@tokensrc/codex 1.13.4 → 1.14.0

package/dist/managed-credential-v3.js

@@ -0,0 +1,423 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { z } from "zod";
+import { CodexServiceError } from "./errors.js";
+import { readJsonIfExists, removePrivateFileDurably, withPrivateFileLock, writePrivateJson } from "./private-file.js";
+const MAX_AUTH_FILE_BYTES = 1024 * 1024;
+const TOKEN_MAX = 65_536;
+const InstantSchema = z.string().datetime({ offset: true });
+const DigestSchema = z.string().length(64).regex(/^[0-9a-f]{64}$/);
+const PreviousLineageSchema = z.strictObject({
+    assignmentId: z.string().min(1).max(255),
+    lineageId: z.string().min(1).max(255),
+    generationVersion: z.number().int().positive(),
+    authorityEpoch: z.number().int().nonnegative().nullable()
+});
+export const ManagedCodexV3StateSchema = z.strictObject({
+    schemaVersion: z.literal(3),
+    tenantId: z.string().min(1).max(255),
+    enrollmentId: z.string().min(1).max(255),
+    assignmentId: z.string().min(1).max(255),
+    managedAccountId: z.string().min(1).max(255),
+    providerAccountId: z.string().min(1).max(512),
+    lineageId: z.string().min(1).max(255),
+    generationVersion: z.number().int().positive(),
+    authorityMode: z.enum(["DELIVERY_PENDING", "CLIENT_MANAGED"]),
+    authorityEpoch: z.number().int().nonnegative().nullable(),
+    deliveryId: z.string().min(1).max(255),
+    ackIdempotencyKey: z.string().min(8).max(255),
+    credentialExpiresAt: InstantSchema,
+    ackExpiresAt: InstantSchema,
+    ackedAt: InstantSchema.nullable(),
+    phase: z.enum(["INSTALLING", "INSTALLED_PENDING_ACK", "INSTALLED"]),
+    accessTokenDigest: DigestSchema,
+    refreshTokenDigest: DigestSchema,
+    idTokenDigest: DigestSchema,
+    updatedAt: InstantSchema,
+    lastReportedAt: InstantSchema.nullable(),
+    previous: PreviousLineageSchema.nullable()
+}).superRefine((value, context) => {
+    const acknowledged = value.phase === "INSTALLED";
+    if (acknowledged !== (value.authorityMode === "CLIENT_MANAGED")
+        || acknowledged !== (value.authorityEpoch != null)
+        || acknowledged !== (value.ackedAt != null)) {
+        context.addIssue({ code: "custom", message: "Managed credential ACK state is inconsistent." });
+    }
+});
+const FullAuthSchema = z.strictObject({
+    auth_mode: z.literal("chatgpt"),
+    OPENAI_API_KEY: z.unknown().optional(),
+    tokens: z.strictObject({
+        id_token: z.string().min(1).max(TOKEN_MAX),
+        access_token: z.string().min(1).max(TOKEN_MAX),
+        refresh_token: z.string().min(1).max(TOKEN_MAX),
+        account_id: z.string().min(1).max(512)
+    }),
+    last_refresh: InstantSchema.optional()
+});
+function paths(env = process.env) {
+    const codexHome = env.CODEX_HOME?.trim() || join(homedir(), ".codex");
+    return {
+        authPath: join(codexHome, "auth.json"),
+        backupPath: join(codexHome, "auth.json.numa-backup"),
+        statePath: join(codexHome, ".numa-managed-lineage.json")
+    };
+}
+function required(value, name, maximum = 255) {
+    if (value !== value.trim() || value.length < 1 || value.length > maximum) {
+        throw invalidCredentials(`${name} is invalid.`);
+    }
+    return value;
+}
+function instant(value, name) {
+    if (value !== value.trim() || !Number.isFinite(Date.parse(value))) {
+        throw invalidCredentials(`${name} is invalid.`);
+    }
+    return value;
+}
+function token(value, name) {
+    return required(value, name, TOKEN_MAX);
+}
+function digest(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function jwtExpiry(value) {
+    const payload = value.split(".")[1];
+    if (!payload)
+        return undefined;
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof decoded.exp === "number" && Number.isFinite(decoded.exp)
+            ? decoded.exp * 1_000
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function validJwt(value) {
+    const payload = value.split(".")[1];
+    if (!payload)
+        return false;
+    try {
+        JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function invalidCredentials(message) {
