@tokensrc/codex 1.14.16 → 1.14.18

package/dist/migration-login-batch.d.ts

@@ -1,66 +0,0 @@
-import type { CodexServiceClient } from "./client.js";
-import { executeCodexEnrollmentLogin } from "./enrollment-flow.js";
-import { CODEX_MIGRATION_CAPACITY, type CodexEnrollmentCandidateResponse, type CodexMigrationLoginQueueResponse, type CodexMigrationPlanStatus, type CodexMigrationTarget } from "./protocol.js";
-type MigrationBatchClient = Pick<CodexServiceClient, "listMigrationLoginQueue" | "getEnrollmentIntent" | "claimEnrollmentIntent" | "heartbeatEnrollmentIntent" | "uploadEnrollmentCandidate">;
-type EnrollmentExecutor = typeof executeCodexEnrollmentLogin;
-export type CodexMigrationBatchStopReason = "DRY_RUN" | "QUEUE_EXHAUSTED" | "PAUSED" | "CANCELLED" | "COMPLETED" | "TARGET_UNCERTAIN" | "AUTHENTICATION_ERROR" | "SERVICE_ERROR" | "LOGIN_ERROR";
-export interface CodexMigrationLoginBatchItemResult {
-    targetId: string;
-    assignmentId: string;
-    intentId: string | null;
-    requestedAction: "LOGIN" | "VIEW_ENROLLMENT" | "NONE";
-    action: "LOGIN" | "SKIP";
-    status: "PLANNED" | "COMPLETED" | "FAILED" | "SKIPPED";
-    outcome?: CodexEnrollmentCandidateResponse["result"]["outcome"];
-    intentStatus?: CodexEnrollmentCandidateResponse["intent"]["status"];
-    safeErrorCode?: string | null;
-    skipReason?: "VIEW_ENROLLMENT" | "ALREADY_USER_BOUND" | "NO_ACTION";
-}
-export interface CodexMigrationLoginBatchResult {
-    schemaVersion: 2;
-    plan: {
-        id: string;
-        status: CodexMigrationPlanStatus;
-        revision: number;
-        accountId: string;
-        sequentialRequired: true;
-    };
-    capacity: typeof CODEX_MIGRATION_CAPACITY;
-    dryRun: boolean;
-    stopReason: CodexMigrationBatchStopReason;
-    counts: {
-        observed: number;
-        plannedLogins: number;
-        attempted: number;
-        completed: number;
-        failed: number;
-        skipped: number;
-    };
-    items: CodexMigrationLoginBatchItemResult[];
-}
-interface QueueSnapshot {
-    plan: CodexMigrationLoginQueueResponse["plan"];
-    items: CodexMigrationTarget[];
-}
-/** Loads all pages and rejects a mixed-revision snapshot instead of reordering targets. */
-export declare function loadCodexMigrationLoginQueueSnapshot(input: {
-    client: Pick<MigrationBatchClient, "listMigrationLoginQueue">;
-    planId: string;
-    pageSize?: number;
-    maxSnapshotAttempts?: number;
-}): Promise<QueueSnapshot>;
-/**
- * Executes at most one isolated official login at a time. The queue is fetched
- * again after every handled target so pause/cancel/completion takes effect before
- * another refresh token can be generated.
- */
-export declare function executeCodexMigrationLoginBatch(input: {
-    client: MigrationBatchClient;
-    tenantId: string;
-    planId: string;
-    deviceAuth?: boolean;
-    dryRun?: boolean;
-    pageSize?: number;
-    executeEnrollment?: EnrollmentExecutor;
-}): Promise<CodexMigrationLoginBatchResult>;
-export {};

