@tokensrc/codex 1.14.16 → 1.14.18

package/dist/short-lived-delivery-journal.js

@@ -1,137 +0,0 @@
-import { createPrivateKey } from "node:crypto";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { z } from "zod";
-import { readJsonIfExists, removePrivateFileDurably, withPrivateFileLock, writePrivateJson } from "./private-file.js";
-const JournalSchema = z.strictObject({
-    schemaVersion: z.literal(2),
-    tenantId: z.string().min(1).max(255),
-    assignmentId: z.string().min(1).max(255),
-    idempotencyKey: z.string().min(8).max(255),
-    clientKey: z.strictObject({
-        version: z.literal(1),
-        algorithm: z.literal("X25519-HKDF-SHA256-AES-256-GCM"),
-        publicKey: z.string().length(43).regex(/^[A-Za-z0-9_-]+$/)
-    }),
-    privateKeyPkcs8: z.string().min(1).max(512).regex(/^[A-Za-z0-9_-]+$/),
-    deliveryId: z.string().min(1).max(255).nullable(),
-    ackExpiresAt: z.string().datetime({ offset: true }).nullable(),
-    createdAt: z.string().datetime({ offset: true }),
-    updatedAt: z.string().datetime({ offset: true })
-});
-function journalPath(env = process.env) {
-    const codexHome = env.CODEX_HOME?.trim() || join(homedir(), ".codex");
-    return join(codexHome, ".numa-short-lived-delivery-journal.json");
-}
-export async function readCodexShortLivedDeliveryJournal(env = process.env) {
-    const raw = await readJsonIfExists(journalPath(env));
-    if (raw === undefined)
-        return undefined;
-    const parsed = JournalSchema.safeParse(raw);
-    if (!parsed.success) {
-        throw Object.assign(new Error("The private short-lived delivery journal is invalid."), {
-            code: "short_lived_delivery_journal_invalid"
-        });
-    }
-    return parsed.data;
-}
-export async function loadOrCreateCodexShortLivedDeliveryJournal(input) {
-    const env = input.env ?? process.env;
-    const path = journalPath(env);
-    return withPrivateFileLock(path, async () => {
-        const existing = await readCodexShortLivedDeliveryJournal(env);
-        if (existing) {
-            if (existing.tenantId !== input.tenantId || existing.assignmentId !== input.assignmentId) {
-                throw Object.assign(new Error("Another short-lived credential delivery is still pending locally."), { code: "short_lived_delivery_state_conflict" });
-            }
-            return existing;
-        }
-        if (input.privateKey.asymmetricKeyType !== "x25519") {
-            throw Object.assign(new Error("The short-lived delivery private key is invalid."), {
-                code: "short_lived_delivery_journal_invalid"
-            });
-        }
-        const encoded = input.privateKey.export({ format: "der", type: "pkcs8" });
-        if (!Buffer.isBuffer(encoded))
-            throw new Error("Unable to export the short-lived delivery private key.");
-        try {
-            const timestamp = new Date(input.now).toISOString();
-            const journal = {
-                schemaVersion: 2,
-                tenantId: input.tenantId,
-                assignmentId: input.assignmentId,
-                idempotencyKey: input.idempotencyKey,
-                clientKey: input.clientKey,
-                privateKeyPkcs8: encoded.toString("base64url"),
-                deliveryId: null,
-                ackExpiresAt: null,
-                createdAt: timestamp,
-                updatedAt: timestamp
-            };
-            await writePrivateJson(path, journal);
-            return journal;
-        }
-        finally {
-            encoded.fill(0);
-        }
-    });
-}
-export function openCodexShortLivedDeliveryJournalPrivateKey(journal) {
-    const encoded = Buffer.from(journal.privateKeyPkcs8, "base64url");
-    try {
-        if (encoded.toString("base64url") !== journal.privateKeyPkcs8)
-            throw new Error("non-canonical key");
-        const key = createPrivateKey({ key: encoded, format: "der", type: "pkcs8" });
-        if (key.asymmetricKeyType !== "x25519")
-            throw new Error("unexpected key type");
-        return key;
-    }
-    catch (error) {
-        throw Object.assign(new Error("The private short-lived delivery journal is invalid.", { cause: error }), {
-            code: "short_lived_delivery_journal_invalid"