+    return new CodexServiceError(message, "invalid_managed_codex_v3_credentials");
+}
+async function readFullAuth(env) {
+    const authPath = paths(env).authPath;
+    const file = await lstat(authPath).catch((error) => {
+        if (error.code === "ENOENT") {
+            throw invalidCredentials("Official Codex auth.json does not exist.");
+        }
+        throw error;
+    });
+    if (!file.isFile() || file.isSymbolicLink() || file.size > MAX_AUTH_FILE_BYTES) {
+        throw invalidCredentials("Official Codex auth.json is not a safe credential file.");
+    }
+    const encoded = await readFile(authPath);
+    try {
+        const parsed = FullAuthSchema.safeParse(JSON.parse(encoded.toString("utf8")));
+        if (!parsed.success)
+            throw invalidCredentials("Official Codex auth.json is incomplete.");
+        return parsed.data;
+    }
+    catch (error) {
+        if (error instanceof CodexServiceError)
+            throw error;
+        throw invalidCredentials("Official Codex auth.json is unreadable.");
+    }
+    finally {
+        encoded.fill(0);
+    }
+}
+export async function readManagedCodexV3State(env = process.env) {
+    const raw = await readJsonIfExists(paths(env).statePath);
+    if (raw === undefined)
+        return undefined;
+    const parsed = ManagedCodexV3StateSchema.safeParse(raw);
+    if (!parsed.success && raw && typeof raw === "object"
+        && raw.schemaVersion === 3) {
+        throw new CodexServiceError("The local v3 managed credential state is invalid.", "managed_codex_v3_state_invalid");
+    }
+    return parsed.success ? parsed.data : undefined;
+}
+export async function managedCodexV3StateExists(env = process.env) {
+    return (await readManagedCodexV3State(env)) !== undefined;
+}
+export async function withCurrentCodexFullCredentials(env, consume) {
+    const auth = await readFullAuth(env);
+    const expiresAt = jwtExpiry(auth.tokens.access_token);
+    if (expiresAt === undefined)
+        throw invalidCredentials("Official Codex access_token has no usable expiry.");
+    const credentials = {
+        refreshToken: auth.tokens.refresh_token,
+        accessToken: auth.tokens.access_token,
+        idToken: auth.tokens.id_token,
+        providerAccountId: auth.tokens.account_id,
+        expiresAt: new Date(expiresAt).toISOString(),
+        ...(auth.last_refresh ? { lastRefresh: auth.last_refresh } : {})
+    };
+    try {
+        return await consume(credentials);
+    }
+    finally {
+        credentials.refreshToken = "";
+        credentials.accessToken = "";
+        credentials.idToken = "";
+        credentials.providerAccountId = "";
+    }
+}
+export async function installManagedCodexV3Credentials(raw, now = Date.now(), env = process.env, hooks = {}) {
+    const input = {
+        tenantId: required(raw.tenantId, "tenantId"),
+        enrollmentId: required(raw.enrollmentId, "enrollmentId"),
+        assignmentId: required(raw.assignmentId, "assignmentId"),
+        managedAccountId: required(raw.managedAccountId, "managedAccountId"),
+        providerAccountId: required(raw.providerAccountId, "providerAccountId", 512),
+        lineageId: required(raw.lineageId, "lineageId"),
+        generationVersion: raw.generationVersion,
+        deliveryId: required(raw.deliveryId, "deliveryId"),
+        ackIdempotencyKey: required(raw.ackIdempotencyKey, "ackIdempotencyKey"),
+        refreshToken: token(raw.refreshToken, "refreshToken"),
+        accessToken: token(raw.accessToken, "accessToken"),
+        idToken: token(raw.idToken, "idToken"),
+        credentialExpiresAt: instant(raw.credentialExpiresAt, "credentialExpiresAt"),
+        ackExpiresAt: instant(raw.ackExpiresAt, "ackExpiresAt"),
+        ...(raw.lastRefresh ? { lastRefresh: instant(raw.lastRefresh, "lastRefresh") } : {})
+    };
+    if (!Number.isInteger(input.generationVersion) || input.generationVersion <= 0) {
+        throw invalidCredentials("generationVersion must be positive.");
+    }
+    if (!validJwt(input.idToken) || !validJwt(input.accessToken)) {
+        throw invalidCredentials("The delivered access/id token is invalid.");
