@tokensrc/codex 1.13.4 → 1.14.0

package/dist/enrollment-flow.js

@@ -0,0 +1,224 @@
+import { randomUUID } from "node:crypto";
+import { sealCodexEnrollmentCandidate } from "./enrollment-envelope.js";
+import { withOneShotCodexLogin } from "./enrollment-login.js";
+import { CodexServiceError } from "./errors.js";
+/**
+ * Claims one server-created intent, runs an isolated official login, and sends
+ * only an authenticated encrypted refresh-token envelope to that exact intent.
+ */
+export async function executeCodexEnrollmentLogin(input) {
+    const randomId = input.randomId ?? randomUUID;
+    const oneShotLogin = input.oneShotLogin ?? withOneShotCodexLogin;
+    let current = await input.client.getEnrollmentIntent(input.intentId);
+    const ingress = current.capabilities.candidateIngress;
+    if (!current.capabilities.candidateUpload || !ingress) {
+        throw new CodexServiceError("服务端尚未启用加密候选上传；为避免生成无法安全接收的 RT，本次不会启动 OpenAI 登录。", "capability_not_enabled", 409);
+    }
+    const resumableClaim = input.resumeClaimedIntent === true
+        && ["CLAIMED", "LOGIN_IN_PROGRESS"].includes(current.intent.status)
+        && current.intent.allowedActions.includes("HEARTBEAT");
+    if (input.requireInitialAwaitingCli
+        && !resumableClaim
+        && (current.intent.status !== "AWAITING_CLI" || !current.intent.allowedActions.includes("CLAIM"))) {
+        throw stateConflict(current);
+    }
+    if (current.intent.allowedActions.includes("CLAIM") || resumableClaim) {
+        current = await input.client.claimEnrollmentIntent(input.intentId, {
+            idempotencyKey: randomId(),
+            revision: current.intent.revision
+        });
+    }
+    if (!["CLAIMED", "LOGIN_IN_PROGRESS"].includes(current.intent.status)
+        || !current.intent.allowedActions.includes("HEARTBEAT")) {
+        throw stateConflict(current);
+    }
+    current = await input.client.heartbeatEnrollmentIntent(input.intentId, {
+        idempotencyKey: randomId(),
+        revision: current.intent.revision,
+        phase: "LOGIN_IN_PROGRESS"
+    });
+    const keepalive = createLoginKeepalive({
+        client: input.client,
+        intentId: input.intentId,
+        current,
+        randomId,
+        intervalMs: input.heartbeatIntervalMs ?? 30_000
+    });
+    try {
+        return await oneShotLogin({
+            ...input.loginOptions,
+            mode: input.deviceAuth ? "device" : "browser"
+        }, async (credentials) => {
+            try {
+                current = await keepalive.stop();
+                const candidateRetryDelays = input.candidateRetryDelaysMs ?? [1_000, 3_000];
+                const transportRetryDelays = input.candidateTransportRetryDelaysMs ?? [250, 1_000];
+                const wait = input.wait ?? defaultWait;
+                for (let candidateAttempt = 0;; candidateAttempt += 1) {
+                    current = await input.client.heartbeatEnrollmentIntent(input.intentId, {
+                        idempotencyKey: randomId(),
+                        revision: current.intent.revision,
+                        phase: "UPLOADING"
+                    });
+                    const revision = current.intent.revision;
+                    const idempotencyKey = randomId();
+                    const candidate = {
+                        schemaVersion: 2,
+                        revision,
+                        envelope: sealCodexEnrollmentCandidate({
+                            tenantId: input.tenantId,
+                            intentId: input.intentId,
+                            revision,
+                            idempotencyKey,
+                            refreshToken: credentials.refreshToken,
+                            ingress
+                        })
+                    };
+                    const result = await uploadCandidateWithRetry({
+                        client: input.client,
+                        intentId: input.intentId,
+                        candidate,
+                        idempotencyKey,
+                        retryDelays: transportRetryDelays,
+                        wait
+                    });
+                    if (result.result.outcome !== "TEMPORARILY_UNAVAILABLE")
+                        return result;
+                    const delay = candidateRetryDelays[candidateAttempt];
+                    if (delay === undefined)
+                        return result;
+                    current = result;
+                    await wait(delay);
