@tokensrc/codex 1.13.4 → 1.14.0

package/dist/managed-credential-v3-envelope.js

@@ -0,0 +1,234 @@
+import { createCipheriv, createDecipheriv, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
+import { CodexServiceError } from "./errors.js";
+import { CodexV3FullCredentialBundleSchema } from "./protocol.js";
+const ALGORITHM = "X25519-HKDF-SHA256-AES-256-GCM";
+const ENROLLMENT_KDF = "active-code-inbox/codex-enrollment-candidate/key/v1\0";
+const DELIVERY_KDF = "active-code-inbox/codex-short-lived-delivery/key/v1\0";
+const BASE64URL = /^[A-Za-z0-9_-]+$/u;
+const MAX_TOKEN_BYTES = 65_536;
+export function codexV3EnrollmentAad(input) {
+    return Buffer.from(JSON.stringify({
+        schemaVersion: 3,
+        purpose: "ENROLLMENT",
+        tenant: required(input.tenantId, "tenantId"),
+        subject: required(input.subject, "subject"),
+        clientRequestId: required(input.clientRequestId, "clientRequestId"),
+        idempotencyKey: required(input.idempotencyKey, "idempotencyKey"),
+        keyId: required(input.keyId, "keyId")
+    }), "utf8");
+}
+export function codexV3GenerationReportAad(input) {
+    return Buffer.from(JSON.stringify({
+        schemaVersion: 3,
+        purpose: "GENERATION_REPORT",
+        tenant: required(input.tenantId, "tenantId"),
+        subject: required(input.subject, "subject"),
+        lineageId: required(input.lineageId, "lineageId"),
+        clientRequestId: required(input.clientRequestId, "clientRequestId"),
+        idempotencyKey: required(input.idempotencyKey, "idempotencyKey"),
+        expectedGenerationVersion: positive(input.expectedGenerationVersion, "expectedGenerationVersion"),
+        rotationMode: input.rotationMode,
+        keyId: required(input.keyId, "keyId")
+    }), "utf8");
+}
+export function sealCodexV3Enrollment(input) {
+    return sealToServer({
+        ingress: input.ingress,
+        aad: codexV3EnrollmentAad({ ...input, keyId: input.ingress.keyId }),
+        plaintext: {
+            schemaVersion: 3,
+            refreshToken: secret(input.credentials.refreshToken, "refreshToken"),
+            accessToken: secret(input.credentials.accessToken, "accessToken"),
+            idToken: secret(input.credentials.idToken, "idToken"),
+            providerAccountId: required(input.credentials.providerAccountId, "providerAccountId"),
+            expiresAt: instant(input.credentials.expiresAt, "expiresAt")
+        },
+        request: (envelope) => ({ clientRequestId: input.clientRequestId, envelope })
+    });
+}
+export function sealCodexV3GenerationReport(input) {
+    return sealToServer({
+        ingress: input.ingress,
+        aad: codexV3GenerationReportAad({ ...input, keyId: input.ingress.keyId }),
+        plaintext: {
+            schemaVersion: 3,
+            refreshToken: secret(input.credentials.refreshToken, "refreshToken"),
+            accessToken: secret(input.credentials.accessToken, "accessToken"),
+            idToken: secret(input.credentials.idToken, "idToken"),
+            providerAccountId: required(input.credentials.providerAccountId, "providerAccountId"),
+            expiresAt: instant(input.credentials.expiresAt, "expiresAt")
+        },
+        request: (envelope) => ({
+            clientRequestId: input.clientRequestId,
+            expectedGenerationVersion: input.expectedGenerationVersion,
+            rotationMode: input.rotationMode,
+            envelope
+        })
+    });
+}
+function sealToServer(input) {
+    if (input.ingress.envelopeVersion !== 1 || input.ingress.algorithm !== ALGORITHM) {
+        throw invalidEnvelope("The account service advertised an unsupported v3 credential envelope.");
+    }
+    let plaintext;
+    let sharedSecret;
+    let key;
+    try {
+        decodeBase64url(input.ingress.publicKey, 32, "Invalid v3 ingress public key.");
+        plaintext = Buffer.from(JSON.stringify(input.plaintext), "utf8");
+        if (plaintext.length > input.ingress.maxCiphertextBytes) {
+            throw invalidEnvelope("The v3 credential bundle exceeds the service limit.");
+        }
+        const { publicKey, privateKey } = generateKeyPairSync("x25519");
+        const exported = publicKey.export({ format: "jwk" });
+        if (exported.kty !== "OKP" || exported.crv !== "X25519" || typeof exported.x !== "string") {
+            throw invalidEnvelope("Unable to create a v3 credential encryption key.");
+        }
+        const salt = randomBytes(32);
+        const nonce = randomBytes(12);
+        const remote = createPublicKey({
+            key: { kty: "OKP", crv: "X25519", x: input.ingress.publicKey },
+            format: "jwk"
+        });
+        sharedSecret = diffieHellman({ privateKey, publicKey: remote });
+        key = Buffer.from(hkdfSync("sha256", sharedSecret, salt, Buffer.from(`${ENROLLMENT_KDF}${input.ingress.keyId}`, "utf8"), 32));
+        const cipher = createCipheriv("aes-256-gcm", key, nonce, { authTagLength: 16 });
+        cipher.setAAD(input.aad);
+        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const envelope = {
+            version: 1,
