@tokensrc/codex 1.14.16 → 1.14.17

package/dist/request-bound-device-v6-state.d.ts

@@ -0,0 +1,397 @@
+import { z } from "zod";
+import { CodexV6FullCredentialDeliveryResponseSchema } from "./protocol.js";
+export declare const CodexV6BindingStateSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    requestId: z.ZodString;
+    bindingId: z.ZodString;
+    predecessorBindingId: z.ZodNullable<z.ZodString>;
+    installationId: z.ZodString;
+    managedAccountId: z.ZodString;
+    providerAccountId: z.ZodString;
+    poolEntryId: z.ZodString;
+    credentialLineageId: z.ZodString;
+    generationVersion: z.ZodNumber;
+    accountExpiresAt: z.ZodNullable<z.ZodString>;
+    localAssignmentId: z.ZodString;
+    source: z.ZodEnum<{
+        ACCOUNT_REPLACEMENT: "ACCOUNT_REPLACEMENT";
+        ADMIN_ADDED: "ADMIN_ADDED";
+        LEGACY_AUTO_MIGRATED: "LEGACY_AUTO_MIGRATED";
+        REQUEST_INITIAL: "REQUEST_INITIAL";
+    }>;
+    status: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        NEEDS_REAUTH: "NEEDS_REAUTH";
+        RETIREMENT_PENDING: "RETIREMENT_PENDING";
+    }>;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexV6DeliveryJournalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    requestId: z.ZodString;
+    bindingId: z.ZodString;
+    installationId: z.ZodString;
+    expectedManagedAccountId: z.ZodString;
+    expectedProviderAccountId: z.ZodString;
+    expectedPoolEntryId: z.ZodString;
+    expectedCredentialLineageId: z.ZodString;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    ackIdempotencyKey: z.ZodString;
+    clientKey: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        publicKey: z.ZodString;
+    }, z.core.$strict>;
+    privateKeyPkcs8: z.ZodString;
+    response: z.ZodNullable<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<6>;
+        delivery: z.ZodObject<{
+            id: z.ZodString;
+            clientRequestId: z.ZodString;
+            requestId: z.ZodString;
+            bindingId: z.ZodString;
+            installationId: z.ZodString;
+            managedAccountId: z.ZodString;
+            providerAccountId: z.ZodString;
+            credentialLineageId: z.ZodString;
+            generationVersion: z.ZodNumber;
+            issuedAt: z.ZodString;
+            credentialExpiresAt: z.ZodString;
+            ackExpiresAt: z.ZodString;
+            ackedAt: z.ZodNullable<z.ZodString>;
+            status: z.ZodLiteral<"AWAITING_ACK">;
+            envelope: z.ZodObject<{
+                version: z.ZodLiteral<1>;
+                algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+                ephemeralPublicKey: z.ZodString;
+                salt: z.ZodString;
+                nonce: z.ZodString;
+                ciphertext: z.ZodString;
+                authenticationTag: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        replayed: z.ZodBoolean;
+    }, z.core.$strict>>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export declare const CodexV6ReportJournalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    subject: z.ZodString;
+    requestId: z.ZodString;
+    bindingId: z.ZodString;
+    installationId: z.ZodString;
+    credentialLineageId: z.ZodString;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    expectedGenerationVersion: z.ZodNumber;
+    rotationMode: z.ZodEnum<{
+        RETAINED: "RETAINED";
+        ROTATED: "ROTATED";
+    }>;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+    accessTokenHealth: z.ZodEnum<{
+        EXPIRED: "EXPIRED";
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    refreshTokenHealth: z.ZodEnum<{
+        HEALTHY: "HEALTHY";
+        REJECTED: "REJECTED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    observedAt: z.ZodString;
+    credentialExpiresAt: z.ZodString;
+    accessTokenDigest: z.ZodString;
+    refreshTokenDigest: z.ZodString;
+    idTokenDigest: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export type CodexV6BindingState = z.infer<typeof CodexV6BindingStateSchema>;
+export type CodexV6DeliveryJournal = z.infer<typeof CodexV6DeliveryJournalSchema>;
+export type CodexV6ReportJournal = z.infer<typeof CodexV6ReportJournalSchema>;
