@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/src/cognito-auth.test.ts

@@ -1,712 +0,0 @@
-/**
- * Unit tests for cognito-auth.ts — focus on the `expiresAt` shape contract.
- *
- * Canonical on-disk shape is epoch milliseconds (number). The reader also
- * tolerates ISO 8601 strings for backward compatibility with pre-migration
- * token files, and fails safe on anything unparseable.
- */
-
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-// Sandbox HOME *before* importing the module — it reads os.homedir() at load
-// time to compute the cache file path.
-let originalHome: string | undefined;
-let originalUserProfile: string | undefined;
-let tmpHome: string;
-
-beforeEach(() => {
-  originalHome = process.env.HOME;
-  originalUserProfile = process.env.USERPROFILE;
-  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "hq-cognito-auth-test-"));
-  process.env.HOME = tmpHome;
-  process.env.USERPROFILE = tmpHome;
-  vi.resetModules();
-});
-
-afterEach(() => {
-  if (originalHome === undefined) delete process.env.HOME;
-  else process.env.HOME = originalHome;
-  if (originalUserProfile === undefined) delete process.env.USERPROFILE;
-  else process.env.USERPROFILE = originalUserProfile;
-  fs.rmSync(tmpHome, { recursive: true, force: true });
-  vi.unstubAllGlobals();
-  vi.restoreAllMocks();
-});
-
-async function importModule() {
-  return await import("./cognito-auth.js");
-}
-
-const baseTokens = {
-  accessToken: "access",
-  idToken: "id",
-  refreshToken: "refresh",
-  tokenType: "Bearer" as const,
-};
-
-// ---------------------------------------------------------------------------
-// Reader: isExpiring accepts both shapes and fails safe
-// ---------------------------------------------------------------------------
-
-describe("isExpiring — expiresAt shape tolerance", () => {
-  it("returns false for ISO string far in the future", async () => {
-    const { isExpiring } = await importModule();
-    const future = new Date(Date.now() + 60 * 60 * 1000).toISOString();
-    expect(isExpiring({ ...baseTokens, expiresAt: future })).toBe(false);
-  });
-
-  it("returns true for ISO string within the buffer window", async () => {
-    const { isExpiring } = await importModule();
-    const soon = new Date(Date.now() + 10 * 1000).toISOString();
-    expect(isExpiring({ ...baseTokens, expiresAt: soon }, 60)).toBe(true);
-  });
-
-  it("returns false for raw number (ms) far in the future", async () => {
-    const { isExpiring } = await importModule();
-    const future = Date.now() + 60 * 60 * 1000;
-    // Cast because the type says string; the point is runtime tolerance.
-    expect(
-      isExpiring({ ...baseTokens, expiresAt: future as unknown as string }),
-    ).toBe(false);
-  });
-
-  it("returns true for raw number (ms) within the buffer window", async () => {
-    const { isExpiring } = await importModule();
-    const soon = Date.now() + 10 * 1000;
-    expect(
-      isExpiring(
-        { ...baseTokens, expiresAt: soon as unknown as string },
-        60,
-      ),
-    ).toBe(true);
-  });
-
-  it("fails safe (returns true) for malformed expiresAt", async () => {
-    const { isExpiring } = await importModule();
-    expect(
-      isExpiring({ ...baseTokens, expiresAt: "not a date" }),
-    ).toBe(true);
-    expect(
-      isExpiring({
-        ...baseTokens,
-        expiresAt: undefined as unknown as string,
-      }),
-    ).toBe(true);
-    expect(
-      isExpiring({
-        ...baseTokens,
-        expiresAt: Number.NaN as unknown as string,
-      }),
-    ).toBe(true);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Stale-pool detection — decodeAccessTokenClientId + getValidAccessToken
-// self-evicts cached tokens minted by a different App Client (e.g. dev pool
-// tokens left over from before the 2026-04-25 cutover).