-        });
-    }
-    finally {
-        encoded.fill(0);
-    }
-}
-export async function markCodexShortLivedDeliveryJournalIssued(expected, deliveryId, ackExpiresAt, now, env = process.env) {
-    const path = journalPath(env);
-    return withPrivateFileLock(path, async () => {
-        const current = await readCodexShortLivedDeliveryJournal(env);
-        if (!current || current.idempotencyKey !== expected.idempotencyKey
-            || current.assignmentId !== expected.assignmentId) {
-            throw Object.assign(new Error("The short-lived delivery journal changed unexpectedly."), {
-                code: "short_lived_delivery_state_conflict"
-            });
-        }
-        if (current.deliveryId && current.deliveryId !== deliveryId) {
-            throw Object.assign(new Error("The replayed delivery does not match its private journal."), {
-                code: "short_lived_delivery_state_conflict"
-            });
-        }
-        const updated = JournalSchema.parse({
-            ...current,
-            deliveryId,
-            ackExpiresAt,
-            updatedAt: new Date(now).toISOString()
-        });
-        await writePrivateJson(path, updated);
-        return updated;
-    });
-}
-export async function clearCodexShortLivedDeliveryJournal(expectedIdempotencyKey, env = process.env) {
-    const path = journalPath(env);
-    await withPrivateFileLock(path, async () => {
-        const current = await readCodexShortLivedDeliveryJournal(env);
-        if (!current)
-            return;
-        if (current.idempotencyKey !== expectedIdempotencyKey) {
-            throw Object.assign(new Error("The short-lived delivery journal changed unexpectedly."), {
-                code: "short_lived_delivery_state_conflict"
-            });
-        }
-        await removePrivateFileDurably(path);
-    });
-}
-//# sourceMappingURL=short-lived-delivery-journal.js.map

package/dist/short-lived-delivery-journal.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"short-lived-delivery-journal.js","sourceRoot":"","sources":["../src/short-lived-delivery-journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;KAC3D,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CACjD,CAAC,CAAC;AAIH,SAAS,WAAW,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,SAAS,EAAE,yCAAyC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,EAAE;YACrF,IAAI,EAAE,sCAAsC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAAC,KAQhE;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,QAAQ,GAAG,MAAM,kCAAkC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;gBACzF,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,mEAAmE,CAAC,EAC9E,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAChD,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,EAAE;gBACjF,IAAI,EAAE,sCAAsC;aAC7C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACzG,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,OAAO,GAAmC;gBAC9C,aAAa,EAAE,CAAC;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC9C,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,SAAS;aACrB,CAAC;YACF,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,OAAuC;IAEvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACpG,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;YACvG,IAAI,EAAE,sCAAsC;SAC7C,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,QAAwC,EACxC,UAAkB,EAClB,YAAoB,EACpB,GAAW,EACX,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,mBAAmB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;eAC7D,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;YACpD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wDAAwD,CAAC,EAAE;gBACvF,IAAI,EAAE,qCAAqC;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YAC5D,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,EAAE;gBAC1F,IAAI,EAAE,qCAAqC;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;YAClC,GAAG,OAAO;YACV,UAAU;YACV,YAAY;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;SACvC,CAAC,CAAC;QACH,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,sBAA8B,EAC9B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,cAAc,KAAK,sBAAsB,EAAE,CAAC;YACtD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wDAAwD,CAAC,EAAE;gBACvF,IAAI,EAAE,qCAAqC;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/short-lived-delivery.d.ts

