@tokensrc/codex 1.13.4 → 1.14.0

package/dist/credentials.js

@@ -3,7 +3,8 @@ import { readFile, rm } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import * as codexMultiAuthCli from "codex-multi-auth/cli";
-import { writePrivateJson, writePrivateText } from "./private-file.js";
+import { CodexServiceError } from "./errors.js";
+import { readJsonIfExists, removePrivateFileDurably, withPrivateFileLock, writePrivateJson, writePrivateText } from "./private-file.js";
 const externalApi = codexMultiAuthCli;
 function paths(env = process.env) {
     const codexHome = env.CODEX_HOME?.trim() || join(homedir(), ".codex");
@@ -13,6 +14,14 @@ function paths(env = process.env) {
         configPath: join(codexHome, "config.toml")
     };
 }
+function managedLineageStatePath(env = process.env) {
+    const codexHome = env.CODEX_HOME?.trim() || join(homedir(), ".codex");
+    return join(codexHome, ".numa-managed-lineage.json");
+}
+function managedRetirementTombstonePath(env = process.env) {
+    const codexHome = env.CODEX_HOME?.trim() || join(homedir(), ".codex");
+    return join(codexHome, ".numa-retirement-tombstone.json");
+}
 async function optionalText(path) {
     try {
         return await readFile(path, "utf8");
@@ -41,6 +50,10 @@ export async function restoreCodexFileCredentials(env = process.env) {
     await writePrivateText(value.authPath, backup);
     return { action: "restored", ...value };
 }
+/** Removes the legacy full-auth backup before entering or leaving schema-v2 managed mode. */
+export async function discardCodexFileCredentialBackup(env = process.env) {
+    await removePrivateFileDurably(paths(env).backupPath);
+}
 export async function inspectLocalCodexCredentialStatus(expectedAccountId, env = process.env) {
     const authPath = paths(env).authPath;
     if (externalApi.inspectCodexCredentialStatus) {
@@ -88,6 +101,321 @@ function validJwt(token) {
         return false;
     }
 }
+function requiredValue(value, name) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new CodexServiceError(`${name} is required.`, "invalid_managed_codex_credentials");
+    return normalized;
+}
+function parseManagedLineageState(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const state = value;
+    if (state.schemaVersion !== 2
+        || (state.tenantId !== undefined && typeof state.tenantId !== "string")
+        || typeof state.assignmentId !== "string"
+        || typeof state.managedAccountId !== "string"
+        || typeof state.lineageId !== "string"
+        || typeof state.generationVersion !== "number"
+        || !Number.isInteger(state.generationVersion)
+        || state.generationVersion <= 0
+        || typeof state.providerAccountId !== "string"
+        || typeof state.deliveryId !== "string"
+        || typeof state.credentialExpiresAt !== "string"
+        || !Number.isFinite(Date.parse(state.credentialExpiresAt))
+        || typeof state.ackExpiresAt !== "string"
+        || !Number.isFinite(Date.parse(state.ackExpiresAt))
+        || (state.ackedAt !== null && typeof state.ackedAt !== "string")
+        || (state.ackedAt !== null && !Number.isFinite(Date.parse(state.ackedAt)))
+        || (state.phase !== "INSTALLING" && state.phase !== "INSTALLED_PENDING_ACK"
+            && state.phase !== "INSTALLED")
+        || typeof state.updatedAt !== "string")
+        return undefined;
+    if (state.previous !== null && state.previous !== undefined) {
+        const previous = state.previous;
+        if (!previous || typeof previous.assignmentId !== "string"
+            || typeof previous.lineageId !== "string"
+            || !Number.isInteger(previous.generationVersion)
+            || previous.generationVersion <= 0)
+            return undefined;
+    }
+    return {
+        schemaVersion: 2,
+        tenantId: state.tenantId?.trim() || null,
+        assignmentId: state.assignmentId,
+        managedAccountId: state.managedAccountId,
+        lineageId: state.lineageId,
+        generationVersion: state.generationVersion,
+        providerAccountId: state.providerAccountId,
+        deliveryId: state.deliveryId,
+        credentialExpiresAt: state.credentialExpiresAt,
+        ackExpiresAt: state.ackExpiresAt,
+        ackedAt: state.ackedAt ?? null,
+        phase: state.phase,
+        updatedAt: state.updatedAt,
+        previous: state.previous ?? null
+    };
+}
+function parseRetirementTombstone(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const tombstone = value;
+    if (tombstone.schemaVersion !== 2
+        || typeof tombstone.retirementId !== "string"
+        || typeof tombstone.expectedRevision !== "number"
+        || !Number.isInteger(tombstone.expectedRevision)
+        || tombstone.expectedRevision <= 0
+        || typeof tombstone.idempotencyKey !== "string"
+        || typeof tombstone.assignmentId !== "string"
+        || typeof tombstone.lineageId !== "string"
+        || typeof tombstone.generationVersion !== "number"
+        || !Number.isInteger(tombstone.generationVersion)
+        || tombstone.generationVersion <= 0
+        || typeof tombstone.deletedAt !== "string"
+        || !Number.isFinite(Date.parse(tombstone.deletedAt))
+        || (tombstone.acknowledgedAt !== null && typeof tombstone.acknowledgedAt !== "string")