-// ---------------------------------------------------------------------------
-
-/** Build a minimal unsigned JWT carrying the given claims. Cognito's real */
-/** tokens are RS256-signed; we don't verify here so the signature can be     */
-/** anything — only the base64url-encoded payload matters.                    */
-function makeAccessToken(claims: Record<string, unknown>): string {
-  const header = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" }))
-    .toString("base64")
-    .replace(/=+$/, "");
-  const payload = Buffer.from(JSON.stringify(claims))
-    .toString("base64")
-    .replace(/=+$/, "");
-  return `${header}.${payload}.signature`;
-}
-
-const DEV_CLIENT = "4mmujmjq3srakdueg656b9m0mp";
-const PROD_CLIENT = "7acei2c8v870enheptb1j5foln";
-
-const baseConfig = {
-  region: "us-east-1",
-  userPoolDomain: "vault-indigo-hq-prod",
-  clientId: PROD_CLIENT,
-};
-
-describe("decodeAccessTokenClientId", () => {
-  it("returns the client_id claim from a well-formed JWT", async () => {
-    const { decodeAccessTokenClientId } = await importModule();
-    const token = makeAccessToken({ client_id: DEV_CLIENT, sub: "abc" });
-    expect(decodeAccessTokenClientId(token)).toBe(DEV_CLIENT);
-  });
-
-  it("returns null when client_id is absent", async () => {
-    const { decodeAccessTokenClientId } = await importModule();
-    const token = makeAccessToken({ sub: "abc" });
-    expect(decodeAccessTokenClientId(token)).toBeNull();
-  });
-
-  it("returns null when the token has fewer than two segments", async () => {
-    const { decodeAccessTokenClientId } = await importModule();
-    expect(decodeAccessTokenClientId("not-a-jwt")).toBeNull();
-  });
-
-  it("returns null when the payload isn't valid JSON", async () => {
-    const { decodeAccessTokenClientId } = await importModule();
-    expect(decodeAccessTokenClientId("aaa.bbb.ccc")).toBeNull();
-  });
-});
-
-describe("getValidAccessToken stale-pool detection", () => {
-  it("evicts a cached token whose client_id mismatches the current config", async () => {
-    const { saveCachedTokens, loadCachedTokens, getValidAccessToken } =
-      await importModule();
-    const devToken = makeAccessToken({ client_id: DEV_CLIENT, sub: "abc" });
-    saveCachedTokens({
-      ...baseTokens,
-      accessToken: devToken,
-      expiresAt: Date.now() + 60 * 60 * 1000,
-    });
-    expect(loadCachedTokens()).not.toBeNull();
-
-    await expect(
-      getValidAccessToken(baseConfig, { interactive: false }),
-    ).rejects.toThrow(/No valid HQ session/);
-
-    expect(loadCachedTokens()).toBeNull();
-  });
-
-  it("keeps a cached token whose client_id matches", async () => {
-    const { saveCachedTokens, getValidAccessToken } = await importModule();
-    const prodToken = makeAccessToken({ client_id: PROD_CLIENT, sub: "abc" });
-    saveCachedTokens({
-      ...baseTokens,
-      accessToken: prodToken,
-      expiresAt: Date.now() + 60 * 60 * 1000,
-    });
-    const access = await getValidAccessToken(baseConfig, {
-      interactive: false,
-    });
-    expect(access).toBe(prodToken);
-  });
-
-  it("keeps a cached token when client_id can't be decoded (back-compat)", async () => {
-    const { saveCachedTokens, getValidAccessToken } = await importModule();
-    saveCachedTokens({
-      ...baseTokens,
-      accessToken: "opaque-non-jwt",
-      expiresAt: Date.now() + 60 * 60 * 1000,
-    });
-    const access = await getValidAccessToken(baseConfig, {
-      interactive: false,
-    });
-    expect(access).toBe("opaque-non-jwt");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Machine identity cache isolation — machine mode must not reuse human tokens
-// from the shared Cognito cache even when the app client matches.
