@indigoai-us/hq-cloud 6.18.44-alpha.8 → 6.18.44

package/dist/cognito-auth.test.js

@@ -1,745 +0,0 @@
-/**
- * Unit tests for cognito-auth.ts — focus on the `expiresAt` shape contract.
- *
- * Canonical on-disk shape is epoch milliseconds (number). The reader also
- * tolerates ISO 8601 strings for backward compatibility with pre-migration
- * token files, and fails safe on anything unparseable.
- */
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-// Sandbox HOME *before* importing the module — it reads os.homedir() at load
-// time to compute the cache file path.
-let originalHome;
-let originalUserProfile;
-let originalStateDir;
-let originalMachineCredsFile;
-let tmpHome;
-beforeEach(() => {
-    originalHome = process.env.HOME;
-    originalUserProfile = process.env.USERPROFILE;
-    originalStateDir = process.env.HQ_STATE_DIR;
-    originalMachineCredsFile = process.env.HQ_MACHINE_CREDS_FILE;
-    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "hq-cognito-auth-test-"));
-    process.env.HOME = tmpHome;
-    process.env.USERPROFILE = tmpHome;
-    // This suite verifies the fallback token cache and machine-creds paths under
-    // its HOME sandbox, rather than the setup file's hermetic defaults.
-    delete process.env.HQ_STATE_DIR;
-    delete process.env.HQ_MACHINE_CREDS_FILE;
-    vi.resetModules();
-});
-afterEach(() => {
-    vi.useRealTimers();
-    if (originalHome === undefined)
-        delete process.env.HOME;
-    else
-        process.env.HOME = originalHome;
-    if (originalUserProfile === undefined)
-        delete process.env.USERPROFILE;
-    else
-        process.env.USERPROFILE = originalUserProfile;
-    if (originalStateDir === undefined)
-        delete process.env.HQ_STATE_DIR;
-    else
-        process.env.HQ_STATE_DIR = originalStateDir;
-    if (originalMachineCredsFile === undefined)
-        delete process.env.HQ_MACHINE_CREDS_FILE;
-    else
-        process.env.HQ_MACHINE_CREDS_FILE = originalMachineCredsFile;
-    fs.rmSync(tmpHome, { recursive: true, force: true });
-    vi.unstubAllGlobals();
-    vi.restoreAllMocks();
-});
-async function importModule() {
-    return await import("./cognito-auth.js");
-}
-const baseTokens = {
-    accessToken: "access",
-    idToken: "id",
-    refreshToken: "refresh",
-    tokenType: "Bearer",
-};
-// ---------------------------------------------------------------------------
-// Reader: isExpiring accepts both shapes and fails safe
-// ---------------------------------------------------------------------------
-describe("isExpiring — expiresAt shape tolerance", () => {
-    it("returns false for ISO string far in the future", async () => {
-        const { isExpiring } = await importModule();
-        const future = new Date(Date.now() + 60 * 60 * 1000).toISOString();
-        expect(isExpiring({ ...baseTokens, expiresAt: future })).toBe(false);
-    });
-    it("returns true for ISO string within the buffer window", async () => {
-        const { isExpiring } = await importModule();
-        const soon = new Date(Date.now() + 10 * 1000).toISOString();
-        expect(isExpiring({ ...baseTokens, expiresAt: soon }, 60)).toBe(true);
-    });
-    it("returns false for raw number (ms) far in the future", async () => {
-        const { isExpiring } = await importModule();
-        const future = Date.now() + 60 * 60 * 1000;
-        // Cast because the type says string; the point is runtime tolerance.
-        expect(isExpiring({ ...baseTokens, expiresAt: future })).toBe(false);
-    });
-    it("returns true for raw number (ms) within the buffer window", async () => {
-        const { isExpiring } = await importModule();
-        const soon = Date.now() + 10 * 1000;
-        expect(isExpiring({ ...baseTokens, expiresAt: soon }, 60)).toBe(true);
-    });
-    it("fails safe (returns true) for malformed expiresAt", async () => {
-        const { isExpiring } = await importModule();
-        expect(isExpiring({ ...baseTokens, expiresAt: "not a date" })).toBe(true);
-        expect(isExpiring({
-            ...baseTokens,
-            expiresAt: undefined,
-        })).toBe(true);
-        expect(isExpiring({
-            ...baseTokens,
-            expiresAt: Number.NaN,
-        })).toBe(true);
-    });
-});
-// ---------------------------------------------------------------------------
-// Stale-pool detection — decodeAccessTokenClientId + getValidAccessToken
-// self-evicts cached tokens minted by a different App Client (e.g. dev pool
-// tokens left over from before the 2026-04-25 cutover).