+export declare function readCodexV6BindingState(env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    requestId: string;
+    bindingId: string;
+    predecessorBindingId: string | null;
+    installationId: string;
+    managedAccountId: string;
+    providerAccountId: string;
+    poolEntryId: string;
+    credentialLineageId: string;
+    generationVersion: number;
+    accountExpiresAt: string | null;
+    localAssignmentId: string;
+    source: "ACCOUNT_REPLACEMENT" | "ADMIN_ADDED" | "LEGACY_AUTO_MIGRATED" | "REQUEST_INITIAL";
+    status: "ACTIVE" | "NEEDS_REAUTH" | "RETIREMENT_PENDING";
+    updatedAt: string;
+} | undefined>;
+export declare function writeCodexV6BindingState(value: CodexV6BindingState, env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    requestId: string;
+    bindingId: string;
+    predecessorBindingId: string | null;
+    installationId: string;
+    managedAccountId: string;
+    providerAccountId: string;
+    poolEntryId: string;
+    credentialLineageId: string;
+    generationVersion: number;
+    accountExpiresAt: string | null;
+    localAssignmentId: string;
+    source: "ACCOUNT_REPLACEMENT" | "ADMIN_ADDED" | "LEGACY_AUTO_MIGRATED" | "REQUEST_INITIAL";
+    status: "ACTIVE" | "NEEDS_REAUTH" | "RETIREMENT_PENDING";
+    updatedAt: string;
+}>;
+export declare function clearCodexV6BindingState(expectedBindingId: string, env?: NodeJS.ProcessEnv): Promise<void>;
+export declare function readCodexV6DeliveryJournal(env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    requestId: string;
+    bindingId: string;
+    installationId: string;
+    expectedManagedAccountId: string;
+    expectedProviderAccountId: string;
+    expectedPoolEntryId: string;
+    expectedCredentialLineageId: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    ackIdempotencyKey: string;
+    clientKey: {
+        version: 1;
+        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+        publicKey: string;
+    };
+    privateKeyPkcs8: string;
+    response: {
+        schemaVersion: 6;
+        delivery: {
+            id: string;
+            clientRequestId: string;
+            requestId: string;
+            bindingId: string;
+            installationId: string;
+            managedAccountId: string;
+            providerAccountId: string;
+            credentialLineageId: string;
+            generationVersion: number;
+            issuedAt: string;
+            credentialExpiresAt: string;
+            ackExpiresAt: string;
+            ackedAt: string | null;
+            status: "AWAITING_ACK";
+            envelope: {
+                version: 1;
+                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+                ephemeralPublicKey: string;
+                salt: string;
+                nonce: string;
+                ciphertext: string;
+                authenticationTag: string;
+            };
+        };
+        replayed: boolean;
+    } | null;
+    createdAt: string;
+    updatedAt: string;
+} | undefined>;
+export declare function writeCodexV6DeliveryJournal(value: CodexV6DeliveryJournal, env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    requestId: string;
+    bindingId: string;
+    installationId: string;
+    expectedManagedAccountId: string;
+    expectedProviderAccountId: string;
+    expectedPoolEntryId: string;
+    expectedCredentialLineageId: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    ackIdempotencyKey: string;
+    clientKey: {
+        version: 1;
+        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+        publicKey: string;
+    };
+    privateKeyPkcs8: string;
+    response: {
+        schemaVersion: 6;
+        delivery: {
+            id: string;
+            clientRequestId: string;
+            requestId: string;
+            bindingId: string;
+            installationId: string;
+            managedAccountId: string;
+            providerAccountId: string;
+            credentialLineageId: string;
+            generationVersion: number;
+            issuedAt: string;
+            credentialExpiresAt: string;
+            ackExpiresAt: string;
+            ackedAt: string | null;
+            status: "AWAITING_ACK";
+            envelope: {
+                version: 1;