-// ---------------------------------------------------------------------------
-
-describe("machine identity cache isolation", () => {
-  it("F06: machine mode re-mints instead of reusing a cached human token", async () => {
-    const { saveCachedTokens, getValidAccessToken } = await importModule();
-
-    const cachedHumanAccessToken = makeAccessToken({
-      token_use: "access",
-      client_id: PROD_CLIENT,
-      username: "human@example.com",
-      sub: "human-sub",
-    });
-    const cachedHumanIdToken = makeAccessToken({
-      token_use: "id",
-      aud: PROD_CLIENT,
-      email: "human@example.com",
-      "cognito:username": "human@example.com",
-      sub: "human-sub",
-    });
-    saveCachedTokens({
-      ...baseTokens,
-      accessToken: cachedHumanAccessToken,
-      idToken: cachedHumanIdToken,
-      expiresAt: Date.now() + 60 * 60 * 1000,
-    });
-
-    const machineUid = "agt_01JZ0000000000000000000000";
-    const machineCredsDir = path.join(tmpHome, ".hq-agent");
-    fs.mkdirSync(machineCredsDir, { recursive: true });
-    fs.writeFileSync(
-      path.join(machineCredsDir, "machine-creds.json"),
-      JSON.stringify({
-        username: "agt-01jz0000000000000000000000@agents.getindigo.ai",
-        secret: "machine-secret",
-        clientId: PROD_CLIENT,
-        region: "us-east-1",
-      }),
-    );
-
-    const mintedMachineAccessToken = makeAccessToken({
-      token_use: "access",
-      client_id: PROD_CLIENT,
-      username: "agt-01jz0000000000000000000000@agents.getindigo.ai",
-      sub: machineUid,
-    });
-    const mintedMachineIdToken = makeAccessToken({
-      token_use: "id",
-      aud: PROD_CLIENT,
-      "custom:entityType": "agent",
-      "custom:entityUid": machineUid,
-      "cognito:username": "agt-01jz0000000000000000000000@agents.getindigo.ai",
-      sub: machineUid,
-    });
-    const fetchMock = vi.fn(async () =>
-      new Response(
-        JSON.stringify({
-          AuthenticationResult: {
-            AccessToken: mintedMachineAccessToken,
-            IdToken: mintedMachineIdToken,
-            ExpiresIn: 3600,
-          },
-        }),
-        { status: 200, headers: { "Content-Type": "application/json" } },
-      ),
-    );
-    vi.stubGlobal("fetch", fetchMock);
-
-    await expect(
-      getValidAccessToken(baseConfig, { interactive: false }),
-    ).resolves.toBe(mintedMachineIdToken);
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Round-trip: writers emit epoch-ms, readers read epoch-ms
-// ---------------------------------------------------------------------------
-
-describe("expiresAt shape round-trip", () => {
-  it("saveCachedTokens + loadCachedTokens preserves epoch-ms number shape", async () => {
-    const { saveCachedTokens, loadCachedTokens } = await importModule();
-    const epochMs = Date.now() + 3600 * 1000;
-    saveCachedTokens({ ...baseTokens, expiresAt: epochMs });
-    const loaded = loadCachedTokens();
-    expect(loaded).not.toBeNull();
-    expect(typeof loaded?.expiresAt).toBe("number");
-    expect(loaded?.expiresAt).toBe(epochMs);
-  });
-
-  it("saveCachedTokens + loadCachedTokens tolerates legacy ISO string", async () => {
-    const { saveCachedTokens, loadCachedTokens } = await importModule();
-    const iso = new Date(Date.now() + 3600 * 1000).toISOString();
-    saveCachedTokens({ ...baseTokens, expiresAt: iso });
-    const loaded = loadCachedTokens();
-    expect(loaded).not.toBeNull();
-    expect(typeof loaded?.expiresAt).toBe("string");
-    expect(loaded?.expiresAt).toBe(iso);
-  });
-
-  it("refreshTokens writes epoch milliseconds to cache", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn(async () =>
-        new Response(
-          JSON.stringify({
-            access_token: "new-access",
-            id_token: "new-id",
-            refresh_token: "new-refresh",
-            expires_in: 3600,
-            token_type: "Bearer",
-          }),
-          { status: 200, headers: { "Content-Type": "application/json" } },
-        ),
-      ),
-    );
-
-    const { refreshTokens, loadCachedTokens } = await importModule();
