@tickernelz/paperclip-pro-adapter-codex-local 2026.925.0

package/dist/server/codex-auth-copyback.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-copyback.test.js","sourceRoot":"","sources":["../../src/server/codex-auth-copyback.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxG,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,wDAAwD;AACxD,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,2EAA2E;YAC3E,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,SAAS,gBAAgB,CAAC,KAIzB;QACC,OAAO,IAAI,CAAC,SAAS,CACnB;YACE,MAAM,EAAE;gBACN,QAAQ,EAAE,YAAY,KAAK,CAAC,MAAM,EAAE;gBACpC,YAAY,EAAE,gBAAgB,KAAK,CAAC,MAAM,EAAE;gBAC5C,aAAa,EAAE,iBAAiB,KAAK,CAAC,MAAM,EAAE;gBAC9C,UAAU,EAAE,KAAK,CAAC,SAAS;aAC5B;YACD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,EACD,IAAI,EACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,SAAS,UAAU,CAAC,MAAc;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QAC/E,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,CAAC;IACrC,MAAM,KAAK,GAAG,sBAAsB,CAAC;IAErC,KAAK,UAAU,WAAW,CAAC,KAI1B;QAOC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE/D,MAAM,eAAe,GACnB,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU;YACrC,CAAC,CAAC,KAAK,CAAC,WAAW;YACnB,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAqB,EAAE,MAAM,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,eAAe;YACf,YAAY;YACZ,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/D,MAAM,eAAe,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC1E,CAAC;IAED,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,WAAW,GAAG,gBAAgB,CAAC;YACnC,SAAS,EAAE,WAAW;YACtB,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,wBAAwB;SACjC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC;YAChC,SAAS,EAAE,WAAW;YACtB,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE5D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,0DAA0D;QAC1D,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,wCAAwC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,KAAK,GAA8D;YACvE;gBACE,IAAI,EAAE,KAAK;gBACX,WAAW,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;gBACpG,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;aAC/F;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,WAAW,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;gBACtG,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;aACjG;YACD;gBACE,IAAI,EAAE,8BAA8B;gBACpC,WAAW,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;gBACvF,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;aACnG;YACD;gBACE,IAAI,EAAE,kCAAkC;gBACxC,WAAW,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;gBAC3G,QAAQ,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;aACnG;SACF,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/F,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACvG,MAAM,KAAK,GAA8D;YACvE;gBACE,IAAI,EAAE,sDAAsD;gBAC5D,WAAW,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;gBACvG,QAAQ;aACT;YACD;gBACE,IAAI,EAAE,mDAAmD;gBACzD,WAAW,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;gBACpG,QAAQ,EAAE,UAAU,CAAC,cAAc,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EAAE,UAAU,CAAC,iBAAiB,CAAC;gBAC1C,QAAQ;aACT;YACD;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,WAAW,EAAE,iBAAiB;gBAC9B,QAAQ;aACT;YACD;gBACE,IAAI,EAAE,4BAA4B;gBAClC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;oBAC1B,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACrE,YAAY,EAAE,KAAK;iBACpB,CAAC;gBACF,QAAQ;aACT;YACD;gBACE,IAAI,EAAE,0DAA0D;gBAChE,WAAW,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;gBACtG,QAAQ,EAAE,iBAAiB;aAC5B;SACF,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/F,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,IAAI,GAAa,EAAE,CAAC;QAE1B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;YAC5E,YAAY;YACZ,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;QACvH,8EAA8E;QAC9E,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QACzG,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;QAExC,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,0CAA0C;QACvE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAC9G,MAAM,MAAM,CACV,iBAAiB,CAAC;gBAChB,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;gBAC7D,YAAY;gBACZ,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC;aACd,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAEzG,gFAAgF;QAChF,8EAA8E;QAC9E,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAAE;YAC7F,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,WAAW,EAAE,KAAK,IAAI,EAAE;gBACtB,MAAM,MAAM,CAAC;YACf,CAAC;YACD,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,sDAAsD;QACtD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QACzG,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzD,MAAM,MAAM,CACV,iBAAiB,CAAC;YAChB,eAAe,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YACD,YAAY;YACZ,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC;SACd,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAEvC,MAAM,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,WAAW,GAAG,gBAAgB,CAAC;YACnC,SAAS,EAAE,WAAW;YACtB,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC;YAChC,SAAS,EAAE,WAAW;YACtB,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,eAAe;SACxB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,wEAAwE;AACxE,cAAc;AACd,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,WAAW,CAAC;IAE/B,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,SAAS,gBAAgB,CAAC,KAAkE;QAC1F,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,MAAM,EAAE;gBACN,QAAQ,EAAE,YAAY,KAAK,CAAC,MAAM,EAAE;gBACpC,YAAY,EAAE,gBAAgB,KAAK,CAAC,MAAM,EAAE;gBAC5C,aAAa,EAAE,iBAAiB,KAAK,CAAC,MAAM,EAAE;gBAC9C,UAAU,EAAE,KAAK,CAAC,SAAS;aAC5B;YACD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,SAAS,UAAU,CAAC,MAAc;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,MAAM,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,CAAC;IACrC,MAAM,KAAK,GAAG,sBAAsB,CAAC;IAErC,KAAK,UAAU,OAAO,CAAC,KAAK,GAA2B,EAAE;QAKvD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAC,CAAC;QACtF,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,GAAG,GAAsB;YAC7B,cAAc,EAAE,IAAI;YACpB,qBAAqB,EAAE,SAAS;YAChC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;YAC3C,GAAG,KAAK;SACT,CAAC;QACF,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IACrF,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,KAM3B;QAKC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,SAAS,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC;YACnE,YAAY,EAAE,KAAK,CAAC,kBAAkB;YACtC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YACD,qBAAqB,EAAE,CAAC,SAAS,EAAE,EAAE,CACnC,4BAA4B,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC;YAChE,GAAG,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,GAAG;SACxC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