@tokensrc/codex 1.13.4 → 1.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (76) hide show
  1. package/README.md +79 -3
  2. package/dist/client.d.ts +29 -1
  3. package/dist/client.js +221 -2
  4. package/dist/client.js.map +1 -1
  5. package/dist/command-directory.d.ts +1 -0
  6. package/dist/command-directory.js +3 -2
  7. package/dist/command-directory.js.map +1 -1
  8. package/dist/commands.d.ts +8 -2
  9. package/dist/commands.js +567 -40
  10. package/dist/commands.js.map +1 -1
  11. package/dist/console-status.js +1 -1
  12. package/dist/console-status.js.map +1 -1
  13. package/dist/credential-supervisor.d.ts +17 -0
  14. package/dist/credential-supervisor.js +84 -0
  15. package/dist/credential-supervisor.js.map +1 -0
  16. package/dist/credentials.d.ts +75 -3
  17. package/dist/credentials.js +357 -12
  18. package/dist/credentials.js.map +1 -1
  19. package/dist/enrollment-envelope.d.ts +18 -0
  20. package/dist/enrollment-envelope.js +112 -0
  21. package/dist/enrollment-envelope.js.map +1 -0
  22. package/dist/enrollment-flow.d.ts +27 -0
  23. package/dist/enrollment-flow.js +224 -0
  24. package/dist/enrollment-flow.js.map +1 -0
  25. package/dist/enrollment-login.d.ts +26 -0
  26. package/dist/enrollment-login.js +104 -0
  27. package/dist/enrollment-login.js.map +1 -0
  28. package/dist/index.d.ts +13 -0
  29. package/dist/index.js +17 -3
  30. package/dist/index.js.map +1 -1
  31. package/dist/managed-credential-v3-envelope.d.ts +60 -0
  32. package/dist/managed-credential-v3-envelope.js +234 -0
  33. package/dist/managed-credential-v3-envelope.js.map +1 -0
  34. package/dist/managed-credential-v3-flow.d.ts +45 -0
  35. package/dist/managed-credential-v3-flow.js +499 -0
  36. package/dist/managed-credential-v3-flow.js.map +1 -0
  37. package/dist/managed-credential-v3-journal.d.ts +192 -0
  38. package/dist/managed-credential-v3-journal.js +153 -0
  39. package/dist/managed-credential-v3-journal.js.map +1 -0
  40. package/dist/managed-credential-v3.d.ts +117 -0
  41. package/dist/managed-credential-v3.js +423 -0
  42. package/dist/managed-credential-v3.js.map +1 -0
  43. package/dist/migration-login-batch.d.ts +66 -0
  44. package/dist/migration-login-batch.js +202 -0
  45. package/dist/migration-login-batch.js.map +1 -0
  46. package/dist/private-file.d.ts +10 -0
  47. package/dist/private-file.js +77 -2
  48. package/dist/private-file.js.map +1 -1
  49. package/dist/profile.d.ts +10 -0
  50. package/dist/profile.js +55 -2
  51. package/dist/profile.js.map +1 -1
  52. package/dist/protocol.d.ts +1070 -0
  53. package/dist/protocol.js +560 -0
  54. package/dist/protocol.js.map +1 -1
  55. package/dist/retirement-flow.d.ts +38 -0
  56. package/dist/retirement-flow.js +78 -0
  57. package/dist/retirement-flow.js.map +1 -0
  58. package/dist/runtime.d.ts +4 -1
  59. package/dist/runtime.js +29 -4
  60. package/dist/runtime.js.map +1 -1
  61. package/dist/selection.d.ts +10 -1
  62. package/dist/selection.js +38 -2
  63. package/dist/selection.js.map +1 -1
  64. package/dist/short-lived-delivery-flow.d.ts +41 -0
  65. package/dist/short-lived-delivery-flow.js +141 -0
  66. package/dist/short-lived-delivery-flow.js.map +1 -0
  67. package/dist/short-lived-delivery-journal.d.ts +34 -0
  68. package/dist/short-lived-delivery-journal.js +137 -0
  69. package/dist/short-lived-delivery-journal.js.map +1 -0
  70. package/dist/short-lived-delivery.d.ts +26 -0
  71. package/dist/short-lived-delivery.js +139 -0
  72. package/dist/short-lived-delivery.js.map +1 -0
  73. package/dist/tui.js +23 -0
  74. package/dist/tui.js.map +1 -1
  75. package/dist/types.d.ts +6 -2
  76. package/package.json +2 -2
@@ -0,0 +1,499 @@
1
+ import { randomUUID } from "node:crypto";
2
+ import { withOneShotCodexLogin } from "./enrollment-login.js";
3
+ import { CodexServiceError } from "./errors.js";
4
+ import { codexV3CredentialDigests, commitManagedCodexV3GenerationReport, installManagedCodexV3Credentials, markManagedCodexV3DeliveryAcknowledged, readManagedCodexV3State, withCurrentCodexFullCredentials, withManagedCodexV3CredentialObservation } from "./managed-credential-v3.js";
5
+ import { createCodexV3DeliveryKeyPair, openCodexV3FullCredentialDelivery, sealCodexV3Enrollment, sealCodexV3GenerationReport } from "./managed-credential-v3-envelope.js";
6
