export interface IOpenAiAccountSummary {
+    providerId: 'openai';
+    authKind: 'chatgptOAuth';
+    accountId?: string;
+    email?: string;
+    plan?: string;
+}
+/** What the person signing in does: open the URL and enter the code. */
+export interface IOpenAiDevicePrompt {
+    flow: 'device';
+    verificationUrl: string;
+    userCode: string;
+}
+export interface IOpenAiLoginResult {
+    credential: IOpenAiOAuthCredential;
+    account: IOpenAiAccountSummary;
+}
+export type TOpenAiOperationErrorCode = 'ABORTED' | 'TIMEOUT';
+export interface IOpenAiRefreshSuccess {
+    success: true;
+    credential: IOpenAiOAuthCredential;
+    account: IOpenAiAccountSummary;
+}
+export interface IOpenAiRefreshFailure {
+    success: false;
+    credential: IOpenAiOAuthCredential;
+    errorCode: TOpenAiOperationErrorCode | 'REFRESH_FAILED';
+    /** Never replay a rotating grant when this is `outcomeUnknown`. */
+    requestOutcome: TOpenAiRequestOutcome;
+    /** The response status, when an HTTP response was observed. */
+    responseStatus?: number;
+    /** Bounded Retry-After delay from the observed response. */
+    retryAfterMs?: number;
+}
+export type TOpenAiRefreshResult = IOpenAiRefreshSuccess | IOpenAiRefreshFailure;

package/dist_ts_signin/signin.interfaces.js

@@ -0,0 +1,3 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbmluLmludGVyZmFjZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zaWduaW4vc2lnbmluLmludGVyZmFjZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsMkpBQTJKIn0=

package/dist_ts_signin/signin.protocol.d.ts

@@ -0,0 +1,93 @@
+import type { TOpenAiRequestOutcome } from './signin.interfaces.js';
+/**
+ * The ChatGPT sign-in protocol Codex uses (`codex-rs/login`: `device_code_auth.rs`, `auth/manager.rs`,
+ * `auth/revoke.rs`, `oauth/client.rs`), for the one party that signs an account in and refreshes it: the device
+ * code, its poll, the authorization-code exchange, the refresh-token grant, the revocation and the claims of the
+ * tokens. Every failure is a fixed message: no response body, token or header crosses an error.
+ */
+export declare const OPENAI_AUTH_ISSUER = "https://auth.openai.com";
+export declare const OPENAI_AUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+/** How long a device code lives: Codex polls it for fifteen minutes and tells the person it expires then. */
+export declare const OPENAI_DEVICE_CODE_LIFETIME_MS: number;
+export declare class OpenAiAuthError extends Error {
+    readonly status?: number;
+    readonly requestOutcome?: TOpenAiRequestOutcome;
+    readonly retryAfterMs?: number;
+    constructor(message: string, options?: {
+        status?: number;
+        requestOutcome?: TOpenAiRequestOutcome;
+        retryAfterMs?: number;
+    });
+}
+export interface IOpenAiAuthOptions {
+    fetch?: typeof fetch;
+    /** Aborts network requests and device-code polling. */
+    signal?: AbortSignal;
+}
+export interface IOpenAiDeviceCodePollOptions extends IOpenAiAuthOptions {
+    timeoutMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+}
+/** What the claims of a ChatGPT token say about its account; never the token itself. */
+export interface IOpenAiTokenClaims {
+    email?: string;
+    chatgptPlanType?: string;
+    chatgptUserId?: string;
+    chatgptAccountId?: string;
+    chatgptAccountIsFedramp: boolean;
+    expiresAt?: string;
+}
+export interface IOpenAiDeviceCode {
+    verificationUrl: string;
+    userCode: string;
+    deviceAuthId: string;
+    intervalSeconds: number;
+}
+export interface IOpenAiDeviceAuthorization {
+    authorizationCode: string;
+    codeChallenge: string;
+    codeVerifier: string;
+}
+/** The tokens one exchange or refresh produced, with the claims of the ID token (or access token). */
+export interface IOpenAiTokenSet {
+    accessToken: string;
+    refreshToken: string;
+    idToken?: string;
+    claims: IOpenAiTokenClaims;
+}
+/** Reads the account claims of a ChatGPT ID or access token. Throws `OpenAiAuthError` for anything but a JWT. */
+export declare const parseOpenAiTokenClaims: (token: string) => IOpenAiTokenClaims;
+/** Starts a device sign-in (`POST {issuer}/api/accounts/deviceauth/usercode`). */
+export declare const requestOpenAiDeviceCode: (options?: IOpenAiAuthOptions) => Promise<IOpenAiDeviceCode>;
+/** What one poll of a device sign-in found: the person has not approved it yet, or has, with its authorization. */
+export type TOpenAiDeviceCodePoll = {
+    status: 'pending';
+} | {
+    status: 'approved';
+    authorization: IOpenAiDeviceAuthorization;
+};
+/**
+ * Asks once whether the person approved the sign-in (`POST {issuer}/api/accounts/deviceauth/token`): 403 and 404
+ * mean pending, as in Codex. `timeoutMs` bounds the one request (at most thirty seconds). The authorization it
+ * answers is single-use, so one sign-in is polled by one caller at a time.
+ */
+export declare const pollOpenAiDeviceCodeOnce: (deviceCode: IOpenAiDeviceCode, options?: IOpenAiAuthOptions & {
+    timeoutMs?: number;
+}) => Promise<TOpenAiDeviceCodePoll>;
+/**
+ * Polls until the person approved the sign-in, at the interval the service asked for, and gives up after at most
+ * fifteen minutes, as Codex does.
+ */
+export declare const pollOpenAiDeviceCode: (deviceCode: IOpenAiDeviceCode, options?: IOpenAiDeviceCodePollOptions) => Promise<IOpenAiDeviceAuthorization>;
+/** Exchanges an approved device sign-in for tokens (`POST {issuer}/oauth/token`, PKCE, form-encoded). */
+export declare const exchangeOpenAiDeviceAuthorization: (authorization: IOpenAiDeviceAuthorization, options?: IOpenAiAuthOptions) => Promise<IOpenAiTokenSet>;
+/**
+ * Sends one refresh-token grant (`POST {issuer}/oauth/token`, JSON). A response without a new refresh token keeps
+ * the one that was sent, as Codex does.
+ */
+export declare const refreshOpenAiTokens: (tokens: IOpenAiTokenSet, options?: IOpenAiAuthOptions) => Promise<IOpenAiTokenSet>;
+/**
+ * Revokes a refresh token (`POST {issuer}/oauth/revoke`, JSON), as Codex does when it logs out: the grant then
+ * refreshes nothing anywhere. It resolves only once the service accepted the revocation.
+ */
+export declare const revokeOpenAiRefreshToken: (refreshToken: string, options?: IOpenAiAuthOptions) => Promise<void>;