@tickernelz/paperclip-pro-adapter-grok-local 2026.925.0

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2025 Paperclip AI
+Copyright (c) 2026 Zhafron Adani Kautsar (paperclip-pro fork modifications)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/cli/format-event.d.ts

@@ -0,0 +1,2 @@
+export declare function printGrokStreamEvent(raw: string, _debug: boolean): void;
+//# sourceMappingURL=format-event.d.ts.map

package/dist/cli/format-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-event.d.ts","sourceRoot":"","sources":["../../src/cli/format-event.ts"],"names":[],"mappings":"AAWA,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CA+CvE"}

package/dist/cli/format-event.js

@@ -0,0 +1,55 @@
+import pc from "picocolors";
+function asRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    return value;
+}
+function asString(value, fallback = "") {
+    return typeof value === "string" ? value : fallback;
+}
+export function printGrokStreamEvent(raw, _debug) {
+    const line = raw.trim();
+    if (!line)
+        return;
+    let parsed = null;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        console.log(line);
+        return;
+    }
+    const type = asString(parsed.type).trim();
+    if (type === "thought") {
+        const text = asString(parsed.data);
+        if (text)
+            console.log(pc.gray(`thinking: ${text}`));
+        return;
+    }
+    if (type === "text") {
+        const text = asString(parsed.data);
+        if (text)
+            console.log(pc.green(`assistant: ${text}`));
+        return;
+    }
+    if (type === "end") {
+        const stopReason = asString(parsed.stopReason);
+        const sessionId = asString(parsed.sessionId);
+        const details = [stopReason ? `stopReason=${stopReason}` : "", sessionId ? `session=${sessionId}` : ""]
+            .filter(Boolean)
+            .join(" ");
+        console.log(pc.blue(`Grok run completed${details ? ` (${details})` : ""}`));
+        return;
+    }
+    if (type === "error") {
+        const text = asString(parsed.data) ||
+            asString(parsed.message) ||
+            asString(parsed.error) ||
+            "Grok error";
+        console.log(pc.red(`error: ${text}`));
+        return;
+    }
+    const payload = asRecord(parsed);
+    console.log(pc.gray(`event: ${type || "unknown"} ${payload ? JSON.stringify(payload) : line}`));
+}
+//# sourceMappingURL=format-event.js.map

package/dist/cli/format-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-event.js","sourceRoot":"","sources":["../../src/cli/format-event.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,QAAQ,GAAG,EAAE;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,MAAe;IAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,IAAI,MAAM,GAAmC,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpG,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,GACR,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;YACxB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YACtB,YAAY,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC"}

package/dist/cli/format-event.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=format-event.test.d.ts.map

package/dist/cli/format-event.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-event.test.d.ts","sourceRoot":"","sources":["../../src/cli/format-event.test.ts"],"names":[],"mappings":""}

package/dist/cli/format-event.test.js

@@ -0,0 +1,19 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { printGrokStreamEvent } from "./format-event.js";
+describe("printGrokStreamEvent", () => {
+    const spy = vi.spyOn(console, "log").mockImplementation(() => { });
+    afterEach(() => {
+        spy.mockClear();
+    });
+    it("prints thought/text/end events", () => {
+        printGrokStreamEvent(JSON.stringify({ type: "thought", data: "Plan" }), false);
+        printGrokStreamEvent(JSON.stringify({ type: "text", data: "hello" }), false);
+        printGrokStreamEvent(JSON.stringify({ type: "end", stopReason: "EndTurn", sessionId: "sess-1" }), false);
+        expect(spy.mock.calls.flat()).toEqual(expect.arrayContaining([
+            expect.stringContaining("thinking: Plan"),
+            expect.stringContaining("assistant: hello"),
+            expect.stringContaining("Grok run completed"),
+        ]));
+    });
+});
+//# sourceMappingURL=format-event.test.js.map

