@tickernelz/paperclip-pro-adapter-codex-local 2026.925.0

package/dist/server/codex-auth-cache.test.js

@@ -0,0 +1,497 @@
+import { chmod, lstat, mkdir, mkdtemp, readdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { assertAccountHomeCacheDirStillValid, clearCodexAuthCache, clearCodexAuthCacheEntry, ensureCodexAuthCacheEntryDir, isCodexAuthCacheEnabled, isCodexAuthCachePath, resolveCodexAuthCacheDir, resolveCodexAuthCacheEntryPath, selectVendCredential, toCacheKey, withAccountHomeSecretMutationLock, withCodexAccountHomePromotionLock, } from "./codex-auth-cache.js";
+import { resolveSharedCodexHomeDir } from "./codex-home.js";
+// This suite proves the per-identity host credential cache store. The cache is a
+// separate directory outside the shared Codex home and outside the symlink
+// allowlist. It keys one usable subscription credential per identity
+// (`account_id`). The suite drives the real path resolver, the real directory
+// guards, and the real decision predicate (`codex-auth-merge-decision.cjs`)
+// against a real host tmp filesystem.
+describe("codex auth cache store", () => {
+    const cleanupDirs = [];
+    afterEach(async () => {
+        while (cleanupDirs.length > 0) {
+            const dir = cleanupDirs.pop();
+            if (!dir)
+                continue;
+            await chmod(dir, 0o700).catch(() => undefined);
+            await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+        }
+    });
+    async function makeInstanceRoot() {
+        const dir = await mkdtemp(path.join(os.tmpdir(), "paperclip-codex-cache-"));
+        cleanupDirs.push(dir);
+        return dir;
+    }
+    function envFor(instanceHome, extra = {}) {
+        return {
+            PAPERCLIP_HOME: instanceHome,
+            PAPERCLIP_INSTANCE_ID: "default",
+            ...extra,
+        };
+    }
+    function subscriptionAuth(input) {
+        const suffix = input.marker ?? input.accountId;
+        return JSON.stringify({
+            tokens: {
+                id_token: `id-token-${suffix}`,
+                access_token: `access-token-${suffix}`,
+                refresh_token: `refresh-token-${suffix}`,
+                account_id: input.accountId,
+            },
+            ...(input.lastRefresh ? { last_refresh: input.lastRefresh } : {}),
+        });
+    }
+    const NEWER = "2026-07-09T02:00:00Z";
+    const OLDER = "2026-07-09T01:00:00Z";
+    describe("Phase 1: cache store location and path scheme", () => {
+        it("resolveCodexAuthCacheDir returns a path outside resolveSharedCodexHomeDir", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home, { CODEX_HOME: path.join(home, "shared-codex") });
+            const cacheDir = resolveCodexAuthCacheDir(env, "company-a");
+            const sharedHome = resolveSharedCodexHomeDir(env);
+            expect(cacheDir.startsWith(sharedHome + path.sep)).toBe(false);
+            expect(cacheDir).not.toBe(sharedHome);
+        });
+        it("resolveCodexAuthCacheDir returns a company-scoped path under the instance companies directory when companyId is set", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const cacheDir = resolveCodexAuthCacheDir(env, "company-a");
+            expect(cacheDir).toBe(path.resolve(home, "instances", "default", "companies", "company-a", "codex-auth-cache"));
+        });
+        it("isCodexAuthCachePath recognizes store entries for any company and rejects everything else", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const cacheDir = resolveCodexAuthCacheDir(env, "company-a");
+            expect(isCodexAuthCachePath(env, cacheDir)).toBe(true);
+            expect(isCodexAuthCachePath(env, path.join(cacheDir, "acct-1"))).toBe(true);
+            expect(isCodexAuthCachePath(env, resolveCodexAuthCacheDir(env, "company-b"))).toBe(true);
+            // The company Codex home and a per-agent home are managed homes, not
+            // store entries — the seeding pass owns them.
+            expect(isCodexAuthCachePath(env, path.join(home, "instances", "default", "companies", "company-a", "codex-home"))).toBe(false);
+            expect(isCodexAuthCachePath(env, path.join(home, "instances", "default", "companies", "company-a", "agents", "agent-1", "codex-home"))).toBe(false);
+            // A sibling directory whose name merely STARTS with the store name
+            // stays out, as does anything outside the instance tree.