+                }
+            }
+            finally {
+                credentials.refreshToken = "";
+                credentials.accessToken = "";
+                credentials.idToken = "";
+                delete credentials.providerAccountId;
+                delete credentials.lastRefresh;
+            }
+        });
+    }
+    finally {
+        await keepalive.stop();
+    }
+}
+async function uploadCandidateWithRetry(input) {
+    let priorAttemptWasUncertain = false;
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            return await input.client.uploadEnrollmentCandidate(input.intentId, input.candidate, input.idempotencyKey);
+        }
+        catch (error) {
+            if (!isUncertainCandidateUpload(error)) {
+                if (priorAttemptWasUncertain) {
+                    return reconcileCandidateUpload(input.client, input.intentId);
+                }
+                throw error;
+            }
+            priorAttemptWasUncertain = true;
+            const delay = input.retryDelays[attempt];
+            if (!isRetryableCandidateUpload(error) || delay === undefined) {
+                return reconcileCandidateUpload(input.client, input.intentId);
+            }
+            await input.wait(delay);
+        }
+    }
+}
+function createLoginKeepalive(input) {
+    let current = input.current;
+    let stopped = false;
+    let timer;
+    let pending = Promise.resolve();
+    let failure;
+    const schedule = () => {
+        if (stopped || input.intervalMs <= 0)
+            return;
+        timer = setTimeout(() => {
+            pending = input.client.heartbeatEnrollmentIntent(input.intentId, {
+                idempotencyKey: input.randomId(),
+                revision: current.intent.revision,
+                phase: "LOGIN_IN_PROGRESS"
+            }).then((response) => {
+                current = response;
+                schedule();
+            }).catch((error) => {
+                failure = error;
+            });
+        }, input.intervalMs);
+        timer.unref();
+    };
+    schedule();
+    return {
+        async stop() {
+            stopped = true;
+            if (timer)
+                clearTimeout(timer);
+            await pending;
+            if (failure)
+                throw failure;
+            return current;
+        }
+    };
+}
+function stateConflict(current) {
+    if (current.intent.status === "TEMPORARILY_UNAVAILABLE") {
+        return new CodexServiceError("This intent retains a prior undispatched candidate that a new login cannot reproduce. Cancel it and create a new enrollment intent.", "enrollment_intent_state_conflict", 409);
+    }
+    return new CodexServiceError(`Enrollment intent cannot start a new official login from status ${current.intent.status}. Check status before retrying.`, "enrollment_intent_state_conflict", 409);
+}
+function isRetryableCandidateUpload(error) {
+    const value = error;
+    return value?.code === "codex_service_unavailable"
+        || typeof value?.status === "number" && value.status >= 500 && value.status <= 599
+        || value?.name === "AbortError"
+        || value?.name === "TimeoutError"
+        || error instanceof TypeError;
+}
+function isUncertainCandidateUpload(error) {
+    const code = error?.code;
+    return isRetryableCandidateUpload(error) || code === "invalid_codex_service_response";
+}
+async function reconcileCandidateUpload(client, intentId) {
+    let observed;
+    try {
+        observed = await client.getEnrollmentIntent(intentId);
+    }
+    catch {
+        throw ambiguousCandidateUpload();
+    }
+    const outcome = candidateOutcomeForStatus(observed.intent.status);
+    if (outcome) {
+        return {
+            ...observed,
+            result: {
+                outcome,
+                managedAccountId: observed.intent.resultManagedAccountId,
+                lineageId: observed.intent.resultLineageId,
+                generationVersion: observed.intent.currentGenerationVersion,
+                replayed: true
+            }
+        };
+    }
+    if (["EXPIRED", "CANCELLED"].includes(observed.intent.status)) {
+        throw new CodexServiceError(`Enrollment candidate ended in terminal status ${observed.intent.status}; do not reuse its login or upload key.`, `enrollment_candidate_${observed.intent.status.toLowerCase()}`, 409);
+    }
+    throw ambiguousCandidateUpload();
+}
+function candidateOutcomeForStatus(status) {
+    return [
+        "READY",
+        "ACCOUNT_MISMATCH",