-// ---------------------------------------------------------------------------
-/** Build a minimal unsigned JWT carrying the given claims. Cognito's real */
-/** tokens are RS256-signed; we don't verify here so the signature can be     */
-/** anything — only the base64url-encoded payload matters.                    */
-function makeAccessToken(claims) {
-    const header = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" }))
-        .toString("base64")
-        .replace(/=+$/, "");
-    const payload = Buffer.from(JSON.stringify(claims))
-        .toString("base64")
-        .replace(/=+$/, "");
-    return `${header}.${payload}.signature`;
-}
-const DEV_CLIENT = "4mmujmjq3srakdueg656b9m0mp";
-const PROD_CLIENT = "7acei2c8v870enheptb1j5foln";
-const baseConfig = {
-    region: "us-east-1",
-    userPoolDomain: "vault-indigo-hq-prod",
-    clientId: PROD_CLIENT,
-};
-describe("decodeAccessTokenClientId", () => {
-    it("returns the client_id claim from a well-formed JWT", async () => {
-        const { decodeAccessTokenClientId } = await importModule();
-        const token = makeAccessToken({ client_id: DEV_CLIENT, sub: "abc" });
-        expect(decodeAccessTokenClientId(token)).toBe(DEV_CLIENT);
-    });
-    it("returns null when client_id is absent", async () => {
-        const { decodeAccessTokenClientId } = await importModule();
-        const token = makeAccessToken({ sub: "abc" });
-        expect(decodeAccessTokenClientId(token)).toBeNull();
-    });
-    it("returns null when the token has fewer than two segments", async () => {
-        const { decodeAccessTokenClientId } = await importModule();
-        expect(decodeAccessTokenClientId("not-a-jwt")).toBeNull();
-    });
-    it("returns null when the payload isn't valid JSON", async () => {
-        const { decodeAccessTokenClientId } = await importModule();
-        expect(decodeAccessTokenClientId("aaa.bbb.ccc")).toBeNull();
-    });
-});
-describe("getValidAccessToken stale-pool detection", () => {
-    it("evicts a cached token whose client_id mismatches the current config", async () => {
-        const { saveCachedTokens, loadCachedTokens, getValidAccessToken } = await importModule();
-        const devToken = makeAccessToken({ client_id: DEV_CLIENT, sub: "abc" });
-        saveCachedTokens({
-            ...baseTokens,
-            accessToken: devToken,
-            expiresAt: Date.now() + 60 * 60 * 1000,
-        });
-        expect(loadCachedTokens()).not.toBeNull();
-        await expect(getValidAccessToken(baseConfig, { interactive: false })).rejects.toThrow(/No valid HQ session/);
-        expect(loadCachedTokens()).toBeNull();
-    });
-    it("keeps a cached token whose client_id matches", async () => {
-        const { saveCachedTokens, getValidAccessToken } = await importModule();
-        const prodToken = makeAccessToken({ client_id: PROD_CLIENT, sub: "abc" });
-        saveCachedTokens({
-            ...baseTokens,
-            accessToken: prodToken,
-            expiresAt: Date.now() + 60 * 60 * 1000,
-        });
-        const access = await getValidAccessToken(baseConfig, {
-            interactive: false,
-        });
-        expect(access).toBe(prodToken);
-    });
-    it("keeps a cached token when client_id can't be decoded (back-compat)", async () => {
-        const { saveCachedTokens, getValidAccessToken } = await importModule();
-        saveCachedTokens({
-            ...baseTokens,
-            accessToken: "opaque-non-jwt",
-            expiresAt: Date.now() + 60 * 60 * 1000,
-        });
-        const access = await getValidAccessToken(baseConfig, {
-            interactive: false,
-        });
-        expect(access).toBe("opaque-non-jwt");
-    });
-});
-// ---------------------------------------------------------------------------
-// Machine identity cache isolation — machine mode must not reuse human tokens
-// from the shared Cognito cache even when the app client matches.