+            expect(isCodexAuthCachePath(env, path.join(home, "instances", "default", "companies", "company-a", "codex-auth-cache-extra"))).toBe(false);
+            expect(isCodexAuthCachePath(env, "/tmp/codex-auth-cache/acct-1")).toBe(false);
+        });
+        it("resolveCodexAuthCacheEntryPath keys the entry by a sanitized account_id and ends with auth.json", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const entryPath = resolveCodexAuthCacheEntryPath(env, "acct-42", "company-a");
+            const cacheDir = resolveCodexAuthCacheDir(env, "company-a");
+            expect(entryPath).toBe(path.join(cacheDir, "acct-42", "auth.json"));
+        });
+        it("toCacheKey rejects an empty account_id, a path separator, and ..", () => {
+            expect(() => toCacheKey("")).toThrow();
+            expect(() => toCacheKey("   ")).toThrow();
+            expect(() => toCacheKey("..")).toThrow();
+            expect(() => toCacheKey(".")).toThrow();
+            expect(() => toCacheKey("a/b")).toThrow();
+            expect(() => toCacheKey("a\\b")).toThrow();
+            expect(() => toCacheKey("../escape")).toThrow();
+            expect(() => toCacheKey("a\0b")).toThrow();
+            expect(toCacheKey("acct-42")).toBe("acct-42");
+        });
+        it("resolveCodexAuthCacheDir rejects a traversal companyId before it builds the path", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            // A traversal companyId must never make the cache root escape the
+            // companies/ directory. Sanitization runs before path construction, so a
+            // relative segment, a path separator, an absolute path, and a NUL byte all
+            // fail loud.
+            expect(() => resolveCodexAuthCacheDir(env, "")).toThrow();
+            expect(() => resolveCodexAuthCacheDir(env, "   ")).toThrow();
+            expect(() => resolveCodexAuthCacheDir(env, "..")).toThrow();
+            expect(() => resolveCodexAuthCacheDir(env, ".")).toThrow();
+            expect(() => resolveCodexAuthCacheDir(env, "../../etc")).toThrow();
+            expect(() => resolveCodexAuthCacheDir(env, "/etc")).toThrow();
+            expect(() => resolveCodexAuthCacheDir(env, "a/b")).toThrow();
+            expect(() => resolveCodexAuthCacheDir(env, "a\\b")).toThrow();
+            expect(() => resolveCodexAuthCacheDir(env, "a\0b")).toThrow();
+            // The clear path inherits the same guard, so a traversal companyId can
+            // never reach rm() on an escaped root.
+            await expect(clearCodexAuthCache(env, "../../etc")).rejects.toThrow();
+            const safeDir = resolveCodexAuthCacheDir(env, "company-a");
+            expect(safeDir).toBe(path.resolve(home, "instances", "default", "companies", "company-a", "codex-auth-cache"));
+        });
+        it("resolveCodexAuthCacheEntryPath rejects an identifier that toAccountHandle rejects", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            // A space, a plus sign, and a leading hyphen all fail the stricter
+            // account-handle allowlist, even though the older denylist alone would
+            // accept some of them.
+            expect(() => resolveCodexAuthCacheEntryPath(env, "acct 42", "company-a")).toThrow();
+            expect(() => resolveCodexAuthCacheEntryPath(env, "acct+42", "company-a")).toThrow();
+            expect(() => resolveCodexAuthCacheEntryPath(env, "-rf", "company-a")).toThrow();
+        });
+        it("resolveCodexAuthCacheEntryPath verifies the resolved path stays under the cache root", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            // A traversal account_id is rejected by toCacheKey, so the resolved entry
+            // path can never escape the cache root.
+            expect(() => resolveCodexAuthCacheEntryPath(env, "../../etc", "company-a")).toThrow();
+            const entryPath = resolveCodexAuthCacheEntryPath(env, "acct-ok", "company-a");
+            const cacheDir = resolveCodexAuthCacheDir(env, "company-a");
+            expect(entryPath.startsWith(cacheDir + path.sep)).toBe(true);
+            expect(entryPath.endsWith(path.join("acct-ok", "auth.json"))).toBe(true);
+        });
+        it("ensureCodexAuthCacheEntryDir creates the cache root and the entry directory private (0700)", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const entryPath = await ensureCodexAuthCacheEntryDir(env, "acct-priv", "company-a");
+            const entryDir = path.dirname(entryPath);
+            const cacheDir = resolveCodexAuthCacheDir(env, "company-a");
+            expect((await lstat(entryDir)).mode & 0o777).toBe(0o700);
+            expect((await lstat(cacheDir)).mode & 0o777).toBe(0o700);
+        });
+        it("the cache root fails closed (lstat) when it is a symlink or a non-directory", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const cacheDir = resolveCodexAuthCacheDir(env, "company-a");
+            // Make the cache root a symlink to another directory. lstat (not stat)
+            // must catch it and fail closed.
+            await mkdir(path.dirname(cacheDir), { recursive: true });
+            const target = path.join(home, "elsewhere");
+            await mkdir(target, { recursive: true });
+            await symlink(target, cacheDir);
+            await expect(ensureCodexAuthCacheEntryDir(env, "acct-x", "company-a")).rejects.toThrow();
+        });
+        it("the entry directory fails closed (lstat) when it is a symlink or a non-directory", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const cacheDir = resolveCodexAuthCacheDir(env, "company-a");
+            await mkdir(cacheDir, { recursive: true, mode: 0o700 });
+            // Put a regular file where the entry directory must be.