+        "IDENTITY_UNVERIFIABLE",
+        "TEMPORARILY_UNAVAILABLE",
+        "OUTCOME_AMBIGUOUS"
+    ].includes(status) ? status : undefined;
+}
+function ambiguousCandidateUpload() {
+    return new CodexServiceError("The enrollment candidate upload result is not safely known. Do not start another login or submit a new key; inspect this same intent and resume only from a terminal Server result.", "enrollment_candidate_upload_ambiguous", 409);
+}
+function defaultWait(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+//# sourceMappingURL=enrollment-flow.js.map

package/dist/enrollment-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment-flow.js","sourceRoot":"","sources":["../src/enrollment-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EACL,qBAAqB,EAEtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA+BhD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAuC;IAEvC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,UAAU,CAAC;IAC9C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACjE,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC;QACtD,MAAM,IAAI,iBAAiB,CACzB,iDAAiD,EACjD,wBAAwB,EACxB,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,mBAAmB,KAAK,IAAI;WACpD,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;WAChE,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,yBAAyB;WAC9B,CAAC,cAAc;WACf,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,cAAc,EAAE,CAAC;QACtE,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE;YACjE,cAAc,EAAE,QAAQ,EAAE;YAC1B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;WAChE,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE;QACrE,cAAc,EAAE,QAAQ,EAAE;QAC1B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,KAAK,EAAE,mBAAmB;KAC3B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,oBAAoB,CAAC;QACrC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO;QACP,QAAQ;QACR,UAAU,EAAE,KAAK,CAAC,mBAAmB,IAAI,MAAM;KAChD,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC;YACxB,GAAG,KAAK,CAAC,YAAY;YACrB,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC9C,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YACvB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,oBAAoB,GAAG,KAAK,CAAC,sBAAsB,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC5E,MAAM,oBAAoB,GAAG,KAAK,CAAC,+BAA+B,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACnF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC;gBAEvC,KAAK,IAAI,gBAAgB,GAAG,CAAC,GAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBACvD,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE;wBACrE,cAAc,EAAE,QAAQ,EAAE;wBAC1B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;wBACjC,KAAK,EAAE,WAAW;qBACnB,CAAC,CAAC;oBACH,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACzC,MAAM,cAAc,GAAG,QAAQ,EAAE,CAAC;oBAClC,MAAM,SAAS,GAAG;wBAChB,aAAa,EAAE,CAAU;wBACzB,QAAQ;wBACR,QAAQ,EAAE,4BAA4B,CAAC;4BACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,QAAQ;4BACR,cAAc;4BACd,YAAY,EAAE,WAAW,CAAC,YAAY;4BACtC,OAAO;yBACR,CAAC;qBACH,CAAC;oBACF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;wBAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,SAAS;wBACT,cAAc;wBACd,WAAW,EAAE,oBAAoB;wBACjC,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,yBAAyB;wBAAE,OAAO,MAAM,CAAC;oBACvE,MAAM,KAAK,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;oBACrD,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,MAAM,CAAC;oBACvC,OAAO,GAAG,MAAM,CAAC;oBACjB,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,WAAW,CAAC,YAAY,GAAG,EAAE,CAAC;gBAC9B,WAAW,CAAC,WAAW,GAAG,EAAE,CAAC;gBAC7B,WAAW,CAAC,OAAO,GAAG,EAAE,CAAC;gBACzB,OAAO,WAAW,CAAC,iBAAiB,CAAC;gBACrC,OAAO,WAAW,CAAC,WAAW,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAOvC;IACC,IAAI,wBAAwB,GAAG,KAAK,CAAC;IACrC,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,yBAAyB,CACjD,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,cAAc,CACrB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,IAAI,wBAAwB,EAAE,CAAC;oBAC7B,OAAO,wBAAwB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,wBAAwB,GAAG,IAAI,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9D,OAAO,wBAAwB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAM7B;IACC,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAiC,CAAC;IACtC,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,IAAI,OAAgB,CAAC;IAErB,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,IAAI,OAAO,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC;YAAE,OAAO;QAC7C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAC/D,