+
    5mjc                       ^ RI Ht ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	H
t
Ht ^ RIHtHt ^ RIHt ^ RIHt ^ RIHt ^ RIHtHtHtHtHt ^ R	IHtHt ^ R
IHtHt  ! R R] 4      t! ! R R]!4      t"]
! RR7       ! R R4      4       t# ! R R]4      t$ ! R R4      t%]
! RR7       ! R R4      4       t&]
! RR7       ! R R4      4       t' ! R R4      t(R# )    )annotationsN)	dataclassreplace)UTCdatetime)Path)Callable)Protocol)AccountAccountRegistry
AccountRefAuthorityBindingAuthorityMode)AccountSnapshotHealthStatus)AccountHealthProviderAccountLifecyclec                      ] tR t^tRtR# )MigrationError N__name__
__module____qualname____firstlineno____static_attributes__r       ^/home/user/overdeck-private-tests/workstation-ai-broad2/modules/systray/authority_migration.pyr   r          r   r   c                      ] tR t^tRtR# )MigrationCleanupErrorr   Nr   r   r   r   r!   r!      r   r   r!   T)frozenc                  @    ] tR t^t$ R]R&   R]R&   R]R&   R]R&   RtR	# )
AuthorityProvisionstrauthority_nameroute_idr   proxy_grant_refint
generationr   N)r   r   r   r   __annotations__r   r   r   r   r$   r$      s    MOr   r$   c                  ^    ] tR t^%tR R ltR R ltR R ltR R ltR	 R
 ltR R lt	Rt
R# )AuthorityMigrationAdminc               $    V ^8  d   QhRRRRRR/#    accountr   r&   r%   returnr$   r   )formats   "r   __annotate__$AuthorityMigrationAdmin.__annotate__&   s    cc7cCcL^cr   c                	    R # Nr   )selfr1   r&   s   &&&r   login_and_provision+AuthorityMigrationAdmin.login_and_provision&   s    `cr   c               $    V ^8  d   QhRRRRRR/# r0   providerr%   
account_idr2   r)   r   )r3   s   "r   r4   r5   (   s    KK#K3K3Kr   c                	    R # r7   r   r8   r=   r>   s   &&&r   status_generation)AuthorityMigrationAdmin.status_generation(   s    r   c                    V ^8  d   QhRRRR/# r0   r'   r%   r2   Noner   )r3   s   "r   r4   r5   *   s    77c7d7r   c                	    R # r7   r   r8   r'   s   &&r   disable_route%AuthorityMigrationAdmin.disable_route*   s    Cr   c                    V ^8  d   QhRRRR/# rD   r   )r3   s   "r   r4   r5   ,   s    ==C=D=r   c                	    R # r7   r   rG   s   &&r   remove_route_grants+AuthorityMigrationAdmin.remove_route_grants,   s    #r   c                    V ^8  d   QhRRRR/# rD   r   )r3   s   "r   r4   r5   .   s    66S6T6r   c                	    R # r7   r   rG   s   &&r   remove_route$AuthorityMigrationAdmin.remove_route.   s    3r   c               $    V ^8  d   QhRRRRRR/# r0   r=   r%   r>   r2   rE   r   )r3   s   "r   r4   r5   0   s    IIsIIIr   c                	    R # r7   r   r@   s   &&&r   remove_account&AuthorityMigrationAdmin.remove_account0   s    cr   r   N)r   r   r   r   r9   rA   rH   rL   rP   rU   r   r   r   r   r-   r-   %   s    cK7=6IIr   r-   c                      ] tR t^3tRtRRRRRRRR/R R lltR	R
/R R lltR	R
/R R lltR R ltR R lt	R R lt
R R ltR R ltR R ltRtR# )SubrouterMigrationAdmina   Production local-admin implementation for the migration coordinator.

