@tokensrc/codex 1.14.2 → 1.14.4

package/dist/token-pool-v4-upload-flow.js

@@ -0,0 +1,162 @@
+import { randomUUID } from "node:crypto";
+import { withOneShotCodexLogin } from "./enrollment-login.js";
+import { CodexServiceError } from "./errors.js";
+import { codexTokenPoolV4AssignmentTarget } from "./managed-credential-v3-assignment.js";
+import { sealCodexTokenPoolV4Upload } from "./managed-credential-v3-envelope.js";
+import { clearCodexTokenPoolV4UploadJournal, readCodexTokenPoolV4UploadJournal, writeCodexTokenPoolV4UploadJournal } from "./token-pool-v4-upload-journal.js";
+export async function executeCodexTokenPoolV4Login(input) {
+    const target = codexTokenPoolV4AssignmentTarget(input.target);
+    const pending = await readCodexTokenPoolV4UploadJournal(input.env);
+    if (pending) {
+        const currentUploaderSubject = await input.client.getCurrentActorSubject();
+        if (pending.tenantId !== input.tenantId || pending.uploaderSubject !== currentUploaderSubject
+            || JSON.stringify(pending.target) !== JSON.stringify(target)) {
+            throw new CodexServiceError("A different token-pool upload is pending; reconcile it before changing the target.", "codex_token_pool_v4_state_conflict", 409);
+        }
+        return completeCodexTokenPoolV4Upload({ ...input, journal: pending });
+    }
+    const configuration = await input.client.getTokenPoolV4EnrollmentConfiguration();
+    const uploaderSubject = await input.client.getCurrentActorSubject();
+    const resolvedUserSubject = target.mode === "UNBOUND_POOL"
+        ? null
+        : target.mode === "SUBJECT"
+            ? target.userSubject
+            : (await input.client.resolveTokenPoolV4DirectoryUser(target.principal)).user.userSubject;
+    const newId = input.newId ?? randomUUID;
+    const now = input.now ?? Date.now;
+    return withOneShotCodexLogin({
+        mode: input.deviceAuth ? "device" : "browser",
+        env: input.env
+    }, async (credentials) => {
+        if (!credentials.providerAccountId) {
+            throw new CodexServiceError("Official Codex login did not expose a provider account id.", "invalid_managed_codex_v3_credentials");
+        }
+        const expiresAt = tokenExpiry(credentials.accessToken);
+        if (expiresAt === undefined) {
+            throw new CodexServiceError("Official Codex login did not expose a usable access-token expiry.", "invalid_managed_codex_v3_credentials");
+        }
+        const clientRequestId = newId();
+        const idempotencyKey = newId();
+        const envelope = sealCodexTokenPoolV4Upload({
+            tenantId: input.tenantId,
+            uploaderSubject,
+            target,
+            clientRequestId,
+            idempotencyKey,
+            ingress: configuration.ingress,
+            credentials: {
+                refreshToken: credentials.refreshToken,
+                accessToken: credentials.accessToken,
+                idToken: credentials.idToken,
+                providerAccountId: credentials.providerAccountId,
+                expiresAt: new Date(expiresAt).toISOString()
+            }
+        });
+        const timestamp = new Date(now()).toISOString();
+        const journal = await writeCodexTokenPoolV4UploadJournal({
+            schemaVersion: 4,
+            kind: "TOKEN_POOL_UPLOAD",
+            tenantId: input.tenantId,
+            uploaderSubject,
+            target,
+            resolvedUserSubject,
+            providerAccountId: credentials.providerAccountId,
+            clientRequestId,
+            idempotencyKey,
+            envelope,
+            createdAt: timestamp,
+            updatedAt: timestamp
+        }, input.env);
+        return completeCodexTokenPoolV4Upload({ ...input, journal });
+    });
+}
+async function completeCodexTokenPoolV4Upload(input) {
+    const request = {
+        schemaVersion: 4,
+        clientRequestId: input.journal.clientRequestId,
+        target: input.journal.target,
+        envelope: input.journal.envelope
+    };
+    const expectedSubject = input.journal.resolvedUserSubject ?? undefined;
+    let response = await postResolveReplay({
+        post: () => input.client.createTokenPoolV4Upload(request, input.journal.idempotencyKey, expectedSubject),
+        resolve: () => input.client.resolveTokenPoolV4Upload(input.journal.clientRequestId, input.journal.target, expectedSubject)
+    });
+    const wait = input.wait ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    for (let attempt = 0; response.upload.status === "VALIDATING" && attempt < 120; attempt += 1) {
+        await wait(1_000);
+        response = await input.client.resolveTokenPoolV4Upload(input.journal.clientRequestId, input.journal.target, expectedSubject);
+    }
+    if (response.upload.status === "VALIDATING") {
+        throw new CodexServiceError("Token-pool upload is still validating; retry the same command to resolve it without another login.", "codex_token_pool_v4_result_unknown");
+    }
+    if (response.upload.status !== "POOLED" && response.upload.status !== "RESERVED") {
+        await clearCodexTokenPoolV4UploadJournal(input.journal, input.env);
+        throw new CodexServiceError(`Token-pool upload did not succeed (${response.upload.status}).`, response.upload.safeErrorCode ?? "codex_token_pool_v4_upload_failed", 409);
+    }
+    const upload = response.upload;
+    if (upload.providerAccountId !== input.journal.providerAccountId
+        || upload.managedAccountId == null || upload.poolEntryId == null || upload.completedAt == null
+        || (upload.status === "RESERVED" && (upload.assignmentId == null
+            || upload.assignedUserSubject !== input.journal.resolvedUserSubject
+            || upload.reservedLineageId == null))) {
+        throw new CodexServiceError("Token-pool upload evidence does not match the encrypted candidate.", "invalid_codex_service_response");
+    }
+    await clearCodexTokenPoolV4UploadJournal(input.journal, input.env);
+    return {
+        uploadId: upload.id,
+        status: upload.status,
+        placement: upload.placement,
+        managedAccountId: upload.managedAccountId,
+        providerAccountId: upload.providerAccountId,
+        poolEntryId: upload.poolEntryId,
+        assignmentId: upload.assignmentId,
+        assignedUserSubject: upload.assignedUserSubject,
+        reservedLineageId: upload.reservedLineageId,
+        target: upload.target,
+        completedAt: upload.completedAt,
+        replayed: response.replayed
+    };
+}
+async function postResolveReplay(input) {
+    try {
+        return await input.post();
+    }
+    catch (postError) {
+        if (!resultMayBeUnknown(postError))
+            throw postError;
+        try {
+            return await input.resolve();
+        }
+        catch (resolveError) {
+            if (resolveError instanceof CodexServiceError && resolveError.status === 404) {
+                try {
+                    return await input.post();
+                }
+                catch (replayError) {
+                    throw new CodexServiceError("Token-pool upload remains unknown after exact replay.", "codex_token_pool_v4_result_unknown", undefined, { cause: replayError });
+                }
+            }
+            throw new CodexServiceError("Token-pool upload outcome is unknown; retry with the persisted local operation.", "codex_token_pool_v4_result_unknown", undefined, { cause: postError });
+        }
+    }
+}
+function resultMayBeUnknown(error) {
+    if (!(error instanceof CodexServiceError))
+        return true;
+    return error.status === undefined || error.status >= 500
+        || error.code === "invalid_codex_service_response";
+}
+function tokenExpiry(token) {
+    try {
+        const payload = token.split(".")[1];
+        if (!payload)
+            return undefined;
+        const value = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof value.exp === "number" && Number.isFinite(value.exp) ? value.exp * 1_000 : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=token-pool-v4-upload-flow.js.map