+            await writeFile(path.join(cacheDir, "acct-file"), "not a dir", { mode: 0o600 });
+            await expect(ensureCodexAuthCacheEntryDir(env, "acct-file", "company-a")).rejects.toThrow();
+        });
+    });
+    describe("Phase 4: identity-anchored vend", () => {
+        async function stageHostAndCache(input) {
+            const home = await makeInstanceRoot();
+            const env = envFor(home, { CODEX_HOME: path.join(home, "shared-codex") });
+            const sharedHome = resolveSharedCodexHomeDir(env);
+            await mkdir(sharedHome, { recursive: true });
+            const sharedHomeAuthPath = path.join(sharedHome, "auth.json");
+            if (input.hostAuth !== undefined) {
+                await writeFile(sharedHomeAuthPath, input.hostAuth, { mode: 0o600 });
+            }
+            for (const [accountId, auth] of Object.entries(input.cacheAuthByAccount ?? {})) {
+                const entryPath = await ensureCodexAuthCacheEntryDir(env, accountId, "company-a");
+                await writeFile(entryPath, auth, { mode: 0o600 });
+            }
+            return { env, sharedHomeAuthPath };
+        }
+        const resolveEntry = (env) => (accountId) => resolveCodexAuthCacheEntryPath(env, accountId, "company-a");
+        it("vend refreshes the host identity when the cached copy is strictly newer for the same identity", async () => {
+            const { env, sharedHomeAuthPath } = await stageHostAndCache({
+                hostAuth: subscriptionAuth({ accountId: "acct-x", lastRefresh: OLDER, marker: "host" }),
+                cacheAuthByAccount: {
+                    "acct-x": subscriptionAuth({ accountId: "acct-x", lastRefresh: NEWER, marker: "cache" }),
+                },
+            });
+            const outcome = await selectVendCredential(sharedHomeAuthPath, resolveEntry(env), () => undefined, env);
+            expect(outcome).toBe("vended");
+            const finalHost = await readFile(sharedHomeAuthPath, "utf8");
+            expect(finalHost).toContain("acct-x");
+            expect(finalHost).toContain("cache");
+        });
+        it("vend keeps the shared-home credential when the cache copy is older or a tie", async () => {
+            for (const cacheRefresh of [OLDER, NEWER]) {
+                const hostRefresh = cacheRefresh === OLDER ? NEWER : NEWER; // host newer or tie
+                const { env, sharedHomeAuthPath } = await stageHostAndCache({
+                    hostAuth: subscriptionAuth({ accountId: "acct-x", lastRefresh: hostRefresh, marker: "host" }),
+                    cacheAuthByAccount: {
+                        "acct-x": subscriptionAuth({ accountId: "acct-x", lastRefresh: cacheRefresh, marker: "cache" }),
+                    },
+                });
+                const before = await readFile(sharedHomeAuthPath, "utf8");
+                const outcome = await selectVendCredential(sharedHomeAuthPath, resolveEntry(env), () => undefined, env);
+                expect(outcome).toBe("kept-host");
+                expect(await readFile(sharedHomeAuthPath, "utf8")).toBe(before);
+            }
+        });
+        it("vend never selects a cache slot with a different account_id than the host holds", async () => {
+            const { env, sharedHomeAuthPath } = await stageHostAndCache({
+                hostAuth: subscriptionAuth({ accountId: "acct-x", lastRefresh: OLDER, marker: "host" }),
+                cacheAuthByAccount: {
+                    "acct-y": subscriptionAuth({ accountId: "acct-y", lastRefresh: NEWER, marker: "other" }),
+                },
+            });
+            const before = await readFile(sharedHomeAuthPath, "utf8");
+            const outcome = await selectVendCredential(sharedHomeAuthPath, resolveEntry(env), () => undefined, env);
+            expect(outcome).toBe("kept-host");
+            expect(await readFile(sharedHomeAuthPath, "utf8")).toBe(before);
+        });
+        it("vend does nothing when the host shared home has no auth.json (no random pick from the cache)", async () => {
+            const { env, sharedHomeAuthPath } = await stageHostAndCache({
+                cacheAuthByAccount: {
+                    "acct-y": subscriptionAuth({ accountId: "acct-y", lastRefresh: NEWER, marker: "other" }),
+                },
+            });
+            const outcome = await selectVendCredential(sharedHomeAuthPath, resolveEntry(env), () => undefined, env);
+            expect(outcome).toBe("no-host-identity");
+            await expect(lstat(sharedHomeAuthPath)).rejects.toThrow();
+        });
+        it("vend does nothing when the host shared home holds an apikey (no subscription identity)", async () => {
+            const { env, sharedHomeAuthPath } = await stageHostAndCache({
+                hostAuth: JSON.stringify({ OPENAI_API_KEY: "sk-host" }),
+                cacheAuthByAccount: {
+                    "acct-y": subscriptionAuth({ accountId: "acct-y", lastRefresh: NEWER, marker: "other" }),