Provider credentials remain inside the dedicated Subrouter authority service.
This class may read the non-secret route identifier, but it never opens the
workstation bearer key; it validates only that file's metadata.
binaryNhelper	state_dircommand_runnerc          
     ,    V ^8  d   QhRRRRRRRRRR/# )	r0   registryr   rY   zPath | NonerZ   r[   r2   rE   r   )r3   s   "r   r4   $SubrouterMigrationAdmin.__annotate__;   sC     @ @!@ 	@
 @ @ 
@r   c          	     	   Wn         T;'       g*    \        \        P                  P	                  R R4      4      V n        T;'       gM    \        \        P                  P	                  R\        \        P                  ! 4       R,          4      4      4      V n        T;'       g*    \        \        P                  P	                  RR4      4      V n	        T;'       g    \        P                  V n        R# )OVERDECK_SUBROUTER_BINz1/var/lib/overdeck/subrouter/current/bin/subrouter#OVERDECK_SUBROUTER_MIGRATION_HELPERzF.local/share/overdeck/deploy/modules/subrouter/bin/migration-provisionOVERDECK_SUBROUTER_STATE_DIRz!/var/lib/overdeck/subrouter/stateN)	_registryr   osenvironget_binaryr%   home_helper
_state_dir
subprocessrun_command_runner)r8   r^   rY   rZ   r[   r\   s   &&$$$$r   __init__ SubrouterMigrationAdmin.__init__;   s     " 
 
JJNN(C"
  
 
JJNN5DIIK"jjk"
 $ 
 
tJJNN.3(
  .??r   captureFc                    V ^8  d   QhRRRR/# )r0   argvz	list[str]rq   boolr   )r3   s   "r   r4   r_   Y   s     
 
 
 
r   c               	    R RRR/pV'       d0   VP                  \        P                  \        P                  R7        V P                  ! V3/ VB p\        TR^4      ^ 8w  d   \        R4      hT#   \         d   p\        R4      ThRp?ii ; i)checkFtextT)stdoutstderrz'authority administration command failedN
returncode)updaterl   PIPErn   	Exceptionr   getattr)r8   rs   rq   kwargs	completedexcs   &&$   r   _runSubrouterMigrationAdmin._runY   s    %,eVT$BMMMI	U,,T<V<I 9lA.!3 !JKK	  	U !JKQTT	Us   A1 1B<BBc                    V ^8  d   QhRRRR/# )r0   argsr%   rq   rt   r   )r3   s   "r   r4   r_   e   s     
 
c 
D 
r   c          	     	\    V P                  R RRR\        V P                  4      .VOVR7      # )	deck-sudoz-uzoverdeck-subrouterz--rq   )r   r%   rh   )r8   rq   r   s   &$*r   _service_command(SubrouterMigrationAdmin._service_commande   sD    yy$DLL!    

 
	
r   c               $    V ^8  d   QhRRRRRR/# r/   r   )r3   s   "r   r4   r_   r   s'     M M7 MC ML^ Mr   c                	   VP                   e   \        R4      h\        P                  ! VP                  P                  R4      4      P                  4       R,          pV P                  P                  R,          VP                  ,          V,          pVP                  RRRR7        R	VP                   R
V R
\        P                  ! 4        2pV P                  R\        V P                  4      RRVRVP                  RVP                   R\        V4      RR.4       VR,          pVR,          pVP#                  4       pVP#                  4       p	W3 F  p
\$        P&                  ! V
P(                  4      '       d]   V
P*                  ^8w  gL   V
P,                  \        P.                  ! 4       8w  g(   \$        P0                  ! V
P(                  4      R8w  g   K  \        R4      h	  VP3                  RR7      P5                  4       p\6        P8                  ! RV4      '       g   \        R4      hV P;                  VP                  VP                   4      p\=        VVVVR7      #   \>         Ed    TR,          pTPA                  4       '       d   TPC                  4       '       g    TP3                  RR7      P5                  4       p\6        P8                  ! RT4      '       dI    T PE                  T4       M  \>         d     Mi ; i T PG                  T4       M#  \>         d     Mi ; iM  \H         d     Mi ; i T PK                  TP                  TP                   4       M  \>         d     Mi ; iTPM                  4       '       d   TPO                  4       MR FE  pTPA                  4       '       g   K  TPC                  4       '       d   K3  TPQ                  RR7       KG  	   TPS                  4        h   \H         d     h i ; ii ; i)Nz"account is already authority-boundutf-8N   Nzauthority-materialTF  parentsexist_okmodez
migration--r   	provisionz--run-id
--provider--account-idz--output-dirz--ttl-seconds3600zroute.idz	proxy.key  z%authority material metadata is unsafeencodingz[A-Za-z0-9][A-Za-z0-9_-]{0,127}z%authority route identifier is invalid)r&   r'   r(   r*   
missing_okr   )*authority_bindingr   hashlibsha256tray_keyencode	hexdigestrd   base_dirtoolmkdirre   getpidr   r%   rj   sluglstatstatS_ISREGst_modest_nlinkst_uidgeteuidS_IMODE	read_textstripre	fullmatchrA   r$   r}   is_file
is_symlinkrL   rP   OSErrorrU   existsiterdirunlinkrmdir)r8   r1   r&   fingerprintmaterialrun_id
route_file
grant_file
route_info
grant_infoinfor'   r*   childs   &&&           r   r9   +SubrouterMigrationAdmin.login_and_provisionr   sj   $$0 !EFFnnW%5%5%<%<W%EFPPRSVW>>**-AAGLLPS^^te%@G	!',,qQryy{mLFII% LL"LL"M#" "J.J!K/J#))+J#))+J#0T\\22}}){{bjjl2||DLL1U:()PQQ 1 "++W+=CCEH<< BHMM$%LMM//gllKJ%-! *%	   	 "J.J!!##J,A,A,C,C)33W3EKKMH||$FQQ! 44X>( ! !! --h7( ! ! R  ##GLL',,? /7/@/@))+bH==??5+;+;+=+=LLDL1 I    9	s   (D+I" A	I" "?I" "*P	P	$<L*"K43L*4L?L*LL*LP	L&#L*$P	%L&&L*)P	*L85P	7L88P	<&M#"P	#M1.P	0M11P	
(P	7P	P	&O76P	7PP	PP	c               $    V ^8  d   QhRRRRRR/# r<   r   )r3   s   "r   r4   r_      s!     # ## #3 #3 #r   c                	
   V P                  R RR\        V P                  4      RVRVRR7	      p\        VRR4      ;'       g    Rp\        P
                  ! R	V4      pVf   \        R
4      h\        VP                  ^4      4      # )authority-accountstatus--state-dirr   r   Tr   rx    z*(?m)^Credential generation: ([1-9][0-9]*)$#authority generation is unavailable)	r   r%   rk   r~   r   searchr   r)   group)r8   r=   r>   r   outputmatchs   &&&   r   rA   )SubrouterMigrationAdmin.status_generation   s    ))  * 