+        || (typeof tombstone.acknowledgedAt === "string"
+            && !Number.isFinite(Date.parse(tombstone.acknowledgedAt))))
+        return undefined;
+    return {
+        schemaVersion: 2,
+        retirementId: tombstone.retirementId,
+        expectedRevision: tombstone.expectedRevision,
+        idempotencyKey: tombstone.idempotencyKey,
+        assignmentId: tombstone.assignmentId,
+        lineageId: tombstone.lineageId,
+        generationVersion: tombstone.generationVersion,
+        deletedAt: tombstone.deletedAt,
+        acknowledgedAt: tombstone.acknowledgedAt ?? null
+    };
+}
+async function installedAuthMatches(input, env) {
+    const raw = await optionalText(paths(env).authPath);
+    if (!raw)
+        return false;
+    try {
+        const auth = JSON.parse(raw);
+        return auth.auth_mode === "chatgpt"
+            && auth.tokens?.id_token === input.idToken
+            && auth.tokens?.access_token === input.accessToken
+            && auth.tokens?.account_id === input.providerAccountId;
+    }
+    catch {
+        return false;
+    }
+}
+export async function readManagedCodexLineageState(env = process.env) {
+    return parseManagedLineageState(await readJsonIfExists(managedLineageStatePath(env)));
+}
+export async function readManagedCodexRetirementTombstone(env = process.env) {
+    return parseRetirementTombstone(await readJsonIfExists(managedRetirementTombstonePath(env)));
+}
+/**
+ * Removes only the exact managed lineage currently installed in auth.json.
+ * The Secret-free tombstone is committed first so a process crash can retry
+ * the Server ACK without restoring or redisclosing credentials.
+ */
+export async function prepareManagedCodexLineageRetirement(input, now = Date.now(), env = process.env) {
+    const retirementId = requiredValue(input.retirementId, "retirementId");
+    const idempotencyKey = requiredValue(input.idempotencyKey, "idempotencyKey");
+    if (!Number.isInteger(input.expectedRevision) || input.expectedRevision <= 0) {
+        throw new CodexServiceError("expectedRevision must be a positive integer.", "invalid_assignment_retirement_request");
+    }
+    const value = paths(env);
+    return withPrivateFileLock(value.authPath, async () => {
+        // A full auth.json backup can contain a real refresh token. Schema-v2 is
+        // Server-owned, so neither enrollment nor retirement may retain it.
+        await removePrivateFileDurably(value.backupPath);
+        const existing = await readManagedCodexRetirementTombstone(env);
+        if (existing?.retirementId === retirementId) {
+            if (existing.expectedRevision === input.expectedRevision)
+                return existing;
+            const retried = { ...existing, expectedRevision: input.expectedRevision, idempotencyKey };
+            await writePrivateJson(managedRetirementTombstonePath(env), retried);
+            return retried;
+        }
+        if (existing && existing.acknowledgedAt === null) {
+            throw new CodexServiceError("Another local retirement acknowledgement is still pending.", "assignment_retirement_local_state_conflict");
+        }
+        const state = await readManagedCodexLineageState(env);
+        if (!state || state.phase === "INSTALLING") {
+            throw new CodexServiceError("No completely installed managed lineage is available for local retirement.", "assignment_retirement_local_state_not_found");
+        }
+        const timestamp = new Date(now).toISOString();
+        const tombstone = {
+            schemaVersion: 2,
+            retirementId,
+            expectedRevision: input.expectedRevision,
+            idempotencyKey,
+            assignmentId: state.assignmentId,
+            lineageId: state.lineageId,
+            generationVersion: state.generationVersion,
+            deletedAt: timestamp,
+            acknowledgedAt: null
+        };
+        await writePrivateJson(managedRetirementTombstonePath(env), tombstone);
+        const local = await inspectLocalCodexCredentialStatus(undefined, env);
+        if (local.accountId === undefined || local.accountId === state.providerAccountId) {
+            await removePrivateFileDurably(value.authPath);
+        }
+        await removePrivateFileDurably(managedLineageStatePath(env));
+        return tombstone;
+    });
+}
+export async function markManagedCodexRetirementAcknowledged(retirementId, acknowledgedAt, env = process.env) {
+    const normalizedRetirementId = requiredValue(retirementId, "retirementId");
+    const normalizedAcknowledgedAt = requiredInstant(acknowledgedAt, "acknowledgedAt");
+    const authPath = paths(env).authPath;
+    return withPrivateFileLock(authPath, async () => {
+        const current = await readManagedCodexRetirementTombstone(env);
+        if (!current || current.retirementId !== normalizedRetirementId) {
+            throw new CodexServiceError("The retirement ACK does not match the local deletion tombstone.", "assignment_retirement_local_state_conflict");
+        }
+        if (current.acknowledgedAt)
+            return current;
+        const acknowledged = { ...current, acknowledgedAt: normalizedAcknowledgedAt };
+        await writePrivateJson(managedRetirementTombstonePath(env), acknowledged);