+    }
+    if (Date.parse(input.credentialExpiresAt) <= now || Date.parse(input.ackExpiresAt) <= now) {
+        throw new CodexServiceError("The full credential delivery has expired.", "full_credential_delivery_expired");
+    }
+    const value = paths(env);
+    return withPrivateFileLock(value.authPath, async () => {
+        await removePrivateFileDurably(value.backupPath);
+        const current = await readManagedCodexV3State(env);
+        const sameLineage = current?.tenantId === input.tenantId
+            && current.assignmentId === input.assignmentId
+            && current.lineageId === input.lineageId;
+        if (sameLineage && current.generationVersion > input.generationVersion) {
+            throw new CodexServiceError("Refusing a stale v3 credential generation.", "lineage_version_conflict");
+        }
+        const tokenDigests = {
+            accessTokenDigest: digest(input.accessToken),
+            refreshTokenDigest: digest(input.refreshToken),
+            idTokenDigest: digest(input.idToken)
+        };
+        if (sameLineage && current.generationVersion === input.generationVersion
+            && current.deliveryId === input.deliveryId) {
+            const auth = await readFullAuth(env).catch(() => undefined);
+            const matches = auth !== undefined && auth.tokens.account_id === input.providerAccountId
+                && digest(auth.tokens.access_token) === tokenDigests.accessTokenDigest
+                && digest(auth.tokens.refresh_token) === tokenDigests.refreshTokenDigest
+                && digest(auth.tokens.id_token) === tokenDigests.idTokenDigest;
+            if (current.phase !== "INSTALLING" && !matches)
+                throw new CodexServiceError("The same v3 generation has different local credentials.", "lineage_version_conflict");
+            if (current.phase === "INSTALLING" && auth !== undefined && !matches)
+                throw new CodexServiceError("The interrupted v3 installation has different local credentials.", "lineage_version_conflict");
+            if (current.phase !== "INSTALLING") {
+                return { action: "UNCHANGED", authPath: value.authPath, statePath: value.statePath, state: current };
+            }
+        }
+        else if (sameLineage && current?.generationVersion === input.generationVersion) {
+            throw new CodexServiceError("The same v3 generation has a different delivery.", "lineage_version_conflict");
+        }
+        const timestamp = new Date(now).toISOString();
+        const previous = current ? {
+            assignmentId: current.assignmentId,
+            lineageId: current.lineageId,
+            generationVersion: current.generationVersion,
+            authorityEpoch: current.authorityEpoch
+        } : null;
+        const installing = ManagedCodexV3StateSchema.parse({
+            schemaVersion: 3,
+            tenantId: input.tenantId,
+            enrollmentId: input.enrollmentId,
+            assignmentId: input.assignmentId,
+            managedAccountId: input.managedAccountId,
+            providerAccountId: input.providerAccountId,
+            lineageId: input.lineageId,
+            generationVersion: input.generationVersion,
+            authorityMode: "DELIVERY_PENDING",
+            authorityEpoch: null,
+            deliveryId: input.deliveryId,
+            ackIdempotencyKey: input.ackIdempotencyKey,
+            credentialExpiresAt: input.credentialExpiresAt,
+            ackExpiresAt: input.ackExpiresAt,
+            ackedAt: null,
+            phase: "INSTALLING",
+            ...tokenDigests,
+            updatedAt: timestamp,
+            lastReportedAt: null,
+            previous
+        });
+        await writePrivateJson(value.statePath, installing);
+        await hooks.afterInstallingState?.();
+        await writePrivateJson(value.authPath, {
+            auth_mode: "chatgpt",
+            OPENAI_API_KEY: null,
+            tokens: {
+                id_token: input.idToken,
+                access_token: input.accessToken,
+                refresh_token: input.refreshToken,