,KAAK,CAC1E,CAAC,KAA4B,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC3F,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAsB,EAAE,SAAiB;QACpE,MAAM,SAAS,GAAG,8BAA8B,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE,CACxE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,iHAAiH,EAAE,KAAK,IAAI,EAAE;QAC/H,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAElG,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAE5E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,oBAAoB;QAC7D,MAAM,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6GAA6G,EAAE,KAAK,IAAI,EAAE;QAC3H,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAE/F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAEtF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kHAAkH,EAAE,KAAK,IAAI,EAAE;QAChI,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAE/F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAEtF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC;QAC7E,MAAM,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB;QAC/E,MAAM,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,4BAA4B;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,KAAK,MAAM,WAAW,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACjE,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACtF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAC3D,+EAA+E;YAC/E,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kHAAkH,EAAE,KAAK,IAAI,EAAE;QAChI,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAE/F,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,WAAW;YACX,QAAQ;YACR,GAAG;YACH,kBAAkB;YAClB,eAAe,EAAE,EAAE,GAAG,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE;SAC7D,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mGAAmG,EAAE,KAAK,IAAI,EAAE;QACjH,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACpD,MAAM,SAAS,CACb,kBAAkB,EAClB,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAC7E,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE,CAC7B,iBAAiB,CAAC;YAChB,eAAe,EAAE,KAAK,IAAI,EAAE,CAC1B,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC;YAC5F,YAAY,EAAE,kBAAkB;YAChC,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC;YACb,qBAAqB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC;YAC9F,GAAG;SACJ,CAAC,CAAC;QACL,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,8BAA8B,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,yDAAyD;QACzD,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC;YACnC,SAAS,EAAE,aAAa;YACxB,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yHAAyH,EAAE,KAAK,IAAI,EAAE;QACvI,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/F,MAAM,SAAS,CAAC,kBAAkB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE/D,2EAA2E;QAC3E,6EAA6E;QAC7E,sEAAsE;QACtE,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,iBAAiB,CAAC;gBAChC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;gBAC7D,YAAY,EAAE,kBAAkB;gBAChC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;oBACZ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;gBACD,qBAAqB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC;gBAC9F,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,qEAAqE;QACrE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,uEAAuE;QACvE,MAAM,CAAC,MAAM,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrE,iEAAiE;QACjE,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QACnE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/F,MAAM,SAAS,CAAC,kBAAkB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE/D,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE5B,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,OAAkE,CAAC;QACvE,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,iBAAiB,CAAC;gBAChC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;gBAC7D,YAAY,EAAE,kBAAkB;gBAChC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;oBACZ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;wBACjD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;oBACpD,CAAC;gBACH,CAAC;gBACD,qBAAqB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC;gBAC9F,GAAG;aACJ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC1B,MAAM,GAAG,KAAK,CAAC;gBACf,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,oEAAoE;QACpE,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/B,4CAA4C;QAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrE,6DAA6D;QAC7D,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,4EAA4E;QAC5E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/codex-auth-merge-decision.cjs

@@ -0,0 +1,170 @@
+const fs = require("fs");
+
+// Co-change notice: parseAuth below mirrors hasUsableAuthPayload in
+// packages/adapters/codex-local/src/server/codex-home.ts. If the auth format
+// changes (new shape, renamed field), update both sites together.
+function parseAuth(filePath) {
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return { kind: "unusable" };
+  }
+
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { kind: "unusable" };
+  }
+
+  if (typeof parsed.OPENAI_API_KEY === "string" && parsed.OPENAI_API_KEY.trim().length > 0) {
+    return { kind: "apikey" };
+  }
+
+  const tokens = parsed.tokens;
+  if (tokens === null || typeof tokens !== "object" || Array.isArray(tokens)) {
+    return { kind: "unusable" };
+  }
+
+  const accountId = typeof tokens.account_id === "string" ? tokens.account_id.trim() : "";
+  const hasTokenMaterial = ["id_token", "access_token", "refresh_token"].some((key) => {
+    const value = tokens[key];
+    return typeof value === "string" && value.trim().length > 0;
+  });
+  if (!accountId || !hasTokenMaterial) {
+    return { kind: "unusable" };
+  }
+
+  const lastRefresh = typeof parsed.last_refresh === "string" ? Date.parse(parsed.last_refresh) : NaN;
+  return {
+    kind: "subscription",
+    accountId,
+    lastRefresh: Number.isFinite(lastRefresh) ? lastRefresh : null,
+  };
+}
+
+// This predicate answers a single, direction-agnostic question: should the
+// caller replace the `destination` auth.json with the `source` auth.json? The
+// caller picks which copy is source and which is destination from its own frame
+// of reference (an inbound restore, an outbound copy-back, …) purely by argument
+// order — there is no `--direction` flag and no hard-coded sandbox/host notion:
+//
+//   argv[0] (first positional)  = source auth.json path
+//   argv[1] (second positional) = destination auth.json path
+//
+// The predicate has two modes, selected by a leading positional flag:
+//
+//   default (no flag) — fail closed to the destination; used by the host default
+//     store, whose fail-closed behavior must never change. An absent or
+//     unusable destination keeps the destination (no seed from empty).