+        return acknowledged;
+    });
+}
+/** Installs a Server-delivered user-bound lineage without writing an account pool. */
+export async function installManagedCodexLineageCredentials(rawInput, now = Date.now(), env = process.env, hooks = {}) {
+    const input = {
+        tenantId: requiredValue(rawInput.tenantId, "tenantId"),
+        deliveryId: requiredValue(rawInput.deliveryId, "deliveryId"),
+        assignmentId: requiredValue(rawInput.assignmentId, "assignmentId"),
+        managedAccountId: requiredValue(rawInput.managedAccountId, "managedAccountId"),
+        lineageId: requiredValue(rawInput.lineageId, "lineageId"),
+        generationVersion: rawInput.generationVersion,
+        providerAccountId: requiredValue(rawInput.providerAccountId, "providerAccountId"),
+        accessToken: requiredValue(rawInput.accessToken, "accessToken"),
+        idToken: requiredValue(rawInput.idToken, "idToken"),
+        credentialExpiresAt: requiredInstant(rawInput.credentialExpiresAt, "credentialExpiresAt"),
+        ackExpiresAt: requiredInstant(rawInput.ackExpiresAt, "ackExpiresAt"),
+        ...(rawInput.lastRefresh ? { lastRefresh: rawInput.lastRefresh } : {})
+    };
+    if (!Number.isInteger(input.generationVersion) || input.generationVersion <= 0) {
+        throw new CodexServiceError("generationVersion must be a positive integer.", "invalid_managed_codex_credentials");
+    }
+    if (!validJwt(input.idToken)) {
+        throw new CodexServiceError("The account service returned an invalid id_token.", "invalid_managed_codex_credentials");
+    }
+    const value = paths(env);
+    const statePath = managedLineageStatePath(env);
+    return withPrivateFileLock(value.authPath, async () => {
+        await removePrivateFileDurably(value.backupPath);
+        const current = await readManagedCodexLineageState(env);
+        const sameTenant = current?.tenantId === input.tenantId
+            || current?.tenantId === null && current.assignmentId === input.assignmentId;
+        const sameLineage = sameTenant && current?.assignmentId === input.assignmentId
+            && current.lineageId === input.lineageId;
+        if (sameLineage && current.generationVersion > input.generationVersion) {
+            throw new CodexServiceError("Refusing to install a stale lineage generation.", "lineage_version_conflict");
+        }
+        if (sameLineage && current.generationVersion === input.generationVersion
+            && current.deliveryId === input.deliveryId) {
+            if (current.phase === "INSTALLED" || current.phase === "INSTALLED_PENDING_ACK") {
+                if (!(await installedAuthMatches(input, env))) {
+                    throw new CodexServiceError("The same lineage generation has different local credentials.", "lineage_version_conflict");
+                }
+                return {
+                    action: "UNCHANGED",
+                    authPath: value.authPath,
+                    statePath,
+                    state: current
+                };
+            }
+        }
+        if (sameLineage && current.generationVersion === input.generationVersion
+            && current.deliveryId !== input.deliveryId
+            && Date.parse(input.credentialExpiresAt) <= Date.parse(current.credentialExpiresAt)
+            && !(current.phase !== "INSTALLED" && Date.parse(current.ackExpiresAt) <= now)) {
+            throw new CodexServiceError("Refusing to install an older short-lived delivery for the current lineage generation.", "lineage_version_conflict");
+        }
+        const timestamp = new Date(now).toISOString();
+        const previous = current ? {
+            assignmentId: current.assignmentId,
+            lineageId: current.lineageId,
+            generationVersion: current.generationVersion
+        } : null;
+        const installing = {
+            schemaVersion: 2,
+            tenantId: input.tenantId,
+            assignmentId: input.assignmentId,
+            managedAccountId: input.managedAccountId,
+            lineageId: input.lineageId,
+            generationVersion: input.generationVersion,
+            providerAccountId: input.providerAccountId,
+            deliveryId: input.deliveryId,
+            credentialExpiresAt: input.credentialExpiresAt,
+            ackExpiresAt: input.ackExpiresAt,
+            ackedAt: null,
+            phase: "INSTALLING",
+            updatedAt: timestamp,
+            previous
+        };
+        const recovering = sameLineage
+            && current?.generationVersion === input.generationVersion
+            && current.deliveryId === input.deliveryId
+            && current.phase === "INSTALLING";
+        await writePrivateJson(statePath, installing);
+        await hooks.afterInstallingState?.();
+        await externalApi.ensureCodexCliFileAuthStore?.(value.configPath);
+        await writePrivateJson(value.authPath, {
+            auth_mode: "chatgpt",
+            OPENAI_API_KEY: null,
+            tokens: {
+                id_token: input.idToken,
+                access_token: input.accessToken,
+                // The real refresh token is Server-owned. This local, random placeholder
+                // preserves the official auth.json shape but is never usable upstream.