	 Hb177R		GP= !FGG5;;q>""r   c                    V ^8  d   QhRRRR/# rD   r   )r3   s   "r   r4   r_      s     
 
c 
d 
r   c                	X    V P                  R RR\        V P                  4      RV4       R# )authority-routedisabler   
--route-idNr   r%   rk   rG   s   &&r   rH   %SubrouterMigrationAdmin.disable_route   s'    y-T__9M|]e	
r   c                    V ^8  d   QhRRRR/# rD   r   )r3   s   "r   r4   r_      s     
 
C 
D 
r   c                	X    V P                  R RR\        V P                  4      RV4       R# )zauthority-grantzremove-router   r   Nr   rG   s   &&r   rL   +SubrouterMigrationAdmin.remove_route_grants   s(    ~}c$//>RT`bj	
r   c                    V ^8  d   QhRRRR/# rD   r   )r3   s   "r   r4   r_      s     
 
S 
T 
r   c                	X    V P                  R RR\        V P                  4      RV4       R# )r   remover   r   Nr   rG   s   &&r   rP   $SubrouterMigrationAdmin.remove_route   s'    xDOO8Ll\d	
r   c               $    V ^8  d   QhRRRRRR/# rS   r   )r3   s   "r   r4   r_      s!     

 

s 

 

 

r   c           
     	\    V P                  R RR\        V P                  4      RVRV4       R# )r   r   r   r   r   Nr   r@   s   &&&r   rU   &SubrouterMigrationAdmin.remove_account   s1     		
r   )rh   rn   rj   rd   rk   )r   r   r   r   __doc__ro   r   r   r9   rA   rH   rL   rP   rU   r   r   r   r   rX   rX   3   sv    @ #	@
 #@ "&@ @<
u 

5 
M^#$







 