-    const before = Date.now();
-    const result = await refreshTokens(
-      {
-        region: "us-east-1",
-        userPoolDomain: "vault-indigo-hq-dev",
-        clientId: "test-client",
-      },
-      "prior-refresh-token",
-    );
-    const after = Date.now();
-
-    expect(typeof result.expiresAt).toBe("number");
-    expect(result.expiresAt).toBeGreaterThanOrEqual(before + 3600 * 1000);
-    expect(result.expiresAt).toBeLessThanOrEqual(after + 3600 * 1000);
-
-    const onDisk = loadCachedTokens();
-    expect(onDisk?.expiresAt).toBe(result.expiresAt);
-    expect(typeof onDisk?.expiresAt).toBe("number");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Concurrency-safe token refresh (cross-process lock)
-//
-// Boxes run several hq processes (`hq auth refresh` on a timer, the sync runner,
-// replica-sync) that refresh the SAME cached session at once. Without
-// coordination they race on the shared cache; and if the app client issues
-// single-use (rotated) tokens, concurrent refreshers invalidate each other —
-// the first consumes the token, the second gets `invalid_grant`. These pin the
-// fix: a cross-process lock + a re-read of the freshest token inside the lock,
-// so refreshes serialize and a consumed token is never reused. (Rotation does
-// NOT reset the 30-day lifetime — see ADR-0009; durable never-log-out is per-box
-// machine identity, which reuses this same lock for its mint sequence.)
-// ---------------------------------------------------------------------------
-describe("refreshTokens — concurrency-safe refresh (cross-process lock)", () => {
-  const config = {
-    region: "us-east-1",
-    userPoolDomain: "vault-indigo-hq-dev",
-    clientId: "test-client",
-  };
-
-  // A minimal unsigned JWT carrying a client_id claim, so the cache's
-  // client-ownership check (decodeAccessTokenClientId) resolves in tests.
-  const jwtFor = (clientId: string, extra: Record<string, unknown> = {}) =>
-    "eyJhbGciOiJub25lIn0." +
-    Buffer.from(JSON.stringify({ client_id: clientId, ...extra })).toString(
-      "base64url",
-    ) +
-    ".sig";
-
-  // Models Cognito refresh-token ROTATION with single-use enforcement: a valid
-  // refresh mints a new token and consumes the old one; reusing a consumed
-  // token returns 400 invalid_grant (exactly what took the outposts offline).
-  function rotatingCognitoFetch(initialToken: string) {
-    let current = initialToken;
-    const consumed = new Set<string>();
-    let counter = 0;
-    return vi.fn(async (_url: string, init?: { body?: string }) => {
-      const sent = new URLSearchParams(init?.body ?? "").get("refresh_token") ?? "";
-      if (sent !== current || consumed.has(sent)) {
-        return new Response(JSON.stringify({ error: "invalid_grant" }), {
-          status: 400,
-          headers: { "Content-Type": "application/json" },
-        });
-      }
-      consumed.add(sent);
-      counter += 1;
-      current = `refresh-${counter}`;
-      return new Response(
-        JSON.stringify({
-          access_token: jwtFor("test-client", { n: counter }),
-          id_token: jwtFor("test-client", { n: counter }),
-          refresh_token: current,
-          expires_in: 3600,
-          token_type: "Bearer",
-        }),
-        { status: 200, headers: { "Content-Type": "application/json" } },
-      );
-    });
-  }
-
-  it("persists the rotated refresh token when Cognito returns one", async () => {
-    vi.stubGlobal("fetch", rotatingCognitoFetch("R0"));
-    const { refreshTokens, loadCachedTokens } = await importModule();
-    const result = await refreshTokens(config, "R0");
-    expect(result.refreshToken).toBe("refresh-1");
-    expect(loadCachedTokens()?.refreshToken).toBe("refresh-1");
-  });
-
-  it("serializes concurrent refreshers: ONE network refresh, neither gets invalid_grant", async () => {
-    const fetchMock = rotatingCognitoFetch("R0");
-    vi.stubGlobal("fetch", fetchMock);
-    const { refreshTokens, saveCachedTokens, loadCachedTokens } =
-      await importModule();
-    // Seed an EXPIRED session (for THIS client) so both callers attempt refresh.