+                refresh_token: randomBytes(48).toString("base64url"),
+                account_id: input.providerAccountId
+            },
+            last_refresh: input.lastRefresh ?? timestamp
+        });
+        await hooks.afterAuthWrite?.();
+        const installed = { ...installing, phase: "INSTALLED_PENDING_ACK" };
+        await writePrivateJson(statePath, installed);
+        return {
+            action: recovering ? "RECOVERED" : "INSTALLED",
+            authPath: value.authPath,
+            statePath,
+            state: installed
+        };
+    });
+}
+export async function markManagedCodexLineageDeliveryAcknowledged(deliveryId, ackedAt, env = process.env) {
+    const normalizedDeliveryId = requiredValue(deliveryId, "deliveryId");
+    const normalizedAckedAt = requiredInstant(ackedAt, "ackedAt");
+    const authPath = paths(env).authPath;
+    return withPrivateFileLock(authPath, async () => {
+        const current = await readManagedCodexLineageState(env);
+        if (!current || current.deliveryId !== normalizedDeliveryId) {
+            throw new CodexServiceError("The delivery ACK does not match the locally installed credentials.", "short_lived_delivery_state_conflict");
+        }
+        if (current.phase === "INSTALLING") {
+            throw new CodexServiceError("The short-lived credentials have not finished installing.", "short_lived_delivery_state_conflict");
+        }
+        if (current.phase === "INSTALLED" && current.ackedAt)
+            return current;
+        const acknowledged = {
+            ...current,
+            phase: "INSTALLED",
+            ackedAt: normalizedAckedAt,
+            updatedAt: normalizedAckedAt
+        };
+        await writePrivateJson(managedLineageStatePath(env), acknowledged);
+        return acknowledged;
+    });
+}
+function requiredInstant(value, name) {
+    const normalized = requiredValue(value, name);
+    if (!Number.isFinite(Date.parse(normalized))) {
+        throw new CodexServiceError(`${name} must be an ISO-8601 instant.`, "invalid_managed_codex_credentials");
+    }
+    return normalized;
+}
 export async function writeCodexChatgptFileCredentials(credentials, now = Date.now(), env = process.env) {
     if (!validJwt(credentials.idToken))
         throw new Error("The account service returned an invalid id_token.");
@@ -115,16 +443,33 @@ export async function writeCodexChatgptFileCredentials(credentials, now = Date.n
 }
 export async function resetManagedCodexFileCredentials(accountId, env = process.env) {
     const value = paths(env);
-    const backup = await optionalText(value.backupPath);
-    if (backup !== undefined) {
-        await writePrivateText(value.authPath, backup);
-        return { action: "restored", ...value };
-    }
-    const status = await inspectLocalCodexCredentialStatus(accountId, env);
-    if (accountId && status.accountId === accountId) {
-        await rm(value.authPath, { force: true });
-        return { action: "removed", ...value };
-    }
-    return { action: "unchanged", ...value };
+    return withPrivateFileLock(value.authPath, async () => {
+        const managedState = await readManagedCodexLineageState(env);
+        if (managedState) {
+            await removePrivateFileDurably(value.backupPath);
+            const status = await inspectLocalCodexCredentialStatus(accountId ?? managedState.providerAccountId, env);
+            if (status.accountId === managedState.providerAccountId) {
+                await removePrivateFileDurably(value.authPath);
+                await removePrivateFileDurably(managedLineageStatePath(env));
+                return { action: "removed", ...value };
+            }
+            await removePrivateFileDurably(managedLineageStatePath(env));
+            return { action: "unchanged", ...value };
+        }
+        const backup = await optionalText(value.backupPath);
+        if (backup !== undefined) {
+            await writePrivateText(value.authPath, backup);
+            await rm(managedLineageStatePath(env), { force: true });
+            return { action: "restored", ...value };
+        }
+        const status = await inspectLocalCodexCredentialStatus(accountId, env);
+        if (accountId && status.accountId === accountId) {
+            await rm(value.authPath, { force: true });
+            await rm(managedLineageStatePath(env), { force: true });
+            return { action: "removed", ...value };
+        }
+        await rm(managedLineageStatePath(env), { force: true });
+        return { action: "unchanged", ...value };
+    });
 }
 //# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,iBAAiB,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAuBvE,MAAM,WAAW,GAAG,iBAA0C,CAAC;AAE/D,SAAS,KAAK,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;QACtC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC;QACpD,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,GAAG,KAAK,EAAE,CAAC;IAC1G,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;IAC3E,MAAM,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/F,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,UAAmB,EAAE,GAAG,KAAK,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,iBAA0B,EAC1B,GAAG,GAAG,OAAO,CAAC,GAAG;IAEjB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACrC,IAAI,WAAW,CAAC,4BAA4B,EAAE,CAAC;QAC7C,OAAO,WAAW,CAAC,4BAA4B,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAG5B,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO;YACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAuB,CAAC,GAAG;YAC3F,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnH,MAAM,OAAO,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QAC5E,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACpE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,sBAAsB,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI;YAClF,MAAM,EAAE,WAAW,IAAI,CAAC,OAAO;SAChC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,SAAiB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