+//   --seed-if-dest-absent — the opt-in cache-slot mode; used only by the
+//     per-identity cache slot helper. It ADDS one behavior on top of the default:
+//     when the destination is unusable (absent or unparseable) AND the source is
+//     a usable subscription credential, use the source (fill the empty slot). It
+//     never relaxes the different-identity, api-key, or unusable-source guards.
+//
+// A leading positional flag (not an environment variable) keeps the mode
+// explicit per call, so a host-default two-path call can never enter seed mode.
+//
+// Exit contract. Exit 10 = use source; exit 20 = keep destination; exit 22 =
+// keep destination, the source `last_refresh` sat further ahead of the host
+// clock than the plausible skew allowance. The predicate only ever reads the
+// two files and exits with a code — it never prints token bytes.
+const USE_SOURCE = 10;
+const KEEP_DESTINATION = 20;
+const IMPLAUSIBLE_LAST_REFRESH = 22;
+const SEED_IF_DEST_ABSENT_FLAG = "--seed-if-dest-absent";
+
+// A `last_refresh` records an event that already happened, so an honest value
+// always sits at or before the host clock. Only clock skew between a sandbox
+// and the host explains a small future value. Five minutes is larger than
+// real skew on a time-synchronised host, and it is short enough that a source
+// which claims a `last_refresh` further ahead than this cannot be trusted.
+const MAX_FUTURE_LAST_REFRESH_SKEW_MS = 5 * 60 * 1000;
+
+// `decide` takes already-parsed `{ kind, accountId, lastRefresh }` shapes plus
+// a caller-supplied `nowMs` and the `seedIfDestAbsent` flag, so a test can
+// drive the exact skew bound without spawning a process and racing wall-clock
+// drift. Guard order, first match wins:
+//   1. Seed mode, the destination is unusable, and the source is a usable
+//      subscription credential -> USE_SOURCE, unless the source fails the
+//      skew bound in step 3 below, in which case the absent slot stays
+//      absent (IMPLAUSIBLE_LAST_REFRESH). A poisoned seed would out-live
+//      every honest refresh, since nothing could ever compare as "strictly
+//      newer" than an unbounded future value, so the bound applies here too.
+//   2. Either side unusable, a kind mismatch, the destination is an api-key
+//      credential, or the two sides carry a different account_id ->
+//      KEEP_DESTINATION.
+//   3. The source `last_refresh` sits further ahead of `nowMs` than
+//      MAX_FUTURE_LAST_REFRESH_SKEW_MS -> IMPLAUSIBLE_LAST_REFRESH. Only the
+//      source is bounded, and only against the caller's clock: the source is
+//      the sandbox-supplied side, so it must never supply the reference time.
+//   4. The source `last_refresh` is strictly greater than the destination's
+//      -> USE_SOURCE.
+//   5. Otherwise (a tie, a null value on either side, or an older source) ->
+//      KEEP_DESTINATION.
+function decide(source, destination, nowMs, seedIfDestAbsent) {
+  const sourceIsImplausible =
+    source.lastRefresh !== null &&
+    source.lastRefresh - nowMs > MAX_FUTURE_LAST_REFRESH_SKEW_MS;
+
+  // Seed mode only: fill an ABSENT (unusable) destination slot from a usable
+  // subscription source. A subscription-kind source is guaranteed usable and to
+  // carry a real account_id (parseAuth returns "subscription" only then), so this
+  // is never a random pick. This branch changes ONLY the destination-unusable
+  // case; the api-key and unusable-source guards below still keep the destination.
+  if (
+    seedIfDestAbsent &&
+    destination.kind === "unusable" &&
+    source.kind === "subscription"
+  ) {
+    return sourceIsImplausible ? IMPLAUSIBLE_LAST_REFRESH : USE_SOURCE;
+  }
+
+  // Fail closed to the destination unless both sides are the same usable,
+  // subscription-kind identity — an unusable side, an api-key credential, a kind
+  // mismatch, or a different account_id all keep the destination copy.
+  if (
+    destination.kind === "unusable" ||
+    source.kind === "unusable" ||
+    source.kind !== destination.kind ||
+    destination.kind === "apikey" ||
+    source.accountId !== destination.accountId
+  ) {
+    return KEEP_DESTINATION;
+  }
+
+  if (sourceIsImplausible) {
+    return IMPLAUSIBLE_LAST_REFRESH;
+  }
+
+  // Use the source credential only when it is strictly fresher: both sides must
+  // carry a parseable last_refresh and the source one must be strictly greater.
+  // Ties and null/unparseable freshness keep the destination copy so a spent
+  // single-use refresh token is never written over a good one.