-// ---------------------------------------------------------------------------
-describe("machine identity cache isolation", () => {
-    it("F06: machine mode re-mints instead of reusing a cached human token", async () => {
-        const { saveCachedTokens, getValidAccessToken } = await importModule();
-        const cachedHumanAccessToken = makeAccessToken({
-            token_use: "access",
-            client_id: PROD_CLIENT,
-            username: "human@example.com",
-            sub: "human-sub",
-        });
-        const cachedHumanIdToken = makeAccessToken({
-            token_use: "id",
-            aud: PROD_CLIENT,
-            email: "human@example.com",
-            "cognito:username": "human@example.com",
-            sub: "human-sub",
-        });
-        saveCachedTokens({
-            ...baseTokens,
-            accessToken: cachedHumanAccessToken,
-            idToken: cachedHumanIdToken,
-            expiresAt: Date.now() + 60 * 60 * 1000,
-        });
-        const machineUid = "agt_01JZ0000000000000000000000";
-        const machineCredsDir = path.join(tmpHome, ".hq-agent");
-        fs.mkdirSync(machineCredsDir, { recursive: true });
-        fs.writeFileSync(path.join(machineCredsDir, "machine-creds.json"), JSON.stringify({
-            username: "agt-01jz0000000000000000000000@agents.getindigo.ai",
-            secret: "machine-secret",
-            clientId: PROD_CLIENT,
-            region: "us-east-1",
-        }));
-        const mintedMachineAccessToken = makeAccessToken({
-            token_use: "access",
-            client_id: PROD_CLIENT,
-            username: "agt-01jz0000000000000000000000@agents.getindigo.ai",
-            sub: machineUid,
-        });
-        const mintedMachineIdToken = makeAccessToken({
-            token_use: "id",
-            aud: PROD_CLIENT,
-            "custom:entityType": "agent",
-            "custom:entityUid": machineUid,
-            "cognito:username": "agt-01jz0000000000000000000000@agents.getindigo.ai",
-            sub: machineUid,
-        });
-        const fetchMock = vi.fn(async () => new Response(JSON.stringify({
-            AuthenticationResult: {
-                AccessToken: mintedMachineAccessToken,
-                IdToken: mintedMachineIdToken,
-                ExpiresIn: 3600,
-            },
-        }), { status: 200, headers: { "Content-Type": "application/json" } }));
-        vi.stubGlobal("fetch", fetchMock);
-        await expect(getValidAccessToken(baseConfig, { interactive: false })).resolves.toBe(mintedMachineIdToken);
-        expect(fetchMock).toHaveBeenCalledTimes(1);
-    });
-});
-// ---------------------------------------------------------------------------
-// Round-trip: writers emit epoch-ms, readers read epoch-ms
-// ---------------------------------------------------------------------------
-describe("expiresAt shape round-trip", () => {
-    it("saveCachedTokens + loadCachedTokens preserves epoch-ms number shape", async () => {
-        const { saveCachedTokens, loadCachedTokens } = await importModule();
-        const epochMs = Date.now() + 3600 * 1000;
-        saveCachedTokens({ ...baseTokens, expiresAt: epochMs });
-        const loaded = loadCachedTokens();
-        expect(loaded).not.toBeNull();
-        expect(typeof loaded?.expiresAt).toBe("number");
-        expect(loaded?.expiresAt).toBe(epochMs);
-    });
-    it("saveCachedTokens + loadCachedTokens tolerates legacy ISO string", async () => {
-        const { saveCachedTokens, loadCachedTokens } = await importModule();
-        const iso = new Date(Date.now() + 3600 * 1000).toISOString();
-        saveCachedTokens({ ...baseTokens, expiresAt: iso });
-        const loaded = loadCachedTokens();
-        expect(loaded).not.toBeNull();
-        expect(typeof loaded?.expiresAt).toBe("string");
-        expect(loaded?.expiresAt).toBe(iso);
-    });
-    it("refreshTokens writes epoch milliseconds to cache", async () => {
-        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({
-            access_token: "new-access",
-            id_token: "new-id",
-            refresh_token: "new-refresh",
-            expires_in: 3600,
-            token_type: "Bearer",
-        }), { status: 200, headers: { "Content-Type": "application/json" } })));
-        const { refreshTokens, loadCachedTokens } = await importModule();
-        const before = Date.now();
-        const result = await refreshTokens({
-            region: "us-east-1",
-            userPoolDomain: "vault-indigo-hq-dev",
-            clientId: "test-client",
-        }, "prior-refresh-token");
-        const after = Date.now();
-        expect(typeof result.expiresAt).toBe("number");
-        expect(result.expiresAt).toBeGreaterThanOrEqual(before + 3600 * 1000);
-        expect(result.expiresAt).toBeLessThanOrEqual(after + 3600 * 1000);
-        const onDisk = loadCachedTokens();
-        expect(onDisk?.expiresAt).toBe(result.expiresAt);
-        expect(typeof onDisk?.expiresAt).toBe("number");
-    });
-});
-// ---------------------------------------------------------------------------
-// Concurrency-safe token refresh (cross-process lock)
-//
-// Boxes run several hq processes (`hq auth refresh` on a timer, the sync runner,
-// replica-sync) that refresh the SAME cached session at once. Without
-// coordination they race on the shared cache; and if the app client issues
-// single-use (rotated) tokens, concurrent refreshers invalidate each other —
-// the first consumes the token, the second gets `invalid_grant`. These pin the
-// fix: a cross-process lock + a re-read of the freshest token inside the lock,
-// so refreshes serialize and a consumed token is never reused. (Rotation does
-// NOT reset the 30-day lifetime — see ADR-0009; durable never-log-out is per-box
-// machine identity, which reuses this same lock for its mint sequence.)
-// ---------------------------------------------------------------------------
-describe("refreshTokens — concurrency-safe refresh (cross-process lock)", () => {
-    const config = {
-        region: "us-east-1",
-        userPoolDomain: "vault-indigo-hq-dev",
-        clientId: "test-client",
-    };
-    // A minimal unsigned JWT carrying a client_id claim, so the cache's
-    // client-ownership check (decodeAccessTokenClientId) resolves in tests.