IACzF,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,sBAAsB,KAAK,IAAI,CAAC;AACjE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACpF,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,WAAwE,EACxE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,GAAG,GAAG,OAAO,CAAC,GAAG;IAEjB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,WAAW,CAAC,6BAA6B,EAAE,CAAC;QAC9C,OAAO,CAAC,MAAM,WAAW,CAAC,6BAA6B,CAAC,WAAW,EAAE;YACnE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG;SACJ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACf,CAAC;IACD,MAAM,WAAW,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE;QACrC,SAAS,EAAE,SAAS;QACpB,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE;YACN,QAAQ,EAAE,WAAW,CAAC,OAAO;YAC7B,YAAY,EAAE,WAAW,CAAC,WAAW;YACrC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpD,UAAU,EAAE,WAAW,CAAC,SAAS;SAClC;QACD,YAAY,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,QAAQ,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,SAAkB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,UAAmB,EAAE,GAAG,KAAK,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvE,IAAI,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,GAAG,KAAK,EAAE,CAAC;AACpD,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,iBAAiB,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAwE3B,MAAM,WAAW,GAAG,iBAA0C,CAAC;AAE/D,SAAS,KAAK,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;QACtC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC;QACpD,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACnE,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,8BAA8B,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC1E,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,GAAG,KAAK,EAAE,CAAC;IAC1G,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;IAC3E,MAAM,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/F,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,UAAmB,EAAE,GAAG,KAAK,EAAE,CAAC;AACnD,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IACtE,MAAM,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,iBAA0B,EAC1B,GAAG,GAAG,OAAO,CAAC,GAAG;IAEjB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACrC,IAAI,WAAW,CAAC,4BAA4B,EAAE,CAAC;QAC7C,OAAO,WAAW,CAAC,4BAA4B,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAG5B,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO;YACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAuB,CAAC,GAAG;YAC3F,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnH,MAAM,OAAO,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QAC5E,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACpE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,sBAAsB,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI;YAClF,MAAM,EAAE,WAAW,IAAI,CAAC,OAAO;SAChC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,SAAiB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IACzF,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,sBAAsB,KAAK,IAAI,CAAC;AACjE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACpF,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1G,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,KAAK,GAAG,KAA0C,CAAC;IACzD,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC;WACxB,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;WACpE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;WACtC,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ;WAC1C,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;WACnC,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ;WAC3C,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC;WAC1C,KAAK,CAAC,iBAAiB,IAAI,CAAC;WAC5B,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ;WAC3C,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;WACpC,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ;WAC7C,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;WACvD,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;WACtC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;WAChD,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC;WAC7D,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;WACvE,CAAC,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,KAAK,KAAK,uBAAuB;eACtE,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC;WAC9B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAgD,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;eACrD,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ;eACtC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC;eAC7C,QAAQ,CAAC,iBAAiB,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;IACzD,CAAC;IACD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,SAAS,GAAG,KAAiD,CAAC;IACpE,IAAI,SAAS,CAAC,aAAa,KAAK,CAAC;WAC5B,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ;WAC1C,OAAO,SAAS,CAAC,gBAAgB,KAAK,QAAQ;WAC9C,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,CAAC;WAC7C,SAAS,CAAC,gBAAgB,IAAI,CAAC;WAC/B,OAAO,SAAS,CAAC,cAAc,KAAK,QAAQ;WAC5C,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ;WAC1C,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;WACvC,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ;WAC/C,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,CAAC;WAC9C,SAAS,CAAC,iBAAiB,IAAI,CAAC;WAChC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;WACvC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;WACjD,CAAC,SAAS,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,SAAS,CAAC,cAAc,KAAK,QAAQ,CAAC;WACnF,CAAC,OAAO,SAAS,CAAC,cAAc,KAAK,QAAQ;eAC3C,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,IAAI;KACjD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAyC,EACzC,GAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAO1B,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS;eAC9B,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,KAAK,CAAC,OAAO;eACvC,IAAI,CAAC,MAAM,EAAE,YAAY,KAAK,KAAK,CAAC,WAAW;eAC/C,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,KAAK,CAAC,iBAAiB,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,wBAAwB,CAAC,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