package/dist/migration-login-batch.js

@@ -1,202 +0,0 @@
-import { executeCodexEnrollmentLogin } from "./enrollment-flow.js";
-import { CodexServiceError } from "./errors.js";
-import { CODEX_MIGRATION_CAPACITY } from "./protocol.js";
-/** Loads all pages and rejects a mixed-revision snapshot instead of reordering targets. */
-export async function loadCodexMigrationLoginQueueSnapshot(input) {
-    const pageSize = input.pageSize ?? 100;
-    const maxAttempts = input.maxSnapshotAttempts ?? 3;
-    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-        const first = await input.client.listMigrationLoginQueue(input.planId, { page: 1, pageSize });
-        if (first.plan.status !== "ACTIVE" || first.total <= first.items.length) {
-            return { plan: first.plan, items: uniqueQueueItems(first.items, first.total) };
-        }
-        const items = [...first.items];
-        let stable = true;
-        const pageCount = Math.ceil(first.total / pageSize);
-        for (let page = 2; page <= pageCount; page += 1) {
-            const next = await input.client.listMigrationLoginQueue(input.planId, { page, pageSize });
-            if (!samePlanProjection(first.plan, next.plan) || next.total !== first.total) {
-                stable = false;
-                break;
-            }
-            items.push(...next.items);
-        }
-        if (stable && items.length === first.total) {
-            return { plan: first.plan, items: uniqueQueueItems(items, first.total) };
-        }
-    }
-    throw new CodexServiceError("Migration login queue changed while it was being paged; retry from a fresh snapshot.", "migration_queue_changed", 409);
-}
-/**
- * Executes at most one isolated official login at a time. The queue is fetched
- * again after every handled target so pause/cancel/completion takes effect before
- * another refresh token can be generated.
- */
-export async function executeCodexMigrationLoginBatch(input) {
-    const executeEnrollment = input.executeEnrollment ?? executeCodexEnrollmentLogin;
-    const handledTargets = new Set();
-    const items = [];
-    let latest = await loadCodexMigrationLoginQueueSnapshot(input);
-    if (input.dryRun) {
-        if (latest.plan.status === "ACTIVE") {
-            for (const target of latest.items)
-                items.push(dryRunItem(target));
-        }
-        return result(latest.plan, true, latest.plan.status === "ACTIVE"
-            ? "DRY_RUN" : planStopReason(latest.plan.status), items);
-    }
-    while (true) {
-        const stopped = planStopReason(latest.plan.status);
-        if (stopped !== "QUEUE_EXHAUSTED")
-            return result(latest.plan, false, stopped, items);
-        const target = latest.items.find((candidate) => !handledTargets.has(candidate.id));
-        if (!target)
-            return result(latest.plan, false, "QUEUE_EXHAUSTED", items);
-        handledTargets.add(target.id);
-        const resumableClaim = target.allowedAction === "VIEW_ENROLLMENT"
-            && target.enrollmentIntent !== null
-            && ["CLAIMED", "LOGIN_IN_PROGRESS"].includes(target.enrollmentIntent.status);
-        if (target.allowedAction !== "LOGIN" && !resumableClaim) {
-            items.push(skippedItem(target));
-            latest = await loadCodexMigrationLoginQueueSnapshot(input);
-            continue;
-        }
-        if (!target.enrollmentIntent || (!resumableClaim && target.enrollmentIntent.status !== "AWAITING_CLI")) {
-            items.push({
-                ...baseItem(target),
-                action: "LOGIN",
-                status: "FAILED",
-                safeErrorCode: "invalid_migration_login_target"
-            });
-            return result(latest.plan, false, "SERVICE_ERROR", items);
-        }
-        try {
-            const response = await executeEnrollment({
-                client: input.client,
-                tenantId: input.tenantId,
-                intentId: target.enrollmentIntent.id,
-                deviceAuth: input.deviceAuth,
-                requireInitialAwaitingCli: true,
-                resumeClaimedIntent: resumableClaim
-            });
-            items.push({
-                ...baseItem(target),
-                action: "LOGIN",
-                status: response.result.outcome === "READY" ? "COMPLETED" : "FAILED",
-                outcome: response.result.outcome,
-                intentStatus: response.intent.status,
-                safeErrorCode: response.intent.safeErrorCode
-            });
-            if (!["READY", "ACCOUNT_MISMATCH", "IDENTITY_UNVERIFIABLE"].includes(response.result.outcome)) {
-                latest = await loadCodexMigrationLoginQueueSnapshot(input);
-                const planStopped = planStopReason(latest.plan.status);
-                return result(latest.plan, false, planStopped === "QUEUE_EXHAUSTED" ? "TARGET_UNCERTAIN" : planStopped, items);
-            }
-        }
-        catch (error) {
-            latest = await safeReload(input, latest);
-            const refreshedTarget = latest.items.find(({ id }) => id === target.id);
-            if (["enrollment_intent_state_conflict", "enrollment_intent_claimed"].includes(String(error.code ?? ""))
-                && refreshedTarget && refreshedTarget.allowedAction !== "LOGIN") {
-                items.push(skippedItem(refreshedTarget));
-                continue;
-            }
-            const classified = classifyBatchError(error);
-            items.push({
-                ...baseItem(target),
-                action: "LOGIN",
-                status: "FAILED",
-                safeErrorCode: classified.safeErrorCode
-            });
-            const planStopped = planStopReason(latest.plan.status);
-            return result(latest.plan, false, planStopped === "QUEUE_EXHAUSTED" ? classified.stopReason : planStopped, items);
-        }
-        latest = await loadCodexMigrationLoginQueueSnapshot(input);
-    }
-}
-function samePlanProjection(left, right) {
-    return left.id === right.id && left.status === right.status && left.revision === right.revision
-        && left.accountId === right.accountId && right.sequentialRequired === true;
-}
-function uniqueQueueItems(items, total) {
-    if (items.length !== total || new Set(items.map(({ id }) => id)).size !== items.length
-        || new Set(items.map(({ assignmentId }) => assignmentId)).size !== items.length) {
-        throw new CodexServiceError("Migration login queue contains duplicate or incomplete targets.", "invalid_codex_service_response");
-    }
-    return items;
-}
-function baseItem(target) {
-    return {
-        targetId: target.id,
-        assignmentId: target.assignmentId,
-        intentId: target.enrollmentIntent?.id ?? null,
-        requestedAction: target.allowedAction
-    };
-}
-function dryRunItem(target) {
-    if (target.allowedAction === "LOGIN" && target.enrollmentIntent?.status === "AWAITING_CLI") {
-        return { ...baseItem(target), action: "LOGIN", status: "PLANNED" };
-    }
-    return { ...skippedItem(target), status: "PLANNED" };
-}
-function skippedItem(target) {
-    return {
-        ...baseItem(target),
-        action: "SKIP",
-        status: "SKIPPED",
-        intentStatus: target.enrollmentIntent?.status,
-        safeErrorCode: target.enrollmentIntent?.safeErrorCode,
-        skipReason: target.allowedAction === "VIEW_ENROLLMENT"
-            ? "VIEW_ENROLLMENT"
-            : target.distributionMode === "USER_BOUND" && target.projectedStatus === "ACTIVE"
-                ? "ALREADY_USER_BOUND"
-                : "NO_ACTION"
-    };
-}
-function planStopReason(status) {
-    return status === "ACTIVE" ? "QUEUE_EXHAUSTED" : status;
-}
-function classifyBatchError(error) {
-    const value = error;
-    const code = typeof value?.code === "string" && /^[a-z][a-z0-9_.-]{0,127}$/iu.test(value.code)
-        ? value.code
-        : "official_login_failed";
-    const status = typeof value?.status === "number" ? value.status : undefined;
-    if (["auth_error", "login_required", "http_error", "issuer_mismatch", "codex_access_denied"]
-        .includes(code) || status === 401 || status === 403) {
-        return { stopReason: "AUTHENTICATION_ERROR", safeErrorCode: code };
-    }
-    if (["codex_service_unavailable", "invalid_codex_service_response", "codex_service_error",
-        "migration_queue_changed"].includes(code) || status !== undefined && status >= 500) {
-        return { stopReason: "SERVICE_ERROR", safeErrorCode: code };
-    }
-    return { stopReason: "LOGIN_ERROR", safeErrorCode: code };
-}
-async function safeReload(input, fallback) {
-    try {
-        return await loadCodexMigrationLoginQueueSnapshot(input);
-    }
-    catch {
-        return fallback;
-    }
-}
-function result(plan, dryRun, stopReason, items) {
-    return {
-        schemaVersion: 2,
-        plan,
-        capacity: CODEX_MIGRATION_CAPACITY,
-        dryRun,
-        stopReason,
-        counts: {
-            observed: items.length,
-            plannedLogins: items.filter(({ action }) => action === "LOGIN").length,
-            attempted: items.filter(({ action, status }) => action === "LOGIN"
-                && status !== "PLANNED").length,
-            completed: items.filter(({ status }) => status === "COMPLETED").length,
-            failed: items.filter(({ status }) => status === "FAILED").length,
-            skipped: items.filter(({ action }) => action === "SKIP").length
-        },
-        items
-    };
-}
-//# sourceMappingURL=migration-login-batch.js.map