+                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+                ephemeralPublicKey: string;
+                salt: string;
+                nonce: string;
+                ciphertext: string;
+                authenticationTag: string;
+            };
+        };
+        replayed: boolean;
+    } | null;
+    createdAt: string;
+    updatedAt: string;
+}>;
+export declare function updateCodexV6DeliveryJournalResponse(expected: CodexV6DeliveryJournal, response: z.infer<typeof CodexV6FullCredentialDeliveryResponseSchema>, now: number, env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    requestId: string;
+    bindingId: string;
+    installationId: string;
+    expectedManagedAccountId: string;
+    expectedProviderAccountId: string;
+    expectedPoolEntryId: string;
+    expectedCredentialLineageId: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    ackIdempotencyKey: string;
+    clientKey: {
+        version: 1;
+        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+        publicKey: string;
+    };
+    privateKeyPkcs8: string;
+    response: {
+        schemaVersion: 6;
+        delivery: {
+            id: string;
+            clientRequestId: string;
+            requestId: string;
+            bindingId: string;
+            installationId: string;
+            managedAccountId: string;
+            providerAccountId: string;
+            credentialLineageId: string;
+            generationVersion: number;
+            issuedAt: string;
+            credentialExpiresAt: string;
+            ackExpiresAt: string;
+            ackedAt: string | null;
+            status: "AWAITING_ACK";
+            envelope: {
+                version: 1;
+                algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+                ephemeralPublicKey: string;
+                salt: string;
+                nonce: string;
+                ciphertext: string;
+                authenticationTag: string;
+            };
+        };
+        replayed: boolean;
+    } | null;
+    createdAt: string;
+    updatedAt: string;
+}>;
+export declare function clearCodexV6DeliveryJournal(expected: Pick<CodexV6DeliveryJournal, "clientRequestId" | "idempotencyKey">, env?: NodeJS.ProcessEnv): Promise<void>;
+export declare function openCodexV6DeliveryJournalKey(journal: CodexV6DeliveryJournal): KeyObject;
+export declare function readCodexV6ReportJournal(env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    requestId: string;
+    bindingId: string;
+    installationId: string;
+    credentialLineageId: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    expectedGenerationVersion: number;
+    rotationMode: "RETAINED" | "ROTATED";
+    envelope: {
+        version: 1;
+        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+        keyId: string;
+        ephemeralPublicKey: string;
+        salt: string;
+        nonce: string;
+        ciphertext: string;
+        authenticationTag: string;
+    };
+    accessTokenHealth: "EXPIRED" | "HEALTHY" | "REJECTED" | "UNKNOWN";
+    refreshTokenHealth: "HEALTHY" | "REJECTED" | "UNKNOWN";
+    observedAt: string;
+    credentialExpiresAt: string;
+    accessTokenDigest: string;
+    refreshTokenDigest: string;
+    idTokenDigest: string;
+    createdAt: string;
+    updatedAt: string;
+} | undefined>;
+export declare function writeCodexV6ReportJournal(value: CodexV6ReportJournal, env?: NodeJS.ProcessEnv): Promise<{
+    schemaVersion: 1;
+    tenantId: string;
+    subject: string;
+    requestId: string;
+    bindingId: string;
+    installationId: string;
+    credentialLineageId: string;
+    clientRequestId: string;
+    idempotencyKey: string;
+    expectedGenerationVersion: number;
+    rotationMode: "RETAINED" | "ROTATED";
+    envelope: {
+        version: 1;
+        algorithm: "X25519-HKDF-SHA256-AES-256-GCM";
+        keyId: string;
+        ephemeralPublicKey: string;
+        salt: string;
+        nonce: string;
+        ciphertext: string;
+        authenticationTag: string;
+    };
+    accessTokenHealth: "EXPIRED" | "HEALTHY" | "REJECTED" | "UNKNOWN";
+    refreshTokenHealth: "HEALTHY" | "REJECTED" | "UNKNOWN";
+    observedAt: string;
