@paperclipai/server 2026.824.0 → 2026.825.0-beta.1

package/dist/services/artifact-review-documents.js

@@ -0,0 +1,196 @@
+import { isDeepStrictEqual } from "node:util";
+import { and, eq } from "drizzle-orm";
+import { assets, documentRevisions, documents, issueAttachments, issueDocuments } from "@paperclipai/db";
+import { MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES, artifactReviewDocumentKey, getAttachmentArtifactWorkProductMetadata, isMarkdownAttachmentContent, } from "@paperclipai/shared";
+import { HttpError, conflict, notFound, payloadTooLarge, unprocessable, unsupportedMediaType, } from "../errors.js";
+import { documentAnnotationService } from "./document-annotations.js";
+import { documentService, issueDocumentSelect, mapIssueDocumentRow } from "./documents.js";
+/**
+ * Materializes the review IssueDocument for an eligible Markdown
+ * attachment-backed work product under the deterministic
+ * `artifact-review-<workProductId>` key. The operation is idempotent: repeated
+ * calls return the existing document and only write a new revision when the
+ * review content or its work-product provenance changed.
+ */
+export function artifactReviewDocumentService(db, storage) {
+    const documentsSvc = documentService(db);
+    const annotationsSvc = documentAnnotationService(db);
+    const getExistingByKey = async (issueId, key) => {
+        const document = await db
+            .select(issueDocumentSelect)
+            .from(issueDocuments)
+            .innerJoin(documents, eq(issueDocuments.documentId, documents.id))
+            .where(and(eq(issueDocuments.issueId, issueId), eq(issueDocuments.key, key)))
+            .then((rows) => (rows[0] ? mapIssueDocumentRow(rows[0], true) : null));
+        if (!document)
+            return null;
+        const latestRevision = document.latestRevisionId
+            ? await db
+                .select({
+                createdByAgentId: documentRevisions.createdByAgentId,
+                createdByUserId: documentRevisions.createdByUserId,
+                createdByRunId: documentRevisions.createdByRunId,
+            })
+                .from(documentRevisions)
+                .where(and(eq(documentRevisions.id, document.latestRevisionId), eq(documentRevisions.documentId, document.id), eq(documentRevisions.companyId, document.companyId)))
+                .then((rows) => rows[0] ?? null)
+            : null;
+        return { document, latestRevision };
+    };
+    const readMarkdownAttachmentBody = async (issue, metadata) => {
+        const attachment = await db
+            .select({
+            id: issueAttachments.id,
+            companyId: issueAttachments.companyId,
+            issueId: issueAttachments.issueId,
+            objectKey: assets.objectKey,
+            contentType: assets.contentType,
+            byteSize: assets.byteSize,
+            originalFilename: assets.originalFilename,
+            createdByAgentId: assets.createdByAgentId,
+            createdByUserId: assets.createdByUserId,
+        })
+            .from(issueAttachments)
+            .innerJoin(assets, eq(issueAttachments.assetId, assets.id))
+            .where(eq(issueAttachments.id, metadata.attachmentId))
+            .then((rows) => rows[0] ?? null);
+        // Unknown and cross-scope attachment ids are deliberately
+        // indistinguishable: canonical metadata must reference an attachment on
+        // the same issue and company.
+        if (!attachment || attachment.companyId !== issue.companyId || attachment.issueId !== issue.id) {
+            throw unprocessable("Work product attachment must reference an attachment on the same issue", {
+                code: "invalid_attachment_artifact_metadata",
+                attachmentId: metadata.attachmentId,
+            });
+        }
+        if (!isMarkdownAttachmentContent(attachment)) {
+            throw unsupportedMediaType("Work product attachment is not Markdown", {
+                code: "unsupported_review_document_content_type",
+                contentType: attachment.contentType,
+            });
+        }
+        if (attachment.byteSize > MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES) {
+            throw payloadTooLarge("Markdown attachment exceeds the review document size limit", {
+                code: "review_document_too_large",
+                byteSize: attachment.byteSize,
+                maxBytes: MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES,
+            });
+        }
+        const object = await storage.getObject(attachment.companyId, attachment.objectKey);
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of object.stream) {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            total += buffer.length;
+            // Defense in depth: enforce the cap during streaming too, so a
+            // metadata/object size mismatch can never exceed the limit.
+            if (total > MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES) {
+                object.stream.destroy();
+                throw payloadTooLarge("Markdown attachment exceeds the review document size limit", {
+                    code: "review_document_too_large",
+                    maxBytes: MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES,
+                });
+            }
+            chunks.push(buffer);
+        }
+        let body;
+        try {
+            body = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+        }
+        catch {
+            throw unprocessable("Markdown attachment is not valid UTF-8", {
+                code: "invalid_review_document_encoding",
+                attachmentId: attachment.id,
+            });
+        }
+        return { attachment, body };
+    };
+    return {
+        ensureForWorkProduct: async (input) => {
+            const { issue, workProduct } = input;
+            if (workProduct.issueId !== issue.id || workProduct.companyId !== issue.companyId) {
+                throw notFound("Work product not found");
+            }
+            const metadata = getAttachmentArtifactWorkProductMetadata(workProduct);
+            if (!metadata) {
+                throw unprocessable("Work product is not an attachment-backed Paperclip artifact", {
+                    code: "not_attachment_backed_artifact",
+                    workProductId: workProduct.id,
+                });
+            }
+            if (!isMarkdownAttachmentContent(metadata)) {
+                throw unsupportedMediaType("Work product attachment is not Markdown", {
+                    code: "unsupported_review_document_content_type",
+                    contentType: metadata.contentType,
+                });
+            }
+            const { attachment, body } = await readMarkdownAttachmentBody(issue, metadata);
+            const key = artifactReviewDocumentKey(workProduct.id);
+            // The review document represents agent-authored attachment content, so
+            // attribution promotes the attachment/work-product provenance instead of
+            // the actor who triggered materialization.