,wBAAwB,CAAC,MAAM,gBAAgB,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAIC,EACD,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,iBAAiB,CACzB,8CAA8C,EAC9C,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACpD,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,YAAY,KAAK,YAAY,EAAE,CAAC;YAC5C,IAAI,QAAQ,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB;gBAAE,OAAO,QAAQ,CAAC;YAC1E,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC;YAC1F,MAAM,gBAAgB,CAAC,8BAA8B,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YACrE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,QAAQ,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,iBAAiB,CACzB,4DAA4D,EAC5D,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3C,MAAM,IAAI,iBAAiB,CACzB,4EAA4E,EAC5E,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAoC;YACjD,aAAa,EAAE,CAAC;YAChB,YAAY;YACZ,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,cAAc;YACd,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,SAAS;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,MAAM,gBAAgB,CAAC,8BAA8B,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACjF,MAAM,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,wBAAwB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,YAAoB,EACpB,cAAsB,EACtB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,sBAAsB,GAAG,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC3E,MAAM,wBAAwB,GAAG,eAAe,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACrC,OAAO,mBAAmB,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,sBAAsB,EAAE,CAAC;YAChE,MAAM,IAAI,iBAAiB,CACzB,iEAAiE,EACjE,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,cAAc;YAAE,OAAO,OAAO,CAAC;QAC3C,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,CAAC;QAC9E,MAAM,gBAAgB,CAAC,8BAA8B,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;QAC1E,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,QAA4C,EAC5C,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,KAAK,GAGD,EAAE;IAON,MAAM,KAAK,GAAuC;QAChD,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QACtD,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;QAC5D,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC;QAClE,gBAAgB,EAAE,aAAa,CAAC,QAAQ,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC9E,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;QACzD,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,iBAAiB,EAAE,aAAa,CAAC,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACjF,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;QAC/D,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;QACnD,mBAAmB,EAAE,eAAe,CAAC,QAAQ,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACzF,YAAY,EAAE,eAAe,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,EAAE,mCAAmC,CAAC,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,EAAE,mCAAmC,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,OAAO,EAAE,QAAQ,KAAK,KAAK,CAAC,QAAQ;eAClD,OAAO,EAAE,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC;QAC/E,MAAM,WAAW,GAAG,UAAU,IAAI,OAAO,EAAE,YAAY,KAAK,KAAK,CAAC,YAAY;eACzE,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC;QAC3C,IAAI,WAAW,IAAI,OAAO,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACvE,MAAM,IAAI,iBAAiB,CAAC,iDAAiD,EAAE,0BAA0B,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,WAAW,IAAI,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACnE,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,IAAI,OAAO,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBAC/E,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,iBAAiB,CACzB,8DAA8D,EAC9D,0BAA0B,CAC3B,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,WAAoB;oBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS;oBACT,KAAK,EAAE,OAAO;iBACf,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,WAAW,IAAI,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACnE,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;eACvC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;eAChF,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,iBAAiB,CACzB,uFAAuF,EACvF,0BAA0B,CAC3B,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;YACzB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;SAC7C,CAAC,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,UAAU,GAA6B;YAC3C,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,SAAS;YACpB,QAAQ;SACT,CAAC;QACF,MAAM,UAAU,GAAG,WAAW;eACzB,OAAO,EAAE,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACtD,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;eACvC,OAAO,CAAC,KAAK,KAAK,YAAY,CAAC;QACpC,MAAM,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACrC,MAAM,WAAW,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE;YACrC,SAAS,EAAE,SAAS;YACpB,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE;gBACN,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,yEAAyE;gBACzE,uEAAuE;gBACvE,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACpD,UAAU,EAAE,KAAK,CAAC,iBAAiB;aACpC;YACD,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,SAAS;SAC7C,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/B,MAAM,SAAS,GAA6B,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC9F,MAAM,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,WAAoB,CAAC,CAAC,CAAC,WAAoB;YAChE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS;YACT,KAAK,EAAE,SAAS;SACjB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,UAAkB,EAClB,OAAe,EACf,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,oBAAoB,GAAG,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACrC,OAAO,mBAAmB,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC5D,MAAM,IAAI,iBAAiB,CACzB,oEAAoE,EACpE,qCAAqC,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CACzB,2DAA2D,EAC3D,qCAAqC,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;QACrE,MAAM,YAAY,GAA6B;YAC7C,GAAG,OAAO;YACV,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,iBAAiB;YAC1B,SAAS,EAAE,iBAAiB;SAC7B,CAAC;QACF,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;QACnE,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,+BAA+B,EAAE,mCAAmC,