@tokensrc/codex 1.13.4 → 1.14.0

package/dist/managed-credential-v3-journal.d.ts

@@ -0,0 +1,192 @@
+import { type KeyObject } from "node:crypto";
+import { z } from "zod";
+declare const EnrollmentJournalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    kind: z.ZodLiteral<"ENROLLMENT">;
+    providerAccountId: z.ZodString;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+declare const DeliveryJournalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    kind: z.ZodLiteral<"DELIVERY">;
+    enrollmentId: z.ZodString;
+    assignmentId: z.ZodString;
+    managedAccountId: z.ZodString;
+    providerAccountId: z.ZodString;
+    lineageId: z.ZodString;
+    generationVersion: z.ZodNumber;
+    clientKey: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        publicKey: z.ZodString;
+    }, z.core.$strict>;
+    privateKeyPkcs8: z.ZodString;
+    ackIdempotencyKey: z.ZodString;
+}, z.core.$strict>;
+declare const ReportJournalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    kind: z.ZodLiteral<"REPORT">;
+    lineageId: z.ZodString;
+    expectedGenerationVersion: z.ZodNumber;
+    rotationMode: z.ZodEnum<{
+        RETAINED: "RETAINED";
+        ROTATED: "ROTATED";
+    }>;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+    accessTokenHealth: z.ZodEnum<{
+        EXPIRED: "EXPIRED";
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    refreshTokenHealth: z.ZodEnum<{
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    observedAt: z.ZodString;
+    credentialExpiresAt: z.ZodString;
+    accessTokenDigest: z.ZodString;
+    refreshTokenDigest: z.ZodString;
+    idTokenDigest: z.ZodString;
+}, z.core.$strict>;
+declare const JournalSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    kind: z.ZodLiteral<"ENROLLMENT">;
+    providerAccountId: z.ZodString;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    kind: z.ZodLiteral<"DELIVERY">;
+    enrollmentId: z.ZodString;
+    assignmentId: z.ZodString;
+    managedAccountId: z.ZodString;
+    providerAccountId: z.ZodString;
+    lineageId: z.ZodString;
+    generationVersion: z.ZodNumber;
+    clientKey: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        publicKey: z.ZodString;
+    }, z.core.$strict>;
+    privateKeyPkcs8: z.ZodString;
+    ackIdempotencyKey: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    kind: z.ZodLiteral<"REPORT">;
+    lineageId: z.ZodString;
+    expectedGenerationVersion: z.ZodNumber;
+    rotationMode: z.ZodEnum<{
+        RETAINED: "RETAINED";
+        ROTATED: "ROTATED";
+    }>;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+    accessTokenHealth: z.ZodEnum<{
+        EXPIRED: "EXPIRED";
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    refreshTokenHealth: z.ZodEnum<{
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    observedAt: z.ZodString;
+    credentialExpiresAt: z.ZodString;
+    accessTokenDigest: z.ZodString;
+    refreshTokenDigest: z.ZodString;
+    idTokenDigest: z.ZodString;
+}, z.core.$strict>], "kind">;
+export type ManagedCodexV3OperationJournal = z.infer<typeof JournalSchema>;
+export type ManagedCodexV3EnrollmentJournal = z.infer<typeof EnrollmentJournalSchema>;
+export type ManagedCodexV3DeliveryJournal = z.infer<typeof DeliveryJournalSchema>;
+export type ManagedCodexV3ReportJournal = z.infer<typeof ReportJournalSchema>;
+export declare function readManagedCodexV3OperationJournal(env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3OperationJournal | undefined>;
+export declare function writeManagedCodexV3OperationJournal(value: ManagedCodexV3OperationJournal, env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3OperationJournal>;
+export declare function replaceManagedCodexV3OperationWithDelivery(input: {
+    previous: ManagedCodexV3EnrollmentJournal;
+    delivery: Omit<ManagedCodexV3DeliveryJournal, "schemaVersion" | "kind" | "createdAt" | "updatedAt" | "privateKeyPkcs8">;
+    privateKey: KeyObject;
+    now: number;
+    env?: NodeJS.ProcessEnv;
+}): Promise<ManagedCodexV3DeliveryJournal>;
+export declare function openManagedCodexV3DeliveryJournalKey(journal: ManagedCodexV3DeliveryJournal): KeyObject;
+export declare function clearManagedCodexV3OperationJournal(expected: {
+    kind: ManagedCodexV3OperationJournal["kind"];
+    clientRequestId: string;
+    idempotencyKey: string;
+}, env?: NodeJS.ProcessEnv): Promise<void>;
+export {};

package/dist/managed-credential-v3-journal.js

@@ -0,0 +1,153 @@
+import { createPrivateKey } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { z } from "zod";