-    saveCachedTokens({
-      ...baseTokens,
-      accessToken: jwtFor("test-client"),
-      refreshToken: "R0",
-      expiresAt: Date.now() - 1000,
-    });
-
-    // Two processes refresh the same expiring session at once. Without the lock
-    // both send "R0"; the second would hit the mock's invalid_grant and throw.
-    const [a, b] = await Promise.all([
-      refreshTokens(config, "R0"),
-      refreshTokens(config, "R0"),
-    ]);
-
-    // Neither threw; the network was hit exactly once (the waiter reused the
-    // winner's fresh token under the lock); both hold that same token.
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(a.refreshToken).toBe("refresh-1");
-    expect(b.refreshToken).toBe("refresh-1");
-    expect(a.accessToken).toBe(b.accessToken);
-    expect(loadCachedTokens()?.refreshToken).toBe("refresh-1");
-  });
-
-  it("reclaims a lock whose holder process has died (no deadlock)", async () => {
-    vi.stubGlobal("fetch", rotatingCognitoFetch("R0"));
-    const { refreshTokens } = await importModule();
-    // A crashed refresher left its lock behind, tagged with a pid that is not
-    // running — reclaimed by pid-liveness, not by an mtime heuristic.
-    const hqDir = path.join(tmpHome, ".hq");
-    fs.mkdirSync(hqDir, { recursive: true });
-    const lockPath = path.join(hqDir, "cognito-tokens.json.lock");
-    fs.writeFileSync(lockPath, "2147483646");
-
-    const result = await refreshTokens(config, "R0");
-    expect(result.refreshToken).toBe("refresh-1");
-    // Our own lock is released after the refresh completes (no leak).
-    expect(fs.existsSync(lockPath)).toBe(false);
-  });
-
-  it("does NOT reuse a cached session minted by a different app client", async () => {
-    const fetchMock = rotatingCognitoFetch("R-B");
-    vi.stubGlobal("fetch", fetchMock);
-    const { refreshTokens, saveCachedTokens } = await importModule();
-    // Cache holds a FRESH token, but for a DIFFERENT client.
-    saveCachedTokens({
-      ...baseTokens,
-      accessToken: jwtFor("other-client"),
-      refreshToken: "R-other",
-      expiresAt: Date.now() + 3600 * 1000,
-    });
-
-    // A caller for "test-client" must NOT be handed the other client's cached
-    // token; it must exchange the token it supplied.