package/dist/migration-login-batch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"migration-login-batch.js","sourceRoot":"","sources":["../src/migration-login-batch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,wBAAwB,EAKzB,MAAM,eAAe,CAAC;AA+DvB,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC;IACvC,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;IACnD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9F,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC;QACpD,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC7E,MAAM,GAAG,KAAK,CAAC;gBACf,MAAM;YACR,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,sFAAsF,EACtF,yBAAyB,EACzB,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAQrD;IACC,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;IACjF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,KAAK,GAAyC,EAAE,CAAC;IACvD,IAAI,MAAM,GAAG,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC;IAE/D,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC9D,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,iBAAiB;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACzE,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAE9B,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,KAAK,iBAAiB;eAC5D,MAAM,CAAC,gBAAgB,KAAK,IAAI;eAChC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,MAAM,GAAG,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,cAAc,CAAC,EAAE,CAAC;YACvG,KAAK,CAAC,IAAI,CAAC;gBACT,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,QAAQ;gBAChB,aAAa,EAAE,gCAAgC;aAChD,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;gBACvC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE;gBACpC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,yBAAyB,EAAE,IAAI;gBAC/B,mBAAmB,EAAE,cAAc;aACpC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC;gBACT,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;gBACpE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO;gBAChC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;gBACpC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa;aAC7C,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9F,MAAM,GAAG,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC;gBAC3D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAC9B,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,kCAAkC,EAAE,2BAA2B,CAAC,CAAC,QAAQ,CAC5E,MAAM,CAAE,KAA4B,CAAC,IAAI,IAAI,EAAE,CAAC,CACjD;mBACI,eAAe,IAAI,eAAe,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;gBAClE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC;gBACT,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,QAAQ;gBAChB,aAAa,EAAE,UAAU,CAAC,aAAa;aACxC,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAC9B,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,GAAG,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,IAA8C,EAC9C,KAA+C;IAE/C,OAAO,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;WAC1F,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,CAAC;AAC/E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA6B,EAAE,KAAa;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;WACjF,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAClF,MAAM,IAAI,iBAAiB,CACzB,iEAAiE,EACjE,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,MAA4B;IAC5C,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,IAAI,IAAI;QAC7C,eAAe,EAAE,MAAM,CAAC,aAAa;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAA4B;IAC9C,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM,KAAK,cAAc,EAAE,CAAC;QAC3F,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,MAA4B;IAC/C,OAAO;QACL,GAAG,QAAQ,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM;QAC7C,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,aAAa;QACrD,UAAU,EAAE,MAAM,CAAC,aAAa,KAAK,iBAAiB;YACpD,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,MAAM,CAAC,gBAAgB,KAAK,YAAY,IAAI,MAAM,CAAC,eAAe,KAAK,QAAQ;gBAC/E,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,WAAW;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAgC;IACtD,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IAKxC,MAAM,KAAK,GAAG,KAA6C,CAAC;IAC5D,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5F,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,uBAAuB,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;SACzF,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACtD,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,2BAA2B,EAAE,gCAAgC,EAAE,qBAAqB;QACvF,yBAAyB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QACrF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAA4D,EAC5D,QAAuB;IAEvB,IAAI,CAAC;QACH,OAAO,MAAM,oCAAoC,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CACb,IAA8C,EAC9C,MAAe,EACf,UAAyC,EACzC,KAA2C;IAE3C,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI;QACJ,QAAQ,EAAE,wBAAwB;QAClC,MAAM;QACN,UAAU;QACV,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM;YACtE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO;mBAC7D,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;YACjC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM;YACtE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YAChE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;SAChE;QACD,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/retirement-flow.d.ts