-    const jwtFor = (clientId, extra = {}) => "eyJhbGciOiJub25lIn0." +
-        Buffer.from(JSON.stringify({ client_id: clientId, ...extra })).toString("base64url") +
-        ".sig";
-    // Models Cognito refresh-token ROTATION with single-use enforcement: a valid
-    // refresh mints a new token and consumes the old one; reusing a consumed
-    // token returns 400 invalid_grant (exactly what took the outposts offline).
-    function rotatingCognitoFetch(initialToken) {
-        let current = initialToken;
-        const consumed = new Set();
-        let counter = 0;
-        return vi.fn(async (_url, init) => {
-            const sent = new URLSearchParams(init?.body ?? "").get("refresh_token") ?? "";
-            if (sent !== current || consumed.has(sent)) {
-                return new Response(JSON.stringify({ error: "invalid_grant" }), {
-                    status: 400,
-                    headers: { "Content-Type": "application/json" },
-                });
-            }
-            consumed.add(sent);
-            counter += 1;
-            current = `refresh-${counter}`;
-            return new Response(JSON.stringify({
-                access_token: jwtFor("test-client", { n: counter }),
-                id_token: jwtFor("test-client", { n: counter }),
-                refresh_token: current,
-                expires_in: 3600,
-                token_type: "Bearer",
-            }), { status: 200, headers: { "Content-Type": "application/json" } });
-        });
-    }
-    it("persists the rotated refresh token when Cognito returns one", async () => {
-        vi.stubGlobal("fetch", rotatingCognitoFetch("R0"));
-        const { refreshTokens, loadCachedTokens } = await importModule();
-        const result = await refreshTokens(config, "R0");
-        expect(result.refreshToken).toBe("refresh-1");
-        expect(loadCachedTokens()?.refreshToken).toBe("refresh-1");
-    });
-    it("serializes concurrent refreshers: ONE network refresh, neither gets invalid_grant", async () => {
-        const fetchMock = rotatingCognitoFetch("R0");
-        vi.stubGlobal("fetch", fetchMock);
-        const { refreshTokens, saveCachedTokens, loadCachedTokens } = await importModule();
-        // Seed an EXPIRED session (for THIS client) so both callers attempt refresh.
-        saveCachedTokens({
-            ...baseTokens,
-            accessToken: jwtFor("test-client"),
-            refreshToken: "R0",
-            expiresAt: Date.now() - 1000,
-        });
-        // Two processes refresh the same expiring session at once. Without the lock
-        // both send "R0"; the second would hit the mock's invalid_grant and throw.
-        const [a, b] = await Promise.all([
-            refreshTokens(config, "R0"),
-            refreshTokens(config, "R0"),
-        ]);
-        // Neither threw; the network was hit exactly once (the waiter reused the
-        // winner's fresh token under the lock); both hold that same token.
-        expect(fetchMock).toHaveBeenCalledTimes(1);
-        expect(a.refreshToken).toBe("refresh-1");
-        expect(b.refreshToken).toBe("refresh-1");
-        expect(a.accessToken).toBe(b.accessToken);
-        expect(loadCachedTokens()?.refreshToken).toBe("refresh-1");
-    });
-    it("reclaims a lock whose holder process has died (no deadlock)", async () => {
-        vi.stubGlobal("fetch", rotatingCognitoFetch("R0"));
-        const { refreshTokens } = await importModule();
-        // A crashed refresher left its lock behind, tagged with a pid that is not
-        // running — reclaimed by pid-liveness, not by an mtime heuristic.
-        const hqDir = path.join(tmpHome, ".hq");
-        fs.mkdirSync(hqDir, { recursive: true });
-        const lockPath = path.join(hqDir, "cognito-tokens.json.lock");
-        fs.writeFileSync(lockPath, "2147483646");
-        const result = await refreshTokens(config, "R0");
-        expect(result.refreshToken).toBe("refresh-1");
-        // Our own lock is released after the refresh completes (no leak).
-        expect(fs.existsSync(lockPath)).toBe(false);
-    });
-    it("does NOT reuse a cached session minted by a different app client", async () => {
-        const fetchMock = rotatingCognitoFetch("R-B");
-        vi.stubGlobal("fetch", fetchMock);
-        const { refreshTokens, saveCachedTokens } = await importModule();
-        // Cache holds a FRESH token, but for a DIFFERENT client.
-        saveCachedTokens({
-            ...baseTokens,
-            accessToken: jwtFor("other-client"),
-            refreshToken: "R-other",
-            expiresAt: Date.now() + 3600 * 1000,
-        });
-        // A caller for "test-client" must NOT be handed the other client's cached
-        // token; it must exchange the token it supplied.