package/dist/token-pool-v4-upload-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-pool-v4-upload-flow.js","sourceRoot":"","sources":["../src/token-pool-v4-upload-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,gCAAgC,EAEjC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,kCAAkC,EAEnC,MAAM,mCAAmC,CAAC;AAqB3C,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KASlD;IACC,MAAM,MAAM,GAAG,gCAAgC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnE,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,sBAAsB,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAC3E,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,eAAe,KAAK,sBAAsB;eACxF,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,iBAAiB,CACzB,oFAAoF,EACpF,oCAAoC,EACpC,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,qCAAqC,EAAE,CAAC;IACjF,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;IACpE,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,KAAK,cAAc;QACxD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,MAAM,CAAC,WAAW;YACpB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,+BAA+B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,OAAO,qBAAqB,CAAC;QAC3B,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC7C,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;QACvB,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CACzB,4DAA4D,EAC5D,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,mEAAmE,EACnE,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,KAAK,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,KAAK,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,0BAA0B,CAAC;YAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,eAAe;YACf,MAAM;YACN,eAAe;YACf,cAAc;YACd,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,WAAW,EAAE;gBACX,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;gBAChD,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;aAC7C;SACF,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC;YACvD,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,eAAe;YACf,MAAM;YACN,mBAAmB;YACnB,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;YAChD,eAAe;YACf,cAAc;YACd,QAAQ;YACR,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,8BAA8B,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAK7C;IACC,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,CAAU;QACzB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;QAC9C,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;KACjC,CAAC;IACF,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,IAAI,SAAS,CAAC;IACvE,IAAI,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACrC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAC9C,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CACvD;QACD,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,CAClD,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CACrE;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,YAAoB,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACnH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,wBAAwB,CACpD,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,iBAAiB,CACzB,oGAAoG,EACpG,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjF,MAAM,kCAAkC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,IAAI,iBAAiB,CACzB,sCAAsC,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,EAChE,QAAQ,CAAC,MAAM,CAAC,aAAa,IAAI,mCAAmC,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,OAAO,CAAC,iBAAiB;WAC3D,MAAM,CAAC,gBAAgB,IAAI,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI;WAC3F,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI;eAC3D,MAAM,CAAC,mBAAmB,KAAK,KAAK,CAAC,OAAO,CAAC,mBAAmB;eAChE,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,iBAAiB,CACzB,oEAAoE,EACpE,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,kCAAkC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnE,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC,MAA+B;QAC9C,SAAS,EAAE,MAAM,CAAC,SAAwC;QAC1D,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAI,KAA4D;IAC9F,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;YAAE,MAAM,SAAS,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,IAAI,YAAY,YAAY,iBAAiB,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7E,IAAI,CAAC;oBACH,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5B,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,MAAM,IAAI,iBAAiB,CACzB,uDAAuD,EACvD,oCAAoC,EACpC,SAAS,EACT,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,iFAAiF,EACjF,oCAAoC,EACpC,SAAS,EACT,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;WACnD,KAAK,CAAC,IAAI,KAAK,gCAAgC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;QAClG,OAAO,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/token-pool-v4-upload-journal.d.ts