@@ -1,38 +0,0 @@
-import type { CodexServiceClient } from "./client.js";
-interface RetirementClient {
-    getAssignmentRetirement: CodexServiceClient["getAssignmentRetirement"];
-    acknowledgeAssignmentRetirementLocalDelete: CodexServiceClient["acknowledgeAssignmentRetirementLocalDelete"];
-}
-export declare function executeCodexAssignmentRetirementLocalDelete(input: {
-    client: RetirementClient;
-    retirementId: string;
-    expectedRevision?: number;
-    idempotencyKey?: string;
-    env?: NodeJS.ProcessEnv;
-    now?: () => number;
-}): Promise<{
-    schemaVersion: 2;
-    retirement: {
-        id: string;
-        assignmentId: string;
-        revision: number;
-        reason: "COMPROMISED" | "REPLACED" | "UNASSIGN";
-        status: "COMPROMISED" | "FINALIZED" | "READY_TO_FINALIZE" | "RETIREMENT_PENDING";
-        requestedAt: string;
-        serverRefreshStoppedAt: string;
-        shortLivedCredentialsExpireAt: string;
-        localDeleteStatus: "ACKNOWLEDGED" | "EXPIRED" | "NOT_REQUIRED" | "PENDING";
-        localDeleteAcknowledgedAt: string | null;
-        serverSecretsShreddedAt: string | null;
-        upstreamRevocationStatus: "UNKNOWN";
-        safeToFinalizeAt: string;
-    };
-    replayed: boolean;
-    local: {
-        assignmentId: string;
-        lineageId: string;
-        generationVersion: number;
-        deletedAt: string;
-    };
-}>;
-export {};

package/dist/retirement-flow.js

@@ -1,78 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { markManagedCodexRetirementAcknowledged, prepareManagedCodexLineageRetirement, readManagedCodexLineageState, readManagedCodexRetirementTombstone } from "./credentials.js";
-import { CodexServiceError } from "./errors.js";
-export async function executeCodexAssignmentRetirementLocalDelete(input) {
-    const env = input.env ?? process.env;
-    const now = input.now ?? Date.now;
-    const existing = await readManagedCodexRetirementTombstone(env);
-    const localState = await readManagedCodexLineageState(env);
-    const localTarget = existing?.retirementId === input.retirementId ? {
-        assignmentId: existing.assignmentId,
-        lineageId: existing.lineageId,
-        generationVersion: existing.generationVersion
-    } : localState ? {
-        assignmentId: localState.assignmentId,
-        lineageId: localState.lineageId,
-        generationVersion: localState.generationVersion
-    } : undefined;
-    if (!localTarget) {
-        throw new CodexServiceError("No local managed lineage matches this retirement request.", "assignment_retirement_local_state_not_found");
-    }
-    const preflight = await input.client.getAssignmentRetirement(input.retirementId);
-    const targetMatches = preflight.retirement.assignmentId === localTarget.assignmentId
-        && preflight.allowedLocalDeleteTargets.some((target) => target.lineageId === localTarget.lineageId
-            && target.generationVersion === localTarget.generationVersion);
-    if (!targetMatches) {
-        throw new CodexServiceError("The Server retirement does not authorize deletion of the locally installed lineage.", "assignment_retirement_local_delete_target_mismatch");
-    }
-    if (existing?.retirementId === input.retirementId
-        && existing.acknowledgedAt === null
-        && preflight.retirement.localDeleteAcknowledgedAt !== null) {
-        const recovered = await markManagedCodexRetirementAcknowledged(existing.retirementId, preflight.retirement.localDeleteAcknowledgedAt, env);
-        return {
-            schemaVersion: 2,
-            retirement: preflight.retirement,
-            replayed: true,
-            local: {
-                assignmentId: recovered.assignmentId,
-                lineageId: recovered.lineageId,
-                generationVersion: recovered.generationVersion,
-                deletedAt: recovered.deletedAt
-            }
-        };
-    }
-    if (input.expectedRevision !== undefined && input.expectedRevision !== preflight.retirement.revision) {
-        throw new CodexServiceError("The retirement revision changed before local deletion.", "assignment_retirement_revision_conflict");
-    }
-    if (!preflight.allowedActions.includes("ACKNOWLEDGE_LOCAL_DELETE")) {
-        throw new CodexServiceError("The Server retirement is not accepting local deletion evidence.", "assignment_retirement_local_delete_not_allowed");
-    }
-    const prepared = await prepareManagedCodexLineageRetirement({
-        retirementId: input.retirementId,
-        expectedRevision: preflight.retirement.revision,
-        idempotencyKey: input.idempotencyKey ?? randomUUID()
-    }, now(), env);
-    const response = await input.client.acknowledgeAssignmentRetirementLocalDelete(prepared.retirementId, {
-        schemaVersion: 2,
-        expectedRevision: prepared.expectedRevision,
-        targets: [{
-                lineageId: prepared.lineageId,
-                generationVersion: prepared.generationVersion
-            }]
-    }, prepared.idempotencyKey);
-    const acknowledgedAt = response.retirement.localDeleteAcknowledgedAt;
-    if (!acknowledgedAt) {
-        throw new CodexServiceError("Server accepted a local deletion ACK without acknowledgement metadata.", "invalid_codex_service_response");
-    }
-    await markManagedCodexRetirementAcknowledged(prepared.retirementId, acknowledgedAt, env);
-    return {
-        ...response,
-        local: {
-            assignmentId: prepared.assignmentId,
-            lineageId: prepared.lineageId,
-            generationVersion: prepared.generationVersion,
-            deletedAt: prepared.deletedAt
-        }
-    };
-}
-//# sourceMappingURL=retirement-flow.js.map