@@ -1,26 +0,0 @@
-import { type KeyObject } from "node:crypto";
-import { type CodexShortLivedDeliveryClientKey, type CodexShortLivedDeliveryResponse, type CodexShortLivedCredentialBundle } from "./protocol.js";
-export interface CodexShortLivedDeliveryKeyPair {
-    clientKey: CodexShortLivedDeliveryClientKey;
-    privateKey: KeyObject;
-}
-export declare function createCodexShortLivedDeliveryKeyPair(): CodexShortLivedDeliveryKeyPair;
-export declare function codexShortLivedDeliveryAad(delivery: {
-    tenantId: string;
-    subject: string;
-    assignmentId: string;
-    managedAccountId: string;
-    providerAccountId: string;
-    lineageId: string;
-    generationVersion: number;
-    deliveryId: string;
-    credentialExpiresAt: string;
-    ackExpiresAt: string;
-}): Buffer;
-/** Decrypts a Server-owned lineage delivery. The plaintext contract cannot contain an RT. */
-export declare function openCodexShortLivedCredentialDelivery(input: {
-    tenantId: string;
-    response: CodexShortLivedDeliveryResponse;
-    privateKey: KeyObject;
-    now?: number;
-}): CodexShortLivedCredentialBundle;

package/dist/short-lived-delivery.js

@@ -1,139 +0,0 @@
-import { createDecipheriv, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync } from "node:crypto";
-import { CodexServiceError } from "./errors.js";
-import { CodexShortLivedCredentialBundleSchema } from "./protocol.js";
-const ALGORITHM = "X25519-HKDF-SHA256-AES-256-GCM";
-const HKDF_INFO_PREFIX = "active-code-inbox/codex-short-lived-delivery/key/v1\0";
-const BASE64URL = /^[A-Za-z0-9_-]+$/u;
-export function createCodexShortLivedDeliveryKeyPair() {
-    const { publicKey, privateKey } = generateKeyPairSync("x25519");
-    const exported = publicKey.export({ format: "jwk" });
-    if (exported.kty !== "OKP" || exported.crv !== "X25519" || typeof exported.x !== "string") {
-        throw invalidEnvelope("Unable to create a short-lived credential delivery key.");
-    }
-    decodeCanonicalBase64url(exported.x, 32, "Unable to create a short-lived credential delivery key.");
-    return {
-        clientKey: { version: 1, algorithm: ALGORITHM, publicKey: exported.x },
-        privateKey
-    };
-}
-export function codexShortLivedDeliveryAad(delivery) {
-    return Buffer.from(JSON.stringify({
-        schemaVersion: 2,
-        tenant: required(delivery.tenantId, "tenantId"),
-        subject: required(delivery.subject, "subject"),
-        assignmentId: required(delivery.assignmentId, "assignmentId"),
-        managedAccountId: required(delivery.managedAccountId, "managedAccountId"),
-        providerAccountId: required(delivery.providerAccountId, "providerAccountId"),
-        lineageId: required(delivery.lineageId, "lineageId"),
-        generationVersion: positiveInteger(delivery.generationVersion, "generationVersion"),
-        deliveryId: required(delivery.deliveryId, "deliveryId"),
-        credentialExpiresAt: validInstant(delivery.credentialExpiresAt, "credentialExpiresAt"),
-        ackExpiresAt: validInstant(delivery.ackExpiresAt, "ackExpiresAt")
-    }), "utf8");
-}
-/** Decrypts a Server-owned lineage delivery. The plaintext contract cannot contain an RT. */
-export function openCodexShortLivedCredentialDelivery(input) {
-    const delivery = input.response.delivery;
-    if (delivery.status !== "AWAITING_ACK" || delivery.envelope.version !== 1
-        || delivery.envelope.algorithm !== ALGORITHM || input.privateKey.asymmetricKeyType !== "x25519") {
-        throw invalidEnvelope("The account service returned an unsupported short-lived credential envelope.");
-    }
-    const ephemeralPublicKey = decodeCanonicalBase64url(delivery.envelope.ephemeralPublicKey, 32, "The account service returned an invalid delivery public key.");
-    const salt = decodeCanonicalBase64url(delivery.envelope.salt, 32, "The account service returned an invalid delivery salt.");
-    const nonce = decodeCanonicalBase64url(delivery.envelope.nonce, 12, "The account service returned an invalid delivery nonce.");
-    const authenticationTag = decodeCanonicalBase64url(delivery.envelope.authenticationTag, 16, "The account service returned an invalid delivery authentication tag.");