+ import { clearManagedCodexV3OperationJournal, openManagedCodexV3DeliveryJournalKey, readManagedCodexV3OperationJournal, replaceManagedCodexV3OperationWithDelivery, writeManagedCodexV3OperationJournal } from "./managed-credential-v3-journal.js";
7
+ export async function executeManagedCodexV3Login(input) {
8
+ const resumed = await resumePendingManagedCodexV3EnrollmentOperation(input);
9
+ if (resumed)
10
+ return resumed;
11
+ const configuration = await input.client.getV3EnrollmentConfiguration();
12
+ const subject = await input.client.getCurrentActorSubject();
13
+ return withOneShotCodexLogin({
14
+ mode: input.deviceAuth ? "device" : "browser",
15
+ env: input.env
16
+ }, async (credentials) => {
17
+ if (!credentials.providerAccountId) {
18
+ throw new CodexServiceError("Official Codex login did not expose a provider account id.", "invalid_managed_codex_v3_credentials");
19
+ }
20
+ const accessPayload = credentials.accessToken.split(".")[1];
21
+ const exp = accessPayload ? tokenExpiry(credentials.accessToken) : undefined;
22
+ if (!exp)
23
+ throw new CodexServiceError("Official Codex login did not expose a usable access-token expiry.", "invalid_managed_codex_v3_credentials");
24
+ return executeManagedCodexV3Enrollment({
25
+ ...input,
26
+ configuration: configuration.ingress,
27
+ subject,
28
+ credentials: {
29
+ refreshToken: credentials.refreshToken,
30
+ accessToken: credentials.accessToken,
31
+ idToken: credentials.idToken,
32
+ providerAccountId: credentials.providerAccountId,
33
+ expiresAt: new Date(exp).toISOString()
34
+ }
35
+ });
36
+ });
37
+ }
38
+ export async function executeManagedCodexV3Upload(input) {
39
+ const resumed = await resumePendingManagedCodexV3EnrollmentOperation(input);
40
+ if (resumed)
41
+ return resumed;
42
+ const configuration = await input.client.getV3EnrollmentConfiguration();
43
+ const subject = await input.client.getCurrentActorSubject();
44
+ return withCurrentCodexFullCredentials(input.env ?? process.env, async (credentials) => executeManagedCodexV3Enrollment({
45
+ ...input,
46
+ configuration: configuration.ingress,
47
+ subject,
48
+ credentials
49
+ }));
50
+ }
51
+ async function executeManagedCodexV3Enrollment(input) {
52
+ const newId = input.newId ?? randomUUID;
53
+ const now = input.now ?? Date.now;
54
+ const clientRequestId = newId();
55
+ const enrollmentKey = newId();
56
+ const envelope = sealCodexV3Enrollment({
57
+ tenantId: input.tenantId,
58
+ subject: input.subject,
59
+ clientRequestId,
60
+ idempotencyKey: enrollmentKey,
61
+ ingress: input.configuration,
62
+ credentials: input.credentials
63
+ });
64
+ const timestamp = new Date(now()).toISOString();
65
+ const journal = await writeManagedCodexV3OperationJournal({
66
+ schemaVersion: 3,
67
+ kind: "ENROLLMENT",
68
+ tenantId: input.tenantId,
69
+ subject: input.subject,
70
+ clientRequestId,
71
+ idempotencyKey: enrollmentKey,
72
+ providerAccountId: input.credentials.providerAccountId,
73
+ envelope,
74
+ createdAt: timestamp,
75
+ updatedAt: timestamp
76
+ }, input.env);
77
+ if (journal.kind !== "ENROLLMENT")
78
+ throw new Error("Unexpected v3 operation journal.");
79
+ return completeEnrollmentJournal({ ...input, journal });
80
+ }
81
+ async function completeEnrollmentJournal(input) {
82
+ const newId = input.newId ?? randomUUID;
83
+ const now = input.now ?? Date.now;
84
+ const wait = input.wait ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
85
+ let enrollment = await postResolveReplay({
86
+ post: () => input.client.createV3Enrollment({
87
+ clientRequestId: input.journal.clientRequestId,
88
+ envelope: input.journal.envelope
89
+ }, input.journal.idempotencyKey),
90
+ resolve: () => input.client.resolveV3Enrollment(input.journal.clientRequestId)
91
+ });
92
+ for (let attempt = 0; enrollment.enrollment.status === "VALIDATING" && attempt < 120; attempt += 1) {
93
+ await wait(1_000);
94
+ enrollment = await input.client.resolveV3Enrollment(input.journal.clientRequestId);
95
+ }
96
+ const ready = requireReadyEnrollment(enrollment);
97
+ if (ready.providerAccountId !== input.journal.providerAccountId) {
98
+ throw new CodexServiceError("V3 enrollment provider identity does not match the official Codex login.", "invalid_codex_service_response");
99
+ }
100
+ const keyPair = createCodexV3DeliveryKeyPair();
101
+ const deliveryClientRequestId = newId();
102