package/dist/retirement-flow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"retirement-flow.js","sourceRoot":"","sources":["../src/retirement-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,sCAAsC,EACtC,oCAAoC,EACpC,4BAA4B,EAC5B,mCAAmC,EACpC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAQhD,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAAC,KAOjE;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,mCAAmC,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,QAAQ,EAAE,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAClE,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;KAC9C,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACf,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;KAChD,CAAC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,iBAAiB,CACzB,2DAA2D,EAC3D,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,SAAS,CAAC,UAAU,CAAC,YAAY,KAAK,WAAW,CAAC,YAAY;WAC/E,SAAS,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,SAAS;eACvC,MAAM,CAAC,iBAAiB,KAAK,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACnE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,iBAAiB,CACzB,qFAAqF,EACrF,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,EAAE,YAAY,KAAK,KAAK,CAAC,YAAY;WAC5C,QAAQ,CAAC,cAAc,KAAK,IAAI;WAChC,SAAS,CAAC,UAAU,CAAC,yBAAyB,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,sCAAsC,CAC5D,QAAQ,CAAC,YAAY,EACrB,SAAS,CAAC,UAAU,CAAC,yBAAyB,EAC9C,GAAG,CACJ,CAAC;QACF,OAAO;YACL,aAAa,EAAE,CAAU;YACzB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE;gBACL,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;gBAC9C,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B;SACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACrG,MAAM,IAAI,iBAAiB,CACzB,wDAAwD,EACxD,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,iBAAiB,CACzB,iEAAiE,EACjE,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,oCAAoC,CAAC;QAC1D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ;QAC/C,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,UAAU,EAAE;KACrD,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACf,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,0CAA0C,CAC5E,QAAQ,CAAC,YAAY,EACrB;QACE,aAAa,EAAE,CAAC;QAChB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,OAAO,EAAE,CAAC;gBACR,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;aAC9C,CAAC;KACH,EACD,QAAQ,CAAC,cAAc,CACxB,CAAC;IACF,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,yBAAyB,CAAC;IACrE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,wEAAwE,EACxE,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,sCAAsC,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;IACzF,OAAO;QACL,GAAG,QAAQ;QACX,KAAK,EAAE;YACL,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B;KACF,CAAC;AACJ,CAAC"}