+  if (
+    source.lastRefresh !== null &&
+    destination.lastRefresh !== null &&
+    source.lastRefresh > destination.lastRefresh
+  ) {
+    return USE_SOURCE;
+  }
+
+  return KEEP_DESTINATION;
+}
+
+if (require.main === module) {
+  const rawArgs = process.argv.slice(2);
+  const seedIfDestAbsent = rawArgs[0] === SEED_IF_DEST_ABSENT_FLAG;
+  const [sourceAuthPath, destinationAuthPath] = seedIfDestAbsent ? rawArgs.slice(1) : rawArgs;
+  const sourceAuth = parseAuth(sourceAuthPath);
+  const destinationAuth = parseAuth(destinationAuthPath);
+  process.exit(decide(sourceAuth, destinationAuth, Date.now(), seedIfDestAbsent));
+}
+
+module.exports = {
+  decide,
+  parseAuth,
+  USE_SOURCE,
+  KEEP_DESTINATION,
+  IMPLAUSIBLE_LAST_REFRESH,
+  MAX_FUTURE_LAST_REFRESH_SKEW_MS,
+};

package/dist/server/codex-auth-merge-decision.d.ts

@@ -0,0 +1,22 @@
+/** Exit code: install the source credential over the destination. */
+export declare const USE_SOURCE_EXIT = 10;
+/** Exit code: keep the destination credential. */
+export declare const KEEP_DESTINATION_EXIT = 20;
+/** Exit code: keep the destination; the source `last_refresh` was implausibly far in the future. */
+export declare const IMPLAUSIBLE_LAST_REFRESH_EXIT = 22;
+export interface DecideCodexAuthMergeOptions {
+    /** Opt in to the cache-slot seed mode: fill an absent destination from a
+     *  usable subscription source. */
+    seedIfDestAbsent?: boolean;
+    /** The caller name that prefixes a predicate error, for example
+     *  `codex auth cache`. */
+    errorLabel: string;
+}
+/**
+ * Runs the shared decision predicate and returns its exit code (10, 20, or
+ * 22). Any other exit, or a failure to run `node`, is a hard failure: this
+ * throws so a broken predicate is never mistaken for a "keep destination"
+ * decision.
+ */
+export declare function decideCodexAuthMerge(sourcePath: string, destinationPath: string, options: DecideCodexAuthMergeOptions): Promise<number>;
+//# sourceMappingURL=codex-auth-merge-decision.d.ts.map

package/dist/server/codex-auth-merge-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-merge-decision.d.ts","sourceRoot":"","sources":["../../src/server/codex-auth-merge-decision.ts"],"names":[],"mappings":"AAyBA,qEAAqE;AACrE,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,oGAAoG;AACpG,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAIhD,MAAM,WAAW,2BAA2B;IAC1C;sCACkC;IAClC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;8BAC0B;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,MAAM,CAAC,CA0BjB"}

package/dist/server/codex-auth-merge-decision.js

@@ -0,0 +1,58 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+const execFile = promisify(execFileCallback);
+// The single identity-and-freshness predicate. Every credential writer that must
+// answer "should the caller replace `destination` with `source`?" runs this one
+// predicate: the inbound restore, the outbound copy-back, the per-identity cache
+// slot, and the device-login promotion. The predicate lives in
+// `codex-auth-merge-decision.cjs`. It reads only the two files, and it exits with
+// a code; it never prints token bytes. Argument order sets source and
+// destination (first = source, second = destination), so the caller frames the
+// direction. Exit 10 = use source; exit 20 = keep destination; exit 22 = keep
+// destination, the source `last_refresh` sat further ahead of the host clock
+// than the plausible skew allowance. The leading `--seed-if-dest-absent` flag
+// adds one behavior: fill an absent destination slot from a usable
+// subscription source. This module gives every caller one shared entry point,
+// so the predicate contract can never drift between callers.
+const DECISION_SCRIPT_PATH = fileURLToPath(new URL("./codex-auth-merge-decision.cjs", import.meta.url));
+const SEED_IF_DEST_ABSENT_FLAG = "--seed-if-dest-absent";
+/** Exit code: install the source credential over the destination. */
+export const USE_SOURCE_EXIT = 10;
+/** Exit code: keep the destination credential. */
+export const KEEP_DESTINATION_EXIT = 20;
+/** Exit code: keep the destination; the source `last_refresh` was implausibly far in the future. */
+export const IMPLAUSIBLE_LAST_REFRESH_EXIT = 22;
+const KNOWN_EXIT_CODES = new Set([USE_SOURCE_EXIT, KEEP_DESTINATION_EXIT, IMPLAUSIBLE_LAST_REFRESH_EXIT]);
+/**
+ * Runs the shared decision predicate and returns its exit code (10, 20, or
+ * 22). Any other exit, or a failure to run `node`, is a hard failure: this
+ * throws so a broken predicate is never mistaken for a "keep destination"
+ * decision.
+ */
+export async function decideCodexAuthMerge(sourcePath, destinationPath, options) {
+    const args = options.seedIfDestAbsent
+        ? [DECISION_SCRIPT_PATH, SEED_IF_DEST_ABSENT_FLAG, sourcePath, destinationPath]
+        : [DECISION_SCRIPT_PATH, sourcePath, destinationPath];
+    try {
+        await execFile("node", args);
+    }
+    catch (error) {
+        const code = error.code;
+        if (typeof code === "number" && KNOWN_EXIT_CODES.has(code)) {
+            return code;
+        }
+        const detail = typeof code === "string"
+            ? `node could not be executed (${code})`
+            : typeof code === "number"
+                ? `unexpected predicate exit code ${code}`
+                : error instanceof Error
+                    ? error.message
+                    : String(error);
+        throw new Error(`${options.errorLabel} decision predicate failed: ${detail}`);
+    }
+    // `execFile` resolved, so the predicate exited 0. The predicate always exits
+    // 10, 20, or 22, so a clean exit 0 is unexpected; fail loud.