-    const ciphertext = decodeCanonicalBase64url(delivery.envelope.ciphertext, undefined, "The account service returned invalid delivery ciphertext.");
-    const serverPublicKey = createPublicKey({
-        key: {
-            kty: "OKP",
-            crv: "X25519",
-            x: ephemeralPublicKey.toString("base64url")
-        },
-        format: "jwk"
-    });
-    const sharedSecret = diffieHellman({ privateKey: input.privateKey, publicKey: serverPublicKey });
-    const key = Buffer.from(hkdfSync("sha256", sharedSecret, salt, Buffer.from(`${HKDF_INFO_PREFIX}${delivery.id}`, "utf8"), 32));
-    let plaintext;
-    try {
-        const decipher = createDecipheriv("aes-256-gcm", key, nonce, { authTagLength: 16 });
-        decipher.setAAD(codexShortLivedDeliveryAad({
-            tenantId: input.tenantId,
-            subject: delivery.subject,
-            assignmentId: delivery.assignmentId,
-            managedAccountId: delivery.managedAccountId,
-            providerAccountId: delivery.providerAccountId,
-            lineageId: delivery.lineageId,
-            generationVersion: delivery.generationVersion,
-            deliveryId: delivery.id,
-            credentialExpiresAt: delivery.credentialExpiresAt,
-            ackExpiresAt: delivery.ackExpiresAt
-        }));
-        decipher.setAuthTag(authenticationTag);
-        plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-        let raw;
-        try {
-            raw = JSON.parse(plaintext.toString("utf8"));
-        }
-        catch {
-            throw invalidEnvelope("The account service returned an invalid short-lived credential payload.");
-        }
-        const parsed = CodexShortLivedCredentialBundleSchema.safeParse(raw);
-        if (!parsed.success) {
-            throw invalidEnvelope("The account service returned an invalid short-lived credential payload.");
-        }
-        const bundle = parsed.data;
-        if (bundle.deliveryId !== delivery.id
-            || bundle.managedAccountId !== delivery.managedAccountId
-            || bundle.providerAccountId !== delivery.providerAccountId
-            || bundle.lineageId !== delivery.lineageId
-            || bundle.generationVersion !== delivery.generationVersion
-            || bundle.expiresAt !== delivery.credentialExpiresAt) {
-            throw invalidEnvelope("The short-lived credential payload does not match its delivery metadata.");
-        }
-        const now = input.now ?? Date.now();
-        if (Date.parse(bundle.expiresAt) <= now || Date.parse(delivery.ackExpiresAt) <= now) {
-            throw new CodexServiceError("The short-lived credential delivery has expired.", "short_lived_credential_delivery_expired");
-        }
-        return bundle;
-    }
-    catch (error) {
-        if (error instanceof CodexServiceError)
-            throw error;
-        throw invalidEnvelope("Unable to authenticate the short-lived credential delivery.");
-    }
-    finally {
-        plaintext?.fill(0);
-        sharedSecret.fill(0);
-        key.fill(0);
-    }
-}
-function decodeCanonicalBase64url(value, length, message) {
-    if (!value || !BASE64URL.test(value))
-        throw invalidEnvelope(message);
-    const decoded = Buffer.from(value, "base64url");
-    if ((length !== undefined && decoded.length !== length)
-        || decoded.toString("base64url") !== value) {
-        throw invalidEnvelope(message);
-    }
-    return decoded;
-}
-function required(value, name) {
-    const normalized = value.trim();
-    if (!normalized)
-        throw invalidEnvelope(`${name} is required.`);
-    return normalized;
-}
-function positiveInteger(value, name) {
-    if (!Number.isInteger(value) || value <= 0)
-        throw invalidEnvelope(`${name} is invalid.`);
-    return value;
-}
-function validInstant(value, name) {
-    if (!Number.isFinite(Date.parse(value)))
-        throw invalidEnvelope(`${name} is invalid.`);
-    return value;
-}
-function invalidEnvelope(message) {
-    return new CodexServiceError(message, "invalid_short_lived_credential_envelope");
-}
-//# sourceMappingURL=short-lived-delivery.js.map