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,WAAwE,EACxE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,GAAG,GAAG,OAAO,CAAC,GAAG;IAEjB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,WAAW,CAAC,6BAA6B,EAAE,CAAC;QAC9C,OAAO,CAAC,MAAM,WAAW,CAAC,6BAA6B,CAAC,WAAW,EAAE;YACnE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG;SACJ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACf,CAAC;IACD,MAAM,WAAW,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE;QACrC,SAAS,EAAE,SAAS;QACpB,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE;YACN,QAAQ,EAAE,WAAW,CAAC,OAAO;YAC7B,YAAY,EAAE,WAAW,CAAC,WAAW;YACrC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpD,UAAU,EAAE,WAAW,CAAC,SAAS;SAClC;QACD,YAAY,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,QAAQ,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,SAAkB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,SAAS,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YACzG,IAAI,MAAM,CAAC,SAAS,KAAK,YAAY,CAAC,iBAAiB,EAAE,CAAC;gBACxD,MAAM,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC/C,MAAM,wBAAwB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7D,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;YAClD,CAAC;YACD,MAAM,wBAAwB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,GAAG,KAAK,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,UAAmB,EAAE,GAAG,KAAK,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACvE,IAAI,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,GAAG,KAAK,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/enrollment-envelope.d.ts

@@ -0,0 +1,18 @@
+import type { CodexEnrollmentCandidateEnvelope, CodexEnrollmentCandidateIngress } from "./protocol.js";
+export interface SealCodexEnrollmentCandidateInput {
+    tenantId: string;
+    intentId: string;
+    revision: number;
+    idempotencyKey: string;
+    refreshToken: string;
+    ingress: CodexEnrollmentCandidateIngress;
+}
+export declare function codexEnrollmentCandidateAad(input: {
+    tenantId: string;
+    intentId: string;
+    revision: number;
+    idempotencyKey: string;
+    keyId: string;
+}): Buffer;
+/** Encrypts the one-shot refresh credential without accepting provider identity input. */
+export declare function sealCodexEnrollmentCandidate(input: SealCodexEnrollmentCandidateInput): CodexEnrollmentCandidateEnvelope;

package/dist/enrollment-envelope.js

@@ -0,0 +1,112 @@
+import { createCipheriv, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
+import { CodexServiceError } from "./errors.js";
+const ALGORITHM = "X25519-HKDF-SHA256-AES-256-GCM";
+const HKDF_INFO_PREFIX = "active-code-inbox/codex-enrollment-candidate/key/v1\0";
+const BASE64URL = /^[A-Za-z0-9_-]+$/u;
+const MAX_REFRESH_TOKEN_BYTES = 8_192;
+export function codexEnrollmentCandidateAad(input) {
+    return Buffer.from(JSON.stringify({
+        schemaVersion: 2,
+        tenant: required(input.tenantId, "tenantId"),
+        intentId: required(input.intentId, "intentId"),
+        revision: nonnegativeInteger(input.revision, "revision"),
+        idempotencyKey: required(input.idempotencyKey, "idempotencyKey"),
+        keyId: required(input.keyId, "keyId")
+    }), "utf8");
+}
+/** Encrypts the one-shot refresh credential without accepting provider identity input. */
+export function sealCodexEnrollmentCandidate(input) {
+    if (input.ingress.envelopeVersion !== 1 || input.ingress.algorithm !== ALGORITHM) {
+        throw invalidEnvelope("The account service advertised an unsupported enrollment envelope.");
+    }
+    const refreshToken = required(input.refreshToken, "refreshToken");
+    if (Buffer.byteLength(refreshToken, "utf8") > MAX_REFRESH_TOKEN_BYTES) {
+        throw invalidEnvelope("The official Codex refresh credential exceeds the supported size.");
+    }
+    let plaintext;
+    let sharedSecret;
+    let key;
+    try {
+        decodeCanonicalBase64url(input.ingress.publicKey, 32, "The account service advertised an invalid enrollment public key.");
+        const salt = randomBytes(32);
+        const nonce = randomBytes(12);
+        plaintext = Buffer.from(JSON.stringify({ schemaVersion: 2, refreshToken }), "utf8");
+        if (plaintext.length > input.ingress.maxCiphertextBytes) {
+            throw invalidEnvelope("The encrypted enrollment candidate exceeds the service limit.");
+        }
+        const { publicKey, privateKey } = generateKeyPairSync("x25519");
+        const exported = publicKey.export({ format: "jwk" });
+        if (exported.kty !== "OKP" || exported.crv !== "X25519" || typeof exported.x !== "string") {
+            throw invalidEnvelope("Unable to create an enrollment encryption key.");
+        }
+        const ephemeralPublicKey = decodeCanonicalBase64url(exported.x, 32, "Unable to create an enrollment encryption key.");
+        const serverKey = createPublicKey({
+            key: { kty: "OKP", crv: "X25519", x: input.ingress.publicKey },
+            format: "jwk"
+        });
+        sharedSecret = diffieHellman({ privateKey, publicKey: serverKey });
+        key = Buffer.from(hkdfSync("sha256", sharedSecret, salt, Buffer.from(`${HKDF_INFO_PREFIX}${input.ingress.keyId}`, "utf8"), 32));
+        const aad = codexEnrollmentCandidateAad({
+            tenantId: input.tenantId,
+            intentId: input.intentId,
+            revision: input.revision,
+            idempotencyKey: input.idempotencyKey,
+            keyId: input.ingress.keyId
+        });
+        const cipher = createCipheriv("aes-256-gcm", key, nonce, { authTagLength: 16 });
+        cipher.setAAD(aad);
+        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const authenticationTag = cipher.getAuthTag();
+        if (ciphertext.length > input.ingress.maxCiphertextBytes) {
+            throw invalidEnvelope("The encrypted enrollment candidate exceeds the service limit.");
+        }
+        const envelope = {
+            version: 1,
+            algorithm: ALGORITHM,
+            keyId: input.ingress.keyId,