package/dist/short-lived-delivery-flow.d.ts

@@ -1,41 +0,0 @@
-import type { CodexServiceClient } from "./client.js";
-import { installManagedCodexLineageCredentials } from "./credentials.js";
-interface ShortLivedDeliveryClient {
-    createShortLivedCredentialDelivery: CodexServiceClient["createShortLivedCredentialDelivery"];
-    acknowledgeShortLivedCredentialDelivery: CodexServiceClient["acknowledgeShortLivedCredentialDelivery"];
-}
-export interface CodexShortLivedDeliveryFlowResult {
-    deliveryId: string;
-    assignmentId: string;
-    managedAccountId: string;
-    providerAccountId: string;
-    lineageId: string;
-    generationVersion: number;
-    credentialExpiresAt: string;
-    installAction: "INSTALLED" | "UNCHANGED" | "RECOVERED";
-    issueReplayed: boolean;
-    ackReplayed: boolean;
-    resumed: boolean;
-}
-export declare function executeCodexShortLivedCredentialDelivery(input: {
-    client: ShortLivedDeliveryClient;
-    tenantId: string;
-    assignmentId: string;
-    env?: NodeJS.ProcessEnv;
-    now?: () => number;
-    newId?: () => string;
-    installHooks?: Parameters<typeof installManagedCodexLineageCredentials>[3];
-    allowNewDelivery?: boolean;
-}): Promise<CodexShortLivedDeliveryFlowResult>;
-export declare function resumePendingCodexShortLivedDeliveryAck(input: {
-    client: Pick<ShortLivedDeliveryClient, "acknowledgeShortLivedCredentialDelivery">;
-    tenantId: string;
-    assignmentId: string;
-    env?: NodeJS.ProcessEnv;
-    now?: number;
-    idempotencyKey?: string;
-}): Promise<{
-    deliveryId: string;
-    replayed: boolean;
-} | undefined>;
-export {};

package/dist/short-lived-delivery-flow.js

@@ -1,141 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { installManagedCodexLineageCredentials, markManagedCodexLineageDeliveryAcknowledged, readManagedCodexLineageState } from "./credentials.js";
-import { CodexServiceError } from "./errors.js";
-import { createCodexShortLivedDeliveryKeyPair, openCodexShortLivedCredentialDelivery } from "./short-lived-delivery.js";
-import { clearCodexShortLivedDeliveryJournal, loadOrCreateCodexShortLivedDeliveryJournal, markCodexShortLivedDeliveryJournalIssued, openCodexShortLivedDeliveryJournalPrivateKey, readCodexShortLivedDeliveryJournal } from "./short-lived-delivery-journal.js";
-export async function executeCodexShortLivedCredentialDelivery(input) {
-    const now = input.now ?? Date.now;
-    const newId = input.newId ?? randomUUID;
-    const env = input.env ?? process.env;
-    const pending = await readManagedCodexLineageState(env);
-    const existingJournal = await readCodexShortLivedDeliveryJournal(env);
-    const pendingMatchesRequest = pending !== undefined && pending.assignmentId === input.assignmentId
-        && (pending.tenantId === input.tenantId || pending.tenantId === null);
-    if (pending && pendingMatchesRequest && pending.phase === "INSTALLED_PENDING_ACK"
-        && Date.parse(pending.ackExpiresAt) > now()) {
-        const resumed = await acknowledgeInstalledDelivery(input.client, pending, newId(), env);
-        const journal = await readCodexShortLivedDeliveryJournal(env);
-        if (journal?.deliveryId === pending.deliveryId) {
-            await clearCodexShortLivedDeliveryJournal(journal.idempotencyKey, env);
-        }
-        if (Date.parse(pending.credentialExpiresAt) > now()) {
-            return {
-                deliveryId: pending.deliveryId,
-                assignmentId: pending.assignmentId,
-                managedAccountId: pending.managedAccountId,
-                providerAccountId: pending.providerAccountId,
-                lineageId: pending.lineageId,
-                generationVersion: pending.generationVersion,
-                credentialExpiresAt: pending.credentialExpiresAt,
-                installAction: "UNCHANGED",
-                issueReplayed: true,
-                ackReplayed: resumed.replayed,
-                resumed: true
-            };
-        }
-    }
-    const journalMatchesRequest = existingJournal?.tenantId === input.tenantId
-        && existingJournal.assignmentId === input.assignmentId;
-    if (input.allowNewDelivery === false && !journalMatchesRequest) {
-        throw new CodexServiceError("The assignment is not eligible for a new short-lived credential delivery.", "short_lived_credential_lineage_not_ready", 409);
-    }
-    for (let journalAttempt = 0; journalAttempt < 2; journalAttempt += 1) {
-        const generated = createCodexShortLivedDeliveryKeyPair();
-        const journal = await loadOrCreateCodexShortLivedDeliveryJournal({
-            tenantId: input.tenantId,
-            assignmentId: input.assignmentId,
-            idempotencyKey: newId(),
-            clientKey: generated.clientKey,
-            privateKey: generated.privateKey,
-            now: now(),
-            env
-        });
-        const privateKey = openCodexShortLivedDeliveryJournalPrivateKey(journal);
-        let issue;
-        try {
-            issue = await input.client.createShortLivedCredentialDelivery(input.assignmentId, {
-                schemaVersion: 2,
-                clientKey: journal.clientKey
-            }, journal.idempotencyKey);
-        }
-        catch (error) {
-            if (journalAttempt === 0 && error instanceof CodexServiceError
-                && [
-                    "short_lived_credential_delivery_expired",
-                    "short_lived_credential_delivery_already_acked",
-                    "lineage_version_conflict"
-                ].includes(error.code)) {
-                await clearCodexShortLivedDeliveryJournal(journal.idempotencyKey, env);
-                if (input.allowNewDelivery === false)
-                    throw error;
-                continue;
-            }
-            throw error;
-        }
-        const issuedJournal = await markCodexShortLivedDeliveryJournalIssued(journal, issue.delivery.id, issue.delivery.ackExpiresAt, now(), env);
-        const bundle = openCodexShortLivedCredentialDelivery({
-            tenantId: input.tenantId,
-            response: issue,
-            privateKey,
-            now: now()
-        });
-        const installed = await installManagedCodexLineageCredentials({
-            tenantId: input.tenantId,
-            deliveryId: bundle.deliveryId,
-            assignmentId: issue.delivery.assignmentId,
-            managedAccountId: bundle.managedAccountId,
-            lineageId: bundle.lineageId,
-            generationVersion: bundle.generationVersion,
-            providerAccountId: bundle.providerAccountId,
-            accessToken: bundle.accessToken,
-            idToken: bundle.idToken,
-            credentialExpiresAt: bundle.expiresAt,
-            ackExpiresAt: issue.delivery.ackExpiresAt,
-            lastRefresh: issue.delivery.issuedAt
-        }, now(), env, input.installHooks);
-        const acknowledged = await input.client.acknowledgeShortLivedCredentialDelivery(bundle.deliveryId, {
-            schemaVersion: 2,
-            lineageId: bundle.lineageId,
-            generationVersion: bundle.generationVersion
-        }, newId());
-        await markManagedCodexLineageDeliveryAcknowledged(bundle.deliveryId, acknowledged.delivery.ackedAt, env);
-        await clearCodexShortLivedDeliveryJournal(issuedJournal.idempotencyKey, env);
-        return {
-            deliveryId: bundle.deliveryId,
-            assignmentId: issue.delivery.assignmentId,
-            managedAccountId: bundle.managedAccountId,
-            providerAccountId: bundle.providerAccountId,
-            lineageId: bundle.lineageId,
-            generationVersion: bundle.generationVersion,
-            credentialExpiresAt: bundle.expiresAt,
-            installAction: installed.action,
-            issueReplayed: issue.replayed,
-            ackReplayed: acknowledged.replayed,
-            resumed: false
-        };
-    }
-    throw new CodexServiceError("Unable to replace the expired short-lived credential delivery journal.", "short_lived_delivery_state_conflict");
-}
-export async function resumePendingCodexShortLivedDeliveryAck(input) {
-    const env = input.env ?? process.env;
-    const state = await readManagedCodexLineageState(env);
-    const stateMatchesRequest = state !== undefined && state.assignmentId === input.assignmentId
-        && (state.tenantId === input.tenantId || state.tenantId === null);
-    if (!state || !stateMatchesRequest || state.phase !== "INSTALLED_PENDING_ACK")
-        return undefined;
-    if (Date.parse(state.ackExpiresAt) <= (input.now ?? Date.now())) {
-        throw new CodexServiceError("The pending short-lived credential ACK has expired; request a new delivery.", "short_lived_credential_delivery_expired");
-    }
-    const result = await acknowledgeInstalledDelivery(input.client, state, input.idempotencyKey ?? randomUUID(), env);
-    return { deliveryId: state.deliveryId, replayed: result.replayed };
-}
-async function acknowledgeInstalledDelivery(client, state, idempotencyKey, env) {
-    const acknowledged = await client.acknowledgeShortLivedCredentialDelivery(state.deliveryId, {
-        schemaVersion: 2,
-        lineageId: state.lineageId,
-        generationVersion: state.generationVersion
-    }, idempotencyKey);
-    await markManagedCodexLineageDeliveryAcknowledged(state.deliveryId, acknowledged.delivery.ackedAt, env);
-    return { replayed: acknowledged.replayed };
-}
-//# sourceMappingURL=short-lived-delivery-flow.js.map