+    throw new Error(`${options.errorLabel} decision predicate exited 0 (expected 10, 20, or 22)`);
+}
+//# sourceMappingURL=codex-auth-merge-decision.js.map

package/dist/server/codex-auth-merge-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-merge-decision.js","sourceRoot":"","sources":["../../src/server/codex-auth-merge-decision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,QAAQ,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAE7C,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,+DAA+D;AAC/D,kFAAkF;AAClF,sEAAsE;AACtE,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAC9E,6DAA6D;AAE7D,MAAM,oBAAoB,GAAG,aAAa,CACxC,IAAI,GAAG,CAAC,iCAAiC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAC5D,CAAC;AACF,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAEzD,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,kDAAkD;AAClD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,oGAAoG;AACpG,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,qBAAqB,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAW1G;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,eAAuB,EACvB,OAAoC;IAEpC,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB;QACnC,CAAC,CAAC,CAAC,oBAAoB,EAAE,wBAAwB,EAAE,UAAU,EAAE,eAAe,CAAC;QAC/E,CAAC,CAAC,CAAC,oBAAoB,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GACV,OAAO,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC,+BAA+B,IAAI,GAAG;YACxC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ;gBACxB,CAAC,CAAC,kCAAkC,IAAI,EAAE;gBAC1C,CAAC,CAAC,KAAK,YAAY,KAAK;oBACtB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,UAAU,+BAA+B,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,UAAU,uDAAuD,CAC7E,CAAC;AACJ,CAAC"}

package/dist/server/codex-auth-merge-decision.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=codex-auth-merge-decision.test.d.ts.map

package/dist/server/codex-auth-merge-decision.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-merge-decision.test.d.ts","sourceRoot":"","sources":["../../src/server/codex-auth-merge-decision.test.ts"],"names":[],"mappings":""}

package/dist/server/codex-auth-merge-decision.test.js

@@ -0,0 +1,230 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { afterEach, describe, expect, it } from "vitest";
+const execFile = promisify(execFileCallback);
+// The exact-boundary cases below drive the predicate's pure `decide` function
+// directly (via `require`, never spawning a process), so the skew bound can be
+// tested to the exact millisecond without racing subprocess-spawn wall-clock
+// drift. Every other case in this file drives the REAL `.cjs` through a
+// spawned `node` process (no stub), matching how the wrapper invokes it in
+// production.
+const decisionModule = createRequire(import.meta.url)(fileURLToPath(new URL("./codex-auth-merge-decision.cjs", import.meta.url)));
+const { decide, IMPLAUSIBLE_LAST_REFRESH, MAX_FUTURE_LAST_REFRESH_SKEW_MS } = decisionModule;
+// This suite pins the opt-in seed mode of the single decision predicate. The
+// default (no-flag) call keeps the fail-closed host-default contract unchanged.
+// The leading positional `--seed-if-dest-absent` flag adds one behaviour: fill
+// an ABSENT destination slot from a usable subscription source. The flag never
+// relaxes the different-identity, api-key, or unusable-source guards, and a
+// default two-path call can never enter seed mode.
+describe("codex-auth-merge-decision predicate seed mode", () => {
+    const cleanupDirs = [];
+    afterEach(async () => {
+        while (cleanupDirs.length > 0) {
+            const dir = cleanupDirs.pop();
+            if (!dir)
+                continue;
+            await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+        }
+    });
+    const decisionScriptPath = fileURLToPath(new URL("./codex-auth-merge-decision.cjs", import.meta.url));
+    const USE_SOURCE = 10;
+    const KEEP_DESTINATION = 20;
+    const NEWER = "2026-07-09T02:00:00Z";
+    const OLDER = "2026-07-09T01:00:00Z";
+    function subscriptionAuth(input) {
+        const suffix = input.marker ?? input.accountId;
+        return JSON.stringify({
+            tokens: {
+                id_token: `id-token-${suffix}`,
+                access_token: `access-token-${suffix}`,
+                refresh_token: `refresh-token-${suffix}`,
+                account_id: input.accountId,
+            },
+            ...(input.lastRefresh ? { last_refresh: input.lastRefresh } : {}),
+        });
+    }
+    function apiKeyAuth(marker) {
+        return JSON.stringify({ OPENAI_API_KEY: `sk-${marker}` });
+    }
+    const ABSENT = Symbol("absent");
+    async function runDecision(input) {
+        const dir = await mkdtemp(path.join(os.tmpdir(), "paperclip-codex-seed-decision-"));
+        cleanupDirs.push(dir);
+        const sourcePath = path.join(dir, "source-auth.json");
+        const destinationPath = path.join(dir, "destination-auth.json");
+        await writeFile(sourcePath, input.sourceAuth, { mode: 0o600 });
+        if (input.destinationAuth !== ABSENT) {
+            await writeFile(destinationPath, input.destinationAuth, { mode: 0o600 });
+        }
+        // The flag, when present, is the leading positional argument, parsed before
+        // the two path arguments.