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE;gBAChC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;gBACjC,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACnB,OAAO,GAAG,QAAQ,CAAC;gBACnB,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC1B,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACrB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,QAAQ,EAAE,CAAC;IAEX,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,OAAO,CAAC;YACd,IAAI,OAAO;gBAAE,MAAM,OAAO,CAAC;YAC3B,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAsC;IAC3D,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACxD,OAAO,IAAI,iBAAiB,CAC1B,qIAAqI,EACrI,kCAAkC,EAClC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,iBAAiB,CAC1B,mEAAmE,OAAO,CAAC,MAAM,CAAC,MAAM,iCAAiC,EACzH,kCAAkC,EAClC,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,MAAM,KAAK,GAAG,KAAyE,CAAC;IACxF,OAAO,KAAK,EAAE,IAAI,KAAK,2BAA2B;WAC7C,OAAO,KAAK,EAAE,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;WAC/E,KAAK,EAAE,IAAI,KAAK,YAAY;WAC5B,KAAK,EAAE,IAAI,KAAK,cAAc;WAC9B,KAAK,YAAY,SAAS,CAAC;AAClC,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,MAAM,IAAI,GAAI,KAAwC,EAAE,IAAI,CAAC;IAC7D,OAAO,0BAA0B,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,gCAAgC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAqD,EACrD,QAAgB;IAEhB,IAAI,QAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,wBAAwB,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,OAAO,GAAG,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,GAAG,QAAQ;YACX,MAAM,EAAE;gBACN,OAAO;gBACP,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,sBAAsB;gBACxD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe;gBAC1C,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,wBAAwB;gBAC3D,QAAQ,EAAE,IAAI;aACf;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,iBAAiB,CACzB,iDAAiD,QAAQ,CAAC,MAAM,CAAC,MAAM,yCAAyC,EAChH,wBAAwB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAC9D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,wBAAwB,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAyD;IAEzD,OAAO;QACL,OAAO;QACP,kBAAkB;QAClB,uBAAuB;QACvB,yBAAyB;QACzB,mBAAmB;KACpB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAA+D,CAAC,CAAC,CAAC,SAAS,CAAC;AACnG,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,IAAI,iBAAiB,CAC1B,qLAAqL,EACrL,uCAAuC,EACvC,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,YAAoB;IACvC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/enrollment-login.d.ts

@@ -0,0 +1,26 @@
+import { type CodexRuntimeOptions } from "./runtime.js";
+export interface OneShotCodexCredentials {
+    idToken: string;
+    accessToken: string;
+    refreshToken: string;
+    providerAccountId?: string;
+    lastRefresh?: string;
+}
+export interface OneShotCodexLoginContext {
+    codexHome: string;
+    args: string[];
+    env: NodeJS.ProcessEnv;
+}
+export interface OneShotCodexLoginOptions {
+    mode?: "browser" | "device";
+    env?: NodeJS.ProcessEnv;
+    temporaryRoot?: string;
+    runtime?: Omit<CodexRuntimeOptions, "env">;
+    runner?: (context: OneShotCodexLoginContext) => Promise<number>;
+}
+/**
+ * Runs one isolated official Codex login without touching the normal Codex home
+ * or the codex-multi-auth account pool. Credentials exist only for the duration
+ * of `consume`; the isolated home is removed on success, failure, or cancellation.
+ */
+export declare function withOneShotCodexLogin<T>(options: OneShotCodexLoginOptions, consume: (credentials: OneShotCodexCredentials) => Promise<T>): Promise<T>;

package/dist/enrollment-login.js

@@ -0,0 +1,104 @@
+import { lstat, mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { z } from "zod";
+import { CodexRuntimeError } from "./errors.js";
+import { resolveCodexRuntime, runCodexLaunch } from "./runtime.js";
+const MAX_AUTH_FILE_BYTES = 1024 * 1024;
+const OneShotAuthFileSchema = z.strictObject({
+    auth_mode: z.literal("chatgpt"),
+    OPENAI_API_KEY: z.unknown().optional(),
+    tokens: z.strictObject({
+        id_token: z.string().min(1),
+        access_token: z.string().min(1),
+        refresh_token: z.string().min(1),
+        account_id: z.string().min(1).optional()
+    }),
+    last_refresh: z.string().datetime({ offset: true }).optional()
+});
+async function runOfficialLogin(context, runtime) {
+    const launch = await resolveCodexRuntime(context.args, {
+        ...runtime,
+        env: context.env
+    });
+    return runCodexLaunch(launch, context.env, runtime?.binaryEnvNames?.[0]);
+}
+async function readOneShotCredentials(codexHome) {