r   rX   c                      ] tR t^t$ RtR]R&   RtR]R&   RtR]R&   RtR]R&   Rt	R]R&   Rt
R]R&   RtR]R	&   RtR]R
&   RtR]R&   RtR]R&   RtR]R&   RtR]R&   R R ltR R ltR R ltRtR# )MigrationAcceptanceFrt   cliresume	streamingquota_healthrepairrestartexact_routeno_provider_credentials	responsesrealtime
app_serverhttp_ssec                    V ^8  d   QhRRRR/# r0   r=   r%   r2   ztuple[str, ...]r   )r3   s   "r   r4    MigrationAcceptance.__annotate__   s     I I I Ir   c                	\    RpVR8X  d   . VORNRNRN5# VR8X  d   . VORN5# \        R4      h)	r   codexr   r   r   clauder   (unsupported authority migration provider)r   r   r   r   r   r   r   r   )r   )r8   r=   commons   && r   requiredMigrationAcceptance.required   sQ    	
 wCVC[C*ClCCx(V(Z((GHHr   c                    V ^8  d   QhRRRR/# r   r   )r3   s   "r   r4   r     s     Z Z Z Zr   c                	   a  \         ;QJ d&    . V 3R  lS P                  V4       4       F  NK  	  5# ! V 3R  lS P                  V4       4       4      # )c              3  P   <"   T F  p\        SV4      '       d   K  Vx  K  	  R # 5ir7   )r~   ).0namer8   s   & r   	<genexpr>.MigrationAcceptance.missing.<locals>.<genexpr>  s     Y&=dWTSWEXTT&=s   &
&)tupler   )r8   r=   s   f&r   missingMigrationAcceptance.missing  s7    uYdmmH&=YuYuYdmmH&=YYYr   c                   V ^8  d   QhRR/# )r0   r2   zdict[str, bool]r   )r3   s   "r   r4   r     s     
 
 
r   c           
     	V    R Uu/ uF  pV\        \        W4      4      bK  	  up# u upi )r   )r   r   r   r   r   r   r   r   r   r   r   r   )rt   r~   )r8   r  s   & r   as_dictMigrationAcceptance.as_dict  s<    
 $wt*++
 	
 
s   &r   N)r   r   r   r   r   r+   r   r   r   r   r   r   r   r   r   r   r   r   r  r	  r   r   r   r   r   r      s    CFDItL$FDGTK$)T)ItHdJHdI"Z
 
r   r   c                      ] tR tRt$ R]R&   R]R&   R]R&   R]R&   R]R&   R]R	&   R]R
&   R]R&   RtR]R&   RtR]R&   RtR]R&   RtR]R&   Rt	R]R&   Rt
R]R&   RtR]R&   R R ltRtR# )AccountMigrationReceipti&  r%   r=   r&   account_fingerprintroute_fingerprintstater)   r*   
started_at
updated_atNz
str | Nonepromoted_atrollback_started_atrollback_completed_atzdict[str, bool] | Noneflow_checksFrt   provider_credential_copiednative_fallback_usedcleanup_completec                   V ^8  d   QhRR/# )r0   r2   zdict[str, object]r   )r3   s   "r   r4   $AccountMigrationReceipt.__annotate__8  s     
 
* 
r   c                	   / R RbRV P                   bRV P                  bRV P                  bRV P                  bRV P                  bRV P
                  bRV P                  bR	V P                  bR
V P                  bRV P                  bRV P                  bR\        V P                  ;'       g    / 4      bRV P                  bRV P                  bRV P                  b# )schemaAccountMigrationReceipt/v1r=   r&   r  r  r  r*   r  r  r  r  r  r  r  r  r  )r=   r&   r  r  r  r*   r  r  r  r  r  dictr  r  r  r  )r8   s   &r   r	  AccountMigrationReceipt.as_dict8  s&   
2

 d11
 "4#;#;	

  !7!7
 TZZ
 $//
 $//
 $//
 4++
 "4#;#;
 $T%?%?
 4 0 0 6 6B7
 )$*I*I
 #D$=$=
   5 5!
 	
r   r   )r   r   r   r   r+   r  r  r  r  r  r  r  r	  r   r   r   r   r  r  &  s    MJOOO"K"&**(,:,*.K'.',,!&$&"d"
 
r   r  c                      ] tR tRtRR/R R llt]R R l4       tR R	 ltR
 R lt]R R l4       t	R R lt
R R ltR R ltR R ltR R ltR R ltR R ltR R ltR R ltR  R! lt]R" R# l4       tR$tR# )%AuthorityMigrationCoordinatoriM  clockNc               (    V ^8  d   QhRRRRRRRR/# )	r0   r^   r   adminr-   r"  zCallable[[], datetime] | Noner2   rE   r   )r3   s   "r   r4   *AuthorityMigrationCoordinator.__annotate__N  s8     
P 
P!
P '
P
 -
P 

