@tickernelz/paperclip-pro-adapter-grok-local 2026.925.0

package/dist/server/adapter-auth-promotion.test.js

@@ -0,0 +1,563 @@
+import { chmod, lstat, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { assertUsableGrokAuthShape, checkStagedGrokCredentialReadiness, DeviceLoginReadinessError, promoteGrokDeviceLoginCredential, } from "./adapter-auth-promotion.js";
+import { resolveManagedGrokHomeDir } from "./grok-home.js";
+const COMPANY_A = "company-a";
+const COMPANY_B = "company-b";
+const ISSUER = "https://issuer.x.ai";
+const UUID_A = "3fa85f64-5717-4562-b3fc-2c963f66afa6";
+const UUID_B = "8f14e45f-ceea-467e-a4b6-8b0e12345678";
+const TOKEN_SENTINEL = "SENTINEL_REFRESH_TOKEN_XYZ";
+// This suite proves the Grok device-login credential promotion helper. It runs
+// an independent readiness check on the exact staged credential first, then
+// validates its shape, then writes only the company-scoped credential home. It
+// writes only while the session holds the sole active claim on the slot, and
+// only for a user-initiated login. For a home that already holds the SAME
+// account, it installs the login only when the login is strictly newer than
+// the existing credential (the same freshness predicate the teardown
+// copy-back path uses), so it never replaces a fresher remote copy-back
+// credential. It never writes the instance-global host, never crosses a
+// company boundary, and never logs a secret.
+describe("grok device-login credential promotion", () => {
+    const cleanupDirs = [];
+    afterEach(async () => {
+        while (cleanupDirs.length > 0) {
+            const dir = cleanupDirs.pop();
+            if (!dir)
+                continue;
+            await chmod(dir, 0o700).catch(() => undefined);
+            await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+        }
+    });
+    async function makeInstanceRoot() {
+        const dir = await mkdtemp(path.join(os.tmpdir(), "paperclip-grok-promotion-"));
+        cleanupDirs.push(dir);
+        return dir;
+    }
+    function envFor(instanceHome) {
+        return {
+            PAPERCLIP_HOME: instanceHome,
+            PAPERCLIP_INSTANCE_ID: "default",
+        };
+    }
+    function grokAuth(input) {
+        const suffix = input.marker ?? input.uuid;
+        return Buffer.from(JSON.stringify({
+            [`${input.issuer ?? ISSUER}::${input.uuid}`]: {
+                key: `api-key-${suffix}`,
+                refresh_token: `${TOKEN_SENTINEL}-${suffix}`,
+                expires_at: input.expiresAt ?? "2026-01-01T00:00:00Z",
+                oidc_issuer: input.issuer ?? ISSUER,
+                oidc_client_id: "client-1",
+                email: `user-${suffix}@example.com`,
+                first_name: "Test",
+                last_name: "User",
+                user_id: `user-${suffix}`,
+                principal_id: `principal-${suffix}`,
+                team_id: `team-${suffix}`,
+            },
+        }));
+    }
+    const ready = () => ({ ready: true });
+    const notReady = () => ({ ready: false, reason: "auth_unusable" });
+    const soleOwner = () => true;
+    const notSoleOwner = () => false;
+    const noopLog = (_line) => { };
+    function companyHomeAuthPath(env, companyId) {
+        return path.join(resolveManagedGrokHomeDir(env, companyId), "auth.json");
+    }
+    // ---------------------------------------------------------------------
+    // Shape validation.