package/dist/cli/format-event.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format-event.test.js","sourceRoot":"","sources":["../../src/cli/format-event.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAElE,SAAS,CAAC,GAAG,EAAE;QACb,GAAG,CAAC,SAAS,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/E,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7E,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAEzG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CACnC,MAAM,CAAC,eAAe,CAAC;YACrB,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YACzC,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;YAC3C,MAAM,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;SAC9C,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+export { printGrokStreamEvent } from "./format-event.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,2 @@
+export { printGrokStreamEvent } from "./format-event.js";
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export declare const type = "grok_local";
+export declare const label = "Grok Build";
+export declare const DEFAULT_GROK_LOCAL_MODEL = "grok-build";
+export declare const models: {
+    id: string;
+    label: string;
+}[];
+export declare function grokLocalReasoningEffortsForModel(model: string): readonly string[];
+export declare const agentConfigurationDoc = "# grok_local agent configuration\n\nAdapter: grok_local\n\nUse when:\n- You want Paperclip to run the native Grok Build CLI locally on the host machine\n- You want resumable Grok sessions across heartbeats via `--resume`\n- You want Paperclip-managed instructions and skills staged into the execution workspace using Grok's native discovery paths (`Agents.md` and `.claude/skills`)\n\nDon't use when:\n- You need a webhook-style external invocation (use http or openclaw_gateway)\n- You only need a one-shot script without an AI coding agent loop (use process)\n- Grok CLI is not installed or authenticated on the machine that runs Paperclip\n\nCore fields:\n- cwd (string, optional): default absolute working directory fallback for the agent process (created if missing when possible)\n- instructionsFilePath (string, optional): absolute path to a markdown instructions file. Paperclip stages it into the execution workspace as `Agents.md` when safe, otherwise falls back to `--rules @file`\n- promptTemplate (string, optional): run prompt template\n- model (string, optional): Grok model id. Defaults to grok-build.\n- permissionMode (string, optional): Grok permission mode passed via `--permission-mode`. Unset by default: Grok >= 1.0 enforces `dontAsk` as deny-by-default and it overrides `--always-approve`, so unattended runs rely on `--always-approve` alone unless you explicitly need a mode\n- reasoningEffort (string, optional): Grok reasoning effort (low|medium|high; grok-4.7 and grok-4.6 also accept xhigh) passed via `--reasoning-effort`\n- maxTurns (number, optional): maximum agent turns for the run\n- command (string, optional): defaults to \"grok\"\n- extraArgs (string[], optional): additional CLI args\n- env (object, optional): KEY=VALUE environment variables\n\nOperational fields:\n- timeoutSec (number, optional): run timeout in seconds\n- graceSec (number, optional): SIGTERM grace period in seconds\n\nNotes:\n- Runs use `grok --single` with `--output-format streaming-json`.\n- Sessions resume with `--resume <sessionId>` when the saved session cwd matches the current cwd.\n- Paperclip stages desired runtime skills into `.claude/skills` inside the execution workspace so Grok discovers them as project skills.\n- Use `grok models` to inspect authentication and available models on the host.\n- Local subscription runs use the host `grok login` (`~/.grok`) until the company Grok home has a usable `auth.json` (sandbox device login). `XAI_API_KEY` authenticates without a home. Remote/sandbox runs never fall back to the host login.\n- Without a usable company login, local runs preserve an inherited or configured `GROK_HOME`. Managed AI connections keep their selected home. An explicit empty `XAI_API_KEY` clears an inherited key and selects subscription authentication.\n";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,IAAI,eAAe,CAAC;AACjC,eAAO,MAAM,KAAK,eAAe,CAAC;AAElC,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD,eAAO,MAAM,MAAM;;;GAKlB,CAAC;AAEF,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAIlF;AAED,eAAO,MAAM,qBAAqB,yvFAqCjC,CAAC"}