+ const deliveryKey = newId();
103
+ const ackKey = newId();
104
+ const deliveryJournal = await replaceManagedCodexV3OperationWithDelivery({
105
+ previous: input.journal,
106
+ delivery: {
107
+ tenantId: input.journal.tenantId,
108
+ subject: input.journal.subject,
109
+ clientRequestId: deliveryClientRequestId,
110
+ idempotencyKey: deliveryKey,
111
+ enrollmentId: ready.id,
112
+ assignmentId: ready.assignmentId,
113
+ managedAccountId: ready.managedAccountId,
114
+ providerAccountId: ready.providerAccountId,
115
+ lineageId: ready.lineageId,
116
+ generationVersion: ready.generationVersion,
117
+ clientKey: keyPair.clientKey,
118
+ ackIdempotencyKey: ackKey
119
+ },
120
+ privateKey: keyPair.privateKey,
121
+ now: now(),
122
+ env: input.env
123
+ });
124
+ return completeDeliveryJournal({
125
+ client: input.client,
126
+ journal: deliveryJournal,
127
+ now,
128
+ env: input.env,
129
+ enrollmentReplayed: enrollment.replayed
130
+ });
131
+ }
132
+ async function completeDeliveryJournal(input) {
133
+ const now = input.now ?? Date.now;
134
+ const delivery = await postResolveReplay({
135
+ post: () => input.client.createV3FullCredentialDelivery(input.journal.assignmentId, {
136
+ schemaVersion: 3,
137
+ clientRequestId: input.journal.clientRequestId,
138
+ clientKey: input.journal.clientKey
139
+ }, input.journal.idempotencyKey),
140
+ resolve: () => input.client.resolveV3FullCredentialDelivery(input.journal.assignmentId, input.journal.clientRequestId)
141
+ });
142
+ const bundle = openCodexV3FullCredentialDelivery({
143
+ tenantId: input.journal.tenantId,
144
+ response: delivery,
145
+ privateKey: openManagedCodexV3DeliveryJournalKey(input.journal),
146
+ now: now()
147
+ });
148
+ if (bundle.providerAccountId !== input.journal.providerAccountId
149
+ || bundle.lineageId !== input.journal.lineageId
150
+ || bundle.managedAccountId !== input.journal.managedAccountId
151
+ || bundle.generationVersion !== input.journal.generationVersion
152
+ || delivery.delivery.assignmentId !== input.journal.assignmentId) {
153
+ throw new CodexServiceError("V3 enrollment and delivery evidence do not match.", "invalid_codex_service_response");
154
+ }
155
+ await installManagedCodexV3Credentials({
156
+ tenantId: input.journal.tenantId,
157
+ enrollmentId: input.journal.enrollmentId,
158
+ assignmentId: input.journal.assignmentId,
159
+ managedAccountId: bundle.managedAccountId,
160
+ providerAccountId: bundle.providerAccountId,
161
+ lineageId: bundle.lineageId,
162
+ generationVersion: bundle.generationVersion,
163
+ deliveryId: bundle.deliveryId,
164
+ ackIdempotencyKey: input.journal.ackIdempotencyKey,
165
+ refreshToken: bundle.refreshToken,
166
+ accessToken: bundle.accessToken,
167
+ idToken: bundle.idToken,
168
+ credentialExpiresAt: bundle.expiresAt,
169
+ ackExpiresAt: delivery.delivery.ackExpiresAt,
170
+ lastRefresh: delivery.delivery.issuedAt
171
+ }, now(), input.env);
172
+ const ack = await acknowledgeWithRecovery(input.client, {
173
+ assignmentId: input.journal.assignmentId,
174
+ managedAccountId: bundle.managedAccountId,
175
+ providerAccountId: bundle.providerAccountId,
176
+ lineageId: bundle.lineageId,
177
+ deliveryId: bundle.deliveryId,
178
+ generationVersion: bundle.generationVersion,
179
+ idempotencyKey: input.journal.ackIdempotencyKey
180
+ });
181
+ if (ack.delivery.assignmentId !== input.journal.assignmentId
182
+ || ack.delivery.managedAccountId !== bundle.managedAccountId
183
+ || ack.delivery.providerAccountId !== bundle.providerAccountId
184
+ || ack.delivery.lineageId !== bundle.lineageId) {
185
+ throw new CodexServiceError("V3 ACK evidence does not match installed credentials.", "invalid_codex_service_response");
186
+ }
187
+ await markManagedCodexV3DeliveryAcknowledged({
188
+ deliveryId: bundle.deliveryId,
189
+ generationVersion: bundle.generationVersion,
190
+ authorityEpoch: ack.delivery.authorityEpoch,
191
+ ackedAt: ack.delivery.ackedAt
192
+ }, input.env);
193
+ await clearManagedCodexV3OperationJournal(input.journal, input.env);
194
+ return {
195
+ enrollmentId: input.journal.enrollmentId,
196
+ assignmentId: input.journal.assignmentId,
197
+ managedAccountId: input.journal.managedAccountId,
198
+ providerAccountId: input.journal.providerAccountId,
199
+ lineageId: input.journal.lineageId,
200
+ generationVersion: input.journal.generationVersion,