-    const result = await refreshTokens(config, "R-B");
-    expect(fetchMock).toHaveBeenCalledTimes(1); // did not short-circuit on the wrong-client cache
-    expect(result.refreshToken).toBe("refresh-1");
-  });
-});
-
-describe("refresh expiry hardening", () => {
-  it("retries one transient refresh failure and preserves the refresh token", async () => {
-    const fetchMock = vi
-      .fn()
-      .mockResolvedValueOnce(
-        new Response(JSON.stringify({ message: "temporarily unavailable" }), {
-          status: 503,
-        }),
-      )
-      .mockResolvedValueOnce(
-        new Response(
-          JSON.stringify({
-            access_token: "fresh-access",
-            id_token: "fresh-id",
-            expires_in: 3600,
-            token_type: "Bearer",
-          }),
-          { status: 200, headers: { "Content-Type": "application/json" } },
-        ),
-      );
-    vi.stubGlobal("fetch", fetchMock);
-
-    const { refreshTokens } = await importModule();
-    const result = await refreshTokens(baseConfig, "preserved-refresh");
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(result.accessToken).toBe("fresh-access");
-    expect(result.refreshToken).toBe("preserved-refresh");
-  });
-
-  it("clears an expired refresh session after one 401 retry", async () => {
-    const fetchMock = vi.fn(async () =>
-      new Response(JSON.stringify({ message: "refresh token expired" }), {
-        status: 401,
-      }),
-    );
-    vi.stubGlobal("fetch", fetchMock);
-
-    const { saveCachedTokens, loadCachedTokens, getValidAccessToken } =
-      await importModule();
-    saveCachedTokens({ ...baseTokens, expiresAt: 0 });
-
-    await expect(
-      getValidAccessToken(baseConfig, { interactive: false }),
-    ).rejects.toThrow(/quick refresh/i);
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(loadCachedTokens()).toBeNull();
-  });
-
-  it("keeps the stored session after two transient network failures", async () => {
-    const fetchMock = vi.fn(async () => {
-      throw new Error("ECONNRESET");
-    });
-    vi.stubGlobal("fetch", fetchMock);
-
-    const { saveCachedTokens, loadCachedTokens, getValidAccessToken } =
-      await importModule();
-    saveCachedTokens({ ...baseTokens, expiresAt: 0 });
-
-    await expect(
-      getValidAccessToken(baseConfig, { interactive: false }),
-    ).rejects.toThrow(/ECONNRESET/);
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(loadCachedTokens()?.refreshToken).toBe("refresh");
-  });
-
-  it("does not invalidate a newer login when an older token fails late", async () => {
-    const {
-      accessTokenFingerprint,
-      invalidateCachedTokensByFingerprint,
-      loadCachedTokens,
-      saveCachedTokens,
-    } = await importModule();
-
-    saveCachedTokens({
-      ...baseTokens,
-      accessToken: "old-access",
-      expiresAt: Date.now() + 60_000,
-    });
-    const oldFingerprint = accessTokenFingerprint("old-access");
-
-    saveCachedTokens({
-      ...baseTokens,
-      accessToken: "new-access",
-      expiresAt: Date.now() + 60_000,
-    });
-    invalidateCachedTokensByFingerprint(oldFingerprint);
-
-    expect(loadCachedTokens()?.accessToken).toBe("new-access");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Machine mint identity binding under EMAIL-ALIAS pools (regression, 2026-07-20)
-//
-// The prod pool aliases email-format usernames: Cognito's canonical username
-// (`cognito:username` / access `username`) is a generated UUID equal to `sub`,
-// NEVER the email-format username the machine creds carry. The 6.14.13
-// predicate bound the ID token to creds via username equality only, so every
-// valid outpost/agent mint was rejected with "Machine token mint returned
-// tokens that do not match the requested machine identity" — a fleet-wide
-// sync outage on boxes. Claim shapes below mirror a real prod outpost token
-// (email claim ABSENT: the machine app client cannot read `email`, so Cognito
-// omits it from the ID token entirely).
-// ---------------------------------------------------------------------------
-
-describe("machine mint under email-alias pools (username is a UUID)", () => {
-  const MACHINE_CLIENT = "4q3bmth9ad4v3be6booc5td193";
-  const OUTPOST_UID = "out_01KXVRESJMP7TD263P7S0YHPSD";
-  const COGNITO_INTERNAL_SUB = "f4981438-a0a1-704c-542a-dfac148f2380";
-  const CREDS_USERNAME = "out-01kxvresjmp7td263p7s0yhpsd@outposts.hq.computer";
-
-  function writeOutpostCreds(overrides: Record<string, unknown> = {}) {
-    const dir = path.join(tmpHome, ".hq-agent");
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(
-      path.join(dir, "machine-creds.json"),
-      JSON.stringify({
-        username: CREDS_USERNAME,
-        secret: "machine-secret",
-        clientId: MACHINE_CLIENT,
-        region: "us-east-1",
-        entityType: "outpost",
-        entityUid: OUTPOST_UID,
-        ...overrides,
-      }),
-    );
-  }
-
-  function mintResponse(accessClaims: Record<string, unknown>, idClaims: Record<string, unknown>) {
-    return vi.fn(async () =>
-      new Response(
-        JSON.stringify({
-          AuthenticationResult: {
-            AccessToken: makeAccessToken(accessClaims),
-            IdToken: makeAccessToken(idClaims),
-            ExpiresIn: 3600,
-          },
-        }),
-        { status: 200, headers: { "Content-Type": "application/json" } },
-      ),
-    );
-  }
-
-  it("accepts a valid outpost mint whose cognito:username is the internal UUID (alias pool)", async () => {
-    const { getValidAccessToken } = await importModule();
-    writeOutpostCreds();
-    const fetchMock = mintResponse(
-      {
-        token_use: "access",
-        client_id: MACHINE_CLIENT,
-        // Alias pool: access username is the internal UUID, not the email-format name.