package/dist/index.js

@@ -0,0 +1,53 @@
+export const type = "grok_local";
+export const label = "Grok Build";
+export const DEFAULT_GROK_LOCAL_MODEL = "grok-build";
+export const models = [
+    { id: DEFAULT_GROK_LOCAL_MODEL, label: DEFAULT_GROK_LOCAL_MODEL },
+    { id: "grok-4.7", label: "Grok 4.7" },
+    { id: "grok-4.6", label: "Grok 4.6" },
+    { id: "grok-4.5", label: "Grok 4.5" },
+];
+export function grokLocalReasoningEffortsForModel(model) {
+    return model.trim() === "grok-4.7" || model.trim() === "grok-4.6"
+        ? ["low", "medium", "high", "xhigh"]
+        : ["low", "medium", "high"];
+}
+export const agentConfigurationDoc = `# grok_local agent configuration
+
+Adapter: grok_local
+
+Use when:
+- You want Paperclip to run the native Grok Build CLI locally on the host machine
+- You want resumable Grok sessions across heartbeats via \`--resume\`
+- You want Paperclip-managed instructions and skills staged into the execution workspace using Grok's native discovery paths (\`Agents.md\` and \`.claude/skills\`)
+
+Don't use when:
+- You need a webhook-style external invocation (use http or openclaw_gateway)
+- You only need a one-shot script without an AI coding agent loop (use process)
+- Grok CLI is not installed or authenticated on the machine that runs Paperclip
+
+Core fields:
+- cwd (string, optional): default absolute working directory fallback for the agent process (created if missing when possible)
+- instructionsFilePath (string, optional): absolute path to a markdown instructions file. Paperclip stages it into the execution workspace as \`Agents.md\` when safe, otherwise falls back to \`--rules @file\`
+- promptTemplate (string, optional): run prompt template
+- model (string, optional): Grok model id. Defaults to grok-build.
+- permissionMode (string, optional): Grok permission mode passed via \`--permission-mode\`. Unset by default: Grok >= 1.0 enforces \`dontAsk\` as deny-by-default and it overrides \`--always-approve\`, so unattended runs rely on \`--always-approve\` alone unless you explicitly need a mode
+- reasoningEffort (string, optional): Grok reasoning effort (low|medium|high; grok-4.7 and grok-4.6 also accept xhigh) passed via \`--reasoning-effort\`
+- maxTurns (number, optional): maximum agent turns for the run
+- command (string, optional): defaults to "grok"
+- extraArgs (string[], optional): additional CLI args
+- env (object, optional): KEY=VALUE environment variables
+
+Operational fields:
+- timeoutSec (number, optional): run timeout in seconds
+- graceSec (number, optional): SIGTERM grace period in seconds
+
+Notes:
+- Runs use \`grok --single\` with \`--output-format streaming-json\`.
+- Sessions resume with \`--resume <sessionId>\` when the saved session cwd matches the current cwd.
+- Paperclip stages desired runtime skills into \`.claude/skills\` inside the execution workspace so Grok discovers them as project skills.
+- Use \`grok models\` to inspect authentication and available models on the host.
+- Local subscription runs use the host \`grok login\` (\`~/.grok\`) until the company Grok home has a usable \`auth.json\` (sandbox device login). \`XAI_API_KEY\` authenticates without a home. Remote/sandbox runs never fall back to the host login.
+- Without a usable company login, local runs preserve an inherited or configured \`GROK_HOME\`. Managed AI connections keep their selected home. An explicit empty \`XAI_API_KEY\` clears an inherited key and selects subscription authentication.
+`;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,CAAC;AACjC,MAAM,CAAC,MAAM,KAAK,GAAG,YAAY,CAAC;AAElC,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAErD,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACjE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;IACrC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;IACrC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;CACtC,CAAC;AAEF,MAAM,UAAU,iCAAiC,CAAC,KAAa;IAC7D,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,UAAU;QAC/D,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;QACpC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCpC,CAAC"}