package/dist/short-lived-delivery-flow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"short-lived-delivery-flow.js","sourceRoot":"","sources":["../src/short-lived-delivery-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,qCAAqC,EACrC,2CAA2C,EAC3C,4BAA4B,EAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,oCAAoC,EACpC,qCAAqC,EACtC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,4CAA4C,EAC5C,kCAAkC,EACnC,MAAM,mCAAmC,CAAC;AAqB3C,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAAC,KAS9D;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,MAAM,kCAAkC,CAAC,GAAG,CAAC,CAAC;IACtE,MAAM,qBAAqB,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC7F,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IACxE,IAAI,OAAO,IAAI,qBAAqB,IAAI,OAAO,CAAC,KAAK,KAAK,uBAAuB;WAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/C,MAAM,mCAAmC,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;YACpD,OAAO;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,IAAI;gBACnB,WAAW,EAAE,OAAO,CAAC,QAAQ;gBAC7B,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,qBAAqB,GAAG,eAAe,EAAE,QAAQ,KAAK,KAAK,CAAC,QAAQ;WACrE,eAAe,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC;IACzD,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/D,MAAM,IAAI,iBAAiB,CACzB,2EAA2E,EAC3E,0CAA0C,EAC1C,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,KAAK,IAAI,cAAc,GAAG,CAAC,EAAE,cAAc,GAAG,CAAC,EAAE,cAAc,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,SAAS,GAAG,oCAAoC,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,0CAA0C,CAAC;YAC/D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE,KAAK,EAAE;YACvB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,GAAG,EAAE,GAAG,EAAE;YACV,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,4CAA4C,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,kCAAkC,CAAC,KAAK,CAAC,YAAY,EAAE;gBAChF,aAAa,EAAE,CAAC;gBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,cAAc,KAAK,CAAC,IAAI,KAAK,YAAY,iBAAiB;mBACzD;oBACD,yCAAyC;oBACzC,+CAA+C;oBAC/C,0BAA0B;iBAC3B,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,mCAAmC,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;gBACvE,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK;oBAAE,MAAM,KAAK,CAAC;gBAClD,SAAS;YACX,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,wCAAwC,CAClE,OAAO,EACP,KAAK,CAAC,QAAQ,CAAC,EAAE,EACjB,KAAK,CAAC,QAAQ,CAAC,YAAY,EAC3B,GAAG,EAAE,EACL,GAAG,CACJ,CAAC;QACF,MAAM,MAAM,GAAG,qCAAqC,CAAC;YACnD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK;YACf,UAAU;YACV,GAAG,EAAE,GAAG,EAAE;SACX,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,qCAAqC,CAAC;YAC5D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;YACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,mBAAmB,EAAE,MAAM,CAAC,SAAS;YACrC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;YACzC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;SACrC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,uCAAuC,CAC7E,MAAM,CAAC,UAAU,EACjB;YACE,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,EACD,KAAK,EAAE,CACR,CAAC;QACF,MAAM,2CAA2C,CAC/C,MAAM,CAAC,UAAU,EACjB,YAAY,CAAC,QAAQ,CAAC,OAAO,EAC7B,GAAG,CACJ,CAAC;QACF,MAAM,mCAAmC,CAAC,aAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7E,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;YACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,mBAAmB,EAAE,MAAM,CAAC,SAAS;YACrC,aAAa,EAAE,SAAS,CAAC,MAAM;YAC/B,aAAa,EAAE,KAAK,CAAC,QAAQ;YAC7B,WAAW,EAAE,YAAY,CAAC,QAAQ;YAClC,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,wEAAwE,EACxE,qCAAqC,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAO7D;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,mBAAmB,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WACvF,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,IAAI,KAAK,CAAC,KAAK,KAAK,uBAAuB;QAAE,OAAO,SAAS,CAAC;IAChG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CACzB,6EAA6E,EAC7E,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAC/C,KAAK,CAAC,MAAM,EACZ,KAAK,EACL,KAAK,CAAC,cAAc,IAAI,UAAU,EAAE,EACpC,GAAG,CACJ,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAAiF,EACjF,KAA4E,EAC5E,cAAsB,EACtB,GAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,KAAK,CAAC,UAAU,EAAE;QAC1F,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,EAAE,cAAc,CAAC,CAAC;IACnB,MAAM,2CAA2C,CAC/C,KAAK,CAAC,UAAU,EAChB,YAAY,CAAC,QAAQ,CAAC,OAAO,EAC7B,GAAG,CACJ,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC"}