Pr   c               	r    Wn         W n        T;'       g    R  V n        VP                  R,          V n        R# )c                 6    \         P                  ! \        4      # r7   )r   nowr   r   r   r   <lambda>8AuthorityMigrationCoordinator.__init__.<locals>.<lambda>W  s    S(9r   zauthority-migration-receiptsN)rd   _admin_clockr   _receipt_root)r8   r^   r$  r"  s   &&&$r   ro   &AuthorityMigrationCoordinator.__init__N  s2     ":: 9%..1OOr   c                    V ^8  d   QhRRRR/# )r0   valuer%   r2   r   )r3   s   "r   r4   r%  [  s     F FC FC Fr   c                	v    \         P                  ! V P                  R 4      4      P                  4       R,          # )r   r   )r   r   r   r   )r0  s   &r   _fingerprint*AuthorityMigrationCoordinator._fingerprintZ  s(    ~~ell734>>@EEr   c                   V ^8  d   QhRR/# )r0   r2   r%   r   )r3   s   "r   r4   r%  ^  s     H HC Hr   c                	   V P                  4       p\        V\        4      '       g   \        R 4      hVP                  f   VP                  \        R7      pVP                  \        4      P                  4       P                  RR4      # )z)migration clock returned an invalid value)tzinfoz+00:00Z)	r,  
isinstancer   r   r6  r   r   
astimezone	isoformat)r8   r0  s   & r   
_timestamp(AuthorityMigrationCoordinator._timestamp^  sg    %** !LMM<<MMM-E$..0883GGr   c                    V ^8  d   QhRRRR/# )r0   r1   r   r2   r   r   )r3   s   "r   r4   r%  f  s     a aW a ar   c                	    V P                   VP                  ,          V P                  VP                  4       R 2,          # )z.json)r-  r   r2  r   )r8   r1   s   &&r   _receipt_path+AuthorityMigrationCoordinator._receipt_pathf  s6    !!GLL0d6G6GHXHX6Y5ZZ_3```r   c                    V ^8  d   QhRRRR/# r0   r1   r   r2   r   )r3   s   "r   r4   r%  j  s     	
 	
g 	
' 	
r   c           
     	    \        \        V P                  V P                  4      V P                  V P
                  V P                  V P                  V P                  R R7      # )N)refaliasaccount_homeemailplanr>   r   )	r   r   r   r   rE  rF  rG  rH  r>   )r1   s   &r   _native_view*AuthorityMigrationCoordinator._native_viewi  sK    7<<6-- ----))"
 	
r   c               $    V ^8  d   QhRRRRRR/# )r0   r1   r   receiptr  r2   r   r   )r3   s   "r   r4   r%  u  s#      g 8O TX r   c                	   V P                  V4      pVP                  P                  R R RR7       \        P                  ! VP                  4       ^R R7      R,           p\        P                  ! RVP                   R2VP                  R7      w  rV\        V4      p \        P                  ! VR4       \        P                  ! VRR	R
7      ;_uu_ 4       pVP                  V4       VP                  4        \        P                  ! VP!                  4       4       RRR4       \        P"                  ! Ws4       VP%                  R R7       V#   + '       g   i     L:; i  TP%                  R R7       i ; i)Tr   r   )indent	sort_keys
.)prefixdirr   wr   r   Nr   )r?  parentr   jsondumpsr	  tempfilemkstempr  r   re   fchmodfdopenwriteflushfsyncfilenor   r   )	r8   r1   rL  pathpayloadfdr  	temporaryhandles	   &&&      r   _write_receipt,AuthorityMigrationCoordinator._write_receiptu  s   !!'*$EB**W__.qDIDP##Qtyyk+;MJ		.IIb% 2sW55W%) 6 JJy'- 65 -s%   8E AEE E	E E3c                    V ^8  d   QhRRRR/# r0   r1   r   r2   r  r   )r3   s   "r   r4   r%    s     6
 6
W 6
1H 6
r   c                	(   V P                  V4      p \        P                  ! VP                  R R7      4      p0 Rmp\        T\        4      '       d   \        T4      T8w  d   \        R4      hTP                  R4      R8w  d   \        R4      hTP                  R4      TP                  8w  d   \        R4      hTP                  R4      T P                  TP                  4      8w  d   \        R4      hTP                  R4      RJg   TP                  R4      RJd   \        R4      hTP                  R
4      p\        T\        4      '       g   \        T\        4      '       d   T^ 8:  d   \        R4      hTP                  R4      p\        T\        4      '       dW   \         ;QJ d*    R TP#                  4        4       F  '       g   K   RM	  RM! R TP#                  4        4       4      '       d   \        R4      h\%        TR,          TR,          TR,          TR,          TR	,          TTR,          TR,          TR,          TR,          TR,          TTR,          R7      #   \        \        P
                  3 d   p\        R4      ThRp?ii ; i) r   r   z migration receipt is unavailableNr  r=   r&   r  r  r  r*   r  r  r  r  r  r  r  r  r  zmigration receipt is invalidr  z#migration receipt provider mismatchz"migration receipt account mismatchFz.migration receipt violates credential boundaryz'migration receipt generation is invalidc              3     "   T F9  w  r\        V\        4      '       * ;'       g    \        V\        4      '       * x  K;  	  R # 5ir7   )r8  r%   rt   )r   kvs   &  r   r  >AuthorityMigrationCoordinator._read_receipt.<locals>.<genexpr>  sC       4G  sFjnjk
1c8J4J4e4eR\]^`dReNe4e  sFs
   "AATz)migration receipt flow checks are invalid)r=   r&   r  r  r  r*   r  r  r  r  r  r  r  >   r  r  r=   r*   r  r  r  r  r&   r  r  r  r  r  r  r  )r?  rV  loadsr   r   JSONDecodeErrorr   r8  r  setrg   r   r2  r   rt   r)   anyitemsr  )r8   r1   r`  ra  r   expectedr*   r  s   &&      r   _read_receipt+AuthorityMigrationCoordinator._read_receipt  sZ   !!'*	Njj!ABG
$ '4((CLH,D !?@@;;x $@@ !?@@;;z"gll2 !FGG;;,-1B1B7CSCS1TT !EFF;;34EAW[[QgEhpuEu !QRR[[.
j$''z*c/J/Jj\]o !JKKkk-0+t,,  4Gr}  sD  sD  sF  4G  4Gr}  sD  sD  sF  4G  1G  1G !LMM&Z("#34 '(= >%&9:'"!|,|,. '(= >")*A"B#$%78
 	