+                account_id: input.providerAccountId
+            },
+            last_refresh: input.lastRefresh ?? timestamp
+        });
+        await hooks.afterAuthWrite?.();
+        const installed = ManagedCodexV3StateSchema.parse({
+            ...installing,
+            phase: "INSTALLED_PENDING_ACK",
+            updatedAt: timestamp
+        });
+        await writePrivateJson(value.statePath, installed);
+        return {
+            action: current
+                ? (sameLineage && current.phase === "INSTALLING" ? "RECOVERED" : "REPLACED")
+                : "INSTALLED",
+            authPath: value.authPath,
+            statePath: value.statePath,
+            state: installed
+        };
+    });
+}
+export async function markManagedCodexV3DeliveryAcknowledged(input, env = process.env) {
+    const value = paths(env);
+    return withPrivateFileLock(value.authPath, async () => {
+        const current = await readManagedCodexV3State(env);
+        if (!current || current.deliveryId !== input.deliveryId
+            || current.generationVersion !== input.generationVersion) {
+            throw new CodexServiceError("The v3 ACK does not match local credentials.", "lineage_version_conflict");
+        }
+        if (!Number.isInteger(input.authorityEpoch) || input.authorityEpoch <= 0) {
+            throw invalidCredentials("authorityEpoch must be positive.");
+        }
+        const ackedAt = instant(input.ackedAt, "ackedAt");
+        if (current.phase === "INSTALLED") {
+            if (current.authorityEpoch !== input.authorityEpoch || current.ackedAt !== ackedAt) {
+                throw new CodexServiceError("The replayed v3 ACK differs from local state.", "lineage_version_conflict");
+            }
+            return current;
+        }
+        if (current.phase !== "INSTALLED_PENDING_ACK") {
+            throw new CodexServiceError("The v3 credentials are not ready for ACK.", "lineage_version_conflict");
+        }
+        const acknowledged = ManagedCodexV3StateSchema.parse({
+            ...current,
+            phase: "INSTALLED",
+            authorityMode: "CLIENT_MANAGED",
+            authorityEpoch: input.authorityEpoch,
+            ackedAt,
+            updatedAt: ackedAt
+        });
+        await writePrivateJson(value.statePath, acknowledged);
+        return acknowledged;
+    });
+}
+export async function withManagedCodexV3CredentialObservation(env, now, consume) {
+    const value = paths(env);
+    const observation = await withPrivateFileLock(value.authPath, async () => {
+        const state = await readManagedCodexV3State(env);
+        if (!state || state.phase !== "INSTALLED" || state.authorityMode !== "CLIENT_MANAGED")
+            return undefined;
+        const auth = await readFullAuth(env).catch(() => undefined);
+        if (!auth || auth.tokens.account_id !== state.providerAccountId)
+            return undefined;
+        const accessExpiresAt = jwtExpiry(auth.tokens.access_token);
+        const observedAt = new Date(now).toISOString();
+        return {
+            state,
+            rotationMode: digest(auth.tokens.refresh_token) === state.refreshTokenDigest ? "RETAINED" : "ROTATED",
+            accessTokenHealth: accessExpiresAt === undefined
+                ? "UNKNOWN"
+                : accessExpiresAt <= now ? "EXPIRED" : "HEALTHY",
+            refreshTokenHealth: auth.tokens.refresh_token ? "HEALTHY" : "UNKNOWN",
+            observedAt,
+            credentialExpiresAt: accessExpiresAt === undefined
+                ? state.credentialExpiresAt
+                : new Date(accessExpiresAt).toISOString(),
+            credentials: {
+                refreshToken: auth.tokens.refresh_token,
+                accessToken: auth.tokens.access_token,
+                idToken: auth.tokens.id_token,
+                providerAccountId: auth.tokens.account_id
+            }
+        };
+    });
+    if (!observation)
+        return undefined;
+    // Never hold the auth.json writer lock while a caller performs network I/O.
+    // The commit path below revalidates the exact observed credential digests.