+    // ---------------------------------------------------------------------
+    describe("assertUsableGrokAuthShape", () => {
+        it("rejects empty bytes", () => {
+            expect(() => assertUsableGrokAuthShape(Buffer.alloc(0))).toThrow(/empty/);
+        });
+        it("rejects oversized bytes", () => {
+            const big = Buffer.alloc(64 * 1024 + 1, "a");
+            expect(() => assertUsableGrokAuthShape(big)).toThrow(/oversized/);
+        });
+        it("rejects invalid JSON", () => {
+            expect(() => assertUsableGrokAuthShape(Buffer.from("{not json"))).toThrow(/invalid JSON/);
+        });
+        it("rejects an object with no top-level key", () => {
+            expect(() => assertUsableGrokAuthShape(Buffer.from("{}"))).toThrow(/single/);
+        });
+        it("rejects an object with more than one top-level key", () => {
+            const bytes = Buffer.from(JSON.stringify({
+                [`${ISSUER}::${UUID_A}`]: { key: "k", refresh_token: "r" },
+                [`${ISSUER}::${UUID_B}`]: { key: "k2", refresh_token: "r2" },
+            }));
+            expect(() => assertUsableGrokAuthShape(bytes)).toThrow(/single/);
+        });
+        it("rejects a key that does not match the <issuer>::<uuid> shape", () => {
+            const bytes = Buffer.from(JSON.stringify({ some_fixed_key: { key: "k", refresh_token: "r" } }));
+            expect(() => assertUsableGrokAuthShape(bytes)).toThrow(/single/);
+        });
+        it("rejects a value with no usable key or refresh_token", () => {
+            const bytes = Buffer.from(JSON.stringify({ [`${ISSUER}::${UUID_A}`]: { key: "k" } }));
+            expect(() => assertUsableGrokAuthShape(bytes)).toThrow(/usable/);
+        });
+        it("accepts an object whose single key matches <issuer>::<uuid> and holds key + refresh_token", () => {
+            const payload = assertUsableGrokAuthShape(grokAuth({ uuid: UUID_A }));
+            expect(payload.identityKey).toBe(`${ISSUER}::${UUID_A}`);
+            expect(payload.value.key).toBe(`api-key-${UUID_A}`);
+        });
+    });
+    // ---------------------------------------------------------------------
+    // Readiness.
+    // ---------------------------------------------------------------------
+    describe("checkStagedGrokCredentialReadiness", () => {
+        it("reports not ready for empty bytes", async () => {
+            const result = await checkStagedGrokCredentialReadiness(Buffer.alloc(0));
+            expect(result.ready).toBe(false);
+        });
+        it("reports not ready for a Codex-shaped payload", async () => {
+            const codexShaped = Buffer.from(JSON.stringify({ OPENAI_API_KEY: "sk-test" }));
+            const result = await checkStagedGrokCredentialReadiness(codexShaped);
+            expect(result.ready).toBe(false);
+            expect(result.reason).toBe("no_usable_auth");
+        });
+        it("reports ready for a usable Grok payload", async () => {
+            const result = await checkStagedGrokCredentialReadiness(grokAuth({ uuid: UUID_A }));
+            expect(result.ready).toBe(true);
+        });
+    });
+    // ---------------------------------------------------------------------
+    // The promotion order and gates.
+    // ---------------------------------------------------------------------
+    it("a failed readiness check rejects and writes nothing", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const logs = [];
+        await expect(promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: notReady,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: (line) => {
+                logs.push(line);
+            },
+        })).rejects.toBeInstanceOf(DeviceLoginReadinessError);
+        await expect(lstat(companyHomeAuthPath(env, COMPANY_A))).rejects.toThrow();
+        expect(logs.join("\n")).not.toContain(TOKEN_SENTINEL);
+        expect(logs.join("\n")).not.toContain("example.com");
+    });
+    it("an invalid shape rejects after a passed readiness check and writes nothing", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        await expect(promoteGrokDeviceLoginCredential({
+            authBytes: Buffer.from("{}"),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        })).rejects.toThrow(/single/);
+        await expect(lstat(companyHomeAuthPath(env, COMPANY_A))).rejects.toThrow();