-        const result = await refreshTokens(config, "R-B");
-        expect(fetchMock).toHaveBeenCalledTimes(1); // did not short-circuit on the wrong-client cache
-        expect(result.refreshToken).toBe("refresh-1");
-    });
-    it.each([
-        ["invalid_grant", "invalid_grant"],
-        ["invalid_client", "invalid_client"],
-        ["unauthorized_client", "unauthorized_client"],
-        ["invalid_request", "invalid_request"],
-        ["invalid_scope", "invalid_scope"],
-        ["NotAuthorizedException", "NotAuthorizedException"],
-        ["provider-secret-message", "other"],
-        [undefined, "unknown"],
-    ])("returns a closed OAuth error class for %s", async (oauthError, expected) => {
-        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ error: oauthError, description: "private detail" }), {
-            status: 400,
-            headers: { "Content-Type": "application/json" },
-        })));
-        const { refreshTokens } = await importModule();
-        const caught = await refreshTokens(config, "caller-refresh").catch((error) => error);
-        expect(caught).toMatchObject({
-            name: "CognitoRefreshError",
-            oauthError: expected,
-            refreshGeneration: "caller_snapshot",
-        });
-        expect(caught.message).not.toContain("private detail");
-        expect(caught.message).not.toContain("provider-secret-message");
-        expect(JSON.stringify(caught)).not.toContain("private detail");
-        expect(JSON.stringify(caught)).not.toContain("provider-secret-message");
-    });
-    it("labels a rejected refresh that used the matching cache re-read", async () => {
-        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({ error: "invalid_client" }), {
-            status: 400,
-            headers: { "Content-Type": "application/json" },
-        })));
-        const { refreshTokens, saveCachedTokens } = await importModule();
-        saveCachedTokens({
-            ...baseTokens,
-            accessToken: jwtFor("test-client"),
-            refreshToken: "cache-refresh",
-            expiresAt: 0,
-        });
-        const caught = await refreshTokens(config, "caller-refresh").catch((error) => error);
-        expect(caught).toMatchObject({
-            name: "CognitoRefreshError",
-            oauthError: "invalid_client",
-            refreshGeneration: "cache_reloaded",
-        });
-    });
-});
-describe("refresh expiry hardening", () => {
-    it("retries one transient refresh failure and preserves the refresh token", async () => {
-        const fetchMock = vi
-            .fn()
-            .mockResolvedValueOnce(new Response(JSON.stringify({ message: "temporarily unavailable" }), {
-            status: 503,
-        }))
-            .mockResolvedValueOnce(new Response(JSON.stringify({
-            access_token: "fresh-access",
-            id_token: "fresh-id",
-            expires_in: 3600,
-            token_type: "Bearer",
-        }), { status: 200, headers: { "Content-Type": "application/json" } }));
-        vi.stubGlobal("fetch", fetchMock);
-        const { refreshTokens } = await importModule();
-        const result = await refreshTokens(baseConfig, "preserved-refresh");
-        expect(fetchMock).toHaveBeenCalledTimes(2);
-        expect(result.accessToken).toBe("fresh-access");
-        expect(result.refreshToken).toBe("preserved-refresh");
-    });
-    it("clears an expired refresh session after one 401 retry", async () => {
-        const fetchMock = vi.fn(async () => new Response(JSON.stringify({ message: "refresh token expired" }), {
-            status: 401,
-        }));
-        vi.stubGlobal("fetch", fetchMock);
-        const { saveCachedTokens, loadCachedTokens, getValidAccessToken } = await importModule();
-        saveCachedTokens({ ...baseTokens, expiresAt: 0 });
-        await expect(getValidAccessToken(baseConfig, { interactive: false })).rejects.toThrow(/quick refresh/i);
-        expect(fetchMock).toHaveBeenCalledTimes(2);
-        expect(loadCachedTokens()).toBeNull();
-    });
-    it("keeps the stored session after two transient network failures", async () => {
-        vi.useFakeTimers();
-        const fetchMock = vi.fn(async () => {
-            throw new Error("ECONNRESET");
-        });
-        vi.stubGlobal("fetch", fetchMock);
-        const { saveCachedTokens, loadCachedTokens, getValidAccessToken } = await importModule();
-        saveCachedTokens({ ...baseTokens, expiresAt: 0 });
-        const refresh = getValidAccessToken(baseConfig, { interactive: false });
-        const result = refresh.then(() => ({ error: null }), (error) => ({ error }));
-        await vi.advanceTimersByTimeAsync(99);
-        expect(fetchMock).toHaveBeenCalledTimes(1);
-        await vi.advanceTimersByTimeAsync(1);
-        expect((await result).error).toMatchObject({ message: expect.stringMatching(/ECONNRESET/) });
-        expect(fetchMock).toHaveBeenCalledTimes(2);