package/dist/short-lived-delivery.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"short-lived-delivery.js","sourceRoot":"","sources":["../src/short-lived-delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,EAET,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,qCAAqC,EAItC,MAAM,eAAe,CAAC;AAEvB,MAAM,SAAS,GAAG,gCAAyC,CAAC;AAC5D,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;AACjF,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAOtC,MAAM,UAAU,oCAAoC;IAClD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1F,MAAM,eAAe,CAAC,yDAAyD,CAAC,CAAC;IACnF,CAAC;IACD,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,yDAAyD,CAAC,CAAC;IACpG,OAAO;QACL,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE;QACtE,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAW1C;IACC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC/C,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;QAC9C,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC;QAC7D,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QACzE,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QAC5E,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;QACpD,iBAAiB,EAAE,eAAe,CAAC,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACnF,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;QACvD,mBAAmB,EAAE,YAAY,CAAC,QAAQ,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACtF,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC;KAClE,CAAC,EAAE,MAAM,CAAC,CAAC;AACd,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,qCAAqC,CAAC,KAKrD;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC;WACpE,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,eAAe,CAAC,8EAA8E,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,kBAAkB,GAAG,wBAAwB,CACjD,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,EACpC,EAAE,EACF,8DAA8D,CAC/D,CAAC;IACF,MAAM,IAAI,GAAG,wBAAwB,CACnC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EACtB,EAAE,EACF,wDAAwD,CACzD,CAAC;IACF,MAAM,KAAK,GAAG,wBAAwB,CACpC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EACvB,EAAE,EACF,yDAAyD,CAC1D,CAAC;IACF,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,EACnC,EAAE,EACF,sEAAsE,CACvE,CAAC;IACF,MAAM,UAAU,GAAG,wBAAwB,CACzC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAC5B,SAAS,EACT,2DAA2D,CAC5D,CAAC;IACF,MAAM,eAAe,GAAG,eAAe,CAAC;QACtC,GAAG,EAAE;YACH,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,QAAQ;YACb,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC5C;QACD,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAC9B,QAAQ,EACR,YAAY,EACZ,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,GAAG,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EACxD,EAAE,CACH,CAAC,CAAC;IACH,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,MAAM,CAAC,0BAA0B,CAAC;YACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;YACjD,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACvC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,eAAe,CAAC,yEAAyE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,MAAM,GAAG,qCAAqC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,yEAAyE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3B,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,EAAE;eAChC,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;eACrD,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB;eACvD,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;eACvC,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB;eACvD,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACvD,MAAM,eAAe,CAAC,0EAA0E,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC;YACpF,MAAM,IAAI,iBAAiB,CACzB,kDAAkD,EAClD,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,KAAK,CAAC;QACpD,MAAM,eAAe,CAAC,6DAA6D,CAAC,CAAC;IACvF,CAAC;YAAS,CAAC;QACT,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAa,EACb,MAA0B,EAC1B,OAAe;IAEf,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;WAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;QAC7C,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU;QAAE,MAAM,eAAe,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;IAC/D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY;IAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,eAAe,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,eAAe,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,yCAAyC,CAAC,CAAC;AACnF,CAAC"}