+    });
+    it("skips a background (non-user-initiated) login and writes nothing", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: false,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("background_skipped");
+        await expect(lstat(companyHomeAuthPath(env, COMPANY_A))).rejects.toThrow();
+    });
+    it("skips a session that lost the sole active claim and writes nothing", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: notSoleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("not_sole_owner");
+        await expect(lstat(companyHomeAuthPath(env, COMPANY_A))).rejects.toThrow();
+    });
+    it("creates the company Grok home at mode 0700 and writes auth.json at exact mode 0600", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("promoted");
+        const companyHome = resolveManagedGrokHomeDir(env, COMPANY_A);
+        const dirStat = await lstat(companyHome);
+        expect(dirStat.mode & 0o777).toBe(0o700);
+        const authPath = path.join(companyHome, "auth.json");
+        const fileStat = await lstat(authPath);
+        expect(fileStat.mode & 0o777).toBe(0o600);
+        const written = JSON.parse(await readFile(authPath, "utf8"));
+        expect(Object.keys(written)).toEqual([`${ISSUER}::${UUID_A}`]);
+    });
+    it("normalizes the company Grok home to mode 0700 when the home already exists at a broader mode", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const companyHome = resolveManagedGrokHomeDir(env, COMPANY_A);
+        await mkdir(companyHome, { recursive: true, mode: 0o755 });
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("promoted");
+        const dirStat = await lstat(companyHome);
+        expect(dirStat.mode & 0o777).toBe(0o700);
+        const authPath = path.join(companyHome, "auth.json");
+        const fileStat = await lstat(authPath);
+        expect(fileStat.mode & 0o777).toBe(0o600);
+    });
+    it("keeps an occupied home that holds a different identity", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const first = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(first).toBe("promoted");
+        const second = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_B }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(second).toBe("kept_foreign_identity");
+        const authPath = companyHomeAuthPath(env, COMPANY_A);
+        const written = JSON.parse(await readFile(authPath, "utf8"));
+        expect(Object.keys(written)).toEqual([`${ISSUER}::${UUID_A}`]);
+    });
+    it("redacts the credential bytes and the account email the same way on a promoted and on a kept_foreign_identity outcome", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const logs = [];
+        const captureLog = (line) => {
+            logs.push(line);
+        };
+        const promoted = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: captureLog,
+        });
+        expect(promoted).toBe("promoted");
+        const keptForeign = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_B }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: captureLog,
+        });
+        expect(keptForeign).toBe("kept_foreign_identity");
+        const allLogs = logs.join("\n");
+        expect(allLogs).not.toContain(TOKEN_SENTINEL);
+        expect(allLogs).not.toContain(`user-${UUID_A}@example.com`);
+        expect(allLogs).not.toContain(`user-${UUID_B}@example.com`);
+        expect(allLogs).not.toContain(UUID_A);
+        expect(allLogs).not.toContain(UUID_B);
+    });
+    it("overwrites the home with a strictly newer credential for the same identity", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A, marker: "first", expiresAt: "2026-01-01T00:00:00Z" }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A, marker: "second", expiresAt: "2026-06-01T00:00:00Z" }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("promoted");
+        const authPath = companyHomeAuthPath(env, COMPANY_A);
+        const written = JSON.parse(await readFile(authPath, "utf8"));
+        expect(written[`${ISSUER}::${UUID_A}`].refresh_token).toBe(`${TOKEN_SENTINEL}-second`);
+    });
+    // ---------------------------------------------------------------------
+    // The freshness gate: a same-identity login never replaces a home
+    // credential that is at least as new, so a remote copy-back cannot lose
+    // its fresher credential to an older device login.