+    credentialExpiresAt: string;
+    accessTokenDigest: string;
+    refreshTokenDigest: string;
+    idTokenDigest: string;
+    createdAt: string;
+    updatedAt: string;
+}>;
+export declare function clearCodexV6ReportJournal(expected: Pick<CodexV6ReportJournal, "clientRequestId" | "idempotencyKey">, env?: NodeJS.ProcessEnv): Promise<void>;
+export declare function resetCodexV6LocalState(env?: NodeJS.ProcessEnv): Promise<{
+    clearedBinding: boolean;
+    clearedDelivery: boolean;
+    clearedReport: boolean;
+}>;
+import { type KeyObject } from "node:crypto";

package/dist/request-bound-device-v6-state.js

@@ -0,0 +1,221 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { z } from "zod";
+import { CodexShortLivedDeliveryClientKeySchema, CodexV3AccessTokenHealthSchema, CodexV3CredentialEnvelopeSchema, CodexV3RefreshTokenHealthSchema, CodexV6FullCredentialDeliveryResponseSchema } from "./protocol.js";
+import { readJsonIfExists, removePrivateFileDurably, withPrivateFileLock, writePrivateJson } from "./private-file.js";
+const Id = z.string().min(1).max(512);
+const Stable = z.string().min(8).max(255);
+const Instant = z.string().datetime({ offset: true });
+const InstallationId = z.string().min(16).max(200).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]+$/u);
+const Digest = z.string().length(64).regex(/^[0-9a-f]{64}$/u);
+export const CodexV6BindingStateSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    tenantId: Id,
+    subject: Id,
+    requestId: Id,
+    bindingId: Id,
+    predecessorBindingId: Id.nullable(),
+    installationId: InstallationId,
+    managedAccountId: Id,
+    providerAccountId: Id,
+    poolEntryId: Id,
+    credentialLineageId: Id,
+    generationVersion: z.number().int().positive(),
+    accountExpiresAt: Instant.nullable(),
+    localAssignmentId: Id,
+    source: z.enum([
+        "REQUEST_INITIAL",
+        "ADMIN_ADDED",
+        "LEGACY_AUTO_MIGRATED",
+        "ACCOUNT_REPLACEMENT"
+    ]),
+    status: z.enum(["ACTIVE", "NEEDS_REAUTH", "RETIREMENT_PENDING"]),
+    updatedAt: Instant
+});
+export const CodexV6DeliveryJournalSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    tenantId: Id,
+    subject: Id,
+    requestId: Id,
+    bindingId: Id,
+    installationId: InstallationId,
+    expectedManagedAccountId: Id,
+    expectedProviderAccountId: Id,
+    expectedPoolEntryId: Id,
+    expectedCredentialLineageId: Id,
+    clientRequestId: Stable,
+    idempotencyKey: Stable,
+    ackIdempotencyKey: Stable,
+    clientKey: CodexShortLivedDeliveryClientKeySchema,
+    privateKeyPkcs8: z.string().min(1).max(512).regex(/^[A-Za-z0-9_-]+$/u),
+    response: CodexV6FullCredentialDeliveryResponseSchema.nullable(),
+    createdAt: Instant,
+    updatedAt: Instant
+});
+export const CodexV6ReportJournalSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    tenantId: Id,
+    subject: Id,
+    requestId: Id,
+    bindingId: Id,
+    installationId: InstallationId,
+    credentialLineageId: Id,
+    clientRequestId: Stable,
+    idempotencyKey: Stable,
+    expectedGenerationVersion: z.number().int().positive(),
+    rotationMode: z.enum(["ROTATED", "RETAINED"]),
+    envelope: CodexV3CredentialEnvelopeSchema,
+    accessTokenHealth: CodexV3AccessTokenHealthSchema,
+    refreshTokenHealth: CodexV3RefreshTokenHealthSchema,
+    observedAt: Instant,
+    credentialExpiresAt: Instant,
+    accessTokenDigest: Digest,
+    refreshTokenDigest: Digest,
+    idTokenDigest: Digest,
+    createdAt: Instant,
+    updatedAt: Instant
+});
+function root(env) {
+    return env.CODEX_HOME?.trim() || join(homedir(), ".codex");
+}
+function statePath(env) {
+    return join(root(env), ".numa-request-device-v6.json");
+}
+function deliveryPath(env) {
+    return join(root(env), ".numa-request-device-delivery-v6.json");
+}
+function reportPath(env) {
+    return join(root(env), ".numa-request-device-report-v6.json");
+}
+async function readParsed(path, schema) {
+    const value = await readJsonIfExists(path);
+    return value === undefined ? undefined : schema.parse(value);
+}
+export function readCodexV6BindingState(env = process.env) {
+    return readParsed(statePath(env), CodexV6BindingStateSchema);
+}