+        const args = input.seed
+            ? [decisionScriptPath, "--seed-if-dest-absent", sourcePath, destinationPath]
+            : [decisionScriptPath, sourcePath, destinationPath];
+        try {
+            await execFile("node", args);
+            return 0;
+        }
+        catch (error) {
+            const failure = error;
+            if (typeof failure.code === "number")
+                return failure.code;
+            throw error;
+        }
+    }
+    it("default mode keeps destination when destination is absent (host-default fail-closed)", async () => {
+        const code = await runDecision({
+            sourceAuth: subscriptionAuth({ accountId: "acct", lastRefresh: NEWER }),
+            destinationAuth: ABSENT,
+        });
+        expect(code).toBe(KEEP_DESTINATION);
+    });
+    it("seed mode uses source when destination is absent and source is a usable subscription credential", async () => {
+        const code = await runDecision({
+            seed: true,
+            sourceAuth: subscriptionAuth({ accountId: "acct", lastRefresh: NEWER }),
+            destinationAuth: ABSENT,
+        });
+        expect(code).toBe(USE_SOURCE);
+    });
+    it("seed mode uses source when destination is unparseable and source is a usable subscription credential", async () => {
+        const code = await runDecision({
+            seed: true,
+            sourceAuth: subscriptionAuth({ accountId: "acct", lastRefresh: NEWER }),
+            destinationAuth: "{not valid json",
+        });
+        expect(code).toBe(USE_SOURCE);
+    });
+    it("seed mode still keeps destination when source is apikey or unusable", async () => {
+        const apikeyCode = await runDecision({
+            seed: true,
+            sourceAuth: apiKeyAuth("source"),
+            destinationAuth: ABSENT,
+        });
+        expect(apikeyCode).toBe(KEEP_DESTINATION);
+        const unusableCode = await runDecision({
+            seed: true,
+            sourceAuth: "{not valid json",
+            destinationAuth: ABSENT,
+        });
+        expect(unusableCode).toBe(KEEP_DESTINATION);
+    });
+    it("seed mode still keeps destination when destination holds a different account_id", async () => {
+        const code = await runDecision({
+            seed: true,
+            sourceAuth: subscriptionAuth({ accountId: "acct-x", lastRefresh: NEWER }),
+            destinationAuth: subscriptionAuth({ accountId: "acct-y", lastRefresh: OLDER }),
+        });
+        expect(code).toBe(KEEP_DESTINATION);
+    });
+    it("seed mode keeps the same-identity strictly-newer contract for a present destination", async () => {
+        const newerCode = await runDecision({
+            seed: true,
+            sourceAuth: subscriptionAuth({ accountId: "acct", lastRefresh: NEWER, marker: "src" }),
+            destinationAuth: subscriptionAuth({ accountId: "acct", lastRefresh: OLDER, marker: "dst" }),
+        });
+        expect(newerCode).toBe(USE_SOURCE);
+        const tieCode = await runDecision({
+            seed: true,
+            sourceAuth: subscriptionAuth({ accountId: "acct", lastRefresh: NEWER, marker: "src" }),
+            destinationAuth: subscriptionAuth({ accountId: "acct", lastRefresh: NEWER, marker: "dst" }),
+        });
+        expect(tieCode).toBe(KEEP_DESTINATION);
+    });
+    it("the leading positional --seed-if-dest-absent flag is parsed before the two path arguments; a default two-path call never enters seed mode", async () => {
+        // Identical inputs; only the leading flag differs. Absent destination:
+        // default keeps, seed uses source. This proves a host-default two-path call
+        // (no flag) can never seed.
+        const defaultCode = await runDecision({
+            sourceAuth: subscriptionAuth({ accountId: "acct", lastRefresh: NEWER }),
+            destinationAuth: ABSENT,
+        });
+        const seedCode = await runDecision({
+            seed: true,
+            sourceAuth: subscriptionAuth({ accountId: "acct", lastRefresh: NEWER }),
+            destinationAuth: ABSENT,
+        });
+        expect(defaultCode).toBe(KEEP_DESTINATION);
+        expect(seedCode).toBe(USE_SOURCE);
+    });
+});
+// This suite pins the host-clock bound on the source `last_refresh`. A
+// `last_refresh` records an event that already happened, so an honest value
+// never sits far ahead of the host clock; only clock skew explains a small
+// future value. A source that claims a value further ahead than
+// `MAX_FUTURE_LAST_REFRESH_SKEW_MS` cannot be trusted, since a same-account
+// sandbox that controls its own `auth.json` could otherwise pin an unbounded
+// future timestamp that every later honest refresh compares as older than.
+// These cases drive `decide` directly with an explicit `nowMs`, so the bound
+// is proven to the exact millisecond and never depends on the real clock.
+describe("codex-auth-merge-decision predicate: host-clock bound on last_refresh", () => {
+    const USE_SOURCE = 10;
+    const KEEP_DESTINATION = 20;
+    function subscription(accountId, lastRefresh) {
+        return { kind: "subscription", accountId, lastRefresh };
+    }
+    it("keeps the destination when the source last_refresh sits one millisecond beyond the bound", () => {
+        const nowMs = Date.now();
+        const source = subscription("acct", nowMs + MAX_FUTURE_LAST_REFRESH_SKEW_MS + 1);
+        const destination = subscription("acct", nowMs - 60_000);
+        expect(decide(source, destination, nowMs, false)).toBe(IMPLAUSIBLE_LAST_REFRESH);
+    });
+    it("uses the source when the source last_refresh sits exactly at the bound", () => {
+        const nowMs = Date.now();
+        const source = subscription("acct", nowMs + MAX_FUTURE_LAST_REFRESH_SKEW_MS);
+        const destination = subscription("acct", nowMs - 60_000);
+        expect(decide(source, destination, nowMs, false)).toBe(USE_SOURCE);
+    });
+    it("still uses the source for an ordinary same-account, strictly-newer, past timestamp", () => {
+        const nowMs = Date.now();
+        const source = subscription("acct", nowMs - 60_000);
+        const destination = subscription("acct", nowMs - 120_000);
+        expect(decide(source, destination, nowMs, false)).toBe(USE_SOURCE);
+    });
+    it("measures the bound against the host clock and not against a value embedded in either payload", () => {
+        // Fixed instants; only the caller-supplied `nowMs` moves between the two
+        // assertions, so a passing/failing bound can only be explained by the
+        // caller's clock, never by a value embedded in either payload.