+            algorithm: ALGORITHM,
+            keyId: input.ingress.keyId,
+            ephemeralPublicKey: exported.x,
+            salt: salt.toString("base64url"),
+            nonce: nonce.toString("base64url"),
+            ciphertext: ciphertext.toString("base64url"),
+            authenticationTag: cipher.getAuthTag().toString("base64url")
+        };
+        if (Buffer.byteLength(JSON.stringify(input.request(envelope)), "utf8") > input.ingress.maxRequestBytes) {
+            throw invalidEnvelope("The v3 credential request exceeds the service limit.");
+        }
+        return envelope;
+    }
+    catch (error) {
+        if (error instanceof CodexServiceError)
+            throw error;
+        throw invalidEnvelope("Unable to create the authenticated v3 credential envelope.");
+    }
+    finally {
+        input.aad.fill(0);
+        plaintext?.fill(0);
+        sharedSecret?.fill(0);
+        key?.fill(0);
+    }
+}
+export function createCodexV3DeliveryKeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync("x25519");
+    const exported = publicKey.export({ format: "jwk" });
+    if (exported.kty !== "OKP" || exported.crv !== "X25519" || typeof exported.x !== "string") {
+        throw invalidEnvelope("Unable to create a v3 delivery key.");
+    }
+    decodeBase64url(exported.x, 32, "Unable to create a v3 delivery key.");
+    return { clientKey: { version: 1, algorithm: ALGORITHM, publicKey: exported.x }, privateKey };
+}
+export function codexV3FullDeliveryAad(input) {
+    const delivery = input.delivery;
+    return Buffer.from(JSON.stringify({
+        schemaVersion: 3,
+        tenant: required(input.tenantId, "tenantId"),
+        subject: required(delivery.subject, "subject"),
+        assignmentId: required(delivery.assignmentId, "assignmentId"),
+        managedAccountId: required(delivery.managedAccountId, "managedAccountId"),
+        providerAccountId: required(delivery.providerAccountId, "providerAccountId"),
+        lineageId: required(delivery.lineageId, "lineageId"),
+        generationVersion: positive(delivery.generationVersion, "generationVersion"),
+        deliveryId: required(delivery.id, "deliveryId"),
+        clientRequestId: required(delivery.clientRequestId, "clientRequestId"),
+        issuedAt: instant(delivery.issuedAt, "issuedAt"),
+        credentialExpiresAt: instant(delivery.credentialExpiresAt, "credentialExpiresAt"),
+        ackExpiresAt: instant(delivery.ackExpiresAt, "ackExpiresAt")
+    }), "utf8");
+}
+export function openCodexV3FullCredentialDelivery(input) {
+    const delivery = input.response.delivery;
+    if (input.privateKey.asymmetricKeyType !== "x25519" || delivery.envelope.version !== 1
+        || delivery.envelope.algorithm !== ALGORITHM) {
+        throw invalidEnvelope("The account service returned an unsupported v3 delivery envelope.");
+    }
+    const ephemeral = decodeBase64url(delivery.envelope.ephemeralPublicKey, 32, "Invalid v3 delivery public key.");
+    const salt = decodeBase64url(delivery.envelope.salt, 32, "Invalid v3 delivery salt.");
+    const nonce = decodeBase64url(delivery.envelope.nonce, 12, "Invalid v3 delivery nonce.");
+    const tag = decodeBase64url(delivery.envelope.authenticationTag, 16, "Invalid v3 delivery tag.");
+    const ciphertext = decodeBase64url(delivery.envelope.ciphertext, undefined, "Invalid v3 delivery ciphertext.");
+    const remote = createPublicKey({ key: { kty: "OKP", crv: "X25519", x: ephemeral.toString("base64url") }, format: "jwk" });
+    const sharedSecret = diffieHellman({ privateKey: input.privateKey, publicKey: remote });
+    const key = Buffer.from(hkdfSync("sha256", sharedSecret, salt, Buffer.from(`${DELIVERY_KDF}${delivery.id}`, "utf8"), 32));
+    let plaintext;
+    const aad = codexV3FullDeliveryAad({ tenantId: input.tenantId, delivery });
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", key, nonce, { authTagLength: 16 });
+        decipher.setAAD(aad);
+        decipher.setAuthTag(tag);
+        plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        const parsed = CodexV3FullCredentialBundleSchema.safeParse(JSON.parse(plaintext.toString("utf8")));
+        if (!parsed.success)
+            throw invalidEnvelope("The account service returned an invalid v3 credential bundle.");
+        const bundle = parsed.data;
+        if (bundle.deliveryId !== delivery.id || bundle.managedAccountId !== delivery.managedAccountId
+            || bundle.providerAccountId !== delivery.providerAccountId || bundle.lineageId !== delivery.lineageId
+            || bundle.generationVersion !== delivery.generationVersion || bundle.expiresAt !== delivery.credentialExpiresAt) {
+            throw invalidEnvelope("The v3 credential bundle does not match its delivery metadata.");
+        }
+        if (Date.parse(bundle.expiresAt) <= (input.now ?? Date.now())
+            || Date.parse(delivery.ackExpiresAt) <= (input.now ?? Date.now())) {
+            throw new CodexServiceError("The v3 credential delivery has expired.", "full_credential_delivery_expired");
+        }
+        return bundle;
+    }