+    try {
+        return await consume(observation);
+    }
+    finally {
+        observation.credentials.refreshToken = "";
+        observation.credentials.accessToken = "";
+        observation.credentials.idToken = "";
+        observation.credentials.providerAccountId = "";
+    }
+}
+export async function commitManagedCodexV3GenerationReport(input, env = process.env) {
+    const value = paths(env);
+    return withPrivateFileLock(value.authPath, async () => {
+        const current = await readManagedCodexV3State(env);
+        if (!current || current.phase !== "INSTALLED" || current.lineageId !== input.lineageId
+            || current.generationVersion !== input.previousGenerationVersion
+            || input.generationVersion !== input.previousGenerationVersion + 1
+            || !Number.isInteger(input.authorityEpoch) || input.authorityEpoch <= 0) {
+            throw new CodexServiceError("The v3 generation report does not match local state.", "lineage_version_conflict");
+        }
+        const expectedDigests = {
+            accessTokenDigest: DigestSchema.parse(input.tokenDigests.accessTokenDigest),
+            refreshTokenDigest: DigestSchema.parse(input.tokenDigests.refreshTokenDigest),
+            idTokenDigest: DigestSchema.parse(input.tokenDigests.idTokenDigest)
+        };
+        const auth = await readFullAuth(env).catch(() => undefined);
+        if (!auth || auth.tokens.account_id !== current.providerAccountId
+            || digest(auth.tokens.access_token) !== expectedDigests.accessTokenDigest
+            || digest(auth.tokens.refresh_token) !== expectedDigests.refreshTokenDigest
+            || digest(auth.tokens.id_token) !== expectedDigests.idTokenDigest) {
+            throw new CodexServiceError("Official Codex credentials changed while the generation report was in flight.", "lineage_version_conflict");
+        }
+        const updated = ManagedCodexV3StateSchema.parse({
+            ...current,
+            generationVersion: input.generationVersion,
+            authorityEpoch: input.authorityEpoch,
+            credentialExpiresAt: instant(input.credentialExpiresAt, "credentialExpiresAt"),
+            ...expectedDigests,
+            updatedAt: instant(input.observedAt, "observedAt"),
+            lastReportedAt: input.observedAt,
+            previous: {
+                assignmentId: current.assignmentId,
+                lineageId: current.lineageId,
+                generationVersion: current.generationVersion,
+                authorityEpoch: current.authorityEpoch
+            }
+        });
+        await writePrivateJson(value.statePath, updated);
+        return updated;
+    });
+}
+export function codexV3CredentialDigests(credentials) {
+    return {
+        accessTokenDigest: digest(credentials.accessToken),
+        refreshTokenDigest: digest(credentials.refreshToken),
+        idTokenDigest: digest(credentials.idToken)
+    };
+}
+//# sourceMappingURL=managed-credential-v3.js.map

package/dist/managed-credential-v3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-credential-v3.js","sourceRoot":"","sources":["../src/managed-credential-v3.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAEnE,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACzD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7C,mBAAmB,EAAE,aAAa;IAClC,YAAY,EAAE,aAAa;IAC3B,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,uBAAuB,EAAE,WAAW,CAAC,CAAC;IACnE,iBAAiB,EAAE,YAAY;IAC/B,kBAAkB,EAAE,YAAY;IAChC,aAAa,EAAE,YAAY;IAC3B,SAAS,EAAE,aAAa;IACxB,cAAc,EAAE,aAAa,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC;IACjD,IAAI,YAAY,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,gBAAgB,CAAC;WAC1D,YAAY,KAAK,CAAC,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC;WAC/C,YAAY,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC,CAAC,CAAC;AAqCH,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC/B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC;QACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACvC,CAAC;IACF,YAAY,EAAE,aAAa,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;QACtC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC;QACpD,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY,EAAE,OAAO,GAAG,GAAG;IAC1D,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QACzE,MAAM,kBAAkB,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,IAAY;IAC1C,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,kBAAkB,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,IAAY;IACxC,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;QACpG,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;YACpE,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,KAAK;YACrB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAsB;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1D,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAC/E,MAAM,kBAAkB,CAAC,yDAAyD,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,kBAAkB,CAAC,yCAAyC,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,KAAK,CAAC;QACpD,MAAM,kBAAkB,CAAC,yCAAyC,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;WAC/C,GAAmC,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,EAAE,gCAAgC,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,GAAsB,EACtB,OAOgB;IAEhB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