+    const authPath = join(codexHome, "auth.json");
+    const file = await lstat(authPath).catch((error) => {
+        if (error.code === "ENOENT") {
+            throw new CodexRuntimeError("Official Codex login completed without creating auth.json.");
+        }
+        throw error;
+    });
+    if (!file.isFile() || file.isSymbolicLink() || file.size > MAX_AUTH_FILE_BYTES) {
+        throw new CodexRuntimeError("Official Codex login produced an invalid auth.json file.");
+    }
+    let decoded;
+    let encoded;
+    try {
+        encoded = await readFile(authPath);
+        decoded = JSON.parse(encoded.toString("utf8"));
+    }
+    catch (error) {
+        throw new CodexRuntimeError("Official Codex login produced unreadable auth.json data.", {
+            cause: error
+        });
+    }
+    finally {
+        encoded?.fill(0);
+    }
+    const parsed = OneShotAuthFileSchema.safeParse(decoded);
+    if (!parsed.success) {
+        throw new CodexRuntimeError("Official Codex login did not produce complete ChatGPT credentials.");
+    }
+    return {
+        idToken: parsed.data.tokens.id_token,
+        accessToken: parsed.data.tokens.access_token,
+        refreshToken: parsed.data.tokens.refresh_token,
+        ...(parsed.data.tokens.account_id
+            ? { providerAccountId: parsed.data.tokens.account_id }
+            : {}),
+        ...(parsed.data.last_refresh ? { lastRefresh: parsed.data.last_refresh } : {})
+    };
+}
+/**
+ * Runs one isolated official Codex login without touching the normal Codex home
+ * or the codex-multi-auth account pool. Credentials exist only for the duration
+ * of `consume`; the isolated home is removed on success, failure, or cancellation.
+ */
+export async function withOneShotCodexLogin(options, consume) {
+    const baseEnv = options.env ?? process.env;
+    const temporaryRoot = resolve(options.temporaryRoot ?? tmpdir());
+    const codexHome = await mkdtemp(join(temporaryRoot, "numa-codex-enrollment-"));
+    const args = ["login", ...(options.mode === "device" ? ["--device-auth"] : [])];
+    const env = { ...baseEnv, CODEX_HOME: codexHome };
+    try {
+        const exitCode = await (options.runner
+            ? options.runner({ codexHome, args, env })
+            : runOfficialLogin({ codexHome, args, env }, options.runtime));
+        if (exitCode !== 0) {
+            throw new CodexRuntimeError(`Official Codex login exited with code ${exitCode}.`);
+        }
+        const credentials = await readOneShotCredentials(codexHome);
+        try {
+            return await consume(credentials);
+        }
+        finally {
+            credentials.refreshToken = "";
+            credentials.accessToken = "";
+            credentials.idToken = "";
+            delete credentials.providerAccountId;
+            delete credentials.lastRefresh;
+        }
+    }
+    finally {
+        try {
+            await rm(codexHome, { recursive: true, force: true });
+        }
+        catch (error) {
+            throw new CodexRuntimeError("Unable to remove the isolated Codex login directory; remove it before retrying enrollment.", { cause: error });
+        }
+    }
+}
+//# sourceMappingURL=enrollment-login.js.map

package/dist/enrollment-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment-login.js","sourceRoot":"","sources":["../src/enrollment-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,cAAc,EAEf,MAAM,cAAc,CAAC;AAEtB,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC/B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC;QACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC;AAwBH,KAAK,UAAU,gBAAgB,CAC7B,OAAiC,EACjC,OAAqD;IAErD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE;QACrD,GAAG,OAAO;QACV,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1D,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,iBAAiB,CAAC,4DAA4D,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAC/E,MAAM,IAAI,iBAAiB,CAAC,0DAA0D,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,0DAA0D,EAAE;YACtF,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,oEAAoE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;QACpC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY;QAC5C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa;QAC9C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU;YAC/B,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAiC,EACjC,OAA6D;IAE7D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM;YACpC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YAC1C,CAAC,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,QAAQ,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,YAAY,GAAG,EAAE,CAAC;YAC9B,WAAW,CAAC,WAAW,GAAG,EAAE,CAAC;YAC7B,WAAW,CAAC,OAAO,GAAG,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC,iBAAiB,CAAC;YACrC,OAAO,WAAW,CAAC,WAAW,CAAC;QACjC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CACzB,4FAA4F,EAC5F,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -15,4 +15,17 @@ export * from "./config.js";