package/dist/server/adapter-auth-promotion.d.ts

@@ -0,0 +1,87 @@
+import { type GrokAuthPayload } from "./grok-home.js";
+/** The independent readiness result for the exact staged credential. */
+export interface CredentialReadinessResult {
+    /** True when a run launched now with this exact credential would authenticate. */
+    ready: boolean;
+    /** An optional non-secret reason code for a non-ready result. */
+    reason?: string;
+}
+/** Thrown when the independent readiness check does not return a ready result.
+ *  The service maps this to a failed session and still deletes the sandbox. */
+export declare class DeviceLoginReadinessError extends Error {
+    readonly reason: string;
+    constructor(reason: string);
+}
+/**
+ * The independent readiness check for a staged Grok device-login credential. It
+ * runs on the exact staged bytes, before any promotion write. It writes the
+ * bytes to a throwaway private home and runs the same usable-auth predicate the
+ * execute path uses. It always removes the throwaway home before it returns.
+ *
+ * It never uses the `grok models` exit code: that command exits `0` whether or
+ * not the user is authenticated, so it is not a usable auth signal.
+ */
+export declare function checkStagedGrokCredentialReadiness(authBytes: Buffer): Promise<CredentialReadinessResult>;
+/**
+ * Validates the bounded-size, single-identity-key auth shape. Rejects an
+ * empty, an oversized, an invalid-JSON, a no-key, a multi-key, and an
+ * unusable-value payload. Never puts credential bytes into the thrown error.
+ */
+export declare function assertUsableGrokAuthShape(authBytes: Buffer): GrokAuthPayload;
+/**
+ * The promotion outcome.
+ *
+ * - `promoted`: the helper wrote the company home, either seeding an empty home
+ *   or installing a strictly-newer same-account credential.
+ * - `kept`: the login carried the SAME account as the company home, and the
+ *   home already held a same-identity credential that is not older than the
+ *   one this login produced (a tie, or the home credential is newer), so the
+ *   helper kept the home. This IS a successful authentication: a later run
+ *   vends and uses the same account.
+ * - `kept_foreign_identity`: the company home is occupied and this step could
+ *   not confirm it holds the same account — either a DIFFERENT account already
+ *   occupies it, or the existing file is present but this step cannot read it
+ *   as a usable Grok credential (an unreadable or unparseable file fails
+ *   closed the same way). The helper never clobbers an occupied home, so it
+ *   wrote nothing. This is NOT a successful authentication; the caller must
+ *   fail the session.
+ * - `not_sole_owner`: the sole-active-owner gate rejected the write. Nothing
+ *   was written.
+ * - `background_skipped`: the user-initiated gate rejected the write (an
+ *   automatic background path never seeds a company slot). Nothing was written.
+ */
+export type PromoteGrokDeviceLoginCredentialOutcome = "promoted" | "kept" | "kept_foreign_identity" | "not_sole_owner" | "background_skipped";
+export interface PromoteGrokDeviceLoginCredentialInput {
+    /** The exact staged credential bytes the login sandbox produced. */
+    authBytes: Buffer;
+    /** The company that owns this login. It must be a single safe path segment. */
+    companyId: string;
+    /**
+     * True when a user started this login. Only a user-initiated login seeds the
+     * company slot; an automatic background path never seeds it.
+     */
+    userInitiated: boolean;
+    /**
+     * The independent, machine-readable readiness check. It runs on the exact
+     * staged credential before any write. A non-ready result rejects the
+     * promotion (the session fails), and the helper writes nothing.
+     */
+    checkReadiness: (authBytes: Buffer) => Promise<CredentialReadinessResult> | CredentialReadinessResult;
+    /**
+     * Resolves true only while this session still holds the sole active claim on
+     * `(company_id, adapter_type)`. The helper writes only when it resolves true.
+     */
+    isSoleActiveOwner: () => Promise<boolean> | boolean;
+    /** A non-leaking progress sink. It receives only fixed status lines. */
+    log: (line: string) => void | Promise<void>;
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Promotes a Grok device-login credential into the company scope. The order is
+ * fixed: readiness check, credential validation, the user-initiated gate, the
+ * sole-active-owner gate, then the write. The readiness check and the write run
+ * while the caller still holds the active claim, so a second session cannot
+ * race the same slot.
+ */
+export declare function promoteGrokDeviceLoginCredential(input: PromoteGrokDeviceLoginCredentialInput): Promise<PromoteGrokDeviceLoginCredentialOutcome>;
+//# sourceMappingURL=adapter-auth-promotion.d.ts.map

package/dist/server/adapter-auth-promotion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-auth-promotion.d.ts","sourceRoot":"","sources":["../../src/server/adapter-auth-promotion.ts"],"names":[],"mappings":"AAKA,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA8CxB,wEAAwE;AACxE,MAAM,WAAW,yBAAyB;IACxC,kFAAkF;IAClF,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;+EAC+E;AAC/E,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,YAAY,MAAM,EAAE,MAAM,EAIzB;CACF;AAOD;;;;;;;;GAQG;AACH,wBAAsB,kCAAkC,CACtD,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,yBAAyB,CAAC,CAepC;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAyB5E;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,uCAAuC,GAC/C,UAAU,GACV,MAAM,GACN,uBAAuB,GACvB,gBAAgB,GAChB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,qCAAqC;IACpD,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,cAAc,EAAE,CACd,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,yBAAyB,CAAC,GAAG,yBAAyB,CAAC;IACpE;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACpD,wEAAwE;IACxE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAyHD;;;;;;GAMG;AACH,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,uCAAuC,CAAC,CAgGlD"}