+                },
+            });
+            const before = await readFile(sharedHomeAuthPath, "utf8");
+            const outcome = await selectVendCredential(sharedHomeAuthPath, resolveEntry(env), () => undefined, env);
+            expect(outcome).toBe("no-host-identity");
+            expect(await readFile(sharedHomeAuthPath, "utf8")).toBe(before);
+        });
+        it("the vend never emits token bytes or a raw account_id to the log", async () => {
+            const { env, sharedHomeAuthPath } = await stageHostAndCache({
+                hostAuth: subscriptionAuth({ accountId: "SECRET-ACCT", lastRefresh: OLDER, marker: "HOST-SENTINEL" }),
+                cacheAuthByAccount: {
+                    "SECRET-ACCT": subscriptionAuth({ accountId: "SECRET-ACCT", lastRefresh: NEWER, marker: "CACHE-SENTINEL" }),
+                },
+            });
+            const logs = [];
+            await selectVendCredential(sharedHomeAuthPath, resolveEntry(env), (line) => {
+                logs.push(line);
+            }, env);
+            const combined = logs.join("\n");
+            expect(combined).not.toContain("SENTINEL");
+            expect(combined).not.toContain("SECRET-ACCT");
+            expect(combined).not.toContain("id-token");
+        });
+    });
+    describe("Phase 5: cache-clear operator action and off-switch", () => {
+        it("clearCodexAuthCacheEntry removes one identity slot and leaves other slots intact", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const keepPath = await ensureCodexAuthCacheEntryDir(env, "acct-keep", "company-a");
+            const dropPath = await ensureCodexAuthCacheEntryDir(env, "acct-drop", "company-a");
+            await writeFile(keepPath, subscriptionAuth({ accountId: "acct-keep" }), { mode: 0o600 });
+            await writeFile(dropPath, subscriptionAuth({ accountId: "acct-drop" }), { mode: 0o600 });
+            await clearCodexAuthCacheEntry(env, "acct-drop", "company-a");
+            await expect(lstat(path.dirname(dropPath))).rejects.toThrow();
+            expect(await readFile(keepPath, "utf8")).toContain("acct-keep");
+        });
+        it("clearCodexAuthCacheEntry rejects an account_id that escapes the cache root", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            await expect(clearCodexAuthCacheEntry(env, "../../etc", "company-a")).rejects.toThrow();
+            await expect(clearCodexAuthCacheEntry(env, "a/b", "company-a")).rejects.toThrow();
+        });
+        it("clearCodexAuthCacheEntry is a benign no-op for a missing slot", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            await expect(clearCodexAuthCacheEntry(env, "acct-absent", "company-a")).resolves.toBeUndefined();
+        });
+        it("clearCodexAuthCache removes every slot", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            await ensureCodexAuthCacheEntryDir(env, "acct-1", "company-a");
+            await ensureCodexAuthCacheEntryDir(env, "acct-2", "company-a");
+            const cacheDir = resolveCodexAuthCacheDir(env, "company-a");
+            expect((await readdir(cacheDir)).sort()).toEqual(["acct-1", "acct-2"]);
+            await clearCodexAuthCache(env, "company-a");
+            await expect(lstat(cacheDir)).rejects.toThrow();
+        });
+        it("isCodexAuthCacheEnabled defaults to on and turns off on an explicit falsy flag", () => {
+            expect(isCodexAuthCacheEnabled({})).toBe(true);
+            expect(isCodexAuthCacheEnabled({ PAPERCLIP_CODEX_AUTH_CACHE: "1" })).toBe(true);
+            expect(isCodexAuthCacheEnabled({ PAPERCLIP_CODEX_AUTH_CACHE: "on" })).toBe(true);
+            expect(isCodexAuthCacheEnabled({ PAPERCLIP_CODEX_AUTH_CACHE: "0" })).toBe(false);
+            expect(isCodexAuthCacheEnabled({ PAPERCLIP_CODEX_AUTH_CACHE: "false" })).toBe(false);
+            expect(isCodexAuthCacheEnabled({ PAPERCLIP_CODEX_AUTH_CACHE: "off" })).toBe(false);
+            expect(isCodexAuthCacheEnabled({ PAPERCLIP_CODEX_AUTH_CACHE: "no" })).toBe(false);
+        });
+    });
+    describe("Phase 6: whole-promotion serialization for one company", () => {
+        it("withCodexAccountHomePromotionLock never overlaps two concurrent callers for the same company", async () => {
+            // The device-login route holds this lock across its whole promotion
+            // sequence: the account-home directory decision, the credential write,
+            // and the secret bind or cleanup that follows. Two different logins for
+            // the SAME Codex account must run that whole sequence one at a time, so
+            // a login can never delete the shared account-home directory while
+            // another login's own sequence is still writing its credential or
+            // binding its own secret to that same directory. This proves the lock
+            // itself enforces that: two concurrent callers for one company never run
+            // their callbacks at the same time, whichever caller goes first.