+import { CodexShortLivedDeliveryClientKeySchema, CodexV3AccessTokenHealthSchema, CodexV3CredentialEnvelopeSchema, CodexV3RefreshTokenHealthSchema } from "./protocol.js";
+import { readJsonIfExists, removePrivateFileDurably, withPrivateFileLock, writePrivateJson } from "./private-file.js";
+const Instant = z.string().datetime({ offset: true });
+const Id = z.string().min(1).max(512);
+const Stable = z.string().min(8).max(255);
+const Digest = z.string().length(64).regex(/^[0-9a-f]{64}$/);
+const Base = {
+    schemaVersion: z.literal(3),
+    tenantId: Id,
+    subject: Id,
+    clientRequestId: Stable,
+    idempotencyKey: Stable,
+    createdAt: Instant,
+    updatedAt: Instant
+};
+const EnrollmentJournalSchema = z.strictObject({
+    ...Base,
+    kind: z.literal("ENROLLMENT"),
+    providerAccountId: Id,
+    envelope: CodexV3CredentialEnvelopeSchema
+});
+const DeliveryJournalSchema = z.strictObject({
+    ...Base,
+    kind: z.literal("DELIVERY"),
+    enrollmentId: Id,
+    assignmentId: Id,
+    managedAccountId: Id,
+    providerAccountId: Id,
+    lineageId: Id,
+    generationVersion: z.number().int().positive(),
+    clientKey: CodexShortLivedDeliveryClientKeySchema,
+    privateKeyPkcs8: z.string().min(1).max(512).regex(/^[A-Za-z0-9_-]+$/),
+    ackIdempotencyKey: Stable
+});
+const ReportJournalSchema = z.strictObject({
+    ...Base,
+    kind: z.literal("REPORT"),
+    lineageId: Id,
+    expectedGenerationVersion: z.number().int().positive(),
+    rotationMode: z.enum(["ROTATED", "RETAINED"]),
+    envelope: CodexV3CredentialEnvelopeSchema,
+    accessTokenHealth: CodexV3AccessTokenHealthSchema,
+    refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+    observedAt: Instant,
+    credentialExpiresAt: Instant,
+    accessTokenDigest: Digest,
+    refreshTokenDigest: Digest,
+    idTokenDigest: Digest
+});
+const JournalSchema = z.discriminatedUnion("kind", [
+    EnrollmentJournalSchema,
+    DeliveryJournalSchema,
+    ReportJournalSchema
+]);
+function path(env) {
+    return join(env.CODEX_HOME?.trim() || join(homedir(), ".codex"), ".numa-managed-credential-v3-operation.json");
+}
+export async function readManagedCodexV3OperationJournal(env = process.env) {
+    const raw = await readJsonIfExists(path(env));
+    if (raw === undefined)
+        return undefined;
+    const parsed = JournalSchema.safeParse(raw);
+    if (!parsed.success)
+        throw Object.assign(new Error("The private v3 credential operation journal is invalid."), {
+            code: "managed_codex_v3_journal_invalid"
+        });
+    return parsed.data;
+}
+export async function writeManagedCodexV3OperationJournal(value, env = process.env) {
+    const target = path(env);
+    return withPrivateFileLock(target, async () => {
+        const parsed = JournalSchema.parse(value);
+        const current = await readManagedCodexV3OperationJournal(env);
+        if (current) {
+            if (JSON.stringify(current) === JSON.stringify(parsed))
+                return current;
+            throw Object.assign(new Error("Another v3 credential operation is already pending."), {
+                code: "managed_codex_v3_state_conflict"
+            });
+        }
+        await writePrivateJson(target, parsed);
+        return parsed;
+    });
+}
+export async function replaceManagedCodexV3OperationWithDelivery(input) {
+    const env = input.env ?? process.env;
+    const target = path(env);
+    return withPrivateFileLock(target, async () => {
+        const current = await readManagedCodexV3OperationJournal(env);
+        if (!current || current.kind !== "ENROLLMENT"
+            || current.clientRequestId !== input.previous.clientRequestId
+            || current.idempotencyKey !== input.previous.idempotencyKey) {
+            throw Object.assign(new Error("The v3 operation journal changed before delivery."), {
+                code: "managed_codex_v3_state_conflict"
+            });
+        }
+        if (input.privateKey.asymmetricKeyType !== "x25519")
+            throw new Error("Invalid v3 delivery private key.");
+        const encoded = input.privateKey.export({ format: "der", type: "pkcs8" });
+        if (!Buffer.isBuffer(encoded))
+            throw new Error("Unable to export v3 delivery private key.");
+        try {
+            const timestamp = new Date(input.now).toISOString();
+            const value = DeliveryJournalSchema.parse({
+                schemaVersion: 3,
+                kind: "DELIVERY",
+                ...input.delivery,