-        expect(loadCachedTokens()?.refreshToken).toBe("refresh");
-        vi.useRealTimers();
-    });
-    it("does not invalidate a newer login when an older token fails late", async () => {
-        const { accessTokenFingerprint, invalidateCachedTokensByFingerprint, loadCachedTokens, saveCachedTokens, } = await importModule();
-        saveCachedTokens({
-            ...baseTokens,
-            accessToken: "old-access",
-            expiresAt: Date.now() + 60_000,
-        });
-        const oldFingerprint = accessTokenFingerprint("old-access");
-        saveCachedTokens({
-            ...baseTokens,
-            accessToken: "new-access",
-            expiresAt: Date.now() + 60_000,
-        });
-        invalidateCachedTokensByFingerprint(oldFingerprint);
-        expect(loadCachedTokens()?.accessToken).toBe("new-access");
-    });
-});
-// ---------------------------------------------------------------------------
-describe("refresh rejection diagnostics", () => {
-    it.each([400, 401])("keeps the cached session and parks invalid_client from HTTP %i without a marker or quick retry", async (status) => {
-        const fetchMock = vi.fn(async () => new Response(JSON.stringify({ error: "invalid_client" }), { status }));
-        vi.stubGlobal("fetch", fetchMock);
-        const { getValidAccessToken, loadCachedTokens, saveCachedTokens, accessTokenFingerprint } = await importModule();
-        const tokens = {
-            ...baseTokens,
-            accessToken: makeAccessToken({ client_id: PROD_CLIENT }),
-            refreshToken: "invalid-client-refresh",
-            expiresAt: Date.now() - 1,
-        };
-        saveCachedTokens(tokens);
-        const result = await getValidAccessToken(baseConfig, { interactive: false }).catch((error) => error);
-        expect(result).toMatchObject({ requiresReauth: false, oauthError: "invalid_client" });
-        expect(loadCachedTokens()).toEqual(tokens);
-        const marker = path.join(tmpHome, ".hq", `cognito-tokens.json.invalid.${accessTokenFingerprint(tokens.accessToken)}`);
-        expect(fs.existsSync(marker)).toBe(false);
-        await getValidAccessToken(baseConfig, { interactive: false }).catch(() => undefined);
-        expect(fetchMock).toHaveBeenCalledTimes(1);
-    });
-    it.each([
-        [401, { error: "unknown_code" }, true, 2],
-        [401, { error: "invalid_client" }, false, 1],
-        [400, { error: "invalid_client" }, false, 1],
-        [400, { error: "invalid_grant" }, true, 1],
-        [400, { __type: "NotAuthorizedException" }, true, 1],
-        [400, { error: "unauthorized_client" }, false, 2],
-        [400, { error: "unknown_code" }, false, 2],
-        [400, {}, false, 2],
-        [403, { __type: "ForbiddenException" }, false, 2],
-        [400, { __type: "TooManyRequestsException" }, false, 2],
-        [400, { __type: "InternalErrorException" }, false, 2],
-        [500, { __type: "InternalErrorException" }, false, 2],
-    ])("classifies status %i and Cognito payload as reauth=%s", async (status, payload, reauth, attempts) => {
-        const fetchMock = vi.fn(async () => new Response(JSON.stringify(payload), { status }));
-        vi.stubGlobal("fetch", fetchMock);
-        const { refreshTokens } = await importModule();
-        await expect(refreshTokens(baseConfig, "refresh-secret")).rejects.toMatchObject({ requiresReauth: reauth });
-        expect(fetchMock).toHaveBeenCalledTimes(attempts);
-    });
-    it("retries malformed and service errors but rejects only invalid refresh grants", async () => {
-        const fetchMock = vi.fn(async () => new Response(JSON.stringify({ error: "invalid_request", error_description: "malformed request" }), { status: 400 }));
-        vi.stubGlobal("fetch", fetchMock);
-        const { refreshTokens } = await importModule();
-        await expect(refreshTokens({ region: "us-east-1", userPoolDomain: "test", clientId: "test" }, "refresh-secret")).rejects.toMatchObject({ statusCode: 400, requiresReauth: false, oauthError: "invalid_request" });
-        expect(fetchMock).toHaveBeenCalledTimes(2);
-    });
-    it("records the Cognito refusal code in the invalidation marker", async () => {
-        const { accessTokenFingerprint, invalidateCachedTokensByFingerprint } = await importModule();
-        const accessToken = "access-generation-for-marker";
-        const fingerprint = accessTokenFingerprint(accessToken);
-        invalidateCachedTokensByFingerprint(fingerprint, "NotAuthorizedException");
-        const marker = path.join(tmpHome, ".hq", `cognito-tokens.json.invalid.${fingerprint}`);
-        expect(fs.readFileSync(marker, "utf8")).toBe("refresh-rejected:NotAuthorizedException");
-    });
-    it("logs status and Cognito code without token, email, or identifier material", async () => {
-        const warn = vi.spyOn(console, "warn").mockImplementation(() => { });