package/dist/server/adapter-auth-promotion.js

@@ -0,0 +1,294 @@
+import { chmod, mkdir, mkdtemp, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+import { withDirectoryMergeLock } from "@tickernelz/paperclip-pro-adapter-utils/workspace-restore-merge";
+import { grokHomeHasUsableAuth, parseGrokAuthPayload, hasUsableGrokAuthValue, resolveManagedGrokHomeDir, } from "./grok-home.js";
+import { USE_SOURCE_EXIT, decideGrokAuthMerge } from "./grok-auth-merge-decision.js";
+// The Grok device-login credential promotion. It runs after a successful
+// device login, on the exact credential the login sandbox produced. It mirrors
+// the fixed order the Codex promotion uses (see
+// `packages/adapters/codex-local/src/server/adapter-auth-promotion.ts`):
+// readiness check, credential validation, a user-initiated gate, a
+// sole-active-owner gate, then the write.
+//
+// Grok needs no per-identity cache, but it does need a "strictly newer" merge
+// decision: a completed device login is NOT always the newest state for the
+// account it logs in, because a teardown copy-back can install a fresher
+// same-identity credential (see `grok-auth-copyback.ts`) while this session
+// is still logging in. So the write step seeds an empty home, keeps the home
+// untouched when a DIFFERENT account already occupies it, and for the SAME
+// account runs the shared freshness predicate (`grok-auth-merge-decision.ts`)
+// so it replaces the existing credential only when the login is strictly
+// newer. The helper never writes the instance-global home, only the
+// company-scoped one.
+//
+// The comparison-and-install step runs under `withDirectoryMergeLock` on the
+// company Grok home, the same lock `copyBackGrokAuth` (see
+// `grok-auth-copyback.ts`) takes on the same directory at teardown. Both
+// resolve the lock key from the directory's canonical real path, so a
+// promotion and a teardown copy-back for the same company can never
+// interleave their read-decide-write sections.
+//
+// The helper treats the whole credential value as a secret: it never logs a
+// token, a refresh token, or a personal field (email, name, user id).
+const AUTH_FILE_NAME = "auth.json";
+// A private directory (owner rwx only), reused from
+// packages/adapters/codex-local/src/server/adapter-auth-promotion.ts:37-38.
+const PRIVATE_DIR_MODE = 0o700;
+// A private file (owner rw only). The write calls `chmod` after the write, so
+// the process umask can never widen it — the same pattern
+// packages/adapters/codex-local/src/server/codex-home.ts:524-526 uses for a
+// staged credential file.
+const PRIVATE_FILE_MODE = 0o600;
+// A bounded size for the credential payload, mirroring
+// packages/adapters/codex-local/src/server/device-login-export.ts's
+// `MAX_AUTH_JSON_BYTES`. A real `auth.json` is a few kilobytes.
+const MAX_AUTH_JSON_BYTES = 64 * 1024;
+/** Thrown when the independent readiness check does not return a ready result.
+ *  The service maps this to a failed session and still deletes the sandbox. */
+export class DeviceLoginReadinessError extends Error {
+    reason;
+    constructor(reason) {
+        super(`grok device-login promotion: the readiness check did not pass (${reason})`);
+        this.name = "DeviceLoginReadinessError";
+        this.reason = reason;
+    }
+}
+// A private directory (owner rwx only) for the throwaway readiness home.
+const READINESS_HOME_DIR_MODE = 0o700;
+// A private file (owner rw only) for the throwaway readiness credential.
+const READINESS_AUTH_FILE_MODE = 0o600;
+/**
+ * The independent readiness check for a staged Grok device-login credential. It
+ * runs on the exact staged bytes, before any promotion write. It writes the
+ * bytes to a throwaway private home and runs the same usable-auth predicate the
+ * execute path uses. It always removes the throwaway home before it returns.
+ *
+ * It never uses the `grok models` exit code: that command exits `0` whether or
+ * not the user is authenticated, so it is not a usable auth signal.
+ */
+export async function checkStagedGrokCredentialReadiness(authBytes) {
+    if (authBytes.length === 0) {
+        return { ready: false, reason: "empty_credential" };
+    }
+    const scratchHome = await mkdtemp(path.join(os.tmpdir(), "paperclip-grok-login-readiness-"));
+    try {
+        await mkdir(scratchHome, { recursive: true, mode: READINESS_HOME_DIR_MODE });
+        await writeFile(path.join(scratchHome, AUTH_FILE_NAME), authBytes, {
+            mode: READINESS_AUTH_FILE_MODE,
+        });
+        const ready = await grokHomeHasUsableAuth(scratchHome);
+        return ready ? { ready: true } : { ready: false, reason: "no_usable_auth" };
+    }
+    finally {
+        await rm(scratchHome, { recursive: true, force: true }).catch(() => { });
+    }
+}
+/**
+ * Validates the bounded-size, single-identity-key auth shape. Rejects an
+ * empty, an oversized, an invalid-JSON, a no-key, a multi-key, and an
+ * unusable-value payload. Never puts credential bytes into the thrown error.
+ */
+export function assertUsableGrokAuthShape(authBytes) {
+    if (authBytes.length === 0) {
+        throw new Error("grok device-login promotion: refused an empty auth payload");