+            const attribution = {
+                createdByAgentId: attachment.createdByAgentId ?? null,
+                createdByUserId: attachment.createdByUserId ?? null,
+                createdByRunId: workProduct.createdByRunId ?? null,
+                sourceTrust: workProduct.sourceTrust ?? null,
+            };
+            for (let attempt = 0; attempt < 2; attempt += 1) {
+                const existingState = await getExistingByKey(issue.id, key);
+                const existing = existingState?.document ?? null;
+                const latestRevision = existingState?.latestRevision ?? null;
+                const reviewStateMatches = existing &&
+                    existing.body === body &&
+                    existing.title === (workProduct.title ?? null) &&
+                    existing.format === "markdown" &&
+                    latestRevision?.createdByAgentId === attribution.createdByAgentId &&
+                    latestRevision.createdByUserId === attribution.createdByUserId &&
+                    latestRevision.createdByRunId === attribution.createdByRunId &&
+                    isDeepStrictEqual(existing.sourceTrust ?? null, attribution.sourceTrust);
+                if (reviewStateMatches) {
+                    return { document: existing, created: false, revisionChanged: false, remappedAnnotations: [] };
+                }
+                try {
+                    const result = await documentsSvc.upsertIssueDocument({
+                        issueId: issue.id,
+                        key,
+                        title: workProduct.title ?? null,
+                        format: "markdown",
+                        body,
+                        changeSummary: existing
+                            ? "Synced from the work product attachment"
+                            : "Materialized from the Markdown work product attachment",
+                        baseRevisionId: existing?.latestRevisionId ?? null,
+                        ...attribution,
+                        lockedDocumentStrategy: "conflict",
+                    });
+                    const remappedAnnotations = result.created
+                        ? []
+                        : await annotationsSvc.remapOpenThreadsForDocument({
+                            issueId: issue.id,
+                            key: result.document.key,
+                            documentId: result.document.id,
+                            nextRevisionId: result.document.latestRevisionId,
+                            nextRevisionNumber: result.document.latestRevisionNumber,
+                            nextBody: result.document.body,
+                        });
+                    return {
+                        document: result.document,
+                        created: result.created,
+                        revisionChanged: true,
+                        remappedAnnotations,
+                    };
+                }
+                catch (error) {
+                    // A concurrent materialization or document write raced this one.
+                    // Re-read once so identical content converges on the winner.
+                    if (error instanceof HttpError && error.status === 409 && attempt === 0)
+                        continue;
+                    throw error;
+                }
+            }
+            throw conflict("Concurrent review-document updates did not converge", { key });
+        },
+    };
+}
+//# sourceMappingURL=artifact-review-documents.js.map

package/dist/services/artifact-review-documents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-review-documents.js","sourceRoot":"","sources":["../../src/services/artifact-review-documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACzG,OAAO,EACL,kCAAkC,EAClC,yBAAyB,EACzB,wCAAwC,EACxC,2BAA2B,GAG5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAuB3F;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAAM,EAAE,OAAuB;IAC3E,MAAM,YAAY,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAErD,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAe,EAAE,GAAW,EAAE,EAAE;QAC9D,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,mBAAmB,CAAC;aAC3B,IAAI,CAAC,cAAc,CAAC;aACpB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aACjE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;aAC5E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,cAAc,GAAG,QAAQ,CAAC,gBAAgB;YAC9C,CAAC,CAAC,MAAM,EAAE;iBACP,MAAM,CAAC;gBACN,gBAAgB,EAAE,iBAAiB,CAAC,gBAAgB;gBACpD,eAAe,EAAE,iBAAiB,CAAC,eAAe;gBAClD,cAAc,EAAE,iBAAiB,CAAC,cAAc;aACjD,CAAC;iBACD,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,GAAG,CACR,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EACnD,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,EAC7C,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CACpD,CAAC;iBACD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC;QACT,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IACtC,CAAC,CAAC;IAEF,MAAM,0BAA0B,GAAG,KAAK,EACtC,KAAwC,EACxC,QAA+C,EAC/C,EAAE;QACF,MAAM,UAAU,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,OAAO,EAAE,gBAAgB,CAAC,OAAO;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;aAC1D,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;aACrD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,0DAA0D;QAC1D,wEAAwE;QACxE,8BAA8B;QAC9B,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;YAC/F,MAAM,aAAa,CAAC,wEAAwE,EAAE;gBAC5F,IAAI,EAAE,sCAAsC;gBAC5C,YAAY,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,MAAM,oBAAoB,CAAC,yCAAyC,EAAE;gBACpE,IAAI,EAAE,0CAA0C;gBAChD,WAAW,EAAE,UAAU,CAAC,WAAW;aACpC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,GAAG,kCAAkC,EAAE,CAAC;YAC7D,MAAM,eAAe,CAAC,4DAA4D,EAAE;gBAClF,IAAI,EAAE,2BAA2B;gBACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,QAAQ,EAAE,kCAAkC;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnE,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;YACvB,+DAA+D;YAC/D,4DAA4D;YAC5D,IAAI,KAAK,GAAG,kCAAkC,EAAE,CAAC;gBAC/C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,eAAe,CAAC,4DAA4D,EAAE;oBAClF,IAAI,EAAE,2BAA2B;oBACjC,QAAQ,EAAE,kCAAkC;iBAC7C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,aAAa,CAAC,wCAAwC,EAAE;gBAC5D,IAAI,EAAE,kCAAkC;gBACxC,YAAY,EAAE,UAAU,CAAC,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC,CAAC;IAEF,OAAO;QACL,oBAAoB,EAAE,KAAK,EACzB,KAAwC,EACK,EAAE;YAC/C,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;YACrC,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,IAAI,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;gBAClF,MAAM,QAAQ,CAAC,wBAAwB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,QAAQ,GAAG,wCAAwC,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,aAAa,CAAC,6DAA6D,EAAE;oBACjF,IAAI,EAAE,gCAAgC;oBACtC,aAAa,EAAE,WAAW,CAAC,EAAE;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3C,MAAM,oBAAoB,CAAC,yCAAyC,EAAE;oBACpE,IAAI,EAAE,0CAA0C;oBAChD,WAAW,EAAE,QAAQ,CAAC,WAAW;iBAClC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACtD,uEAAuE;YACvE,yEAAyE;YACzE,2CAA2C;YAC3C,MAAM,WAAW,GAAG;gBAClB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,IAAI,IAAI;gBACrD,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,IAAI;gBACnD,cAAc,EAAE,WAAW,CAAC,cAAc,IAAI,IAAI;gBAClD,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,IAAI;aAC7C,CAAC;YAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,aAAa,EAAE,QAAQ,IAAI,IAAI,CAAC;gBACjD,MAAM,cAAc,GAAG,aAAa,EAAE,cAAc,IAAI,IAAI,CAAC;gBAC7D,MAAM,kBAAkB,GAAG,QAAQ;oBACjC,QAAQ,CAAC,IAAI,KAAK,IAAI;oBACtB,QAAQ,CAAC,KAAK,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,IAAI,CAAC;oBAC9C,QAAQ,CAAC,MAAM,KAAK,UAAU;oBAC9B,cAAc,EAAE,gBAAgB,KAAK,WAAW,CAAC,gBAAgB;oBACjE,cAAc,CAAC,eAAe,KAAK,WAAW,CAAC,eAAe;oBAC9D,cAAc,CAAC,cAAc,KAAK,WAAW,CAAC,cAAc;oBAC5D,iBAAiB,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;gBAC3E,IAAI,kBAAkB,EAAE,CAAC;oBACvB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,CAAC;gBACjG,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC;wBACpD,OAAO,EAAE,KAAK,CAAC,EAAE;wBACjB,GAAG;wBACH,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,IAAI;wBAChC,MAAM,EAAE,UAAU;wBAClB,IAAI;wBACJ,aAAa,EAAE,QAAQ;4BACrB,CAAC,CAAC,yCAAyC;4BAC3C,CAAC,CAAC,wDAAwD;wBAC5D,cAAc,EAAE,QAAQ,EAAE,gBAAgB,IAAI,IAAI;wBAClD,GAAG,WAAW;wBACd,sBAAsB,EAAE,UAAU;qBACnC,CAAC,CAAC;oBACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO;wBACxC,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,MAAM,cAAc,CAAC,2BAA2B,CAAC;4BACjD,OAAO,EAAE,KAAK,CAAC,EAAE;4BACjB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;4BACxB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;4BAC9B,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,gBAAgB;4BAChD,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,oBAAoB;4BACxD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI;yBAC/B,CAAC,CAAC;oBACL,OAAO;wBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,eAAe,EAAE,IAAI;wBACrB,mBAAmB;qBACpB,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,iEAAiE;oBACjE,6DAA6D;oBAC7D,IAAI,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,KAAK,CAAC;wBAAE,SAAS;oBAClF,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,CAAC,qDAAqD,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/services/assets.d.ts

@@ -9,10 +9,10 @@ export declare function assetService(db: Db): {
         createdAt: Date;
         updatedAt: Date;
         provider: string;
-        sha256: string;
         contentType: string;
         byteSize: number;
         originalFilename: string | null;
+        sha256: string;
         objectKey: string;
     }>;
     getById: (id: string) => Promise<{

package/dist/services/codex-device-login-credential-read.d.ts

@@ -0,0 +1,58 @@
+import type { Environment, EnvironmentLease } from "@paperclipai/shared";
+import type { EnvironmentRuntimeService } from "./environment-runtime.js";
+/**
+ * The bounded size for the credential payload. A real subscription `auth.json` is
+ * a few kilobytes. The read rejects a larger payload before it returns any bytes.