-        vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({
-            error: "invalid_grant",
-            error_description: "refresh_token=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhYmMiLCJlbWFpbCI6ImFsaWNlQGV4YW1wbGUuY29tIn0.signature user_id=12345678-1234-1234-1234-123456789012",
-        }), { status: 400 })));
-        const { refreshTokens } = await importModule();
-        await expect(refreshTokens({ region: "us-east-1", userPoolDomain: "test", clientId: "test" }, "refresh-secret", "access-secret")).rejects.toMatchObject({ statusCode: 400, oauthError: "invalid_grant" });
-        const logged = JSON.stringify(warn.mock.calls);
-        expect(warn).toHaveBeenCalledWith("Cognito refresh failed", expect.objectContaining({
-            status: 400,
-            code: "invalid_grant",
-        }));
-        expect(logged).not.toMatch(/eyJhbGci|alice@example\.com|12345678-1234-1234-1234-123456789012|refresh-secret|access-secret/);
-    });
-});
-// Machine mint identity binding under EMAIL-ALIAS pools (regression, 2026-07-20)
-//
-// The prod pool aliases email-format usernames: Cognito's canonical username
-// (`cognito:username` / access `username`) is a generated UUID equal to `sub`,
-// NEVER the email-format username the machine creds carry. The 6.14.13
-// predicate bound the ID token to creds via username equality only, so every
-// valid outpost/agent mint was rejected with "Machine token mint returned
-// tokens that do not match the requested machine identity" — a fleet-wide
-// sync outage on boxes. Claim shapes below mirror a real prod outpost token
-// (email claim ABSENT: the machine app client cannot read `email`, so Cognito
-// omits it from the ID token entirely).
-// ---------------------------------------------------------------------------
-describe("machine mint under email-alias pools (username is a UUID)", () => {
-    const MACHINE_CLIENT = "4q3bmth9ad4v3be6booc5td193";
-    const OUTPOST_UID = "out_01KXVRESJMP7TD263P7S0YHPSD";
-    const COGNITO_INTERNAL_SUB = "f4981438-a0a1-704c-542a-dfac148f2380";
-    const CREDS_USERNAME = "out-01kxvresjmp7td263p7s0yhpsd@outposts.hq.computer";
-    function writeOutpostCreds(overrides = {}) {
-        const dir = path.join(tmpHome, ".hq-agent");
-        fs.mkdirSync(dir, { recursive: true });
-        fs.writeFileSync(path.join(dir, "machine-creds.json"), JSON.stringify({
-            username: CREDS_USERNAME,
-            secret: "machine-secret",
-            clientId: MACHINE_CLIENT,
-            region: "us-east-1",
-            entityType: "outpost",
-            entityUid: OUTPOST_UID,
-            ...overrides,
-        }));
-    }
-    function mintResponse(accessClaims, idClaims) {
-        return vi.fn(async () => new Response(JSON.stringify({
-            AuthenticationResult: {
-                AccessToken: makeAccessToken(accessClaims),
-                IdToken: makeAccessToken(idClaims),
-                ExpiresIn: 3600,
-            },
-        }), { status: 200, headers: { "Content-Type": "application/json" } }));
-    }
-    it("accepts a valid outpost mint whose cognito:username is the internal UUID (alias pool)", async () => {
-        const { getValidAccessToken } = await importModule();
-        writeOutpostCreds();
-        const fetchMock = mintResponse({
-            token_use: "access",
-            client_id: MACHINE_CLIENT,
-            // Alias pool: access username is the internal UUID, not the email-format name.
-            username: COGNITO_INTERNAL_SUB,
-            sub: COGNITO_INTERNAL_SUB,
-        }, {
-            token_use: "id",
-            aud: MACHINE_CLIENT,
-            "cognito:username": COGNITO_INTERNAL_SUB,
-            sub: COGNITO_INTERNAL_SUB,
-            // email claim intentionally ABSENT (client cannot read `email`).
-            "custom:entityType": "outpost",
-            "custom:entityUid": OUTPOST_UID,
-            "custom:delegatedSub": "24785418-c071-7077-b7e9-0b1b583cfba1",
-            "custom:delegatedEmail": "hassaan@getindigo.ai",
-        });
-        vi.stubGlobal("fetch", fetchMock);
-        await expect(getValidAccessToken(baseConfig, { interactive: false })).resolves.toBeTypeOf("string");
-        expect(fetchMock).toHaveBeenCalledTimes(1);
-    });
-    it("still rejects a mint whose entityUid does not match the requested creds", async () => {
-        const { getValidAccessToken } = await importModule();
-        writeOutpostCreds();
-        const fetchMock = mintResponse({
-            token_use: "access",
-            client_id: MACHINE_CLIENT,
-            username: COGNITO_INTERNAL_SUB,
-            sub: COGNITO_INTERNAL_SUB,
-        }, {
-            token_use: "id",
-            aud: MACHINE_CLIENT,
-            "cognito:username": COGNITO_INTERNAL_SUB,
-            sub: COGNITO_INTERNAL_SUB,
-            "custom:entityType": "outpost",
-            // A DIFFERENT machine's uid — identity binding must refuse it.