,kBAAkB,CAAC,mDAAmD,CAAC,CAAC;IAC3G,MAAM,WAAW,GAAG;QAClB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;QACvC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;QACrC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;QAC7B,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;QACzC,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC5C,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,WAAW,CAAC,YAAY,GAAG,EAAE,CAAC;QAC9B,WAAW,CAAC,WAAW,GAAG,EAAE,CAAC;QAC7B,WAAW,CAAC,OAAO,GAAG,EAAE,CAAC;QACzB,WAAW,CAAC,iBAAiB,GAAG,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAkC,EAClC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,KAAK,GAAyF,EAAE;IAOhG,MAAM,KAAK,GAAkC;QAC3C,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5C,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC;QACxD,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC;QACxD,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QACpE,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,GAAG,CAAC;QAC5E,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC;QAC/C,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;QAClD,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACvE,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC;QACrD,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC;QAClD,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QACtC,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QAC5E,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,EAAE,CAAC;QAC/E,MAAM,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7D,MAAM,kBAAkB,CAAC,2CAA2C,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC;QAC1F,MAAM,IAAI,iBAAiB,CAAC,2CAA2C,EAAE,kCAAkC,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,EAAE,QAAQ,KAAK,KAAK,CAAC,QAAQ;eACnD,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;eAC3C,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC;QAC3C,IAAI,WAAW,IAAI,OAAO,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACvE,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,EAAE,0BAA0B,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,YAAY,GAAG;YACnB,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5C,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;YAC9C,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;SACrC,CAAC;QACF,IAAI,WAAW,IAAI,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACnE,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,iBAAiB;mBACnF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,YAAY,CAAC,iBAAiB;mBACnE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,YAAY,CAAC,kBAAkB;mBACrE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC;YACjE,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,iBAAiB,CACzE,yDAAyD,EACzD,0BAA0B,CAC3B,CAAC;YACF,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,iBAAiB,CAC/F,kEAAkE,EAClE,0BAA0B,CAC3B,CAAC;YACF,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBACnC,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAChH,CAAC;QACH,CAAC;aAAM,IAAI,WAAW,IAAI,OAAO,EAAE,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACjF,MAAM,IAAI,iBAAiB,CAAC,kDAAkD,EAAE,0BAA0B,CAAC,CAAC;QAC9G,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;YACzB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC;YACjD,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,aAAa,EAAE,kBAAkB;YACjC,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,YAAY;YACnB,GAAG,YAAY;YACf,SAAS,EAAE,SAAS;YACpB,cAAc,EAAE,IAAI;YACpB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACrC,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE;YACrC,SAAS,EAAE,SAAS;YACpB,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE;gBACN,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,UAAU,EAAE,KAAK,CAAC,iBAAiB;aACpC;YACD,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,SAAS;SAC7C,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC;YAChD,GAAG,UAAU;YACb,KAAK,EAAE,uBAAuB;YAC9B,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;QACH,MAAM,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO;YACL,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,WAAoB,CAAC,CAAC,CAAC,UAAmB,CAAC;gBAC9F,CAAC,CAAC,WAAoB;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,SAAS;SACjB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAKC,EACD,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;eAClD,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC3D,MAAM,IAAI,iBAAiB,CAAC,8CAA8C,EAAE,0BAA0B,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBACnF,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,EAAE,0BAA0B,CAAC,CAAC;YAC3G,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CAAC,2CAA2C,EAAE,0BAA0B,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC;YACnD,GAAG,OAAO;YACV,KAAK,EAAE,WAAW;YAClB,aAAa,EAAE,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,MAAM,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACtD,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,GAAsB,EACtB,GAAW,EACX,OAAyE;IAEzE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,aAAa,KAAK,gBAAgB;YAAE,OAAO,SAAS,CAAC;QACxG,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,iBAAiB;YAAE,OAAO,SAAS,CAAC;QAClF,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO;YACL,KAAK;YACL,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACrG,iBAAiB,EAAE,eAAe,KAAK,SAAS;gBAC9C,