+ * The value matches the adapter export bound.
+ */
+export declare const MAX_AUTH_JSON_BYTES: number;
+/** The fixed credential file name inside the session home. No caller controls it. */
+export declare const AUTH_JSON_FILE_NAME = "auth.json";
+/**
+ * The fixed, non-secret error the read returns on every failed path. The message
+ * carries no pathname, no byte, and no other secret detail.
+ */
+export declare const DEVICE_LOGIN_AUTH_READ_ERROR = "device login failed: the sandbox credential read errored.";
+/**
+ * The fixed helper program. The server reads the helper from its own script file
+ * and runs it in the sandbox as `node -e <script> <sessionHome> <maxBytes>
+ * [<expectedUid>]`. The sandbox already runs node for the Paperclip bridge, so the
+ * helper needs no extra runtime. The helper source lives in
+ * `scripts/codex-auth-read.cjs`, so no large script stays as a string literal in
+ * this module.
+ *
+ * The helper opens the filesystem root, then opens each session-home path
+ * component in turn with a no-follow, directory-only open, relative to the
+ * previous directory descriptor, so a symlink at any component fails. It opens
+ * `auth.json` relative to the final directory descriptor with `O_NOFOLLOW`, runs
+ * `fstat` on the opened descriptor, and requires a regular file, the expected
+ * owner, exact mode `0600`, and a size at or below the bound. It reads only from
+ * that same descriptor. The `expectedUid` argument is optional; the server omits
+ * it, so the helper uses the login user's own id.
+ */
+export declare const DEVICE_LOGIN_AUTH_READ_SCRIPT: string;
+/**
+ * Decodes the helper stdout to the credential bytes. It accepts only strict
+ * base64 with correct padding, so a truncated or corrupt line returns the fixed
+ * error instead of partial bytes. It rejects a decoded payload over the bound.
+ */
+export declare function decodeAuthReadOutput(stdout: string): Buffer;
+/** The environment-runtime surface the descriptor-bound read needs. */
+export interface DescriptorBoundAuthReadDeps {
+    environmentRuntime: Pick<EnvironmentRuntimeService, "execute">;
+    environment: Environment;
+    lease: EnvironmentLease;
+    /** The verified, server-controlled session home. */
+    sessionHome: string;
+    /** The host timeout for the read command. */
+    timeoutMs: number;
+}
+/**
+ * Runs the descriptor-bound credential read once and returns the bytes. It
+ * revalidates the session-home shape, then runs the fixed helper as a one-shot,
+ * non-session command. It converts a non-zero exit, an empty or malformed stdout,
+ * or an oversize payload to the one fixed, non-secret error. It reads no bytes on
+ * any failed path.
+ */
+export declare function runDescriptorBoundAuthRead(deps: DescriptorBoundAuthReadDeps): Promise<Buffer>;
+//# sourceMappingURL=codex-device-login-credential-read.d.ts.map

package/dist/services/codex-device-login-credential-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-device-login-credential-read.d.ts","sourceRoot":"","sources":["../../src/services/codex-device-login-credential-read.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAG1E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAY,CAAC;AAE7C,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,4BAA4B,8DACoB,CAAC;AAE9D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,QAGzC,CAAC;AAOF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAU3D;AAED,uEAAuE;AACvE,MAAM,WAAW,2BAA2B;IAC1C,kBAAkB,EAAE,IAAI,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;IAC/D,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,gBAAgB,CAAC;IACxB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/services/codex-device-login-credential-read.js

@@ -0,0 +1,118 @@
+// The descriptor-bound credential read for the Codex device login.
+//
+// The login pseudo-terminal (PTY) runs `codex login --device-auth` and writes
+// `auth.json` into the server-controlled session home. The service reads that
+// file after the command exits with code zero. The read must close the
+// time-of-check-to-time-of-use (TOCTOU) window: a pathname check and a later
+// `cat` on the same pathname let an attacker swap the file between the two steps.
+//
+// This module runs one fixed, server-controlled operation inside the sandbox
+// instead. The operation opens the filesystem root, then walks each path
+// component of the session home with no symlink follow. `O_NOFOLLOW` protects
+// only the final component of one open, so the operation opens every intermediate
+// component with a separate no-follow open. A symlink at any ancestor fails the
+// walk. The operation then opens `auth.json` relative to the final directory
+// descriptor without a symlink follow, runs `fstat` on the opened descriptor, and
+// reads only from that same descriptor. The `fstat` check requires a regular
+// file, login-user ownership, exact mode `0600`, and a bounded size. A missing
+// file, a symlink at any component, a non-regular file, a wrong owner, a wrong
+// mode, or an oversize file returns one fixed, non-secret error.
+//
+// The provider exposes no descriptor application programming interface (API), so
+// this module runs a fixed helper program in the sandbox through the environment
+// runtime `execute` seam. The helper is node, because the sandbox already runs
+// node for the Paperclip bridge. The helper never re-opens the pathname after the
+// check: the `fstat` and the read bind to the one opened descriptor.