I --. 	N !CD#M	Ns   &I% %J JJc               $    V ^8  d   QhRRRRRR/# )r0   r1   r   r&   r%   r2   r  r   )r3   s   "r   r4   r%    s"     # #' #c #F] #r   c               	   VP                   R
9  d   \        R4      hVP                  e   \        R4      hV P                  P	                  W4      pVP
                  V8w  g   VP                  ^ 8:  d   \        R4      hVP                  P                  4       '       g   \        R4      h\        \        P                  VP
                  VP                  VP                   VP                  R7      p V P                  P                  VP                  V4       T P%                  4       p\'        TP                   TP
                  T P)                  TP*                  4      T P)                  TP                  4      RTP                  TT\-        4       P/                  4       R	7	      pT P1                  Y4       T#   \          d,    T P#                  TP                   TP                  TRR7       h i ; i)r   r   z(account already has an authority bindingz(authority provisioning result is invalidz*authority grant reference must be absolute)r   r&   r'   r=   r(   Tremove_grant_refdark)	r=   r&   r  r  r  r*   r  r  r  >   r   r   )r   r   r   r+  r9   r&   r*   r(   is_absoluter   r   SUBROUTER_DARKr'   rd   set_authority_bindingr   r}   _cleanup_authorityr;  r  r2  r   r   r	  re  )r8   r1   r&   r   bindingr(  rL  s   &&$    r   
stage_dark(AuthorityMigrationCoordinator.stage_dark  s   <<22 !KLL$$0 !KLLKK33GL	##~59M9MQR9R !KLL((4466 !MNN"--$33''\\%55
	NN00wG oo)\\"11 $ 1 1'2B2B C"//0@0@A +++-557