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAClD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACrE,UAAU;YACV,mBAAmB,EAAE,eAAe,KAAK,SAAS;gBAChD,CAAC,CAAC,KAAK,CAAC,mBAAmB;gBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE;YAC3C,WAAW,EAAE;gBACX,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACvC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACrC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC7B,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aAC1C;SAC4C,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,WAAW,CAAC,WAAW,CAAC,YAAY,GAAG,EAAE,CAAC;QAC1C,WAAW,CAAC,WAAW,CAAC,WAAW,GAAG,EAAE,CAAC;QACzC,WAAW,CAAC,WAAW,CAAC,OAAO,GAAG,EAAE,CAAC;QACrC,WAAW,CAAC,WAAW,CAAC,iBAAiB,GAAG,EAAE,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAQC,EACD,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;eACjF,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,yBAAyB;eAC7D,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,yBAAyB,GAAG,CAAC;eAC/D,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,EAAE,0BAA0B,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,eAAe,GAAG;YACtB,iBAAiB,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC;YAC3E,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,CAAC;YAC7E,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC;SACpE,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,iBAAiB;eAC5D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,eAAe,CAAC,iBAAiB;eACtE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,eAAe,CAAC,kBAAkB;eACxE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,eAAe,CAAC,aAAa,EAAE,CAAC;YACpE,MAAM,IAAI,iBAAiB,CACzB,+EAA+E,EAC/E,0BAA0B,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC;YAC9C,GAAG,OAAO;YACV,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,mBAAmB,EAAE,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;YAC9E,GAAG,eAAe;YAClB,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC;YAClD,cAAc,EAAE,KAAK,CAAC,UAAU;YAChC,QAAQ,EAAE;gBACR,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC;SACF,CAAC,CAAC;QACH,MAAM,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,WAIxC;IACC,OAAO;QACL,iBAAiB,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;QAClD,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC;QACpD,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;KAC3C,CAAC;AACJ,CAAC"}

package/dist/migration-login-batch.d.ts

@@ -0,0 +1,66 @@
+import type { CodexServiceClient } from "./client.js";
+import { executeCodexEnrollmentLogin } from "./enrollment-flow.js";
+import { CODEX_MIGRATION_CAPACITY, type CodexEnrollmentCandidateResponse, type CodexMigrationLoginQueueResponse, type CodexMigrationPlanStatus, type CodexMigrationTarget } from "./protocol.js";
+type MigrationBatchClient = Pick<CodexServiceClient, "listMigrationLoginQueue" | "getEnrollmentIntent" | "claimEnrollmentIntent" | "heartbeatEnrollmentIntent" | "uploadEnrollmentCandidate">;
+type EnrollmentExecutor = typeof executeCodexEnrollmentLogin;
+export type CodexMigrationBatchStopReason = "DRY_RUN" | "QUEUE_EXHAUSTED" | "PAUSED" | "CANCELLED" | "COMPLETED" | "TARGET_UNCERTAIN" | "AUTHENTICATION_ERROR" | "SERVICE_ERROR" | "LOGIN_ERROR";
+export interface CodexMigrationLoginBatchItemResult {
+    targetId: string;
+    assignmentId: string;
+    intentId: string | null;
+    requestedAction: "LOGIN" | "VIEW_ENROLLMENT" | "NONE";
+    action: "LOGIN" | "SKIP";
+    status: "PLANNED" | "COMPLETED" | "FAILED" | "SKIPPED";
+    outcome?: CodexEnrollmentCandidateResponse["result"]["outcome"];
+    intentStatus?: CodexEnrollmentCandidateResponse["intent"]["status"];
+    safeErrorCode?: string | null;
+    skipReason?: "VIEW_ENROLLMENT" | "ALREADY_USER_BOUND" | "NO_ACTION";
+}
+export interface CodexMigrationLoginBatchResult {
+    schemaVersion: 2;
+    plan: {
+        id: string;
+        status: CodexMigrationPlanStatus;
+        revision: number;
+        accountId: string;
+        sequentialRequired: true;
+    };
+    capacity: typeof CODEX_MIGRATION_CAPACITY;
+    dryRun: boolean;
+    stopReason: CodexMigrationBatchStopReason;
+    counts: {
+        observed: number;
+        plannedLogins: number;
+        attempted: number;
+        completed: number;
+        failed: number;
+        skipped: number;
+    };
+    items: CodexMigrationLoginBatchItemResult[];
+}
+interface QueueSnapshot {
+    plan: CodexMigrationLoginQueueResponse["plan"];
+    items: CodexMigrationTarget[];
+}
+/** Loads all pages and rejects a mixed-revision snapshot instead of reordering targets. */
+export declare function loadCodexMigrationLoginQueueSnapshot(input: {
+    client: Pick<MigrationBatchClient, "listMigrationLoginQueue">;
+    planId: string;
+    pageSize?: number;
+    maxSnapshotAttempts?: number;
+}): Promise<QueueSnapshot>;
+/**
+ * Executes at most one isolated official login at a time. The queue is fetched
+ * again after every handled target so pause/cancel/completion takes effect before
+ * another refresh token can be generated.
+ */
+export declare function executeCodexMigrationLoginBatch(input: {
+    client: MigrationBatchClient;
+    tenantId: string;
+    planId: string;
+    deviceAuth?: boolean;
+    dryRun?: boolean;
+    pageSize?: number;
+    executeEnrollment?: EnrollmentExecutor;
+}): Promise<CodexMigrationLoginBatchResult>;
+export {};