@@ -0,0 +1,36 @@
+import { z } from "zod";
+export declare const CodexTokenPoolV4UploadJournalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<4>;
+    kind: z.ZodLiteral<"TOKEN_POOL_UPLOAD">;
+    tenantId: z.ZodString;
+    uploaderSubject: z.ZodString;
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"UNBOUND_POOL">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"DIRECTORY_PRINCIPAL">;
+        principal: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"SUBJECT">;
+        userSubject: z.ZodString;
+    }, z.core.$strict>], "mode">;
+    resolvedUserSubject: z.ZodNullable<z.ZodString>;
+    providerAccountId: z.ZodString;
+    clientRequestId: z.ZodString;
+    idempotencyKey: z.ZodString;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"X25519-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        authenticationTag: z.ZodString;
+    }, z.core.$strict>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export type CodexTokenPoolV4UploadJournal = z.infer<typeof CodexTokenPoolV4UploadJournalSchema>;
+export declare function readCodexTokenPoolV4UploadJournal(env?: NodeJS.ProcessEnv): Promise<CodexTokenPoolV4UploadJournal | undefined>;
+export declare function writeCodexTokenPoolV4UploadJournal(value: CodexTokenPoolV4UploadJournal, env?: NodeJS.ProcessEnv): Promise<CodexTokenPoolV4UploadJournal>;
+export declare function clearCodexTokenPoolV4UploadJournal(expected: Pick<CodexTokenPoolV4UploadJournal, "clientRequestId" | "idempotencyKey">, env?: NodeJS.ProcessEnv): Promise<void>;