+    }
+    if (authBytes.length > MAX_AUTH_JSON_BYTES) {
+        throw new Error("grok device-login promotion: refused an oversized auth payload");
+    }
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(authBytes.toString("utf8"));
+    }
+    catch {
+        throw new Error("grok device-login promotion: refused invalid JSON");
+    }
+    const payload = parseGrokAuthPayload(parsedJson);
+    if (!payload) {
+        throw new Error("grok device-login promotion: refused a payload with no single <issuer>::<uuid> key");
+    }
+    if (!hasUsableGrokAuthValue(payload.value)) {
+        throw new Error("grok device-login promotion: refused a credential with no usable key and refresh_token");
+    }
+    return payload;
+}
+/** Rejects an empty or unsafe `companyId`, so a promotion can never resolve the
+ *  instance-global home (`resolveManagedGrokHomeDir` with no `companyId`) or
+ *  escape the company tree. */
+function requireSafeCompanyId(companyId) {
+    const trimmed = typeof companyId === "string" ? companyId.trim() : "";
+    if (trimmed.length === 0) {
+        throw new Error("grok device-login promotion: companyId is empty");
+    }
+    if (trimmed === "." || trimmed === "..") {
+        throw new Error("grok device-login promotion: companyId is a relative path segment");
+    }
+    if (trimmed.includes("/") || trimmed.includes("\\") || trimmed.includes("\0")) {
+        throw new Error("grok device-login promotion: companyId contains a path separator");
+    }
+    return trimmed;
+}
+function isEnoentError(error) {
+    return typeof error === "object" && error !== null && error.code === "ENOENT";
+}
+/** Reads the existing home's state at `authPath`. A read failure other than
+ *  a missing file, an invalid-JSON payload, or a non-Grok payload all
+ *  resolve to `unreadable`, so the caller fails closed on any of them. Only
+ *  a missing file resolves to `absent`. */
+async function readExistingHomeState(authPath) {
+    let existingBytes;
+    try {
+        existingBytes = await readFile(authPath);
+    }
+    catch (error) {
+        return isEnoentError(error) ? { kind: "absent" } : { kind: "unreadable" };
+    }
+    let existingJson;
+    try {
+        existingJson = JSON.parse(existingBytes.toString("utf8"));
+    }
+    catch {
+        return { kind: "unreadable" };
+    }
+    const payload = parseGrokAuthPayload(existingJson);
+    return payload ? { kind: "identity", identityKey: payload.identityKey } : { kind: "unreadable" };
+}
+/**
+ * Writes `authBytes` to `authPath` atomically. It stages the bytes into a
+ * private (0600) temporary file in the same directory, then renames that
+ * file over `authPath`. The rename is an atomic same-directory swap, so a
+ * reader never observes a torn file, and a process that stops mid-write
+ * leaves the destination untouched. The temporary file is always removed,
+ * so a failed write never leaves stray bytes behind.
+ */
+async function writeAuthFileAtomically(authPath, authBytes) {
+    const stagedTempPath = path.join(path.dirname(authPath), `.auth-${process.pid}-${randomUUID()}.tmp`);
+    // `wx` + explicit mode create the temp file private (0600) and fail if it
+    // already exists, so the write never goes through a pre-existing symlink.
+    const handle = await open(stagedTempPath, "wx", PRIVATE_FILE_MODE);
+    try {
+        await handle.writeFile(authBytes);
+        await handle.close();
+        await rename(stagedTempPath, authPath);
+        await chmod(authPath, PRIVATE_FILE_MODE);
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+        await rm(stagedTempPath, { force: true }).catch(() => undefined);
+    }
+}
+/**
+ * Runs the shared freshness predicate (the same one `copyBackGrokAuth` uses)
+ * and installs `authBytes` over `authPath` only on a use-source decision. It
+ * stages `authBytes` into a private (0600) temporary file next to `authPath`,
+ * so the predicate can compare both sides by path, then renames that file
+ * over `authPath` on a use-source decision. The staged temp is always
+ * removed: the rename consumes it on the write path, and the `finally`
+ * removes it otherwise. Returns true when it wrote, false when it kept the
+ * existing file.
+ */
+async function writeSameIdentityCredentialIfFresher(authBytes, authPath) {
+    const stagedTempPath = path.join(path.dirname(authPath), `.auth-${process.pid}-${randomUUID()}.tmp`);
+    const handle = await open(stagedTempPath, "wx", PRIVATE_FILE_MODE);
+    try {
+        await handle.writeFile(authBytes);
+        await handle.close();
+        const decision = await decideGrokAuthMerge(stagedTempPath, authPath, {
+            errorLabel: "grok device-login promotion",
+        });
+        if (decision !== USE_SOURCE_EXIT) {
+            return false;
+        }
+        await rename(stagedTempPath, authPath);
+        await chmod(authPath, PRIVATE_FILE_MODE);
+        return true;
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+        await rm(stagedTempPath, { force: true }).catch(() => undefined);
+    }
+}
+/**
+ * Promotes a Grok device-login credential into the company scope. The order is