+                privateKeyPkcs8: encoded.toString("base64url"),
+                createdAt: current.createdAt,
+                updatedAt: timestamp
+            });
+            await writePrivateJson(target, value);
+            return value;
+        }
+        finally {
+            encoded.fill(0);
+        }
+    });
+}
+export function openManagedCodexV3DeliveryJournalKey(journal) {
+    const encoded = Buffer.from(journal.privateKeyPkcs8, "base64url");
+    try {
+        if (encoded.toString("base64url") !== journal.privateKeyPkcs8)
+            throw new Error("non-canonical key");
+        const key = createPrivateKey({ key: encoded, format: "der", type: "pkcs8" });
+        if (key.asymmetricKeyType !== "x25519")
+            throw new Error("unexpected key type");
+        return key;
+    }
+    finally {
+        encoded.fill(0);
+    }
+}
+export async function clearManagedCodexV3OperationJournal(expected, env = process.env) {
+    const target = path(env);
+    await withPrivateFileLock(target, async () => {
+        const current = await readManagedCodexV3OperationJournal(env);
+        if (!current)
+            return;
+        if (current.kind !== expected.kind || current.clientRequestId !== expected.clientRequestId
+            || current.idempotencyKey !== expected.idempotencyKey) {
+            throw Object.assign(new Error("The v3 operation journal changed unexpectedly."), {
+                code: "managed_codex_v3_state_conflict"
+            });
+        }
+        await removePrivateFileDurably(target);
+    });
+}
+//# sourceMappingURL=managed-credential-v3-journal.js.map

package/dist/managed-credential-v3-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-credential-v3-journal.js","sourceRoot":"","sources":["../src/managed-credential-v3-journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sCAAsC,EACtC,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEtH,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAC7D,MAAM,IAAI,GAAG;IACX,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,eAAe,EAAE,MAAM;IACvB,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO;CACnB,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7C,GAAG,IAAI;IACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,iBAAiB,EAAE,EAAE;IACrB,QAAQ,EAAE,+BAA+B;CAC1C,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,GAAG,IAAI;IACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3B,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE;IAChB,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;IACrB,SAAS,EAAE,EAAE;IACb,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,sCAAsC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACrE,iBAAiB,EAAE,MAAM;CAC1B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,GAAG,IAAI;IACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,SAAS,EAAE,EAAE;IACb,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC7C,QAAQ,EAAE,+BAA+B;IACzC,iBAAiB,EAAE,8BAA8B;IACjD,kBAAkB,EAAE,+BAA+B;IACnD,UAAU,EAAE,OAAO;IACnB,mBAAmB,EAAE,OAAO;IAC5B,iBAAiB,EAAE,MAAM;IACzB,kBAAkB,EAAE,MAAM;IAC1B,aAAa,EAAE,MAAM;CACtB,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjD,uBAAuB;IACvB,qBAAqB;IACrB,mBAAmB;CACpB,CAAC,CAAC;AAOH,SAAS,IAAI,CAAC,GAAsB;IAClC,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,4CAA4C,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,EAAE;YAC7G,IAAI,EAAE,kCAAkC;SACzC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,KAAqC,EACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAAE,OAAO,OAAO,CAAC;YACvE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAAE;gBACpF,IAAI,EAAE,iCAAiC;aACxC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAAC,KAMhE;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;eACxC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe;eAC1D,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC9D,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAAE;gBAClF,IAAI,EAAE,iCAAiC;aACxC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,iBAAiB,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5F,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC;gBACxC,aAAa,EAAE,CAAC;gBAChB,IAAI,EAAE,UAAU;gBAChB,GAAG,KAAK,CAAC,QAAQ;gBACjB,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,OAAsC;IACzF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACpG,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC;IACb,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,QAA2G,EAC3G,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;eACrF,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;YACxD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,EAAE;gBAC/E,IAAI,EAAE,iCAAiC;aACxC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/managed-credential-v3.d.ts