+//
+// Security: the helper prints only the base64 of the credential bytes on the
+// fully validated success path. It prints one fixed error token on every failed
+// path. It never prints the pathname, the raw bytes, or any other detail. This
+// module converts any failure to one fixed, non-secret error and reads no bytes.
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { validateLoginSessionHome } from "./login-command.js";
+/**
+ * The bounded size for the credential payload. A real subscription `auth.json` is
+ * a few kilobytes. The read rejects a larger payload before it returns any bytes.
+ * The value matches the adapter export bound.
+ */
+export const MAX_AUTH_JSON_BYTES = 64 * 1024;
+/** The fixed credential file name inside the session home. No caller controls it. */
+export const AUTH_JSON_FILE_NAME = "auth.json";
+/**
+ * The fixed, non-secret error the read returns on every failed path. The message
+ * carries no pathname, no byte, and no other secret detail.
+ */
+export const DEVICE_LOGIN_AUTH_READ_ERROR = "device login failed: the sandbox credential read errored.";
+/**
+ * The fixed helper program. The server reads the helper from its own script file
+ * and runs it in the sandbox as `node -e <script> <sessionHome> <maxBytes>
+ * [<expectedUid>]`. The sandbox already runs node for the Paperclip bridge, so the
+ * helper needs no extra runtime. The helper source lives in
+ * `scripts/codex-auth-read.cjs`, so no large script stays as a string literal in
+ * this module.
+ *
+ * The helper opens the filesystem root, then opens each session-home path
+ * component in turn with a no-follow, directory-only open, relative to the
+ * previous directory descriptor, so a symlink at any component fails. It opens
+ * `auth.json` relative to the final directory descriptor with `O_NOFOLLOW`, runs
+ * `fstat` on the opened descriptor, and requires a regular file, the expected
+ * owner, exact mode `0600`, and a size at or below the bound. It reads only from
+ * that same descriptor. The `expectedUid` argument is optional; the server omits
+ * it, so the helper uses the login user's own id.
+ */
+export const DEVICE_LOGIN_AUTH_READ_SCRIPT = readFileSync(fileURLToPath(new URL("./scripts/codex-auth-read.cjs", import.meta.url)), "utf8");
+/** A strict base64 token: standard alphabet, correct padding, length a multiple
+ *  of four. The read rejects any other stdout, so malformed helper output never
+ *  decodes to partial bytes. */
+const STRICT_BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+/**
+ * Decodes the helper stdout to the credential bytes. It accepts only strict
+ * base64 with correct padding, so a truncated or corrupt line returns the fixed
+ * error instead of partial bytes. It rejects a decoded payload over the bound.
+ */
+export function decodeAuthReadOutput(stdout) {
+    const encoded = stdout.trim();
+    if (encoded.length % 4 !== 0 || !STRICT_BASE64_RE.test(encoded)) {
+        throw new Error(DEVICE_LOGIN_AUTH_READ_ERROR);
+    }
+    const bytes = Buffer.from(encoded, "base64");
+    if (bytes.length > MAX_AUTH_JSON_BYTES) {
+        throw new Error(DEVICE_LOGIN_AUTH_READ_ERROR);
+    }
+    return bytes;
+}
+/**
+ * Runs the descriptor-bound credential read once and returns the bytes. It
+ * revalidates the session-home shape, then runs the fixed helper as a one-shot,
+ * non-session command. It converts a non-zero exit, an empty or malformed stdout,
+ * or an oversize payload to the one fixed, non-secret error. It reads no bytes on
+ * any failed path.
+ */
+export async function runDescriptorBoundAuthRead(deps) {
+    // Revalidate the home shape before the sandbox command. The server derived and
+    // validated it earlier; this second check keeps the helper argument fixed.
+    validateLoginSessionHome(deps.sessionHome);
+    let result;
+    try {
+        result = await deps.environmentRuntime.execute({
+            environment: deps.environment,
+            lease: deps.lease,
+            command: "node",
+            args: ["-e", DEVICE_LOGIN_AUTH_READ_SCRIPT, deps.sessionHome, String(MAX_AUTH_JSON_BYTES)],
+            timeoutMs: deps.timeoutMs,
+            // The read is one fixed, non-session operation. It must not open or reuse
+            // the login session.
+            bypassSession: true,
+        });
+    }
+    catch {
+        // A driver error may embed sandbox text. Convert it to the fixed error.