+export async function writeCodexV6BindingState(value, env = process.env) {
+    const target = statePath(env);
+    return withPrivateFileLock(target, async () => {
+        const parsed = CodexV6BindingStateSchema.parse(value);
+        await writePrivateJson(target, parsed);
+        return parsed;
+    });
+}
+export async function clearCodexV6BindingState(expectedBindingId, env = process.env) {
+    const target = statePath(env);
+    await withPrivateFileLock(target, async () => {
+        const current = await readParsed(target, CodexV6BindingStateSchema);
+        if (!current)
+            return;
+        if (current.bindingId !== expectedBindingId)
+            throw stateConflict();
+        await removePrivateFileDurably(target);
+    });
+}
+export function readCodexV6DeliveryJournal(env = process.env) {
+    return readParsed(deliveryPath(env), CodexV6DeliveryJournalSchema);
+}
+export async function writeCodexV6DeliveryJournal(value, env = process.env) {
+    const target = deliveryPath(env);
+    return withPrivateFileLock(target, async () => {
+        const parsed = CodexV6DeliveryJournalSchema.parse(value);
+        const current = await readParsed(target, CodexV6DeliveryJournalSchema);
+        if (current && JSON.stringify(current) !== JSON.stringify(parsed))
+            throw stateConflict();
+        if (!current)
+            await writePrivateJson(target, parsed);
+        return current ?? parsed;
+    });
+}
+export async function updateCodexV6DeliveryJournalResponse(expected, response, now, env = process.env) {
+    const target = deliveryPath(env);
+    return withPrivateFileLock(target, async () => {
+        const current = await readParsed(target, CodexV6DeliveryJournalSchema);
+        if (!current || current.clientRequestId !== expected.clientRequestId
+            || current.idempotencyKey !== expected.idempotencyKey)
+            throw stateConflict();
+        const updated = CodexV6DeliveryJournalSchema.parse({ ...current, response,
+            updatedAt: new Date(now).toISOString() });
+        await writePrivateJson(target, updated);
+        return updated;
+    });
+}
+export async function clearCodexV6DeliveryJournal(expected, env = process.env) {
+    const target = deliveryPath(env);
+    await withPrivateFileLock(target, async () => {
+        const current = await readParsed(target, CodexV6DeliveryJournalSchema);
+        if (!current)
+            return;
+        if (current.clientRequestId !== expected.clientRequestId
+            || current.idempotencyKey !== expected.idempotencyKey)
+            throw stateConflict();
+        await removePrivateFileDurably(target);
+    });
+}
+export function openCodexV6DeliveryJournalKey(journal) {
+    const encoded = Buffer.from(journal.privateKeyPkcs8, "base64url");
+    try {
+        if (encoded.toString("base64url") !== journal.privateKeyPkcs8)
+            throw stateConflict();
+        const key = createPrivateKey({ key: encoded, format: "der", type: "pkcs8" });
+        if (key.asymmetricKeyType !== "x25519")
+            throw stateConflict();
+        return key;
+    }
+    finally {
+        encoded.fill(0);
+    }
+}
+export function readCodexV6ReportJournal(env = process.env) {
+    return readParsed(reportPath(env), CodexV6ReportJournalSchema);
+}
+export async function writeCodexV6ReportJournal(value, env = process.env) {
+    const target = reportPath(env);
+    return withPrivateFileLock(target, async () => {
+        const parsed = CodexV6ReportJournalSchema.parse(value);
+        const current = await readParsed(target, CodexV6ReportJournalSchema);
+        if (current && JSON.stringify(current) !== JSON.stringify(parsed))
+            throw stateConflict();
+        if (!current)
+            await writePrivateJson(target, parsed);
+        return current ?? parsed;
+    });
+}
+export async function clearCodexV6ReportJournal(expected, env = process.env) {
+    const target = reportPath(env);
+    await withPrivateFileLock(target, async () => {
+        const current = await readParsed(target, CodexV6ReportJournalSchema);
+        if (!current)
+            return;
+        if (current.clientRequestId !== expected.clientRequestId
+            || current.idempotencyKey !== expected.idempotencyKey)