package/dist/short-lived-delivery-journal.d.ts

@@ -1,34 +0,0 @@
-import { type KeyObject } from "node:crypto";
-import { z } from "zod";
-import type { CodexShortLivedDeliveryClientKey } from "./protocol.js";
-declare const JournalSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<2>;
-    tenantId: z.ZodString;
-    assignmentId: z.ZodString;
-    idempotencyKey: z.ZodString;
-    clientKey: z.ZodObject<{
-        version: z.ZodLiteral<1>;
-        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
-        publicKey: z.ZodString;
-    }, z.core.$strict>;
-    privateKeyPkcs8: z.ZodString;
-    deliveryId: z.ZodNullable<z.ZodString>;
-    ackExpiresAt: z.ZodNullable<z.ZodString>;
-    createdAt: z.ZodString;
-    updatedAt: z.ZodString;
-}, z.core.$strict>;
-export type CodexShortLivedDeliveryJournal = z.infer<typeof JournalSchema>;
-export declare function readCodexShortLivedDeliveryJournal(env?: NodeJS.ProcessEnv): Promise<CodexShortLivedDeliveryJournal | undefined>;
-export declare function loadOrCreateCodexShortLivedDeliveryJournal(input: {
-    tenantId: string;
-    assignmentId: string;
-    idempotencyKey: string;
-    clientKey: CodexShortLivedDeliveryClientKey;
-    privateKey: KeyObject;
-    now: number;
-    env?: NodeJS.ProcessEnv;
-}): Promise<CodexShortLivedDeliveryJournal>;
-export declare function openCodexShortLivedDeliveryJournalPrivateKey(journal: CodexShortLivedDeliveryJournal): KeyObject;
-export declare function markCodexShortLivedDeliveryJournalIssued(expected: CodexShortLivedDeliveryJournal, deliveryId: string, ackExpiresAt: string, now: number, env?: NodeJS.ProcessEnv): Promise<CodexShortLivedDeliveryJournal>;
-export declare function clearCodexShortLivedDeliveryJournal(expectedIdempotencyKey: string, env?: NodeJS.ProcessEnv): Promise<void>;
-export {};