+    // ---------------------------------------------------------------------
+    it("keeps the home when the login is older than the existing same-identity credential", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A, marker: "fresher", expiresAt: "2026-06-01T00:00:00Z" }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A, marker: "staler", expiresAt: "2026-01-01T00:00:00Z" }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("kept");
+        const authPath = companyHomeAuthPath(env, COMPANY_A);
+        const written = JSON.parse(await readFile(authPath, "utf8"));
+        expect(written[`${ISSUER}::${UUID_A}`].refresh_token).toBe(`${TOKEN_SENTINEL}-fresher`);
+    });
+    it("keeps the home when the login expiry ties the existing same-identity credential", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A, marker: "first", expiresAt: "2026-01-01T00:00:00Z" }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A, marker: "second", expiresAt: "2026-01-01T00:00:00Z" }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("kept");
+        const authPath = companyHomeAuthPath(env, COMPANY_A);
+        const written = JSON.parse(await readFile(authPath, "utf8"));
+        expect(written[`${ISSUER}::${UUID_A}`].refresh_token).toBe(`${TOKEN_SENTINEL}-first`);
+    });
+    it("leaves no staged temporary file in the company home after a kept (not-fresher) outcome", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A, marker: "fresher", expiresAt: "2026-06-01T00:00:00Z" }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A, marker: "staler", expiresAt: "2026-01-01T00:00:00Z" }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("kept");
+        const companyHome = resolveManagedGrokHomeDir(env, COMPANY_A);
+        const entries = await readdir(companyHome);
+        expect(entries).toEqual(["auth.json"]);
+    });
+    it("redacts the credential bytes on a kept (not-fresher) outcome the same way as a promoted outcome", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const logs = [];
+        const captureLog = (line) => {
+            logs.push(line);
+        };
+        await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A, marker: "fresher", expiresAt: "2026-06-01T00:00:00Z" }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: captureLog,
+        });
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A, marker: "staler", expiresAt: "2026-01-01T00:00:00Z" }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: captureLog,
+        });
+        expect(outcome).toBe("kept");
+        const allLogs = logs.join("\n");
+        expect(allLogs).not.toContain(TOKEN_SENTINEL);
+        expect(allLogs).not.toContain(`user-fresher@example.com`);
+        expect(allLogs).not.toContain(`user-staler@example.com`);
+        expect(allLogs).not.toContain(UUID_A);
+    });
+    // ---------------------------------------------------------------------
+    // Fail closed on an unreadable or unparseable existing home.
+    // ---------------------------------------------------------------------
+    it("keeps a home whose auth.json holds corrupt JSON, and writes nothing", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const companyHome = resolveManagedGrokHomeDir(env, COMPANY_A);
+        await mkdir(companyHome, { recursive: true, mode: 0o700 });
+        const authPath = path.join(companyHome, "auth.json");
+        const corruptBytes = Buffer.from("{not valid json");
+        await writeFile(authPath, corruptBytes, { mode: 0o600 });
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("kept_foreign_identity");
+        const afterBytes = await readFile(authPath);
+        expect(afterBytes.equals(corruptBytes)).toBe(true);
+    });
+    it("keeps a home whose auth.json holds a well-formed but unusable payload, and writes nothing", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const companyHome = resolveManagedGrokHomeDir(env, COMPANY_A);
+        await mkdir(companyHome, { recursive: true, mode: 0o700 });
+        const authPath = path.join(companyHome, "auth.json");
+        const unusableBytes = Buffer.from(JSON.stringify({ some_fixed_key: { key: "k" } }));
+        await writeFile(authPath, unusableBytes, { mode: 0o600 });
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("kept_foreign_identity");
+        const afterBytes = await readFile(authPath);
+        expect(afterBytes.equals(unusableBytes)).toBe(true);
+    });
+    // ---------------------------------------------------------------------
+    // Atomic write.
+    // ---------------------------------------------------------------------
+    it("leaves no staged temporary file in the company home after a successful promotion", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("promoted");
+        const companyHome = resolveManagedGrokHomeDir(env, COMPANY_A);
+        const entries = await readdir(companyHome);
+        expect(entries).toEqual(["auth.json"]);
+    });
+    // ---------------------------------------------------------------------
+    // Company isolation.
+    // ---------------------------------------------------------------------
+    it("a promotion for company A creates no file, replaces no file, and reads no file under company B's home", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        // Seed company B's home first, so a read-through would be observable.