-            "custom:entityUid": "out_01KX0000000000000000000000",
-            "custom:delegatedSub": "24785418-c071-7077-b7e9-0b1b583cfba1",
-            "custom:delegatedEmail": "hassaan@getindigo.ai",
-        });
-        vi.stubGlobal("fetch", fetchMock);
-        await expect(getValidAccessToken(baseConfig, { interactive: false })).rejects.toThrow(/do not match the requested machine identity/);
-    });
-    it("still rejects legacy creds (no entityUid) when the username binding fails", async () => {
-        const { getValidAccessToken } = await importModule();
-        // Legacy agent creds: no entityType/entityUid persisted.
-        writeOutpostCreds({ entityType: undefined, entityUid: undefined, username: "agt-legacy@agents.getindigo.ai" });
-        const fetchMock = mintResponse({
-            token_use: "access",
-            client_id: MACHINE_CLIENT,
-            username: "someone-else",
-            sub: "someone-else",
-        }, {
-            token_use: "id",
-            aud: MACHINE_CLIENT,
-            "cognito:username": "someone-else",
-            sub: "someone-else",
-            "custom:entityType": "agent",
-            "custom:entityUid": "agt_01JZ9999999999999999999999",
-        });
-        vi.stubGlobal("fetch", fetchMock);
-        await expect(getValidAccessToken(baseConfig, { interactive: false })).rejects.toThrow(/do not match the requested machine identity/);
-    });
-});
-// ---------------------------------------------------------------------------
-// Identity-refusal predicates (HQ-DESKTOP-5S)
-//
-// A mid-pass Cognito refusal must be classified WITHOUT reading message text —
-// the split is driven only by class and the authoritative `requiresReauth` bit.
-// These two predicates must partition the Cognito error classes: every instance
-// is exactly one of terminal / retryable, and nothing else matches either.
-// ---------------------------------------------------------------------------
-describe("isTerminalIdentityRefusal / isRetryableIdentityRefusal", () => {
-    it("splits the Cognito classes into exactly terminal xor retryable", async () => {
-        const { CognitoAuthError, CognitoRefreshError, isTerminalIdentityRefusal, isRetryableIdentityRefusal, } = await importModule();
-        // A bare CognitoAuthError (interactive login needed, no browser/stdin) is
-        // never silently recoverable → terminal.
-        const authOnly = new CognitoAuthError("interactive login required");
-        expect(isTerminalIdentityRefusal(authOnly)).toBe(true);
-        expect(isRetryableIdentityRefusal(authOnly)).toBe(false);
-        // A refresh failure the status classifier marked requiresReauth (401 or a
-        // non-408/429 4xx) → terminal, even though it is also a CognitoAuthError.
-        const reauth = new CognitoRefreshError("Your HQ session needs a quick refresh. Sign in again to keep sync moving.", true, 401, "fp-terminal");
-        expect(isTerminalIdentityRefusal(reauth)).toBe(true);
-        expect(isRetryableIdentityRefusal(reauth)).toBe(false);
-        // A retryable refresh failure (5xx/429/408) after the built-in retry was
-        // spent → retryable, NOT terminal.
-        const retryable = new CognitoRefreshError("Cognito refresh failed (503): service unavailable", false, 503, "fp-retryable");
-        expect(isTerminalIdentityRefusal(retryable)).toBe(false);
-        expect(isRetryableIdentityRefusal(retryable)).toBe(true);
-        // A transport-layer refresh failure carries requiresReauth=false → retryable.
-        const transport = new CognitoRefreshError("Cognito refresh request failed: ECONNRESET", false);
-        expect(isTerminalIdentityRefusal(transport)).toBe(false);
-        expect(isRetryableIdentityRefusal(transport)).toBe(true);
-    });
-    it("never matches a non-Cognito value (null-safe over unknown)", async () => {
-        const { isTerminalIdentityRefusal, isRetryableIdentityRefusal } = await importModule();
-        const { VaultAuthError } = await import("./vault-client.js");
-        const nonCognito = [
-            new Error("disk exploded"),
-            new VaultAuthError("token expired"),
-            Object.assign(new Error("socket hang up"), { code: "ECONNRESET" }),
-            "not-an-error",
-            null,
-            undefined,
-            42,
-        ];
-        for (const err of nonCognito) {
-            expect(isTerminalIdentityRefusal(err)).toBe(false);
-            expect(isRetryableIdentityRefusal(err)).toBe(false);
-        }
-    });
-});
-//# sourceMappingURL=cognito-auth.test.js.map