 	G-!  	##GLL',,Z^#_	s   0&F3 36G)c               $    V ^8  d   QhRRRRRR/# )r0   r1   r   
acceptancer   r2   r  r   )r3   s   "r   r4   r%    s#      w 4G Lc r   c           	     	n   V P                  VP                  4      pVP                  pVe2   VP                  \        P
                  8w  g   VP                  '       d   \        R4      hVP                  VP                  4      pV'       d"   \        RRP                  V4      ,           4      hV P                  P                  VP                  VP                  4      pV^ 8:  d   \        R4      hV P                  V4      pVP                  V P                  VP                   4      8w  d   \        R4      h\#        V\        P$                  R7      pV P&                  P)                  VP                  V4       V P+                  4       p	\#        VRVV	V	VP-                  4       R7      p
V P/                  W:4       V
# )	Nz)account is not in a promotable dark statez!migration acceptance incomplete: z, r   z)migration route changed during acceptance)r   	authority)r  r*   r  r  r  )_currentr   r   r   r   r|  quiescedr   r  r   joinr+  rA   rt  r  r2  r'   r   	SUBROUTERrd   r}  r;  r	  re  )r8   r1   r  currentr  r  r*   priorpromoted_bindingr(  rL  s   &&&        r   promote%AuthorityMigrationCoordinator.promote  s\   ---++?gllm.J.JJgN^N^N^ !LMM$$W\\2 !DtyyQXGY!YZZ[[227<<N
? !FGG""7+""d&7&78H8H&II !LMM"71H1HI,,W\\;KLoo!"**,
 	G-r   c                    V ^8  d   QhRRRR/# rh  r   )r3   s   "r   r4   r%    s      7 /F r   c                	z   V P                  VP                  4      pVP                  pVe    VP                  \        P
                  8w  d   \        R4      h V P                  P                  VP                  4       V P                  VP                  VP                  VRR7       T P                  P                  TP                  R 4       T P!                  T4      pT P#                  4       p\%        TRTRR7      pT P'                  T P)                  T4      T4       T#   \         d   p\        R4      ThR p?ii ; i)Nz account is not in dark migrationTrx  zdark migration cleanup failedznative-cancelled)r  r  r  )r  r   r   r   r   r|  r   r+  rH   r'   r~  r   r}   r!   rd   r}  rt  r;  r   re  rI  )r8   r1   r  r  r   r  r(  rL  s   &&      r   cancel_dark)AuthorityMigrationCoordinator.cancel_dark  s   ---++?gllm.J.JJ !CDD	RKK%%g&6&67##gllGd $ 
 	,,W\\4@""7+oo$!	
 	D--g6@  	R'(GHcQ	Rs   AD D:)D55D:c                    V ^8  d   QhRRRR/# rB  r   )r3   s   "r   r4   r%    s     * *g *' *r   c                	   V P                  VP                  4      pVP                  pVe    VP                  \        P
                  8w  d   \        R4      hVP                  '       d   V P                  V4      # V P                  V4      pV P                  4       p\        VRR7      pV P                  P                  VP                  V4       \        VRWUR7      pV P                  W'4        V P                  P!                  VP"                  4       T P                  T4      #   \$         d   p\        R4      ThR p?ii ; i)Nzaccount is not authority-activeT)r  zrollback-quiesced)r  r  r  z!failed to disable authority route)r  r   r   r   r   r  r   r  rI  rt  r;  r   rd   r}  re  r+  rH   r'   r}   )	r8   r1   r  r  r  r(  r  rL  r   s	   &&       r   begin_rollback,AuthorityMigrationCoordinator.begin_rollback  s   ---++?gllm.E.EE !BCC$$W--""7+oo7T2,,W\\8D,
 	G-	OKK%%g&6&67   ))  	O !DE3N	Os   -%D# #D?.D::D?c               $    V ^8  d   QhRRRRRR/# )r0   r1   r   native_healthr   r2   r  r   )r3   s   "r   r4   r%  ,  s(     . .. -	.
 