 export * from "./quota-cache.js";
 export * from "./legacy-cleanup.js";
 export * from "./profile.js";
+export * from "./enrollment-login.js";
+export * from "./enrollment-envelope.js";
+export * from "./enrollment-flow.js";
+export * from "./migration-login-batch.js";
+export * from "./short-lived-delivery.js";
+export * from "./short-lived-delivery-flow.js";
+export * from "./short-lived-delivery-journal.js";
+export * from "./credential-supervisor.js";
+export * from "./managed-credential-v3.js";
+export * from "./managed-credential-v3-envelope.js";
+export * from "./managed-credential-v3-flow.js";
+export * from "./managed-credential-v3-journal.js";
+export * from "./retirement-flow.js";
 export { registerCodexCommands } from "./commands.js";

package/dist/index.js

@@ -24,10 +24,10 @@ export async function createCodexModule(options = {}) {
         launchMode: config.launcher.launchMode,
         packageName: "@openai/codex"
     });
-    const run = async (args = []) => runCodexLaunch(await resolveRuntime(args), env, config.launcher.binaryEnvNames[0]);
-    const app = async (workspace = ".") => {
+    const run = async (args = [], launchOptions = {}) => runCodexLaunch(await resolveRuntime(args), env, config.launcher.binaryEnvNames[0], launchOptions);
+    const app = async (workspace = ".", launchOptions = {}) => {
         await options.desktopApp?.prepare?.();
-        return run(["app", workspace]);
+        return run(["app", workspace], launchOptions);
     };
     const module = {
         config,
@@ -42,6 +42,7 @@ export async function createCodexModule(options = {}) {
                 status,
                 run,
                 app,
+                env,
                 output: options.output ?? process.stdout,
                 errorOutput: options.errorOutput ?? process.stderr,
                 jsonEnabled: options.jsonEnabled
@@ -68,5 +69,18 @@ export * from "./config.js";
 export * from "./quota-cache.js";
 export * from "./legacy-cleanup.js";
 export * from "./profile.js";
+export * from "./enrollment-login.js";
+export * from "./enrollment-envelope.js";
+export * from "./enrollment-flow.js";
+export * from "./migration-login-batch.js";
+export * from "./short-lived-delivery.js";
+export * from "./short-lived-delivery-flow.js";
+export * from "./short-lived-delivery-journal.js";
+export * from "./credential-supervisor.js";
+export * from "./managed-credential-v3.js";
+export * from "./managed-credential-v3-envelope.js";
+export * from "./managed-credential-v3-flow.js";
+export * from "./managed-credential-v3-journal.js";
+export * from "./retirement-flow.js";
 export { registerCodexCommands } from "./commands.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAO,GAAuB,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,CAAC,UAAU,GAAwD,EAAE,EAAE,EAAE,CACzF,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM;QAC5B,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC;QAC7G,CAAC,CAAC,MAAM,CAAC;IACb,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE;QACtF,iBAAiB,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO;KAC/C,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,CAAC,IAAI,GAAa,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE;QACxE,GAAG;QACH,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;QACnC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc;QAC9C,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe;QAChD,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,WAAW,EAAE,eAAe;KAC7B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,GAAa,EAAE,EAAmB,EAAE,CAAC,cAAc,CACxE,MAAM,cAAc,CAAC,IAAI,CAAC,EAC1B,GAAG,EACH,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAClC,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,EAAE,SAAS,GAAG,GAAG,EAAE,EAAE;QACpC,MAAM,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,MAAM,MAAM,GAAgB;QAC1B,MAAM;QACN,MAAM;QACN,MAAM;QACN,gBAAgB,CAAC,OAAgB,EAAE,cAAc,GAAG,EAAE;YACpD,OAAO,qBAAqB,CAAC,OAAO,EAAE;gBACpC,MAAM;gBACN,IAAI;gBACJ,MAAM;gBACN,SAAS;gBACT,MAAM;gBACN,