+        const companyBHome = resolveManagedGrokHomeDir(env, COMPANY_B);
+        await mkdir(companyBHome, { recursive: true, mode: 0o700 });
+        const companyBAuthPath = path.join(companyBHome, "auth.json");
+        const companyBBytes = grokAuth({ uuid: UUID_B });
+        await writeFile(companyBAuthPath, companyBBytes, { mode: 0o600 });
+        const beforeBBytes = await readFile(companyBAuthPath);
+        const outcome = await promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: COMPANY_A,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        });
+        expect(outcome).toBe("promoted");
+        // Company A's write landed only under company A's home.
+        const companyAAuthPath = companyHomeAuthPath(env, COMPANY_A);
+        expect(resolveManagedGrokHomeDir(env, COMPANY_A)).not.toBe(companyBHome);
+        await expect(lstat(companyAAuthPath)).resolves.toBeDefined();
+        // Company B's home is byte-identical to before the company A promotion.
+        const afterBBytes = await readFile(companyBAuthPath);
+        expect(afterBBytes.equals(beforeBBytes)).toBe(true);
+    });
+    it("rejects a companyId that holds a path separator", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        await expect(promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: `${COMPANY_A}/../${COMPANY_B}`,
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        })).rejects.toThrow(/path separator/);
+        await expect(lstat(resolveManagedGrokHomeDir(env, COMPANY_B))).rejects.toThrow();
+    });
+    it("rejects a companyId that is a parent-directory segment", async () => {
+        const home = await makeInstanceRoot();
+        const env = envFor(home);
+        await expect(promoteGrokDeviceLoginCredential({
+            authBytes: grokAuth({ uuid: UUID_A }),
+            companyId: "..",
+            userInitiated: true,
+            checkReadiness: ready,
+            isSoleActiveOwner: soleOwner,
+            env,
+            log: noopLog,
+        })).rejects.toThrow(/relative path segment/);
+    });
+});
+//# sourceMappingURL=adapter-auth-promotion.test.js.map

package/dist/server/adapter-auth-promotion.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-auth-promotion.test.js","sourceRoot":"","sources":["../../src/server/adapter-auth-promotion.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAClC,yBAAyB,EACzB,gCAAgC,GAEjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,MAAM,GAAG,sCAAsC,CAAC;AACtD,MAAM,MAAM,GAAG,sCAAsC,CAAC;AACtD,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAEpD,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,6CAA6C;AAC7C,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,gBAAgB;QAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QAC/E,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,MAAM,CAAC,YAAoB;QAClC,OAAO;YACL,cAAc,EAAE,YAAY;YAC5B,qBAAqB,EAAE,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,SAAS,QAAQ,CAAC,KAKjB;QACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC;QAC1C,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,CAAC,SAAS,CAAC;YACb,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE;gBAC5C,GAAG,EAAE,WAAW,MAAM,EAAE;gBACxB,aAAa,EAAE,GAAG,cAAc,IAAI,MAAM,EAAE;gBAC5C,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,sBAAsB;gBACrD,WAAW,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;gBACnC,cAAc,EAAE,UAAU;gBAC1B,KAAK,EAAE,QAAQ,MAAM,cAAc;gBACnC,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,QAAQ,MAAM,EAAE;gBACzB,YAAY,EAAE,aAAa,MAAM,EAAE;gBACnC,OAAO,EAAE,QAAQ,MAAM,EAAE;aAC1B;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,GAA8B,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,GAA8B,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;IAC7B,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAQ,EAAE,GAAE,CAAC,CAAC;IAE5C,SAAS,mBAAmB,CAAC,GAAsB,EAAE,SAAiB;QACpE,OAAO,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;IAC3E,CAAC;IAED,wEAAwE;IACxE,oBAAoB;IACpB,wEAAwE;IAExE,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,IAAI,CAAC,SAAS,CAAC;gBACb,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE;gBAC1D,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;aAC7D,CAAC,CACH,CAAC;YACF,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YAChG,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YACtF,MAAM,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;YACnG,MAAM,OAAO,GAAG,yBAAyB,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACtE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;YACzD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,aAAa;IACb,wEAAwE;IAExE,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAClD,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,WAAW,CAAC,CAAC;YACrE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACpF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,iCAAiC;IACjC,wEAAwE;IAExE,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,MAAM,CACV,gCAAgC,CAAC;YAC/B,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,QAAQ;YACxB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;SACF,CAAC,CACH,CAAC,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAEpD,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,MAAM,CACV,gCAAgC,CAAC;YAC/B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,KAAK;YACpB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC3C,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,YAAY;YAC/B