@@ -0,0 +1,117 @@
+import { z } from "zod";
+export declare const ManagedCodexV3StateSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<3>;
+    tenantId: z.ZodString;
+    enrollmentId: z.ZodString;
+    assignmentId: z.ZodString;
+    managedAccountId: z.ZodString;
+    providerAccountId: z.ZodString;
+    lineageId: z.ZodString;
+    generationVersion: z.ZodNumber;
+    authorityMode: z.ZodEnum<{
+        CLIENT_MANAGED: "CLIENT_MANAGED";
+        DELIVERY_PENDING: "DELIVERY_PENDING";
+    }>;
+    authorityEpoch: z.ZodNullable<z.ZodNumber>;
+    deliveryId: z.ZodString;
+    ackIdempotencyKey: z.ZodString;
+    credentialExpiresAt: z.ZodString;
+    ackExpiresAt: z.ZodString;
+    ackedAt: z.ZodNullable<z.ZodString>;
+    phase: z.ZodEnum<{
+        INSTALLED: "INSTALLED";
+        INSTALLED_PENDING_ACK: "INSTALLED_PENDING_ACK";
+        INSTALLING: "INSTALLING";
+    }>;
+    accessTokenDigest: z.ZodString;
+    refreshTokenDigest: z.ZodString;
+    idTokenDigest: z.ZodString;
+    updatedAt: z.ZodString;
+    lastReportedAt: z.ZodNullable<z.ZodString>;
+    previous: z.ZodNullable<z.ZodObject<{
+        assignmentId: z.ZodString;
+        lineageId: z.ZodString;
+        generationVersion: z.ZodNumber;
+        authorityEpoch: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ManagedCodexV3State = z.infer<typeof ManagedCodexV3StateSchema>;
+export interface ManagedCodexV3CredentialInput {
+    tenantId: string;
+    enrollmentId: string;
+    assignmentId: string;
+    managedAccountId: string;
+    providerAccountId: string;
+    lineageId: string;
+    generationVersion: number;
+    deliveryId: string;
+    ackIdempotencyKey: string;
+    refreshToken: string;
+    accessToken: string;
+    idToken: string;
+    credentialExpiresAt: string;
+    ackExpiresAt: string;
+    lastRefresh?: string;
+}
+export interface ManagedCodexV3CredentialObservation {
+    state: ManagedCodexV3State;
+    rotationMode: "ROTATED" | "RETAINED";
+    accessTokenHealth: "HEALTHY" | "EXPIRED" | "UNKNOWN";
+    refreshTokenHealth: "HEALTHY" | "UNKNOWN";
+    observedAt: string;
+    credentialExpiresAt: string;
+    credentials: {
+        refreshToken: string;
+        accessToken: string;
+        idToken: string;
+        providerAccountId: string;
+    };
+}
+export declare function readManagedCodexV3State(env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3State | undefined>;
+export declare function managedCodexV3StateExists(env?: NodeJS.ProcessEnv): Promise<boolean>;
+export declare function withCurrentCodexFullCredentials<T>(env: NodeJS.ProcessEnv, consume: (credentials: {
+    refreshToken: string;
+    accessToken: string;
+    idToken: string;
+    providerAccountId: string;
+    expiresAt: string;
+    lastRefresh?: string;
+}) => Promise<T>): Promise<T>;
+export declare function installManagedCodexV3Credentials(raw: ManagedCodexV3CredentialInput, now?: number, env?: NodeJS.ProcessEnv, hooks?: {
+    afterInstallingState?: () => Promise<void>;
+    afterAuthWrite?: () => Promise<void>;
+}): Promise<{
+    action: "INSTALLED" | "REPLACED" | "UNCHANGED" | "RECOVERED";
+    authPath: string;
+    statePath: string;
+    state: ManagedCodexV3State;
+}>;
+export declare function markManagedCodexV3DeliveryAcknowledged(input: {
+    deliveryId: string;
+    generationVersion: number;
+    authorityEpoch: number;
+    ackedAt: string;
+}, env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3State>;
+export declare function withManagedCodexV3CredentialObservation<T>(env: NodeJS.ProcessEnv, now: number, consume: (observation: ManagedCodexV3CredentialObservation) => Promise<T>): Promise<T | undefined>;
+export declare function commitManagedCodexV3GenerationReport(input: {
+    lineageId: string;
+    previousGenerationVersion: number;
+    generationVersion: number;
+    authorityEpoch: number;
+    credentialExpiresAt: string;
+    observedAt: string;
+    tokenDigests: {
+        accessTokenDigest: string;
+        refreshTokenDigest: string;
+        idTokenDigest: string;
+    };
+}, env?: NodeJS.ProcessEnv): Promise<ManagedCodexV3State>;
+export declare function codexV3CredentialDigests(credentials: {
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+}): {
+    accessTokenDigest: string;
+    refreshTokenDigest: string;
+    idTokenDigest: string;
+};