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const events = [];
+            let releaseFirstCaller;
+            const firstCallerGate = new Promise((resolve) => {
+                releaseFirstCaller = resolve;
+            });
+            const firstCall = withCodexAccountHomePromotionLock(env, "company-shared", async () => {
+                events.push("first-enter");
+                await firstCallerGate;
+                events.push("first-exit");
+                return "first";
+            });
+            // Give the first caller a chance to acquire the lock and enter its
+            // callback before the second caller starts racing for the same lock.
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            const secondCall = withCodexAccountHomePromotionLock(env, "company-shared", async () => {
+                events.push("second-enter");
+                events.push("second-exit");
+                return "second";
+            });
+            // The second caller must stay blocked on the lock while the first
+            // caller still holds it: it must never log `second-enter` before the
+            // first caller's `first-exit`.
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            expect(events).toEqual(["first-enter"]);
+            releaseFirstCaller();
+            const [first, second] = await Promise.all([firstCall, secondCall]);
+            expect(first).toBe("first");
+            expect(second).toBe("second");
+            expect(events).toEqual(["first-enter", "first-exit", "second-enter", "second-exit"]);
+        });
+        it("withCodexAccountHomePromotionLock keeps two different companies independent", async () => {
+            // The lock is per company, so two different companies' device logins
+            // never wait on each other.
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const events = [];
+            let releaseCompanyA;
+            const companyAGate = new Promise((resolve) => {
+                releaseCompanyA = resolve;
+            });
+            const companyACall = withCodexAccountHomePromotionLock(env, "company-a", async () => {
+                events.push("a-enter");
+                await companyAGate;
+                events.push("a-exit");
+            });
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            const companyBCall = withCodexAccountHomePromotionLock(env, "company-b", async () => {
+                events.push("b-enter");
+                events.push("b-exit");
+            });
+            await companyBCall;
+            // Company B's callback ran and finished while company A's callback was
+            // still waiting on its own gate, so the two locks never contended.
+            expect(events).toEqual(["a-enter", "b-enter", "b-exit"]);
+            releaseCompanyA();
+            await companyACall;
+            expect(events).toEqual(["a-enter", "b-enter", "b-exit", "a-exit"]);
+        });
+    });
+    describe("Phase 7: account-home secret-mutation serialization for one company", () => {
+        it("withAccountHomeSecretMutationLock never overlaps two concurrent callers for the same company", async () => {
+            // The secrets service holds this lock for the whole of a `local_encrypted`
+            // secret's create or rotate call, and an account-home cleanup's claimant
+            // scan holds it for the whole of its final check-and-delete step. This
+            // proves the lock itself enforces mutual exclusion between any two
+            // holders for one company, whichever caller goes first.
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const events = [];
+            let releaseFirstCaller;
+            const firstCallerGate = new Promise((resolve) => {
+                releaseFirstCaller = resolve;
+            });
+            const firstCall = withAccountHomeSecretMutationLock(env, "company-shared", async () => {
+                events.push("first-enter");
+                await firstCallerGate;
+                events.push("first-exit");
+                return "first";
+            });
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            const secondCall = withAccountHomeSecretMutationLock(env, "company-shared", async () => {
+                events.push("second-enter");
+                events.push("second-exit");
+                return "second";
+            });
+            // The second caller must stay blocked on the lock while the first
+            // caller still holds it: it must never log `second-enter` before the
+            // first caller's `first-exit`.
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            expect(events).toEqual(["first-enter"]);
+            releaseFirstCaller();
+            const [first, second] = await Promise.all([firstCall, secondCall]);
+            expect(first).toBe("first");
+            expect(second).toBe("second");
+            expect(events).toEqual(["first-enter", "first-exit", "second-enter", "second-exit"]);
+        });
+        it("withAccountHomeSecretMutationLock keeps two different companies independent", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const events = [];
+            let releaseCompanyA;
+            const companyAGate = new Promise((resolve) => {
+                releaseCompanyA = resolve;
+            });
+            const companyACall = withAccountHomeSecretMutationLock(env, "company-a", async () => {
+                events.push("a-enter");
+                await companyAGate;
+                events.push("a-exit");
+            });
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            const companyBCall = withAccountHomeSecretMutationLock(env, "company-b", async () => {
+                events.push("b-enter");
+                events.push("b-exit");
+            });
+            await companyBCall;
+            expect(events).toEqual(["a-enter", "b-enter", "b-exit"]);
+            releaseCompanyA();
+            await companyACall;
+            expect(events).toEqual(["a-enter", "b-enter", "b-exit", "a-exit"]);
+        });
+        it("withAccountHomeSecretMutationLock does not contend with withCodexAccountHomePromotionLock for the same company", async () => {
+            // The two locks use separate lock directories (Security condition: no
+            // shared lock key), so a device-login promotion that holds
+            // `withCodexAccountHomePromotionLock` for its whole sequence can still
+            // call into a secrets-service write that takes this lock without
+            // deadlocking on itself.