package/dist/token-pool-v4-upload-journal.js

@@ -0,0 +1,76 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { z } from "zod";
+import { CodexTokenPoolV4AssignmentTargetSchema, CodexTokenPoolV4IdempotencyKeySchema, CodexV3CredentialEnvelopeSchema } from "./protocol.js";
+import { readJsonIfExists, removePrivateFileDurably, withPrivateFileLock, writePrivateJson } from "./private-file.js";
+const Id = z.string().min(1).max(512).refine((value) => value === value.trim());
+const Instant = z.string().datetime({ offset: true });
+export const CodexTokenPoolV4UploadJournalSchema = z.strictObject({
+    schemaVersion: z.literal(4),
+    kind: z.literal("TOKEN_POOL_UPLOAD"),
+    tenantId: Id,
+    uploaderSubject: z.string().min(1).max(255).refine((value) => value === value.trim()),
+    target: CodexTokenPoolV4AssignmentTargetSchema,
+    resolvedUserSubject: z.string().min(1).max(255).nullable(),
+    providerAccountId: Id,
+    clientRequestId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{7,199}$/u),
+    idempotencyKey: CodexTokenPoolV4IdempotencyKeySchema,
+    envelope: CodexV3CredentialEnvelopeSchema,
+    createdAt: Instant,
+    updatedAt: Instant
+}).superRefine((value, context) => {
+    const valid = value.target.mode === "UNBOUND_POOL"
+        ? value.resolvedUserSubject == null
+        : value.target.mode === "SUBJECT"
+            ? value.resolvedUserSubject === value.target.userSubject
+            : value.resolvedUserSubject != null;
+    if (!valid)
+        context.addIssue({ code: "custom", message: "Token-pool target evidence is inconsistent." });
+});
+function journalPath(env) {
+    const home = env.CODEX_HOME?.trim() || join(homedir(), ".codex");
+    return join(home, ".numa-token-pool-v4-upload.json");
+}
+export async function readCodexTokenPoolV4UploadJournal(env = process.env) {
+    const raw = await readJsonIfExists(journalPath(env));
+    if (raw === undefined)
+        return undefined;
+    const parsed = CodexTokenPoolV4UploadJournalSchema.safeParse(raw);
+    if (!parsed.success)
+        throw Object.assign(new Error("The private token-pool upload journal is invalid."), {
+            code: "codex_token_pool_v4_journal_invalid"
+        });
+    return parsed.data;
+}
+export async function writeCodexTokenPoolV4UploadJournal(value, env = process.env) {
+    const target = journalPath(env);
+    return withPrivateFileLock(target, async () => {
+        const parsed = CodexTokenPoolV4UploadJournalSchema.parse(value);
+        const current = await readCodexTokenPoolV4UploadJournal(env);
+        if (current) {
+            if (JSON.stringify(current) === JSON.stringify(parsed))
+                return current;
+            throw Object.assign(new Error("Another token-pool upload is already pending."), {
+                code: "codex_token_pool_v4_state_conflict"
+            });
+        }
+        await writePrivateJson(target, parsed);
+        return parsed;
+    });
+}
+export async function clearCodexTokenPoolV4UploadJournal(expected, env = process.env) {
+    const target = journalPath(env);
+    await withPrivateFileLock(target, async () => {
+        const current = await readCodexTokenPoolV4UploadJournal(env);
+        if (!current)
+            return;
+        if (current.clientRequestId !== expected.clientRequestId
+            || current.idempotencyKey !== expected.idempotencyKey) {
+            throw Object.assign(new Error("The token-pool upload journal changed unexpectedly."), {
+                code: "codex_token_pool_v4_state_conflict"
+            });
+        }
+        await removePrivateFileDurably(target);
+    });
+}
+//# sourceMappingURL=token-pool-v4-upload-journal.js.map

package/dist/token-pool-v4-upload-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-pool-v4-upload-journal.js","sourceRoot":"","sources":["../src/token-pool-v4-upload-journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEtH,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,QAAQ,EAAE,EAAE;IACZ,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;IACrF,MAAM,EAAE,sCAAsC;IAC9C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1D,iBAAiB,EAAE,EAAE;IACrB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sCAAsC,CAAC;IACzE,cAAc,EAAE,oCAAoC;IACpD,QAAQ,EAAE,+BAA+B;IACzC,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc;QAChD,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,IAAI;QACnC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;YAC/B,CAAC,CAAC,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;YACxD,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;AAC3G,CAAC,CAAC,CAAC;AAIH,SAAS,WAAW,CAAC,GAAsB;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,mCAAmC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAAE;YACvG,IAAI,EAAE,qCAAqC;SAC5C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAoC,EACpC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,MAAM,GAAG,mCAAmC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAAE,OAAO,OAAO,CAAC;YACvE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,EAAE;gBAC9E,IAAI,EAAE,oCAAoC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,QAAmF,EACnF,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;eACnD,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;YACxD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAAE;gBACpF,IAAI,EAAE,oCAAoC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokensrc/codex",
-  "version": "1.14.2",
+  "version": "1.14.4",
   "description": "Standalone Codex account selection, authentication and launcher module.",
   "type": "module",
   "bin": {
@@ -75,7 +75,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@numa-tech/cli-auth": "1.14.2",
+    "@numa-tech/cli-auth": "1.14.4",
     "@openai/codex": "^0.146.0",
     "codex-multi-auth": "^2.8.0",
     "commander": "^14.0.3",