201
+ authorityMode: "CLIENT_MANAGED",
202
+ authorityEpoch: ack.delivery.authorityEpoch,
203
+ credentialExpiresAt: bundle.expiresAt,
204
+ enrollmentReplayed: input.enrollmentReplayed,
205
+ deliveryReplayed: delivery.replayed,
206
+ ackReplayed: ack.replayed
207
+ };
208
+ }
209
+ async function resumePendingManagedCodexV3EnrollmentOperation(input) {
210
+ const ack = await resumePendingManagedCodexV3Ack(input);
211
+ if (ack)
212
+ return ack;
213
+ const journal = await readManagedCodexV3OperationJournal(input.env);
214
+ if (!journal)
215
+ return undefined;
216
+ if (journal.tenantId !== input.tenantId) {
217
+ throw new CodexServiceError("Another tenant has a pending v3 credential operation.", "managed_codex_v3_state_conflict");
218
+ }
219
+ if (journal.kind === "REPORT") {
220
+ throw new CodexServiceError("A v3 credential generation report must be reconciled before enrollment.", "managed_codex_v3_state_conflict");
221
+ }
222
+ return journal.kind === "ENROLLMENT"
223
+ ? completeEnrollmentJournal({ ...input, journal })
224
+ : completeDeliveryJournal({ ...input, journal, enrollmentReplayed: true });
225
+ }
226
+ async function resumePendingManagedCodexV3Ack(input) {
227
+ const state = await readManagedCodexV3State(input.env);
228
+ if (!state || state.tenantId !== input.tenantId) {
229
+ return undefined;
230
+ }
231
+ const journal = await readManagedCodexV3OperationJournal(input.env);
232
+ if (state.phase === "INSTALLED") {
233
+ if (state.authorityEpoch == null) {
234
+ throw new CodexServiceError("The acknowledged v3 authority evidence is incomplete.", "managed_codex_v3_state_conflict");
235
+ }
236
+ if (journal?.kind !== "DELIVERY")
237
+ return undefined;
238
+ if (journal.assignmentId !== state.assignmentId
239
+ || journal.managedAccountId !== state.managedAccountId
240
+ || journal.providerAccountId !== state.providerAccountId
241
+ || journal.lineageId !== state.lineageId
242
+ || journal.generationVersion !== state.generationVersion
243
+ || journal.ackIdempotencyKey !== state.ackIdempotencyKey) {
244
+ throw new CodexServiceError("The acknowledged v3 credentials conflict with the pending delivery journal.", "managed_codex_v3_state_conflict");
245
+ }
246
+ await clearManagedCodexV3OperationJournal(journal, input.env);
247
+ return {
248
+ enrollmentId: state.enrollmentId,
249
+ assignmentId: state.assignmentId,
250
+ managedAccountId: state.managedAccountId,
251
+ providerAccountId: state.providerAccountId,
252
+ lineageId: state.lineageId,
253
+ generationVersion: state.generationVersion,
254
+ authorityMode: "CLIENT_MANAGED",
255
+ authorityEpoch: state.authorityEpoch,
256
+ credentialExpiresAt: state.credentialExpiresAt,
257
+ enrollmentReplayed: true,
258
+ deliveryReplayed: true,
259
+ ackReplayed: true
260
+ };
261
+ }
262
+ if (state.phase !== "INSTALLED_PENDING_ACK")
263
+ return undefined;
264
+ if (Date.parse(state.ackExpiresAt) <= (input.now ?? Date.now)()) {
265
+ throw new CodexServiceError("The pending v3 delivery ACK has expired.", "full_credential_delivery_expired");
266
+ }
267
+ const ack = await acknowledgeWithRecovery(input.client, {
268
+ assignmentId: state.assignmentId,
269
+ managedAccountId: state.managedAccountId,
270
+ providerAccountId: state.providerAccountId,
271
+ lineageId: state.lineageId,
272
+ deliveryId: state.deliveryId,
273
+ generationVersion: state.generationVersion,
274
+ idempotencyKey: state.ackIdempotencyKey
275
+ });
276
+ await markManagedCodexV3DeliveryAcknowledged({
277
+ deliveryId: state.deliveryId,
278
+ generationVersion: state.generationVersion,
279
+ authorityEpoch: ack.delivery.authorityEpoch,
280
+ ackedAt: ack.delivery.ackedAt
281
+ }, input.env);
282
+ if (journal?.kind === "DELIVERY" && journal.assignmentId === state.assignmentId
283
+ && journal.ackIdempotencyKey === state.ackIdempotencyKey) {
284
+ await clearManagedCodexV3OperationJournal(journal, input.env);
285
+ }
286
+ return {
287
+ enrollmentId: state.enrollmentId,
288
+ assignmentId: state.assignmentId,
289
+ managedAccountId: state.managedAccountId,
290
+ providerAccountId: state.providerAccountId,
291
+ lineageId: state.lineageId,
292
+ generationVersion: state.generationVersion,
293
+ authorityMode: "CLIENT_MANAGED",
294
+ authorityEpoch: ack.delivery.authorityEpoch,
295
+ credentialExpiresAt: state.credentialExpiresAt,
296