GAAG;gBACH,GAAG;gBACH,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;gBACxC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM;gBAClD,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,EAAE,cAAc,CAAC,CAAC;QACrB,CAAC;QACD,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;QACrC,cAAc;QACd,GAAG;QACH,GAAG;KACJ,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAGD,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAO,GAAuB,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,CAAC,UAAU,GAAwD,EAAE,EAAE,EAAE,CACzF,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM;QAC5B,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC;QAC7G,CAAC,CAAC,MAAM,CAAC;IACb,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE;QACtF,iBAAiB,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO;KAC/C,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,CAAC,IAAI,GAAa,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE;QACxE,GAAG;QACH,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;QACnC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc;QAC9C,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe;QAChD,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,WAAW,EAAE,eAAe;KAC7B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,GAAa,EAAE,EAAE,aAAa,GAA6B,EAAE,EAAmB,EAAE,CAAC,cAAc,CACtH,MAAM,cAAc,CAAC,IAAI,CAAC,EAC1B,GAAG,EACH,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EACjC,aAAa,CACd,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,EAAE,SAAS,GAAG,GAAG,EAAE,aAAa,GAA6B,EAAE,EAAE,EAAE;QAClF,MAAM,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;IAChD,CAAC,CAAC;IACF,MAAM,MAAM,GAAgB;QAC1B,MAAM;QACN,MAAM;QACN,MAAM;QACN,gBAAgB,CAAC,OAAgB,EAAE,cAAc,GAAG,EAAE;YACpD,OAAO,qBAAqB,CAAC,OAAO,EAAE;gBACpC,MAAM;gBACN,IAAI;gBACJ,MAAM;gBACN,SAAS;gBACT,MAAM;gBACN,GAAG;gBACH,GAAG;gBACH,GAAG;gBACH,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;gBACxC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM;gBAClD,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,EAAE,cAAc,CAAC,CAAC;QACrB,CAAC;QACD,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;QACrC,cAAc;QACd,GAAG;QACH,GAAG;KACJ,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAGD,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mCAAmC,CAAC;AAClD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC"}

package/dist/managed-credential-v3-envelope.d.ts

@@ -0,0 +1,60 @@
+import { type KeyObject } from "node:crypto";
+import { type CodexV3CredentialEnvelope, type CodexV3CredentialIngress, type CodexV3FullCredentialDeliveryResponse, type CodexV3FullCredentialBundle, type CodexShortLivedDeliveryClientKey } from "./protocol.js";
+export interface CodexV3FullCredentialInput {
+    refreshToken: string;
+    accessToken: string;
+    idToken: string;
+    providerAccountId: string;
+    expiresAt: string;
+}
+export interface CodexV3DeliveryKeyPair {
+    clientKey: CodexShortLivedDeliveryClientKey;
+    privateKey: KeyObject;
+}
+export declare function codexV3EnrollmentAad(input: {
+    tenantId: string;
+    subject: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    keyId: string;
+}): Buffer;
+export declare function codexV3GenerationReportAad(input: {
+    tenantId: string;
+    subject: string;
+    lineageId: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    expectedGenerationVersion: number;
+    rotationMode: "ROTATED" | "RETAINED";
+    keyId: string;
+}): Buffer;
+export declare function sealCodexV3Enrollment(input: {
+    tenantId: string;
+    subject: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    ingress: CodexV3CredentialIngress;
+    credentials: CodexV3FullCredentialInput;
+}): CodexV3CredentialEnvelope;
+export declare function sealCodexV3GenerationReport(input: {
+    tenantId: string;
+    subject: string;
+    lineageId: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    expectedGenerationVersion: number;
+    rotationMode: "ROTATED" | "RETAINED";
+    ingress: CodexV3CredentialIngress;
+    credentials: CodexV3FullCredentialInput;
+}): CodexV3CredentialEnvelope;
+export declare function createCodexV3DeliveryKeyPair(): CodexV3DeliveryKeyPair;
+export declare function codexV3FullDeliveryAad(input: {
+    tenantId: string;
+    delivery: CodexV3FullCredentialDeliveryResponse["delivery"];
+}): Buffer;
+export declare function openCodexV3FullCredentialDelivery(input: {
+    tenantId: string;
+    response: CodexV3FullCredentialDeliveryResponse;
+    privateKey: KeyObject;
+    now?: number;
+}): CodexV3FullCredentialBundle;