-        username: COGNITO_INTERNAL_SUB,
-        sub: COGNITO_INTERNAL_SUB,
-      },
-      {
-        token_use: "id",
-        aud: MACHINE_CLIENT,
-        "cognito:username": COGNITO_INTERNAL_SUB,
-        sub: COGNITO_INTERNAL_SUB,
-        // email claim intentionally ABSENT (client cannot read `email`).
-        "custom:entityType": "outpost",
-        "custom:entityUid": OUTPOST_UID,
-        "custom:delegatedSub": "24785418-c071-7077-b7e9-0b1b583cfba1",
-        "custom:delegatedEmail": "hassaan@getindigo.ai",
-      },
-    );
-    vi.stubGlobal("fetch", fetchMock);
-
-    await expect(
-      getValidAccessToken(baseConfig, { interactive: false }),
-    ).resolves.toBeTypeOf("string");
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-  });
-
-  it("still rejects a mint whose entityUid does not match the requested creds", async () => {
-    const { getValidAccessToken } = await importModule();
-    writeOutpostCreds();
-    const fetchMock = mintResponse(
-      {
-        token_use: "access",
-        client_id: MACHINE_CLIENT,
-        username: COGNITO_INTERNAL_SUB,
-        sub: COGNITO_INTERNAL_SUB,
-      },
-      {
-        token_use: "id",
-        aud: MACHINE_CLIENT,
-        "cognito:username": COGNITO_INTERNAL_SUB,
-        sub: COGNITO_INTERNAL_SUB,
-        "custom:entityType": "outpost",
-        // A DIFFERENT machine's uid — identity binding must refuse it.
-        "custom:entityUid": "out_01KX0000000000000000000000",
-        "custom:delegatedSub": "24785418-c071-7077-b7e9-0b1b583cfba1",
-        "custom:delegatedEmail": "hassaan@getindigo.ai",
-      },
-    );
-    vi.stubGlobal("fetch", fetchMock);
-
-    await expect(
-      getValidAccessToken(baseConfig, { interactive: false }),
-    ).rejects.toThrow(/do not match the requested machine identity/);
-  });
-
-  it("still rejects legacy creds (no entityUid) when the username binding fails", async () => {
-    const { getValidAccessToken } = await importModule();
-    // Legacy agent creds: no entityType/entityUid persisted.
-    writeOutpostCreds({ entityType: undefined, entityUid: undefined, username: "agt-legacy@agents.getindigo.ai" });
-    const fetchMock = mintResponse(
-      {
-        token_use: "access",
-        client_id: MACHINE_CLIENT,
-        username: "someone-else",
-        sub: "someone-else",
-      },
-      {
-        token_use: "id",
-        aud: MACHINE_CLIENT,
-        "cognito:username": "someone-else",
-        sub: "someone-else",
-        "custom:entityType": "agent",
-        "custom:entityUid": "agt_01JZ9999999999999999999999",
-      },
-    );
-    vi.stubGlobal("fetch", fetchMock);
-
-    await expect(
-      getValidAccessToken(baseConfig, { interactive: false }),
-    ).rejects.toThrow(/do not match the requested machine identity/);
-  });
-});