+        throw new Error(DEVICE_LOGIN_AUTH_READ_ERROR);
+    }
+    if (result.exitCode !== 0) {
+        throw new Error(DEVICE_LOGIN_AUTH_READ_ERROR);
+    }
+    return decodeAuthReadOutput(result.stdout ?? "");
+}
+//# sourceMappingURL=codex-device-login-credential-read.js.map

package/dist/services/codex-device-login-credential-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-device-login-credential-read.js","sourceRoot":"","sources":["../../src/services/codex-device-login-credential-read.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,kFAAkF;AAClF,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,kFAAkF;AAClF,gFAAgF;AAChF,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,iEAAiE;AACjE,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,kFAAkF;AAClF,qEAAqE;AACrE,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AAEjF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,2DAA2D,CAAC;AAE9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CACvD,aAAa,CAAC,IAAI,GAAG,CAAC,+BAA+B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACxE,MAAM,CACP,CAAC;AAEF;;gCAEgC;AAChC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAiC;IAEjC,+EAA+E;IAC/E,2EAA2E;IAC3E,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,IAAI,EAAE,6BAA6B,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC1F,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,0EAA0E;YAC1E,qBAAqB;YACrB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,oBAAoB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/services/codex-device-login-reaper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-device-login-reaper.d.ts","sourceRoot":"","sources":["../../src/services/codex-device-login-reaper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAwB1E,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;8DAC8D;AAC9D,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC;8CAC0C;IAC1C,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChE;wBACoB;IACpB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAC5C;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,cAAc,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,mBAAmB,EAAE,MAAM,CAAC;IAC5B;8CAC0C;IAC1C,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,0BAA0B,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B;iBAyJnD,OAAO,CAAC,iBAAiB,CAAC;EAenD;AAED,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMrF,MAAM,WAAW,uCAAuC;IACtD,EAAE,EAAE,EAAE,CAAC;IACP,kBAAkB,EAAE,yBAAyB,CAAC;CAC/C;AAED;;;;GAIG;AACH,wBAAgB,yCAAyC,CACvD,IAAI,EAAE,uCAAuC,GAC5C,0BAA0B,CA6D5B"}
+{"version":3,"file":"codex-device-login-reaper.d.ts","sourceRoot":"","sources":["../../src/services/codex-device-login-reaper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C,OAAO,EAOL,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAwB1E,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;8DAC8D;AAC9D,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC;8CAC0C;IAC1C,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChE;wBACoB;IACpB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAC5C;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,cAAc,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,mBAAmB,EAAE,MAAM,CAAC;IAC5B;8CAC0C;IAC1C,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,0BAA0B,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B;iBA0JnD,OAAO,CAAC,iBAAiB,CAAC;EAenD;AAED,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMrF,MAAM,WAAW,uCAAuC;IACtD,EAAE,EAAE,EAAE,CAAC;IACP,kBAAkB,EAAE,yBAAyB,CAAC;CAC/C;AAED;;;;GAIG;AACH,wBAAgB,yCAAyC,CACvD,IAAI,EAAE,uCAAuC,GAC5C,0BAA0B,CAkE5B"}

package/dist/services/codex-device-login-reaper.js

@@ -1,6 +1,6 @@
-import { inArray } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { adapterAuthSessions } from "@paperclipai/db";
-import { ADAPTER_AUTH_ACTIVE_STATUSES, decodePendingTerminal, LOGIN_LEASE_SESSION_TAG_KEY, observeSandboxDelete, terminalCleanupWrite, } from "./codex-device-login-service.js";
+import { ADAPTER_AUTH_ACTIVE_STATUSES, CODEX_DEVICE_LOGIN_ADAPTER_TYPE, decodePendingTerminal, LOGIN_LEASE_SESSION_TAG_KEY, observeSandboxDelete, terminalCleanupWrite, } from "./codex-device-login-service.js";
 import { environmentService } from "./environments.js";
 export function createCodexDeviceLoginReaper(deps) {
     const { store, runtime } = deps;
@@ -74,7 +74,7 @@ export function createCodexDeviceLoginReaper(deps) {
             // interleaves with a live write. A crashed owner drops the lock, so the
             // reaper still reclaims the stalled row on a later sweep.
             const pendingWrite = terminalCleanupWrite(false, "timed_out", null);
-            const claimed = await store.withCompanyAdapterPromotionLock(row.companyId, row.adapterType, () => store.compareAndSetStatus({
+            const claimed = await store.withCompanyAdapterPromotionLock(row.companyId, row.startedByUserId, row.adapterType, () => store.compareAndSetStatus({
                 sessionId: row.id,
                 expectedStatuses: [row.status],
                 status: pendingWrite.status,
@@ -198,10 +198,13 @@ export function createProductionLoginSessionReaperRuntime(deps) {
             const environmentRows = await deps.db
                 .selectDistinct({ environmentId: adapterAuthSessions.environmentId })
                 .from(adapterAuthSessions)
-                .where(inArray(adapterAuthSessions.status, [
+                .where(and(
+            // The shared table also holds the setup-token rows. Filter by the
+            // device-login adapter, so the orphan sweep reads only Codex rows.