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3D,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,gCAAgC,CAAC;YACnD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE/B,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sHAAsH,EAAE,KAAK,IAAI,EAAE;QACpI,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,CAAC,IAAY,EAAQ,EAAE;YACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;YACtD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAElC,MAAM,WAAW,GAAG,MAAM,gCAAgC,CAAC;YACzD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAElD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,MAAM,cAAc,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,MAAM,cAAc,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,gCAAgC,CAAC;YACrC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;YACzF,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;YAC1F,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,cAAc,SAAS,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,kEAAkE;IAClE,wEAAwE;IACxE,mDAAmD;IACnD,wEAAwE;IAExE,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,gCAAgC,CAAC;YACrC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;YAC3F,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;YAC1F,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,cAAc,UAAU,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,gCAAgC,CAAC;YACrC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;YACzF,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;YAC1F,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,cAAc,QAAQ,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,gCAAgC,CAAC;YACrC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;YAC3F,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;YAC1F,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7B,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;QAC/G,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,CAAC,IAAY,EAAQ,EAAE;YACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,MAAM,gCAAgC,CAAC;YACrC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;YAC3F,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;YAC1F,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QAC1D,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,6DAA6D;IAC7D,wEAAwE;IAExE,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzD,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAE9C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACpF,MAAM,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAE9C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,gBAAgB;IAChB,wEAAwE;IAExE,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,qBAAqB;IACrB,wEAAwE;IAExE,EAAE,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;QACrH,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAEzB,sEAAsE;QACtE,MAAM,YAAY,GAAG,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,gBAAgB,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjC,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE7D,wEAAwE;QACxE,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACrD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,MAAM,CACV,gCAAgC,CAAC;YAC/B,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,GAAG,SAAS,OAAO,SAAS,EAAE;YACzC,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpC,MAAM,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,MAAM,CACV,gCAAgC,CAAC;YAC/B,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACrC,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,SAAS;YAC5B,GAAG;YACH,GAAG,EAAE,OAAO;SACb,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/device-login-parse.d.ts

@@ -0,0 +1,23 @@
+export interface DeviceLoginPrompt {
+    url: string;
+    code: string;
+}
+/** The one and only accepted device-login command. */
+export declare const GROK_DEVICE_LOGIN_COMMAND = "grok login --device-auth";
+/** The one and only accepted device-login URL origin. */
+export declare const GROK_DEVICE_LOGIN_URL_ORIGIN = "https://accounts.x.ai";
+/** The one and only accepted device-login URL path. */
+export declare const GROK_DEVICE_LOGIN_URL_PATH = "/oauth2/device";
+/**
+ * Parses Grok device-login output. Removes ANSI color sequences first. The
+ * parser reads the URL first, validates its query and its embedded code, then
+ * finds the code preamble after the URL and reads the code from the dedicated
+ * code line right after the preamble line. It returns the prompt only when the
+ * code on that dedicated line equals the code the URL query carries. Returns
+ * null for any other input, including a non-string input, an absent prompt, a
+ * wrong origin or path, a URL with a fragment, a malformed or mismatched query,
+ * and a malformed short code. Never throws on input, and never puts the URL or
+ * the code into a log or an error.
+ */
+export declare function parseGrokDeviceLoginPrompt(text: string): DeviceLoginPrompt | null;
+//# sourceMappingURL=device-login-parse.d.ts.map

package/dist/server/device-login-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login-parse.d.ts","sourceRoot":"","sources":["../../src/server/device-login-parse.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,sDAAsD;AACtD,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAEpE,yDAAyD;AACzD,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAEpE,uDAAuD;AACvD,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAsH3D;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CASjF"}