+            ephemeralPublicKey: ephemeralPublicKey.toString("base64url"),
+            salt: salt.toString("base64url"),
+            nonce: nonce.toString("base64url"),
+            ciphertext: ciphertext.toString("base64url"),
+            authenticationTag: authenticationTag.toString("base64url")
+        };
+        const requestBytes = Buffer.byteLength(JSON.stringify({
+            schemaVersion: 2,
+            revision: input.revision,
+            envelope
+        }), "utf8");
+        if (requestBytes > input.ingress.maxRequestBytes) {
+            throw invalidEnvelope("The encrypted enrollment request exceeds the service limit.");
+        }
+        return envelope;
+    }
+    finally {
+        plaintext?.fill(0);
+        sharedSecret?.fill(0);
+        key?.fill(0);
+    }
+}
+function decodeCanonicalBase64url(value, length, message) {
+    if (!BASE64URL.test(value))
+        throw invalidEnvelope(message);
+    const decoded = Buffer.from(value, "base64url");
+    if (decoded.length !== length || decoded.toString("base64url") !== value) {
+        throw invalidEnvelope(message);
+    }
+    return decoded;
+}
+function required(value, name) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw invalidEnvelope(`${name} is required.`);
+    return normalized;
+}
+function nonnegativeInteger(value, name) {
+    if (!Number.isInteger(value) || value < 0)
+        throw invalidEnvelope(`${name} is invalid.`);
+    return value;
+}
+function invalidEnvelope(message) {
+    return new CodexServiceError(message, "invalid_enrollment_envelope");
+}
+//# sourceMappingURL=enrollment-envelope.js.map

package/dist/enrollment-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment-envelope.js","sourceRoot":"","sources":["../src/enrollment-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMhD,MAAM,SAAS,GAAG,gCAAyC,CAAC;AAC5D,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;AACjF,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAWtC,MAAM,UAAU,2BAA2B,CAAC,KAM3C;IACC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5C,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9C,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QACxD,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAChE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;KACtC,CAAC,EAAE,MAAM,CAAC,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,4BAA4B,CAC1C,KAAwC;IAExC,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjF,MAAM,eAAe,CAAC,oEAAoE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,uBAAuB,EAAE,CAAC;QACtE,MAAM,eAAe,CAAC,mEAAmE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,SAA6B,CAAC;IAClC,IAAI,YAAgC,CAAC;IACrC,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,wBAAwB,CACtB,KAAK,CAAC,OAAO,CAAC,SAAS,EACvB,EAAE,EACF,kEAAkE,CACnE,CAAC;QACF,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACpF,IAAI,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACxD,MAAM,eAAe,CAAC,+DAA+D,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1F,MAAM,eAAe,CAAC,gDAAgD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,kBAAkB,GAAG,wBAAwB,CACjD,QAAQ,CAAC,CAAC,EACV,EAAE,EACF,gDAAgD,CACjD,CAAC;QACF,MAAM,SAAS,GAAG,eAAe,CAAC;YAChC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,YAAY,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACnE,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CACxB,QAAQ,EACR,YAAY,EACZ,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,EAChE,EAAE,CACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,2BAA2B,CAAC;YACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACzD,MAAM,eAAe,CAAC,+DAA+D,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,QAAQ,GAAqC;YACjD,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,SAAS;YACpB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;YAC1B,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5D,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5C,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC3D,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACpD,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,EAAE,MAAM,CAAC,CAAC;QACZ,IAAI,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,eAAe,CAAC,6DAA6D,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa,EAAE,MAAc,EAAE,OAAe;IAC9E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;QACzE,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU;QAAE,MAAM,eAAe,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;IAC/D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,eAAe,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;AACvE,CAAC"}

package/dist/enrollment-flow.d.ts

@@ -0,0 +1,27 @@
+import type { CodexServiceClient } from "./client.js";
+import { withOneShotCodexLogin, type OneShotCodexLoginOptions } from "./enrollment-login.js";
+import type { CodexEnrollmentCandidateResponse } from "./protocol.js";
+type EnrollmentClient = Pick<CodexServiceClient, "getEnrollmentIntent" | "claimEnrollmentIntent" | "heartbeatEnrollmentIntent" | "uploadEnrollmentCandidate">;
+type OneShotLogin = typeof withOneShotCodexLogin;
+export interface ExecuteCodexEnrollmentLoginInput {
+    client: EnrollmentClient;
+    tenantId: string;
+    intentId: string;
+    deviceAuth?: boolean;
+    loginOptions?: Omit<OneShotCodexLoginOptions, "mode">;
+    heartbeatIntervalMs?: number;
+    candidateTransportRetryDelaysMs?: readonly number[];
+    candidateRetryDelaysMs?: readonly number[];
+    wait?: (milliseconds: number) => Promise<void>;
+    randomId?: () => string;
+    oneShotLogin?: OneShotLogin;
+    requireInitialAwaitingCli?: boolean;
+    /** Re-proves the current Bearer is the existing claimant before restarting login. */
+    resumeClaimedIntent?: boolean;
+}
+/**
+ * Claims one server-created intent, runs an isolated official login, and sends
+ * only an authenticated encrypted refresh-token envelope to that exact intent.
+ */
+export declare function executeCodexEnrollmentLogin(input: ExecuteCodexEnrollmentLoginInput): Promise<CodexEnrollmentCandidateResponse>;
+export {};