+            eq(adapterAuthSessions.adapterType, CODEX_DEVICE_LOGIN_ADAPTER_TYPE), inArray(adapterAuthSessions.status, [
                 ...ADAPTER_AUTH_ACTIVE_STATUSES,
                 "cleanup_pending",
-            ]));
+            ])));
             const tagged = [];
             for (const { environmentId } of environmentRows) {
                 const leases = await environmentsSvc.listLeases(environmentId, { status: "active" });

package/dist/services/codex-device-login-reaper.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-device-login-reaper.js","sourceRoot":"","sources":["../../src/services/codex-device-login-reaper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,GAGrB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAuEvD,MAAM,UAAU,4BAA4B,CAAC,IAAgC;IAC3E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE3C,+EAA+E;IAC/E,+EAA+E;IAC/E,uCAAuC;IACvC,KAAK,UAAU,mBAAmB;QAKhC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACzD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;gBACzB,qEAAqE;gBACrE,yBAAyB;gBACzB,MAAM,KAAK,CAAC,SAAS,CAAC;oBACpB,SAAS,EAAE,GAAG,CAAC,EAAE;oBACjB,MAAM,EAAE,OAAO,CAAC,QAAQ;oBACxB,EAAE,EAAE,GAAG,EAAE;oBACT,aAAa,EAAE,OAAO,CAAC,MAAM;oBAC7B,UAAU;iBACX,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YACD,OAAO,IAAI,CAAC,CAAC;YACb,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAClD,OAAO,CAAC,aAAa,CAAC;gBACpB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,eAAe,EAAE,GAAG,CAAC,eAAgB;aACtC,CAAC,CACH,CAAC;YACF,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC1B,wEAAwE;gBACxE,uCAAuC;gBACvC,MAAM,KAAK,CAAC,SAAS,CAAC;oBACpB,SAAS,EAAE,GAAG,CAAC,EAAE;oBACjB,MAAM,EAAE,OAAO,CAAC,QAAQ;oBACxB,EAAE,EAAE,GAAG,EAAE;oBACT,aAAa,EAAE,OAAO,CAAC,MAAM;oBAC7B,UAAU;iBACX,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,KAAK,UAAU,oBAAoB,CAAC,EAAQ;QAI1C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,4EAA4E;YAC5E,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,gCAAgC;YAChC,EAAE;YACF,4EAA4E;YAC5E,mEAAmE;YACnE,oEAAoE;YACpE,wEAAwE;YACxE,0DAA0D;YAC1D,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,+BAA+B,CACzD,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,WAAW,EACf,GAAG,EAAE,CACH,KAAK,CAAC,mBAAmB,CAAC;gBACxB,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC9B,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,EAAE,EAAE,GAAG,EAAE;gBACT,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,UAAU,EAAE,GAAG,EAAE;gBACjB,kBAAkB,EAAE,IAAI;aACzB,CAAC,CACL,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,eAAe;gBACrC,CAAC,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAC9B,OAAO,CAAC,aAAa,CAAC;oBACpB,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,eAAe,EAAE,GAAG,CAAC,eAAgB;iBACtC,CAAC,CACH;gBACH,CAAC,CAAC,uEAAuE;oBACvE,oEAAoE;oBACpE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,mBAAmB,CAAC;oBAC9B,SAAS,EAAE,GAAG,CAAC,EAAE;oBACjB,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;oBACrC,MAAM,EAAE,WAAW;oBACnB,EAAE,EAAE,GAAG,EAAE;oBACT,aAAa,EAAE,IAAI;oBACnB,UAAU,EAAE,GAAG,EAAE;iBAClB,CAAC,CAAC;gBACH,QAAQ,IAAI,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,YAAY,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACpC,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,KAAK,UAAU,iBAAiB;QAC9B,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,KAAK,CAAC,mBAAmB,EAAE;YAC3B,OAAO,CAAC,gBAAgB,EAAE;SAC3B,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;gBAAE,SAAS;YACvD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAClD,OAAO,CAAC,aAAa,CAAC;gBACpB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,eAAe,EAAE,KAAK,CAAC,eAAe;aACvC,CAAC,CACH,CAAC;YACF,2EAA2E;YAC3E,cAAc;YACd,IAAI,WAAW,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,mBAAmB,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACtD,OAAO;YACL,eAAe,EAAE,OAAO,CAAC,QAAQ;YACjC,cAAc,EAAE,OAAO,CAAC,OAAO;YAC/B,cAAc,EAAE,OAAO,CAAC,OAAO;YAC/B,mBAAmB;YACnB,uBAAuB,EAAE,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,YAAY;SAClE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,yCAAyC,CACvD,IAA6C;IAE7C,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,GAAG;YACrB,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACrE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,+BAA+B;gBAC/B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YAClC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC;YAC5F,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,sEAAsE;gBACtE,yDAAyD;gBACzD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YAClC,CAAC;YACD,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;YAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACnE,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,sBAAsB,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC;gBACnD,WAAW;gBACX,KAAK;gBACL,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,wEAAwE;YACxE,mDAAmD;YACnD,IAAI,QAAQ,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,uEAAuE;YACvE,yEAAyE;YACzE,6BAA6B;YAC7B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,EAAE;iBAClC,cAAc,CAAC,EAAE,aAAa,EAAE,mBAAmB,CAAC,aAAa,EAAE,CAAC;iBACpE,IAAI,CAAC,mBAAmB,CAAC;iBACzB,KAAK,CACJ,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE;gBAClC,GAAG,4BAA4B;gBAC/B,iBAAiB;aAClB,CAAC,CACH,CAAC;YACJ,MAAM,MAAM,GAAkB,EAAE,CAAC;YACjC,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,eAAe,