+ * fixed: readiness check, credential validation, the user-initiated gate, the
+ * sole-active-owner gate, then the write. The readiness check and the write run
+ * while the caller still holds the active claim, so a second session cannot
+ * race the same slot.
+ */
+export async function promoteGrokDeviceLoginCredential(input) {
+    const { authBytes, userInitiated, checkReadiness, isSoleActiveOwner, log } = input;
+    const env = input.env ?? process.env;
+    const companyId = requireSafeCompanyId(input.companyId);
+    // 1. Independent readiness check on the exact staged credential. A non-ready
+    //    result rejects the promotion before any validation or write.
+    const readiness = await checkReadiness(authBytes);
+    if (!readiness.ready) {
+        throw new DeviceLoginReadinessError(readiness.reason ?? "not_ready");
+    }
+    // 2. Validate the credential shape: the single `<issuer>::<uuid>` key, and a
+    //    usable `key` and `refresh_token` in its value.
+    const payload = assertUsableGrokAuthShape(authBytes);
+    // 3. Only a user-initiated login seeds the company slot.
+    if (!userInitiated) {
+        await log("[paperclip] Grok device-login promotion: skipped (an automatic background login never seeds a company slot).");
+        return "background_skipped";
+    }
+    // 4. Write only while the session still owns the active slot.
+    const soleOwner = await isSoleActiveOwner();
+    if (!soleOwner) {
+        await log("[paperclip] Grok device-login promotion: skipped (the session no longer holds the sole active claim on the slot).");
+        return "not_sole_owner";
+    }
+    // 5. Never clobber an occupied home. A present file that this step cannot
+    //    read as the same identity — absent from a read failure, invalid JSON,
+    //    or a non-Grok payload — is treated as a foreign identity, so the
+    //    promotion fails closed and writes nothing.
+    //
+    // 6. Write the company credential home. `mkdir` applies `mode` only when it
+    //    creates the directory, so an explicit `chmod` follows it. This keeps
+    //    the directory mode exact both for a new home and for a home that
+    //    already existed at a broader mode. An empty home is always seeded. A
+    //    home that already holds the SAME identity is refreshed only when the
+    //    login is strictly newer than the existing credential — the shared
+    //    freshness predicate in `grok-auth-merge-decision.ts` decides this, the
+    //    same predicate the teardown copy-back uses, so a fresher remote
+    //    copy-back credential can never lose to an older device login. Every
+    //    write is atomic: it stages the bytes into a private temporary file in
+    //    the same directory, then renames that file over `auth.json`.
+    //
+    // Steps 5 and 6 run under `withDirectoryMergeLock` on the company home, the
+    // same lock the teardown copy-back takes on the same directory (see
+    // `grok-auth-copyback.ts`). The directory must exist before the lock can
+    // resolve a canonical real path, so `mkdir` runs once, up front, at the
+    // final private mode; a home that already exists keeps its current mode
+    // until the write path below re-asserts it.
+    const companyHome = resolveManagedGrokHomeDir(env, companyId);
+    await mkdir(companyHome, { recursive: true, mode: PRIVATE_DIR_MODE });
+    return await withDirectoryMergeLock(companyHome, async (canonicalCompanyHome) => {
+        const authPath = path.join(canonicalCompanyHome, AUTH_FILE_NAME);
+        const existingState = await readExistingHomeState(authPath);
+        if (existingState.kind === "unreadable") {
+            await log("[paperclip] Grok device-login promotion: kept the company credential home (the existing file is present but this step cannot read it as a usable Grok credential).");
+            return "kept_foreign_identity";
+        }
+        if (existingState.kind === "identity" && existingState.identityKey !== payload.identityKey) {
+            await log("[paperclip] Grok device-login promotion: kept the company credential home (the login is a different account than the one already set for this company).");
+            return "kept_foreign_identity";
+        }
+        await chmod(canonicalCompanyHome, PRIVATE_DIR_MODE);
+        if (existingState.kind === "identity") {
+            const wrote = await writeSameIdentityCredentialIfFresher(authBytes, authPath);
+            if (!wrote) {
+                await log("[paperclip] Grok device-login promotion: kept the company credential home (the existing same-identity credential is not older than the device-login credential).");
+                return "kept";
+            }
+            await log("[paperclip] Grok device-login promotion: wrote the company credential home at mode 0600.");
+            return "promoted";
+        }
+        await writeAuthFileAtomically(authPath, authBytes);
+        await log("[paperclip] Grok device-login promotion: wrote the company credential home at mode 0600.");
+        return "promoted";
+    }, env);
+}
+//# sourceMappingURL=adapter-auth-promotion.js.map