+    catch (error) {
+        if (error instanceof CodexServiceError)
+            throw error;
+        throw invalidEnvelope("Unable to authenticate the v3 credential delivery.");
+    }
+    finally {
+        aad.fill(0);
+        plaintext?.fill(0);
+        sharedSecret.fill(0);
+        key.fill(0);
+    }
+}
+function decodeBase64url(value, length, message) {
+    if (!value || !BASE64URL.test(value))
+        throw invalidEnvelope(message);
+    const decoded = Buffer.from(value, "base64url");
+    if ((length !== undefined && decoded.length !== length) || decoded.toString("base64url") !== value) {
+        throw invalidEnvelope(message);
+    }
+    return decoded;
+}
+function required(value, name) {
+    if (value !== value.trim() || value.length < 1 || value.length > 512) {
+        throw invalidEnvelope(`${name} is invalid.`);
+    }
+    return value;
+}
+function secret(value, name) {
+    if (!value || Buffer.byteLength(value, "utf8") > MAX_TOKEN_BYTES) {
+        throw invalidEnvelope(`${name} is invalid.`);
+    }
+    return value;
+}
+function positive(value, name) {
+    if (!Number.isInteger(value) || value <= 0)
+        throw invalidEnvelope(`${name} is invalid.`);
+    return value;
+}
+function instant(value, name) {
+    if (value !== value.trim() || !Number.isFinite(Date.parse(value)))
+        throw invalidEnvelope(`${name} is invalid.`);
+    return value;
+}
+function invalidEnvelope(message) {
+    return new CodexServiceError(message, "invalid_managed_codex_v3_envelope");
+}
+//# sourceMappingURL=managed-credential-v3-envelope.js.map

package/dist/managed-credential-v3-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-credential-v3-envelope.js","sourceRoot":"","sources":["../src/managed-credential-v3-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,EACR,WAAW,EAEZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,iCAAiC,EAMlC,MAAM,eAAe,CAAC;AAEvB,MAAM,SAAS,GAAG,gCAAyC,CAAC;AAC5D,MAAM,cAAc,GAAG,uDAAuD,CAAC;AAC/E,MAAM,YAAY,GAAG,uDAAuD,CAAC;AAC7E,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,eAAe,GAAG,MAAM,CAAC;AAe/B,MAAM,UAAU,oBAAoB,CAAC,KAMpC;IACC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,YAAY;QACrB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5C,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;QAC3C,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC;QACnE,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAChE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;KACtC,CAAC,EAAE,MAAM,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAS1C;IACC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5C,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;QAC3C,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;QACjD,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC;QACnE,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAChE,yBAAyB,EAAE,QAAQ,CAAC,KAAK,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;QACjG,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;KACtC,CAAC,EAAE,MAAM,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAOrC;IACC,OAAO,YAAY,CAAC;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,oBAAoB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnE,SAAS,EAAE;YACT,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,cAAc,CAAC;YACpE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC;YACjE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC;YACrD,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;YACrF,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;SAC7D;QACD,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,EAAE,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAU3C;IACC,OAAO,YAAY,CAAC;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,EAAE,0BAA0B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACzE,SAAS,EAAE;YACT,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,cAAc,CAAC;YACpE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC;YACjE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC;YACrD,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;YACrF,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC;SAC7D;QACD,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACtB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ;SACT,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAKrB;IACC,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjF,MAAM,eAAe,CAAC,uEAAuE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAA6B,CAAC;IAClC,IAAI,YAAgC,CAAC;IACrC,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC/E,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACxD,MAAM,eAAe,CAAC,qDAAqD,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1F,MAAM,eAAe,CAAC,kDAAkD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,eAAe,CAAC;YAC7B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,YAAY,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EACrD,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAA8B;YAC1C,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,SAAS;YACpB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;YAC1B,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC9B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5C,iBAAiB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC7D,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACvG,MAAM,eAAe,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,KAAK,CAAC;QACpD,MAAM,eAAe,CAAC,4DAA4D,CAAC,CAAC;IACtF,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1F,MAAM,eAAe,CAAC,qCAAqC,CAAC,CAAC;IAC/D,CAAC;IACD,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,qCAAqC,CAAC,CAAC;IACvE,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAGtC;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5C,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;QAC9C,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC;QAC7D,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QACzE,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QAC5E,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;QACpD,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QAC5E,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;QAC/C,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC;QACtE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QAChD,mBAAmB,EAAE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACjF,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC;KAC7D,CAAC,EAAE,MAAM,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAKjD;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACzC,IAAI,KAAK,CAAC,UAAU,CAAC,iBAAiB,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC;WACjF,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,eAAe,CAAC,mEAAmE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,EAAE,iCAAiC,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,4BAA4B,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACjG,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,iCAAiC,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1H,MAAM,YAAY,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,GAAG,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,SAA6B,CAAC;IAClC,MAAM,GAAG,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,iCAAiC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC,CAAC;QAC9G,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,eAAe,CAAC,+DAA+D,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3B,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;eACzF,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;eAClG,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YAClH,MAAM,eAAe,CAAC,gEAAgE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;eACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,EAAE,kCAAkC,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,KAAK,CAAC;QACpD,MAAM,eAAe,CAAC,oDAAoD,CAAC,CAAC;IAC9E,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,MAA0B,EAAE,OAAe;IACjF,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;QACnG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACrE,MAAM,eAAe,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,IAAY;IACzC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,eAAe,EAAE,CAAC;QACjE,MAAM,eAAe,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,eAAe,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,IAAY;IAC1C,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,eAAe,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAChH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/managed-credential-v3-flow.d.ts

@@ -0,0 +1,45 @@
+import type { CodexServiceClient } from "./client.js";
+type V3Client = Pick<CodexServiceClient, "getCurrentActorSubject" | "getV3EnrollmentConfiguration" | "createV3Enrollment" | "resolveV3Enrollment" | "createV3FullCredentialDelivery" | "resolveV3FullCredentialDelivery" | "acknowledgeV3FullCredentialDelivery" | "listV3CredentialAssignments" | "reportV3Generation" | "resolveV3GenerationReport">;
+export interface ManagedCodexV3EnrollmentResult {
+    enrollmentId: string;
+    assignmentId: string;
+    managedAccountId: string;
+    providerAccountId: string;
+    lineageId: string;
+    generationVersion: number;
+    authorityMode: "CLIENT_MANAGED";
+    authorityEpoch: number;
+    credentialExpiresAt: string;
+    enrollmentReplayed: boolean;
+    deliveryReplayed: boolean;
+    ackReplayed: boolean;
+}
+export declare function executeManagedCodexV3Login(input: {
+    client: V3Client;
+    tenantId: string;
+    env?: NodeJS.ProcessEnv;
+    deviceAuth?: boolean;
+    newId?: () => string;
+    now?: () => number;
+    wait?: (milliseconds: number) => Promise<void>;
+}): Promise<ManagedCodexV3EnrollmentResult>;
+export declare function executeManagedCodexV3Upload(input: {
+    client: V3Client;
+    tenantId: string;
+    env?: NodeJS.ProcessEnv;
+    newId?: () => string;
+    now?: () => number;
+    wait?: (milliseconds: number) => Promise<void>;
+}): Promise<ManagedCodexV3EnrollmentResult>;
+export declare function reportManagedCodexV3Credentials(input: {
+    client: V3Client;
+    tenantId: string;
+    env?: NodeJS.ProcessEnv;
+    newId?: () => string;
+    now?: () => number;
+}): Promise<{
+    reported: boolean;
+    generationVersion?: number;
+    warningCode?: string;
+}>;
+export {};