+ enrollmentReplayed: true,
297
+ deliveryReplayed: true,
298
+ ackReplayed: ack.replayed
299
+ };
300
+ }
301
+ async function acknowledgeWithRecovery(client, expected) {
302
+ const call = () => client.acknowledgeV3FullCredentialDelivery(expected.deliveryId, {
303
+ generationVersion: expected.generationVersion,
304
+ installed: true
305
+ }, expected.idempotencyKey);
306
+ try {
307
+ return await call();
308
+ }
309
+ catch (error) {
310
+ if (!resultMayBeUnknown(error))
311
+ throw error;
312
+ let assignment;
313
+ try {
314
+ assignment = (await client.listV3CredentialAssignments()).items[0];
315
+ }
316
+ catch (inspectError) {
317
+ throw new CodexServiceError("Codex v3 ACK outcome is unknown and assignment evidence is unavailable.", "managed_codex_v3_result_unknown", undefined, { cause: inspectError });
318
+ }
319
+ if (assignment && (assignment.assignmentId !== expected.assignmentId
320
+ || assignment.managedAccountId !== expected.managedAccountId
321
+ || assignment.providerAccountId !== expected.providerAccountId
322
+ || assignment.lineageId !== expected.lineageId
323
+ || assignment.currentGenerationVersion !== expected.generationVersion)) {
324
+ throw new CodexServiceError("Codex v3 ACK assignment evidence conflicts with local credentials.", "lineage_version_conflict");
325
+ }
326
+ try {
327
+ return await call();
328
+ }
329
+ catch (replayError) {
330
+ throw new CodexServiceError("Codex v3 ACK outcome remains unknown after assignment inspection and exact replay.", "managed_codex_v3_result_unknown", undefined, { cause: replayError });
331
+ }
332
+ }
333
+ }
334
+ export async function reportManagedCodexV3Credentials(input) {
335
+ const newId = input.newId ?? randomUUID;
336
+ const now = input.now ?? Date.now;
337
+ try {
338
+ const pending = await readManagedCodexV3OperationJournal(input.env);
339
+ if (pending) {
340
+ if (pending.kind !== "REPORT" || pending.tenantId !== input.tenantId) {
341
+ throw new CodexServiceError("A v3 enrollment/delivery operation is pending.", "managed_codex_v3_state_conflict");
342
+ }
343
+ const generationVersion = await completeReportJournal(input.client, pending, input.env);
344
+ return { reported: true, generationVersion };
345
+ }
346
+ const configuration = await input.client.getV3EnrollmentConfiguration();
347
+ const subject = await input.client.getCurrentActorSubject();
348
+ const result = await withManagedCodexV3CredentialObservation(input.env ?? process.env, now(), async (observation) => {
349
+ const clientRequestId = newId();
350
+ const key = newId();
351
+ const envelope = sealCodexV3GenerationReport({
352
+ tenantId: input.tenantId,
353
+ subject,
354
+ lineageId: observation.state.lineageId,
355
+ clientRequestId,
356
+ idempotencyKey: key,
357
+ expectedGenerationVersion: observation.state.generationVersion,
358
+ rotationMode: observation.rotationMode,
359
+ ingress: configuration.ingress,
360
+ credentials: {
361
+ ...observation.credentials,
362
+ expiresAt: observation.credentialExpiresAt
363
+ }
364
+ });
365
+ const digests = codexV3CredentialDigests(observation.credentials);
366
+ const timestamp = new Date(now()).toISOString();
367
+ const journal = await writeManagedCodexV3OperationJournal({
368
+ schemaVersion: 3,
369
+ kind: "REPORT",
370
+ tenantId: input.tenantId,
371
+ subject,
372
+ clientRequestId,
373
+ idempotencyKey: key,
374
+ lineageId: observation.state.lineageId,
375
+ expectedGenerationVersion: observation.state.generationVersion,
376
+ rotationMode: observation.rotationMode,
377
+ envelope,
378
+ accessTokenHealth: observation.accessTokenHealth,
379
+ refreshTokenHealth: observation.refreshTokenHealth,
380
+ observedAt: observation.observedAt,
381
+ credentialExpiresAt: observation.credentialExpiresAt,
382
+ ...digests,
383
+ createdAt: timestamp,
384
+ updatedAt: timestamp
385
+ }, input.env);
386
+ if (journal.kind !== "REPORT")
387
+ throw new Error("Unexpected v3 report journal.");
388
+ return completeReportJournal(input.client, journal, input.env);
389
+ });
390
+ return result === undefined ? { reported: false } : { reported: true, generationVersion: result };
391
+ }
392
+ catch (error) {
393
+ // Transport silence is not credential invalidity. Leave the local generation
394
+ // untouched so the next explicit observation can reconcile with the same server lineage.