package/dist/server/adapter-auth-promotion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-auth-promotion.js","sourceRoot":"","sources":["../../src/server/adapter-auth-promotion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iEAAiE,CAAC;AACzG,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,GAE1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAErF,yEAAyE;AACzE,+EAA+E;AAC/E,gDAAgD;AAChD,yEAAyE;AACzE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,6EAA6E;AAC7E,2DAA2D;AAC3D,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,+CAA+C;AAC/C,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AAEtE,MAAM,cAAc,GAAG,WAAW,CAAC;AACnC,oDAAoD;AACpD,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,8EAA8E;AAC9E,0DAA0D;AAC1D,4EAA4E;AAC5E,0BAA0B;AAC1B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,uDAAuD;AACvD,oEAAoE;AACpE,gEAAgE;AAChE,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AAUtC;+EAC+E;AAC/E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,MAAM,CAAS;IACxB,YAAY,MAAc;QACxB,KAAK,CAAC,kEAAkE,MAAM,GAAG,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,yEAAyE;AACzE,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,yEAAyE;AACzE,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,SAAiB;IAEjB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE;YACjE,IAAI,EAAE,wBAAwB;SAC/B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC9E,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AA2DD;;+BAE+B;AAC/B,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,MAAM,OAAO,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC3G,CAAC;AAED;;;2CAG2C;AAC3C,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IACnD,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,YAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACnG,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAAgB,EAAE,SAAiB;IACxE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAC9B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EACtB,SAAS,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAC3C,CAAC;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,EAAE,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,oCAAoC,CACjD,SAAiB,EACjB,QAAgB;IAEhB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAC9B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EACtB,SAAS,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAC3C,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,cAAc,EAAE,QAAQ,EAAE;YACnE,UAAU,EAAE,6BAA6B;SAC1C,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,EAAE,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA4C;IAE5C,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACnF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAExD,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,SAAS,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;IACvE,CAAC;IAED,6EAA6E;IAC7E,oDAAoD;IACpD,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAErD,yDAAyD;IACzD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,CACP,8GAA8G,CAC/G,CAAC;QACF,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,8DAA8D;IAC9D,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,GAAG,CACP,mHAAmH,CACpH,CAAC;QACF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,kEAAkE;IAClE,EAAE;IACF,4EAA4E;IAC5E,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACtE,OAAO,MAAM,sBAAsB,CACjC,WAAW,EACX,KAAK,EAAE,oBAAoB,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,aAAa,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACxC,MAAM,GAAG,CACP,oKAAoK,CACrK,CAAC;YACF,OAAO,uBAAuB,CAAC;QACjC,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YAC3F,MAAM,GAAG,CACP,yJAAyJ,CAC1J,CAAC;YACF,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,MAAM,KAAK,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;QAEpD,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,oCAAoC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC9E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,GAAG,CACP,kKAAkK,CACnK,CAAC;gBACF,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,GAAG,CAAC,0FAA0F,CAAC,CAAC;YACtG,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,uBAAuB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,GAAG,CAAC,0FAA0F,CAAC,CAAC;QACtG,OAAO,UAAU,CAAC;IACpB,CAAC,EACD,GAAG,CACJ,CAAC;AACJ,CAAC"}

package/dist/server/adapter-auth-promotion.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapter-auth-promotion.test.d.ts.map

package/dist/server/adapter-auth-promotion.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-auth-promotion.test.d.ts","sourceRoot":"","sources":["../../src/server/adapter-auth-promotion.test.ts"],"names":[],"mappings":""}