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,2BAA2B,CAAC,CAAC;oBAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;wBAC3D,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;oBACpF,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"codex-device-login-reaper.js","sourceRoot":"","sources":["../../src/services/codex-device-login-reaper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,GAGrB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAuEvD,MAAM,UAAU,4BAA4B,CAAC,IAAgC;IAC3E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE3C,+EAA+E;IAC/E,+EAA+E;IAC/E,uCAAuC;IACvC,KAAK,UAAU,mBAAmB;QAKhC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACzD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;gBACzB,qEAAqE;gBACrE,yBAAyB;gBACzB,MAAM,KAAK,CAAC,SAAS,CAAC;oBACpB,SAAS,EAAE,GAAG,CAAC,EAAE;oBACjB,MAAM,EAAE,OAAO,CAAC,QAAQ;oBACxB,EAAE,EAAE,GAAG,EAAE;oBACT,aAAa,EAAE,OAAO,CAAC,MAAM;oBAC7B,UAAU;iBACX,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YACD,OAAO,IAAI,CAAC,CAAC;YACb,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAClD,OAAO,CAAC,aAAa,CAAC;gBACpB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,eAAe,EAAE,GAAG,CAAC,eAAgB;aACtC,CAAC,CACH,CAAC;YACF,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC1B,wEAAwE;gBACxE,uCAAuC;gBACvC,MAAM,KAAK,CAAC,SAAS,CAAC;oBACpB,SAAS,EAAE,GAAG,CAAC,EAAE;oBACjB,MAAM,EAAE,OAAO,CAAC,QAAQ;oBACxB,EAAE,EAAE,GAAG,EAAE;oBACT,aAAa,EAAE,OAAO,CAAC,MAAM;oBAC7B,UAAU;iBACX,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,KAAK,UAAU,oBAAoB,CAAC,EAAQ;QAI1C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,4EAA4E;YAC5E,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,gCAAgC;YAChC,EAAE;YACF,4EAA4E;YAC5E,mEAAmE;YACnE,oEAAoE;YACpE,wEAAwE;YACxE,0DAA0D;YAC1D,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,+BAA+B,CACzD,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,WAAW,EACf,GAAG,EAAE,CACH,KAAK,CAAC,mBAAmB,CAAC;gBACxB,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC9B,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,EAAE,EAAE,GAAG,EAAE;gBACT,aAAa,EAAE,YAAY,CAAC,aAAa;gBACzC,UAAU,EAAE,GAAG,EAAE;gBACjB,kBAAkB,EAAE,IAAI;aACzB,CAAC,CACL,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,eAAe;gBACrC,CAAC,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAC9B,OAAO,CAAC,aAAa,CAAC;oBACpB,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,eAAe,EAAE,GAAG,CAAC,eAAgB;iBACtC,CAAC,CACH;gBACH,CAAC,CAAC,uEAAuE;oBACvE,oEAAoE;oBACpE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,mBAAmB,CAAC;oBAC9B,SAAS,EAAE,GAAG,CAAC,EAAE;oBACjB,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;oBACrC,MAAM,EAAE,WAAW;oBACnB,EAAE,EAAE,GAAG,EAAE;oBACT,aAAa,EAAE,IAAI;oBACnB,UAAU,EAAE,GAAG,EAAE;iBAClB,CAAC,CAAC;gBACH,QAAQ,IAAI,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,YAAY,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACpC,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,KAAK,UAAU,iBAAiB;QAC9B,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,KAAK,CAAC,mBAAmB,EAAE;YAC3B,OAAO,CAAC,gBAAgB,EAAE;SAC3B,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;gBAAE,SAAS;YACvD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,CAClD,OAAO,CAAC,aAAa,CAAC;gBACpB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,eAAe,EAAE,KAAK,CAAC,eAAe;aACvC,CAAC,CACH,CAAC;YACF,2EAA2E;YAC3E,cAAc;YACd,IAAI,WAAW,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,mBAAmB,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACtD,OAAO;YACL,eAAe,EAAE,OAAO,CAAC,QAAQ;YACjC,cAAc,EAAE,OAAO,CAAC,OAAO;YAC/B,cAAc,EAAE,OAAO,CAAC,OAAO;YAC/B,mBAAmB;YACnB,uBAAuB,EAAE,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,YAAY;SAClE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,yCAAyC,CACvD,IAA6C;IAE7C,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,GAAG;YACrB,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACrE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,+BAA+B;gBAC/B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YAClC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC;YAC5F,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,sEAAsE;gBACtE,yDAAyD;gBACzD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YAClC,CAAC;YACD,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;YAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACnE,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,sBAAsB,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC;gBACnD,WAAW;gBACX,KAAK;gBACL,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,wEAAwE;YACxE,mDAAmD;YACnD,IAAI,QAAQ,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,uEAAuE;YACvE,yEAAyE;YACzE,6BAA6B;YAC7B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,EAAE;iBAClC,cAAc,CAAC,EAAE,aAAa,EAAE,mBAAmB,CAAC,aAAa,EAAE,CAAC;iBACpE,IAAI,CAAC,mBAAmB,CAAC;iBACzB,KAAK,CACJ,GAAG;YACD,kEAAkE;YAClE,mEAAmE;YACnE,EAAE,CAAC,mBAAmB,CAAC,WAAW,EAAE,+BAA+B,CAAC,EACpE,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE;gBAClC,GAAG,4BAA4B;gBAC/B,iBAAiB;aAClB,CAAC,CACH,CACF,CAAC;YACJ,MAAM,MAAM,GAAkB,EAAE,CAAC;YACjC,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,eAAe,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,2BAA2B,CAAC,CAAC;oBAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;wBAC3D,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;oBACpF,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}