395
+ return { reported: false, warningCode: errorCode(error) };
396
+ }
397
+ }
398
+ async function completeReportJournal(client, journal, env) {
399
+ const state = await readManagedCodexV3State(env);
400
+ if (state?.phase === "INSTALLED"
401
+ && state.lineageId === journal.lineageId
402
+ && state.generationVersion === journal.expectedGenerationVersion + 1
403
+ && state.lastReportedAt === journal.observedAt
404
+ && state.credentialExpiresAt === journal.credentialExpiresAt
405
+ && state.accessTokenDigest === journal.accessTokenDigest
406
+ && state.refreshTokenDigest === journal.refreshTokenDigest
407
+ && state.idTokenDigest === journal.idTokenDigest) {
408
+ await clearManagedCodexV3OperationJournal(journal, env);
409
+ return state.generationVersion;
410
+ }
411
+ const reportInput = {
412
+ clientRequestId: journal.clientRequestId,
413
+ expectedGenerationVersion: journal.expectedGenerationVersion,
414
+ rotationMode: journal.rotationMode,
415
+ envelope: journal.envelope,
416
+ accessTokenHealth: journal.accessTokenHealth,
417
+ refreshTokenHealth: journal.refreshTokenHealth,
418
+ observedAt: journal.observedAt
419
+ };
420
+ const response = await postResolveReplay({
421
+ post: () => client.reportV3Generation(journal.lineageId, reportInput, journal.idempotencyKey),
422
+ resolve: () => client.resolveV3GenerationReport(journal.lineageId, reportInput)
423
+ });
424
+ if (response.report.credentialExpiresAt !== journal.credentialExpiresAt) {
425
+ throw new CodexServiceError("V3 report expiry evidence does not match observed credentials.", "invalid_codex_service_response");
426
+ }
427
+ await commitManagedCodexV3GenerationReport({
428
+ lineageId: response.report.lineageId,
429
+ previousGenerationVersion: response.report.previousGenerationVersion,
430
+ generationVersion: response.report.generationVersion,
431
+ authorityEpoch: response.report.authorityEpoch,
432
+ credentialExpiresAt: response.report.credentialExpiresAt,
433
+ observedAt: response.report.observedAt,
434
+ tokenDigests: {
435
+ accessTokenDigest: journal.accessTokenDigest,
436
+ refreshTokenDigest: journal.refreshTokenDigest,
437
+ idTokenDigest: journal.idTokenDigest
438
+ }
439
+ }, env);
440
+ await clearManagedCodexV3OperationJournal(journal, env);
441
+ return response.report.generationVersion;
442
+ }
443
+ function requireReadyEnrollment(response) {
444
+ const value = response.enrollment;
445
+ if (value.status !== "READY" || value.assignmentId == null || value.managedAccountId == null
446
+ || value.providerAccountId == null || value.lineageId == null || value.generationVersion == null) {
447
+ throw new CodexServiceError(`Codex v3 enrollment did not become READY (${value.status}).`, value.safeErrorCode ?? "managed_codex_v3_enrollment_not_ready", 409);
448
+ }
449
+ return { ...value, assignmentId: value.assignmentId, managedAccountId: value.managedAccountId,
450
+ providerAccountId: value.providerAccountId, lineageId: value.lineageId,
451
+ generationVersion: value.generationVersion };
452
+ }
453
+ async function postResolveReplay(input) {
454
+ try {
455
+ return await input.post();
456
+ }
457
+ catch (postError) {
458
+ if (!resultMayBeUnknown(postError))
459
+ throw postError;
460
+ try {
461
+ return await input.resolve();
462
+ }
463
+ catch (resolveError) {
464
+ if (resolveError instanceof CodexServiceError && resolveError.status === 404) {
465
+ try {
466
+ return await input.post();
467
+ }
468
+ catch (replayError) {
469
+ throw new CodexServiceError("Codex v3 mutation outcome remains unknown after exact replay.", "managed_codex_v3_result_unknown", undefined, { cause: replayError });
470
+ }
471
+ }
472
+ throw new CodexServiceError("Codex v3 mutation outcome is unknown; retry with the same local operation state.", "managed_codex_v3_result_unknown", undefined, { cause: postError });
473
+ }
474
+ }
475
+ }
476
+ function resultMayBeUnknown(error) {
477
+ if (!(error instanceof CodexServiceError))
478
+ return true;
479
+ return error.status === undefined || error.status >= 500
480
+ || error.code === "invalid_codex_service_response";
481
+ }
482
+ function tokenExpiry(token) {
483
+ try {
484
+ const payload = token.split(".")[1];
485
+ if (!payload)
486
+ return undefined;
487
+ const value = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
488
+ return typeof value.exp === "number" && Number.isFinite(value.exp) ? value.exp * 1_000 : undefined;
489
+ }
490
+ catch {
491
+ return undefined;
492
+ }
493
+ }
494
+ function errorCode(error) {
495
+ return typeof error?.code === "string"
496
+ ? error.code
497
+ : "managed_codex_v3_report_deferred";
498
+ }
499
+ //# sourceMappingURL=managed-credential-v3-flow.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"managed-credential-v3-flow.js","sourceRoot":"","sources":["../src/managed-credential-v3-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,gCAAgC,EAChC,sCAAsC,EACtC,uBAAuB,EACvB,+BAA+B,EAC/B,uCAAuC,EACxC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qBAAqB,EACrB,2BAA2B,EAE5B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,mCAAmC,EACnC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,mCAAmC,EAIpC,MAAM,oCAAoC,CAAC;AAuB5C,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAQhD;IACC,MAAM,OAAO,GAAG,MAAM,8CAA8C,CAAC,KAAK,CAAC,CAAC;IAC5E,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;IAC5D,OAAO,qBAAqB,CAAC;QAC3B,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC7C,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;QACvB,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CACzB,4DAA4D,EAC5D,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,iBAAiB,CACnC,mEAAmE,EACnE,sCAAsC,CACvC,CAAC;QACF,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,aAAa,EAAE,aAAa,CAAC,OAAO;YACpC,OAAO;YACP,WAAW,EAAE;gBACX,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