+            throw stateConflict();
+        await removePrivateFileDurably(target);
+    });
+}
+export async function resetCodexV6LocalState(env = process.env) {
+    const [binding, delivery, report] = await Promise.all([
+        readCodexV6BindingState(env),
+        readCodexV6DeliveryJournal(env),
+        readCodexV6ReportJournal(env)
+    ]);
+    if (report)
+        await clearCodexV6ReportJournal(report, env);
+    if (delivery)
+        await clearCodexV6DeliveryJournal(delivery, env);
+    if (binding)
+        await clearCodexV6BindingState(binding.bindingId, env);
+    return {
+        clearedBinding: binding !== undefined,
+        clearedDelivery: delivery !== undefined,
+        clearedReport: report !== undefined
+    };
+}
+function stateConflict() {
+    return Object.assign(new Error("The Codex v6 request/device state changed unexpectedly."), {
+        code: "request_bound_device_v6_state_conflict"
+    });
+}
+import { createPrivateKey } from "node:crypto";
+//# sourceMappingURL=request-bound-device-v6-state.js.map

package/dist/request-bound-device-v6-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-bound-device-v6-state.js","sourceRoot":"","sources":["../src/request-bound-device-v6-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sCAAsC,EACtC,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAC/B,2CAA2C,EAC5C,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC1C,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAC3F,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,oBAAoB,EAAE,EAAE,CAAC,QAAQ,EAAE;IACnC,cAAc,EAAE,cAAc;IAC9B,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;IACrB,WAAW,EAAE,EAAE;IACf,mBAAmB,EAAE,EAAE;IACvB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE;IACpC,iBAAiB,EAAE,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QACb,iBAAiB;QACjB,aAAa;QACb,sBAAsB;QACtB,qBAAqB;KACtB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAChE,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,cAAc;IAC9B,wBAAwB,EAAE,EAAE;IAC5B,yBAAyB,EAAE,EAAE;IAC7B,mBAAmB,EAAE,EAAE;IACvB,2BAA2B,EAAE,EAAE;IAC/B,eAAe,EAAE,MAAM;IACvB,cAAc,EAAE,MAAM;IACtB,iBAAiB,EAAE,MAAM;IACzB,SAAS,EAAE,sCAAsC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACtE,QAAQ,EAAE,2CAA2C,CAAC,QAAQ,EAAE;IAChE,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,cAAc;IAC9B,mBAAmB,EAAE,EAAE;IACvB,eAAe,EAAE,MAAM;IACvB,cAAc,EAAE,MAAM;IACtB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC7C,QAAQ,EAAE,+BAA+B;IACzC,iBAAiB,EAAE,8BAA8B;IACjD,kBAAkB,EAAE,+BAA+B;IACnD,UAAU,EAAE,OAAO;IACnB,mBAAmB,EAAE,OAAO;IAC5B,iBAAiB,EAAE,MAAM;IACzB,kBAAkB,EAAE,MAAM;IAC1B,aAAa,EAAE,MAAM;IACrB,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAMH,SAAS,IAAI,CAAC,GAAsB;IAClC,OAAO,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAAC,GAAsB;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,uCAAuC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,qCAAqC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,MAAoB;IAC7D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC1E,OAAO,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAA0B,EAC1B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,iBAAyB,EACzB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB;YAAE,MAAM,aAAa,EAAE,CAAC;QACnE,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC7E,OAAO,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,4BAA4B,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAA6B,EAC7B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QACvE,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,MAAM,aAAa,EAAE,CAAC;QACzF,IAAI,CAAC,OAAO;YAAE,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,OAAO,IAAI,MAAM,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,QAAgC,EAChC,QAAqE,EACrE,GAAW,EACX,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;eAC/D,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;YAAE,MAAM,aAAa,EAAE,CAAC;QAC/E,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ;YACvE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAA4E,EAC5E,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;eACnD,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;YAAE,MAAM,aAAa,EAAE,CAAC;QAC/E,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAA+B;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,eAAe;YAAE,MAAM,aAAa,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YAAE,MAAM,aAAa,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC;IACb,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC3E,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,0BAA0B,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA2B,EAC3B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QACrE,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,MAAM,aAAa,EAAE,CAAC;QACzF,IAAI,CAAC,OAAO;YAAE,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,OAAO,IAAI,MAAM,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAA0E,EAC1E,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;eACnD,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;YAAE,MAAM,aAAa,EAAE,CAAC;QAC/E,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpD,uBAAuB,CAAC,GAAG,CAAC;QAC5B,0BAA0B,CAAC,GAAG,CAAC;QAC/B,wBAAwB,CAAC,GAAG,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,MAAM;QAAE,MAAM,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,QAAQ;QAAE,MAAM,2BAA2B,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,OAAO;QAAE,MAAM,wBAAwB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO;QACL,cAAc,EAAE,OAAO,KAAK,SAAS;QACrC,eAAe,EAAE,QAAQ,KAAK,SAAS;QACvC,aAAa,EAAE,MAAM,KAAK,SAAS;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,EAAE;QACzF,IAAI,EAAE,wCAAwC;KAC/C,CAAC,CAAC;AACL,CAAC;AACD,OAAO,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAC"}

package/dist/selection.d.ts

@@ -9,12 +9,17 @@ declare const CodexSelectionSchema: z.ZodObject<{
         label: z.ZodString;
         distributionMode: z.ZodOptional<z.ZodEnum<{
             CLIENT_MANAGED_V4: "CLIENT_MANAGED_V4";
+            REQUEST_BOUND_DEVICE_V6: "REQUEST_BOUND_DEVICE_V6";
             SCHEMA_V1: "SCHEMA_V1";
             SERVER_MANAGED_SHORT_LIVED: "SERVER_MANAGED_SHORT_LIVED";
         }>>;
         assignmentId: z.ZodOptional<z.ZodString>;
         managedAccountId: z.ZodOptional<z.ZodString>;
         providerAccountId: z.ZodOptional<z.ZodString>;
+        requestId: z.ZodOptional<z.ZodString>;
+        bindingId: z.ZodOptional<z.ZodString>;
+        installationId: z.ZodOptional<z.ZodString>;
+        credentialLineageId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     updatedAt: z.ZodString;
 }, z.core.$strip>;

package/dist/selection.js

@@ -11,10 +11,19 @@ const CodexSelectionSchema = z.object({
         id: z.string().min(1),
         accountId: z.string().min(1).optional(),
         label: z.string().min(1),
-        distributionMode: z.enum(["SCHEMA_V1", "SERVER_MANAGED_SHORT_LIVED", "CLIENT_MANAGED_V4"]).optional(),
+        distributionMode: z.enum([
+            "SCHEMA_V1",
+            "SERVER_MANAGED_SHORT_LIVED",
+            "CLIENT_MANAGED_V4",
+            "REQUEST_BOUND_DEVICE_V6"
+        ]).optional(),
         assignmentId: z.string().min(1).optional(),
         managedAccountId: z.string().min(1).optional(),
-        providerAccountId: z.string().min(1).optional()
+        providerAccountId: z.string().min(1).optional(),
+        requestId: z.string().min(1).optional(),
+        bindingId: z.string().min(1).optional(),
+        installationId: z.string().min(16).optional(),
+        credentialLineageId: z.string().min(1).optional()
     }).superRefine((account, context) => {
         if (account.distributionMode === "SERVER_MANAGED_SHORT_LIVED"
             && (!account.assignmentId || !account.managedAccountId)) {
@@ -30,6 +39,15 @@ const CodexSelectionSchema = z.object({
                 message: "A v4 token-pool selection requires the complete account identity."
             });
         }
+        if (account.distributionMode === "REQUEST_BOUND_DEVICE_V6"
+            && (!account.requestId || !account.bindingId || !account.installationId
+                || !account.credentialLineageId || !account.managedAccountId
+                || !account.providerAccountId)) {
+            context.addIssue({
+                code: "custom",
+                message: "A v6 selection requires one complete request/device binding identity."
+            });
+        }
     }),
     updatedAt: z.string().datetime()
 });