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const events = [];
+            await withCodexAccountHomePromotionLock(env, "company-shared", async () => {
+                events.push("promotion-enter");
+                await withAccountHomeSecretMutationLock(env, "company-shared", async () => {
+                    events.push("mutation-enter");
+                    events.push("mutation-exit");
+                });
+                events.push("promotion-exit");
+            });
+            expect(events).toEqual(["promotion-enter", "mutation-enter", "mutation-exit", "promotion-exit"]);
+        });
+    });
+    describe("Phase 8: account-home directory validity before a secret write commits", () => {
+        it("resolves for a value naming a directory that still exists under the cache root", async () => {
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const companyId = "company-still-exists";
+            const entryPath = await ensureCodexAuthCacheEntryDir(env, "acct-still-exists", companyId);
+            const accountHomeDir = path.dirname(entryPath);
+            await expect(assertAccountHomeCacheDirStillValid(env, companyId, accountHomeDir)).resolves.toBeUndefined();
+        });
+        it("rejects a value naming a directory under the cache root that no longer exists", async () => {
+            // This is the shape an account-home cleanup leaves behind: a value that
+            // once named a real directory, now removed. A create or a rotate that
+            // is about to commit this exact value must fail instead of writing a
+            // secret that points at nothing.
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            const companyId = "company-removed";
+            const entryPath = await ensureCodexAuthCacheEntryDir(env, "acct-removed", companyId);
+            const accountHomeDir = path.dirname(entryPath);
+            await rm(accountHomeDir, { recursive: true, force: true });
+            await expect(assertAccountHomeCacheDirStillValid(env, companyId, accountHomeDir)).rejects.toThrow(/no longer exists/);
+        });
+        it("leaves a value alone when it does not sit under this company's cache root", async () => {
+            // Most `local_encrypted` secret values (an API key, a token, a
+            // hand-typed string) never sit under the cache root, so this check must
+            // never reject a write that only happens to name a missing path.
+            const home = await makeInstanceRoot();
+            const env = envFor(home);
+            await expect(assertAccountHomeCacheDirStillValid(env, "company-unrelated", "/some/unrelated/missing/path")).resolves.toBeUndefined();
+        });
+    });
+});
+//# sourceMappingURL=codex-auth-cache.test.js.map

package/dist/server/codex-auth-cache.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-cache.test.js","sourceRoot":"","sources":["../../src/server/codex-auth-cache.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3G,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,OAAO,EACL,mCAAmC,EACnC,mBAAmB,EACnB,wBAAwB,EACxB,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EACxB,8BAA8B,EAC9B,oBAAoB,EACpB,UAAU,EACV,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,iFAAiF;AACjF,2EAA2E;AAC3E,qEAAqE;AACrE,8EAA8E;AAC9E,4EAA4E;AAC5E,sCAAsC;AACtC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,gBAAgB;QAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAC5E,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,MAAM,CAAC,YAAoB,EAAE,KAAK,GAA2B,EAAE;QACtE,OAAO;YACL,cAAc,EAAE,YAAY;YAC5B,qBAAqB,EAAE,SAAS;YAChC,GAAG,KAAK;SACT,CAAC;IACJ,CAAC;IAED,SAAS,gBAAgB,CAAC,KAAmE;QAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;QAC/C,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,MAAM,EAAE;gBACN,QAAQ,EAAE,YAAY,MAAM,EAAE;gBAC9B,YAAY,EAAE,gBAAgB,MAAM,EAAE;gBACtC,aAAa,EAAE,iBAAiB,MAAM,EAAE;gBACxC,UAAU,EAAE,KAAK,CAAC,SAAS;aAC5B;YACD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,CAAC;IACrC,MAAM,KAAK,GAAG,sBAAsB,CAAC;IAErC,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAC7D,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;YACzF,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qHAAqH,EAAE,KAAK,IAAI,EAAE;YACnI,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACnB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CACzF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;YACzG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5E,MAAM,CAAC,oBAAoB,CAAC,GAAG,EAAE,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzF,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/H,MAAM,CACJ,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAChI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACd,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3I,MAAM,CAAC,oBAAoB,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;YAC/G,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,8BAA8B,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAChD,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;YAChG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,kEAAkE;YAClE,yEAAyE;YACzE,2EAA2E;YAC3E,aAAa;YACb,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACnE,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9D,uEAAuE;YACvE,uCAAuC;YACvC,MAAM,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACtE,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAClB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CACzF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;YACjG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,mEAAmE;YACnE,uEAAuE;YACvE,uBAAuB;YACvB,MAAM,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACpF,MAAM,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACpF,MAAM,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;YACpG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,0EAA0E;YAC1E,wCAAwC;YACxC,MAAM,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,8BAA8B,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;YAC1G,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;YACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;YAC3F,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,uEAAuE;YACvE,iCAAiC;YACjC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChC,MAAM,MAAM,CAAC,4BAA4B,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;YAChG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,wDAAwD;YACxD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,MAAM,MAAM,CAAC,4BAA4B,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC/C,KAAK,UAAU,iBAAiB,CAAC,KAGhC;YACC,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;YAC1E,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,SAAS,CAAC,kBAAkB,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/E,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAClF,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,YAAY,GAChB,CAAC,GAAsB,EAAE,EAAE,CAAC,CAAC,SAAiB,EAAE,EAAE,CAChD,8BAA8B,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAEhE,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;YAC7G,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBAC1D,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACvF,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;iBACzF;aACF,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACxG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;YAC3F,KAAK,MAAM,YAAY,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1C,MAAM,WAAW,GAAG,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,oBAAoB;gBAChF,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,iBAAiB,CAAC;oBAC1D,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBAC7F,kBAAkB,EAAE;wBAClB,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;qBAChG;iBACF,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;gBAC1D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBACxG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAClC,MAAM,CAAC,MAAM,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;YAC/F,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBAC1D,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACvF,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;iBACzF;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACxG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;YAC5G,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBAC1D,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;iBACzF;aACF,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACxG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACzC,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;YACtG,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBAC1D,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;gBACvD,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;iBACzF;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACxG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;YAC/E,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBAC1D,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;gBACrG,kBAAkB,EAAE;oBAClB,aAAa,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;iBAC5G;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,YAAY,CAAC,GAAG,CAAC,EACjB,CAAC,IAAI,EAAE,EAAE;gBACP,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,EACD,GAAG,CACJ,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;QACnE,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;YAChG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;YACnF,MAAM,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzF,MAAM,SAAS,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEzF,MAAM,wBAAwB,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9D,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;YAC1F,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACxF,MAAM,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACpF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACnG,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,4BAA4B,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC/D,MAAM,4BAA4B,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5D,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvE,MAAM,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;YACxF,MAAM,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChF,MAAM,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjF,MAAM,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjF,MAAM,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrF,MAAM,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnF,MAAM,CAAC,uBAAuB,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;QACtE,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;YAC5G,oEAAoE;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,mEAAmE;YACnE,kEAAkE;YAClE,sEAAsE;YACtE,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,kBAA+B,CAAC;YACpC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACpD,kBAAkB,GAAG,OAAO,CAAC;YAC/B,CAAC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,iCAAiC,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBACpF,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC3B,MAAM,eAAe,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,iCAAiC,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBACrF,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC3B,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,kEAAkE;YAClE,qEAAqE;YACrE,+BAA+B;YAC/B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAExC,kBAAkB,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;YAC3F,qEAAqE;YACrE,4BAA4B;YAC5B,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,eAA4B,CAAC;YACjC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACjD,eAAe,GAAG,OAAO,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,iCAAiC,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;gBAClF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,MAAM,YAAY,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,iCAAiC,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;gBAClF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,MAAM,YAAY,CAAC;YACnB,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAEzD,eAAe,EAAE,CAAC;YAClB,MAAM,YAAY,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qEAAqE,EAAE,GAAG,EAAE;QACnF,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;YAC5G,2EAA2E;YAC3E,yEAAyE;YACzE,uEAAuE;YACvE,mEAAmE;YACnE,wDAAwD;YACxD,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,kBAA+B,CAAC;YACpC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACpD,kBAAkB,GAAG,OAAO,CAAC;YAC/B,CAAC