;gBAChD,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAOjD;IACC,MAAM,OAAO,GAAG,MAAM,8CAA8C,CAAC,KAAK,CAAC,CAAC;IAC5E,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;IAC5D,OAAO,+BAA+B,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CACrF,+BAA+B,CAAC;QAC9B,GAAG,KAAK;QACR,aAAa,EAAE,aAAa,CAAC,OAAO;QACpC,OAAO;QACP,WAAW;KACZ,CAAC,CAAC,CAAC;AACR,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAU9C;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,eAAe,GAAG,KAAK,EAAE,CAAC;IAChC,MAAM,aAAa,GAAG,KAAK,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,qBAAqB,CAAC;QACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe;QACf,cAAc,EAAE,aAAa;QAC7B,OAAO,EAAE,KAAK,CAAC,aAAa;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;QACxD,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe;QACf,cAAc,EAAE,aAAa;QAC7B,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC,iBAAiB;QACtD,QAAQ;QACR,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACvF,OAAO,yBAAyB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAOxC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,YAAoB,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACnH,IAAI,UAAU,GAAG,MAAM,iBAAiB,CAAC;QACvC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC;YAC1C,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;SACjC,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;KAC/E,CAAC,CAAC;IACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CACzB,0EAA0E,EAC1E,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,4BAA4B,EAAE,CAAC;IAC/C,MAAM,uBAAuB,GAAG,KAAK,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,KAAK,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;IACvB,MAAM,eAAe,GAAG,MAAM,0CAA0C,CAAC;QACvE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,eAAe,EAAE,uBAAuB;YACxC,cAAc,EAAE,WAAW;YAC3B,YAAY,EAAE,KAAK,CAAC,EAAE;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,iBAAiB,EAAE,MAAM;SAC1B;QACD,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,EAAE,GAAG,EAAE;QACV,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IACH,OAAO,uBAAuB,CAAC;QAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,kBAAkB,EAAE,UAAU,CAAC,QAAQ;KACxC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAMtC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;YAClF,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;SACnC,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,+BAA+B,CACzD,KAAK,CAAC,OAAO,CAAC,YAAY,EAC1B,KAAK,CAAC,OAAO,CAAC,eAAe,CAC9B;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,iCAAiC,CAAC;QAC/C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/D,GAAG,EAAE,GAAG,EAAE;KACX,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,OAAO,CAAC,iBAAiB;WAC3D,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;WAC5C,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,OAAO,CAAC,gBAAgB;WAC1D,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,OAAO,CAAC,iBAAiB;WAC5D,QAAQ,CAAC,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACnE,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,EAAE,gCAAgC,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;QAClD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,mBAAmB,EAAE,MAAM,CAAC,SAAS;QACrC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY;QAC5C,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;KACxC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE;QACtD,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;KAChD,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC,YAAY;WACvD,GAAG,CAAC,QAAQ,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB;WACzD,GAAG,CAAC,QAAQ,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB;WAC3D,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,EAAE,gCAAgC,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,sCAAsC,CAAC;QAC3C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc;QAC3C,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;KAC9B,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACd,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB;QAChD,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;QAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;QAClD,aAAa,EAAE,gBAAgB;QAC/B,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc;QAC3C,mBAAmB,EAAE,MAAM,CAAC,SAAS;QACrC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,gBAAgB,EAAE,QAAQ,CAAC,QAAQ;QACnC,WAAW,EAAE,GAAG,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8CAA8C,CAAC,KAO7D;IACC,MAAM,GAAG,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,EAAE,iCAAiC,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,iBAAiB,CAAC,yEAAyE,EAAE,iCAAiC,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,KAAK,YAAY;QAClC,CAAC,CAAC,yBAAyB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC;QAClD,CAAC,CAAC,uBAAuB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAK7C;IACC,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,EAAE,iCAAiC,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,OAAO,EAAE,IAAI,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;eAC1C,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB;eACnD,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACrD,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;eACrC,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACrD,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC3D,MAAM,IAAI,iBAAiB,CACzB,6EAA6E,EAC7E,iCAAiC,CAClC,CAAC;QACJ,CAAC;QACD,MAAM,mCAAmC,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,aAAa,EAAE,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;YACtB,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,uBAAuB;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,EAAE,kCAAkC,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE;QACtD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,iBAAiB;KACxC,CAAC,CAAC;IACH,MAAM,sCAAsC,CAAC;QAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc;QAC3C,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;KAC9B,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC1E,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC3D,MAAM,mCAAmC,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,aAAa,EAAE,gBAAgB;QAC/B,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc;QAC3C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,kBAAkB,EAAE,IAAI;QACxB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,GAAG,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,MAAgB,EAAE,QAQxD;IACC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,mCAAmC,CAAC,QAAQ,CAAC,UAAU,EAAE;QACjF,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,SAAS,EAAE,IAAI;KAChB,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5C,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CACzB,yEAAyE,EACzE,iCAAiC,EACjC,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;eAC/D,UAAU,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;eACzD,UAAU,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB;eAC3D,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;eAC3C,UAAU,CAAC,wBAAwB,KAAK,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,iBAAiB,CAAC,oEAAoE,EAAE,0BAA0B,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CACzB,oFAAoF,EACpF,iCAAiC,EACjC,SAAS,EACT,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrE,MAAM,IAAI,iBAAiB,CAAC,gDAAgD,EAAE,iCAAiC,CAAC,CAAC;YACnH,CAAC;YACD,MAAM,iBAAiB,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACxF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,uCAAuC,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YAClH,MAAM,eAAe,GAAG,KAAK,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,2BAA2B,CAAC;gBAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO;gBACP,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS;gBACtC,eAAe;gBACf,cAAc,EAAE,GAAG;gBACnB,yBAAyB,EAAE,WAAW,CAAC,KAAK,CAAC,iBAAiB;gBAC9D,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,WAAW,EAAE;oBACX,GAAG,WAAW,CAAC,WAAW;oBAC1B,SAAS,EAAE,WAAW,CAAC,mBAAmB;iBAC3C;aACF,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,wBAAwB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;gBACxD,aAAa,EAAE,CAAC;gBAChB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO;gBACP,eAAe;gBACf,cAAc,EAAE,GAAG;gBACnB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS;gBACtC,yBAAyB,EAAE,WAAW,CAAC,KAAK,CAAC,iBAAiB;gBAC9D,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,QAAQ;gBACR,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;gBAChD,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;gBAClD,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;gBACpD,GAAG,OAAO;gBACV,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,SAAS;aACrB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAChF,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACpG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6EAA6E;QAC7E,yFAAyF;QACzF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,MAAgB,EAChB,OAAoC,EACpC,GAAuB;IAEvB,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,KAAK,EAAE,KAAK,KAAK,WAAW;WAC3B,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;WACrC,KAAK,CAAC,iBAAiB,KAAK,OAAO,CAAC,yBAAyB,GAAG,CAAC;WACjE,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,UAAU;WAC3C,KAAK,CAAC,mBAAmB,KAAK,OAAO,CAAC,mBAAmB;WACzD,KAAK,CAAC,iBAAiB,KAAK,OAAO,CAAC,iBAAiB;WACrD,KAAK,CAAC,kBAAkB,KAAK,OAAO,CAAC,kBAAkB;WACvD,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,mCAAmC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC,iBAAiB,CAAC;IACjC,CAAC;IACD,MAAM,WAAW,GAAG;QAClB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,yBAAyB,EAAE,OAAO,CAAC,yBAAyB;QAC5D,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;KACtB,CAAC;IACX,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;QAC7F,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC;KAChF,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,CAAC,mBAAmB,KAAK,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACxE,MAAM,IAAI,iBAAiB,CAAC,gEAAgE,EAAE,gCAAgC,CAAC,CAAC;IAClI,CAAC;IACD,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;QACpC,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,yBAAyB;QACpE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB;QACpD,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc;QAC9C,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB;QACxD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU;QACtC,YAAY,EAAE;YACZ,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC;KACF,EAAE,GAAG,CAAC,CAAC;IACR,MAAM,mCAAmC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;AAC3C,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAmC;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAI;WACvF,KAAK,CAAC,iBAAiB,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QACnG,MAAM,IAAI,iBAAiB,CACzB,6CAA6C,KAAK,CAAC,MAAM,IAAI,EAC7D,KAAK,CAAC,aAAa,IAAI,uCAAuC,EAC9D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QAC3F,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;QACtE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAI,KAA4D;IAC9F,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;YAAE,MAAM,SAAS,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,IAAI,YAAY,YAAY,iBAAiB,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7E,IAAI,CAAC;oBACH,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5B,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,MAAM,IAAI,iBAAiB,CACzB,+DAA+D,EAC/D,iCAAiC,EACjC,SAAS,EACT,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,kFAAkF,EAClF,iCAAiC,EACjC,SAAS,EACT,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;WACnD,KAAK,CAAC,IAAI,KAAK,gCAAgC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;QAClG,OAAO,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAQ,KAAwC,EAAE,IAAI,KAAK,QAAQ;QACxE,CAAC,CAAE,KAA0B,CAAC,IAAI;QAClC,CAAC,CAAC,kCAAkC,CAAC;AACzC,CAAC"}