+        const sourceLastRefresh = 2_000_000_000_000;
+        const destinationLastRefresh = 1_000_000_000_000;
+        const source = subscription("acct", sourceLastRefresh);
+        const destination = subscription("acct", destinationLastRefresh);
+        expect(decide(source, destination, sourceLastRefresh - MAX_FUTURE_LAST_REFRESH_SKEW_MS, false)).toBe(USE_SOURCE);
+        expect(decide(source, destination, sourceLastRefresh - MAX_FUTURE_LAST_REFRESH_SKEW_MS - 1, false)).toBe(IMPLAUSIBLE_LAST_REFRESH);
+    });
+    it("keeps the destination for a same-identity source whose kind or account guard would otherwise fire, regardless of the bound", () => {
+        // A kind mismatch or a different account_id already keeps the destination
+        // before the bound runs, so an implausible source never surfaces as
+        // IMPLAUSIBLE_LAST_REFRESH when a different guard already applies.
+        const nowMs = Date.now();
+        const implausibleLastRefresh = nowMs + MAX_FUTURE_LAST_REFRESH_SKEW_MS + 1;
+        const differentAccount = decide(subscription("acct-x", implausibleLastRefresh), subscription("acct-y", nowMs - 60_000), nowMs, false);
+        expect(differentAccount).toBe(KEEP_DESTINATION);
+    });
+    // Seed mode fills an ABSENT destination slot from a usable subscription
+    // source. The bound applies there too: an absent destination that got
+    // seeded with an implausible future last_refresh would never be
+    // refreshable again, since no later honest refresh could ever compare as
+    // "strictly newer" than an unbounded future value. The seed-mode source in
+    // production is the sandbox's own `auth.json`
+    // (see `writeCodexAuthCacheEntry` in codex-auth-cache.ts), so this is the
+    // same untrusted input the write-back guard defends against.
+    it("seed mode keeps an absent destination slot absent when the source last_refresh is implausibly far in the future", () => {
+        const nowMs = Date.now();
+        const source = subscription("acct", nowMs + MAX_FUTURE_LAST_REFRESH_SKEW_MS + 1);
+        const destination = { kind: "unusable", lastRefresh: null };
+        expect(decide(source, destination, nowMs, true)).toBe(IMPLAUSIBLE_LAST_REFRESH);
+    });
+    it("seed mode still fills an absent destination slot when the source last_refresh sits at or before the bound", () => {
+        const nowMs = Date.now();
+        const source = subscription("acct", nowMs + MAX_FUTURE_LAST_REFRESH_SKEW_MS);
+        const destination = { kind: "unusable", lastRefresh: null };
+        expect(decide(source, destination, nowMs, true)).toBe(USE_SOURCE);
+    });
+});
+//# sourceMappingURL=codex-auth-merge-decision.test.js.map

package/dist/server/codex-auth-merge-decision.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-merge-decision.test.js","sourceRoot":"","sources":["../../src/server/codex-auth-merge-decision.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,MAAM,QAAQ,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAE7C,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,wEAAwE;AACxE,2EAA2E;AAC3E,cAAc;AACd,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CACnD,aAAa,CAAC,IAAI,GAAG,CAAC,iCAAiC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAY3E,CAAC;AACF,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,GAAG,cAAc,CAAC;AAE7F,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,mDAAmD;AACnD,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,aAAa,CACtC,IAAI,GAAG,CAAC,iCAAiC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAC5D,CAAC;IAEF,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,gBAAgB,GAAG,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,sBAAsB,CAAC;IACrC,MAAM,KAAK,GAAG,sBAAsB,CAAC;IAErC,SAAS,gBAAgB,CAAC,KAAmE;QAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;QAC/C,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,MAAM,EAAE;gBACN,QAAQ,EAAE,YAAY,MAAM,EAAE;gBAC9B,YAAY,EAAE,gBAAgB,MAAM,EAAE;gBACtC,aAAa,EAAE,iBAAiB,MAAM,EAAE;gBACxC,UAAU,EAAE,KAAK,CAAC,SAAS;aAC5B;YACD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,SAAS,UAAU,CAAC,MAAc;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,MAAM,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEhC,KAAK,UAAU,WAAW,CAAC,KAI1B;QACC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAC,CAAC;QACpF,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACtD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAChE,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;YACrC,MAAM,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,4EAA4E;QAC5E,0BAA0B;QAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;YACrB,CAAC,CAAC,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,UAAU,EAAE,eAAe,CAAC;YAC5E,CAAC,CAAC,CAAC,kBAAkB,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAA2B,CAAC;YAC5C,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;YAC7B,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YACvE,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;QAC/G,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;YAC7B,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YACvE,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;QACpH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;YAC7B,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YACvE,eAAe,EAAE,iBAAiB;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC;YACnC,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC;YAChC,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAE1C,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;YACrC,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,iBAAiB;YAC7B,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;YAC7B,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YACzE,eAAe,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC;YAClC,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACtF,eAAe,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SAC5F,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACtF,eAAe,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SAC5F,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2IAA2I,EAAE,KAAK,IAAI,EAAE;QACzJ,uEAAuE;QACvE,4EAA4E;QAC5E,4BAA4B;QAC5B,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC;YACpC,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YACvE,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;YACjC,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YACvE,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,uEAAuE;AACvE,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,QAAQ,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACrF,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,gBAAgB,GAAG,EAAE,CAAC;IAE5B,SAAS,YAAY,CAAC,SAAiB,EAAE,WAA0B;QACjE,OAAO,EAAE,IAAI,EAAE,cAAuB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACnE,CAAC;IAED,EAAE,CAAC,0FAA0F,EAAE,GAAG,EAAE;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,GAAG,+BAA+B,GAAG,CAAC,CAAC,CAAC;QACjF,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,GAAG,+BAA+B,CAAC,CAAC;QAC7E,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,GAAG,EAAE;QACtG,yEAAyE;QACzE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;QAC5C,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;QACjD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QAEjE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,GAAG,+BAA+B,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,GAAG,+BAA+B,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CACtG,wBAAwB,CACzB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4HAA4H,EAAE,GAAG,EAAE;QACpI,0EAA0E;QAC1E,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,sBAAsB,GAAG,KAAK,GAAG,+BAA+B,GAAG,CAAC,CAAC;QAC3E,MAAM,gBAAgB,GAAG,MAAM,CAC7B,YAAY,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAC9C,YAAY,CAAC,QAAQ,EAAE,KAAK,GAAG,MAAM,CAAC,EACtC,KAAK,EACL,KAAK,CACN,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,yEAAyE;IACzE,2EAA2E;IAC3E,8CAA8C;IAC9C,0EAA0E;IAC1E,6DAA6D;IAC7D,EAAE,CAAC,iHAAiH,EAAE,GAAG,EAAE;QACzH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,GAAG,+BAA+B,GAAG,CAAC,CAAC,CAAC;QACjF,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,UAAmB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2GAA2G,EAAE,GAAG,EAAE;QACnH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,GAAG,+BAA+B,CAAC,CAAC;QAC7E,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,UAAmB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/codex-auth-merge-extract.sh

@@ -0,0 +1,73 @@
+#!/bin/sh
+
+if [ "$#" -ne 2 ]; then
+  echo "Usage: codex-auth-merge-extract.sh <asset-dir> <asset-tar>" >&2
+  exit 1
+fi
+
+asset_dir=$1
+asset_tar=$2
+auth_name=auth.json
+stage_root="$asset_dir.paperclip-extract.$$"
+stage_dir="$stage_root/stage"
+preserve_dir="$stage_root/preserve"
+sandbox_auth="$asset_dir/$auth_name"
+host_auth="$stage_dir/$auth_name"
+preserve_auth="$preserve_dir/$auth_name"
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P) || exit 1
+decision_script="$script_dir/codex-auth-merge-decision.cjs"
+
+cleanup() {
+  rm -rf "$stage_root" "$asset_tar"
+}
+trap cleanup EXIT HUP INT TERM
+rm -rf "$stage_root" &&
+mkdir -p "$stage_dir" "$preserve_dir" &&
+tar -xf "$asset_tar" -C "$stage_dir" || exit 1
+
+keep_sandbox=0
+if [ -f "$sandbox_auth" ]; then
+  if command -v node >/dev/null 2>&1; then
+    node "$decision_script" "$sandbox_auth" "$host_auth"
+    decision_rc=$?
+    if [ "$decision_rc" -eq 10 ]; then
+      keep_sandbox=1
+    else
+      keep_sandbox=0
+    fi
+  else
+    echo "[paperclip] node not found in PATH; cannot evaluate auth-merge decision - aborting sandbox restore" >&2
+    exit 1
+  fi
+fi
+
+if [ "$keep_sandbox" -eq 1 ]; then
+  if ! ( umask 077 && rm -f "$preserve_auth" && cat "$sandbox_auth" > "$preserve_auth" ); then
+    keep_sandbox=0
+  fi
+fi
+
+rm -rf "$asset_dir" || exit 1
+mkdir -p "$asset_dir" || exit 1
+find "$stage_dir" -mindepth 1 -maxdepth 1 ! -name "$auth_name" -exec mv -f -- {} "$asset_dir/" \; || exit 1
+
+source_auth="$host_auth"
+if [ "$keep_sandbox" -eq 1 ] && [ -f "$preserve_auth" ]; then
+  source_auth="$preserve_auth"
+fi
+
+# When neither the shipped host home nor a preserved prior-lease credential
+# provides auth.json, fall back to the sandbox image's own Codex login so an
+# image signed in to Codex works on hosts with no credentials (managed cloud
+# hosts never have one). Host and preserved credentials always win over the
+# image login, preserving the existing shadowing precedence.
+if [ ! -f "$source_auth" ] && [ -f "${HOME:-/nonexistent}/.codex/$auth_name" ]; then
+  source_auth="${HOME:-/nonexistent}/.codex/$auth_name"
+fi
+
+if [ -f "$source_auth" ]; then
+  target_auth="$asset_dir/$auth_name"
+  target_tmp="$asset_dir/.auth.json.paperclip.$$"
+  ( umask 077 && rm -f "$target_tmp" && cat "$source_auth" > "$target_tmp" ) || exit 1
+  mv -f "$target_tmp" "$target_auth" || exit 1
+fi