!.r   c          	     	   V P                  VP                  4      pVP                  pVe2   VP                  \        P
                  8w  g   VP                  '       g   \        R4      hV P                  V4      pV P                  V4      pVP                  V4      pVP                  \        P                  8w  d   \        R4      hV P                  P                  VP                  R 4       V P!                  4       p V P#                  VP$                  VP                  VRR7       \)        TR	TTRR7      p
T P+                  Yj4       T
#   \&         d3   p	\)        TRTTRR7      p
T P+                  Yj4       \-        R4      T	hR p	?	ii ; i)
Nz"authority rollback is not quiescedz*fresh native readiness verification failedTrx  znative-cleanup-requiredF)r  r  r  r  z4native routing restored but authority cleanup failednative)r  r   r   r   r   r  r  r   rt  rI  fetchr   r   OKrd   r}  r;  r~  r   r}   r   re  r!   )r8   r1   r  r  r  r  r  snapshotr   r   rL  s   &&$        r   complete_rollback/AuthorityMigrationCoordinator.complete_rollback,  sg    ---++O||}666### !EFF""7+""7+$1$7$7$???loo- !MNN,,W\\4@OO%		##gllGd $   "+!
 	F,)  	/$&/!&G 0'F	s   <)E F-F  Fc               (    V ^8  d   QhRRRRRRRR/# )	r0   r1   r   native_lifecycler   r  r   r2   r  r   )r3   s   "r   r4   r%  \  s8     L LL +	L
 -L 
!Lr   c               	z   V P                  V4      p\        VP                  V4      4      p\        ;QJ d    R  V 4       F  '       g   K   RM	  RM! R  V 4       4      '       d;   \        ;QJ d    R V 4       F  '       g   K   RM	  RM! R V 4       4      '       d   \	        R4      hV P                  WR7      # )c              3  >   "   T F  qP                   R 8H  x  K  	  R# 5i)successNkindr   events   & r   r  9AuthorityMigrationCoordinator.rollback.<locals>.<genexpr>e  s     ?u::*   TFc              3  >   "   T F  qP                   R 8H  x  K  	  R# 5i)failureNr  r  s   & r   r  r  e  s      G
17JJ)#r  z.fresh native reauthentication did not complete)r  )r  listreauthenticaterq  r   r  )r8   r1   r  r  r  eventss   &&$$  r   rollback&AuthorityMigrationCoordinator.rollback\  s     $$W-&55f=>s??sss????33 G
17G
333 G
17G
 D
 D
 !!QRR%%g%KKr   c                    V ^8  d   QhRRRR/# )r0   r   r%   r2   r   r   )r3   s   "r   r4   r%  k  s     E ES EW Er   c                	    V P                   P                  4        F  pVP                  V8X  g   K  Vu # 	  \        R 4      h)z$account disappeared during migration)rd   r  r   r   )r8   r   r1   s   && r   r  &AuthorityMigrationCoordinator._currentk  s8    ~~**,G||t# - CDDr   c          
     ,    V ^8  d   QhRRRRRRRRRR	/# )
r0   r=   r%   r>   r  r   ry  rt   r2   rE   r   )r3   s   "r   r4   r%  q  sC     [ [[ [ "	[ [ 
[r   c               	~  a aaa . pVV 3R  lVV 3R lVVV 3R l3 F  p V! 4        K  	  V'       d    S P                  SP                  4       V'       d   \	        R4      V^ ,          hR#   \          d   pTP                  T4        Rp?Kr  Rp?ii ; i  \          d   pTP                  T4        Rp?LhRp?ii ; i)c                 N   < SP                   P                  S P                  4      # r7   )r+  rL   r'   r  r8   s   r   r)  BAuthorityMigrationCoordinator._cleanup_authority.<locals>.<lambda>{  s    DKK33G4D4DEr   c                 N   < SP                   P                  S P                  4      # r7   )r+  rP   r'   r  s   r   r)  r  |  s    DKK,,W-=-=>r   c                 <   < SP                   P                  SS 4      # r7   )r+  rU   )r>   r=   r8   s   r   r)  r  }  s    DKK..xDr   Nz authority cleanup was incomplete)r}   append_remove_grant_refr(   r!   )r8   r=   r>   r  ry  errors	operationr   s   ffff$   r   r~  0AuthorityMigrationCoordinator._cleanup_authorityq  s     #%E>D
I
#
 #&&w'>'>? '(JKQWXYQZZ   #c""#
  #c""#s.   A,B ,B7BBB<!B77B<c                    V ^8  d   QhRRRR/# )r0   r`  r   r2   rE   r   )r3   s   "r   r4   r%    s        r   c                	    V P                  4       p\        P                  ! TP                  4      '       dc   TP
                  ^8w  gR   TP                  \        P                  ! 4       8w  g.   \        P                  ! TP                  4      ^?,          '       d   \        R4      hT P                  4        R #   \         d     R # i ; i)Nz'refusing unsafe authority grant cleanup)r   FileNotFoundErrorr   r   r   r   r   re   r   r   r!   r   )r`  r   s   & r   r  /AuthorityMigrationCoordinator._remove_grant_ref  s    	::<D T\\**}}!{{bjjl*||DLL)E11'(QRR ! 		s   B7 7CC)r+  r,  r-  rd   )r   r   r   r   ro   staticmethodr2  r;  r?  rI  re  rt  r  r  r  r  r  r  r  r~  r  r   r   r   r   r!  r!  M  s    
P
 04
P F FHa 	
 	
"6
p#J80**.`LE[4  r   r!  ))
__future__r   r   rV  re   r   r   rl   rX  dataclassesr   r   r   r   pathlibr   collections.abcr	   typingr
   account_registryr   r   r   r   r   health_clientr   r   provider_servicesr   r   RuntimeErrorr   r!   r$   r-   rX   r   r  r!  r   r   r   <module>r     s    "   	 	    * "  $  b b 7 E	\ 		N 	 $  Jh Jy
 y
x $3
 3
 3
l $#
 #
 #
LK Kr   