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,iCAAiC,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBACpF,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC3B,MAAM,eAAe,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,iCAAiC,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBACrF,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC3B,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,kEAAkE;YAClE,qEAAqE;YACrE,+BAA+B;YAC/B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAExC,kBAAkB,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;YAC3F,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,eAA4B,CAAC;YACjC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACjD,eAAe,GAAG,OAAO,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,iCAAiC,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;gBAClF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,MAAM,YAAY,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,iCAAiC,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;gBAClF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,MAAM,YAAY,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAEzD,eAAe,EAAE,CAAC;YAClB,MAAM,YAAY,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gHAAgH,EAAE,KAAK,IAAI,EAAE;YAC9H,sEAAsE;YACtE,2DAA2D;YAC3D,uEAAuE;YACvE,iEAAiE;YACjE,yBAAyB;YACzB,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,MAAM,GAAa,EAAE,CAAC;YAE5B,MAAM,iCAAiC,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBACxE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,MAAM,iCAAiC,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE;oBACxE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC/B,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACnG,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wEAAwE,EAAE,GAAG,EAAE;QACtF,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;YAC9F,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,sBAAsB,CAAC;YACzC,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;YAC1F,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAE/C,MAAM,MAAM,CACV,mCAAmC,CAAC,GAAG,EAAE,SAAS,EAAE,cAAc,CAAC,CACpE,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;YAC7F,wEAAwE;YACxE,sEAAsE;YACtE,qEAAqE;YACrE,iCAAiC;YACjC,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,iBAAiB,CAAC;YACpC,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;YACrF,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAE3D,MAAM,MAAM,CAAC,mCAAmC,CAAC,GAAG,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC/F,kBAAkB,CACnB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;YACzF,+DAA+D;YAC/D,wEAAwE;YACxE,iEAAiE;YACjE,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAEzB,MAAM,MAAM,CACV,mCAAmC,CAAC,GAAG,EAAE,mBAAmB,EAAE,8BAA8B,CAAC,CAC9F,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/codex-auth-copyback.d.ts

@@ -0,0 +1,53 @@
+/** Outcome of a copy-back attempt. No token material is ever surfaced. */
+export type CopyBackCodexAuthOutcome = "copied" | "kept-host";
+export interface CopyBackCodexAuthInput {
+    /**
+     * Reads the sandbox `auth.json` bytes back from the (about-to-be-destroyed)
+     * sandbox. In production this is bound to the managed-runtime restore
+     * context's `readFile` for `${assetDir}/auth.json`.
+     */
+    readSandboxAuth: () => Promise<Buffer>;
+    /**
+     * Absolute path of the shared host credential to (maybe) overwrite — the
+     * symlink *source* the managed Codex homes point their `auth.json` at, never
+     * an in-sandbox or per-agent symlink.
+     */
+    hostAuthPath: string;
+    /** Non-leaking progress sink: receives decision/outcome lines only. */
+    log: (line: string) => void | Promise<void>;
+    /**
+     * Resolves and ensures the per-identity cache slot path for a sandbox
+     * `account_id`. When this is provided AND the cache off-switch is on, the
+     * copy-back also writes the fresher, usable subscription credential into its
+     * per-identity cache slot as a second, additive write, keyed by the real
+     * `account_id`. This is independent of the host default overwrite: it can
+     * write a cache slot for a different identity than the host holds (matrix rows
+     * 1b, 3), and it never touches the host default store. When absent, no cache
+     * write happens.
+     */
+    resolveCacheEntryPath?: (accountId: string) => Promise<string>;
+    /** Environment for the cache off-switch read. Defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Guards, locks, and atomically installs a strictly-newer sandbox Codex
+ * `auth.json` onto the shared host credential at teardown.
+ *
+ * Sequence, all under `withDirectoryMergeLock` on the host target's directory
+ * so a concurrent inbound restore or another copy-back can't interleave:
+ *   1. Read the sandbox credential bytes. A genuinely absent sandbox
+ *      `auth.json` (ENOENT) means there is simply nothing to copy back, so it
+ *      resolves to `kept-host` (benign no-op, host untouched); every other read
+ *      error stays fail-loud.
+ *   2. Stage them to a `0600` temp file on the **same filesystem** as the host
+ *      target (its directory), which doubles as the predicate `source`.
+ *   3. Run the Phase-3 decision predicate (`source` = sandbox temp, `destination`
+ *      = host). Exit 10 → adopt the sandbox copy; exit 20 → keep the host copy.
+ *   4. On exit 10, `rename` the staged temp over the host target — an atomic
+ *      same-directory swap that preserves mode `0600`. On exit 20, discard it.
+ * The staged temp is always removed (rename consumes it on the copy path; the
+ * finally cleans it up otherwise), so a failure never leaves a partial file.
+ * Never logs token bytes — only the decision outcome.
+ */
+export declare function copyBackCodexAuth(input: CopyBackCodexAuthInput): Promise<CopyBackCodexAuthOutcome>;
+//# sourceMappingURL=codex-auth-copyback.d.ts.map

package/dist/server/codex-auth-copyback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-copyback.d.ts","sourceRoot":"","sources":["../../src/server/codex-auth-copyback.ts"],"names":[],"mappings":"AAyBA,0EAA0E;AAC1E,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C;;;;;;;;;OASG;IACH,qBAAqB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAmHxG"}