@tickernelz/paperclip-pro-adapter-grok-local 2026.925.0

package/dist/server/grok-auth-merge-decision.cjs

@@ -0,0 +1,157 @@
+const fs = require("fs");
+
+// Co-change notice: parseAuthValue below mirrors parseGrokAuthPayload and
+// hasUsableGrokAuthValue in
+// packages/adapters/grok-local/src/server/grok-home.ts. If the auth format
+// changes (new shape, renamed field), update both sites together.
+
+// Matches the composite `<issuer>::<uuid>` top-level key. See grok-home.ts
+// for the full rationale (the greedy `.+` backtracks to the last `::`).
+const GROK_IDENTITY_KEY_RE =
+  /^.+::[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
+// Parses one already-decoded JSON value into `{ kind: "unusable" }` or
+// `{ kind: "usable", identityKey, expiresAtRaw }`. `expiresAtRaw` is the raw,
+// still-undecoded `expires_at` field (or `undefined` when absent) — decoding
+// it is `readExpiry`'s job, kept separate so a caller can compare two already
+// -parsed shapes without touching the filesystem (see `decide` below).
+function parseAuthValue(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return { kind: "unusable" };
+  const keys = Object.keys(raw);
+  if (keys.length !== 1) return { kind: "unusable" };
+  const [identityKey] = keys;
+  if (!GROK_IDENTITY_KEY_RE.test(identityKey)) return { kind: "unusable" };
+  const value = raw[identityKey];
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return { kind: "unusable" };
+  const key = value.key;
+  const refreshToken = value.refresh_token;
+  const hasUsableValue =
+    typeof key === "string" &&
+    key.trim().length > 0 &&
+    typeof refreshToken === "string" &&
+    refreshToken.trim().length > 0;
+  if (!hasUsableValue) return { kind: "unusable" };
+  return { kind: "usable", identityKey, expiresAtRaw: value.expires_at };
+}
+
+function parseAuthFile(filePath) {
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return { kind: "unusable" };
+  }
+  return parseAuthValue(parsed);
+}
+
+const ISO_8601_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+// Below this magnitude a numeric `expires_at` is epoch seconds; at or above
+// it, epoch milliseconds. A modern epoch-seconds instant is around 1.7e9; a
+// modern epoch-millisecond instant is around 1.7e12, so this threshold never
+// confuses the two for a real-world timestamp.
+const EPOCH_SECONDS_MAX = 1e12;
+
+// Reads one raw `expires_at` value into `{ present, unreadable, ms }`.
+//   - `present: false` — the field is absent (missing or null).
+//   - `unreadable: true` — the field is present but not one of the three
+//     accepted encodings (ISO-8601 string, epoch-seconds number, epoch-
+//     milliseconds number).
+//   - otherwise `ms` holds the decoded epoch-millisecond value.
+function readExpiry(raw) {
+  if (raw === undefined || raw === null) return { present: false, unreadable: false, ms: null };
+  if (typeof raw === "string") {
+    if (ISO_8601_RE.test(raw)) {
+      const ms = Date.parse(raw);
+      if (Number.isFinite(ms)) return { present: true, unreadable: false, ms };
+    }
+    return { present: true, unreadable: true, ms: null };
+  }
+  if (typeof raw === "number" && Number.isFinite(raw)) {
+    const ms = raw < EPOCH_SECONDS_MAX ? raw * 1000 : raw;
+    return { present: true, unreadable: false, ms };
+  }
+  return { present: true, unreadable: true, ms: null };
+}
+
+// Exit contract. Exit 10 = use source; exit 20 = keep destination; exit 21 =
+// keep destination, an expiry was present but not a recognized encoding;
+// exit 22 = keep destination, the source expiry sat further ahead of the
+// host clock than the plausible bound.
+const USE_SOURCE = 10;
+const KEEP_DESTINATION = 20;
+const UNREADABLE_EXPIRY = 21;
+const IMPLAUSIBLE_EXPIRY = 22;
+const MAX_PLAUSIBLE_EXPIRY_MS = 400 * 24 * 60 * 60 * 1000;
+
+// This predicate answers one direction-agnostic question: should the caller
+// replace `destination` with `source`? The caller picks which copy is source
+// and which is destination from its own frame of reference (the outbound
+// copy-out is the only caller today) purely by argument order — there is no
+// `--direction` flag:
+//
+//   argv[0] (first positional)  = source auth.json path
+//   argv[1] (second positional) = destination auth.json path
+//
+// `decide` takes already-parsed `{ kind, identityKey, expiresAtRaw }` shapes
+// plus a caller-supplied `nowMs`, so a test can drive the exact plausibility
+// bound without spawning a process and racing wall-clock drift. Guard order,
+// first match wins:
+//   1. Either side unusable, or the identity keys differ -> KEEP_DESTINATION.
+//   2. Either side's expiry is absent -> KEEP_DESTINATION.
+//   3. Either side's expiry is present but unreadable -> UNREADABLE_EXPIRY.
+//   4. The source expiry sits further ahead of `nowMs` than
+//      MAX_PLAUSIBLE_EXPIRY_MS -> IMPLAUSIBLE_EXPIRY. Only the source is
+//      bounded, and only against the caller's clock: the source is the
+//      sandbox-supplied side, so it must never be allowed to supply the
+//      reference time.
+//   5. The source expiry is strictly later than the destination expiry
+//      -> USE_SOURCE.
+//   6. Otherwise (a tie, or the source is older) -> KEEP_DESTINATION.
+//
+// The predicate only ever reads the two files and exits with a code; it
+// never prints token bytes.
+function decide(source, destination, nowMs) {
+  if (
+    source.kind === "unusable" ||
+    destination.kind === "unusable" ||
+    source.identityKey !== destination.identityKey
+  ) {
+    return KEEP_DESTINATION;
+  }
+
+  const sourceExpiry = readExpiry(source.expiresAtRaw);
+  const destinationExpiry = readExpiry(destination.expiresAtRaw);
+
+  if (!sourceExpiry.present || !destinationExpiry.present) {
+    return KEEP_DESTINATION;
+  }
+  if (sourceExpiry.unreadable || destinationExpiry.unreadable) {
+    return UNREADABLE_EXPIRY;
+  }
+  if (sourceExpiry.ms - nowMs > MAX_PLAUSIBLE_EXPIRY_MS) {
+    return IMPLAUSIBLE_EXPIRY;
+  }
+  if (sourceExpiry.ms > destinationExpiry.ms) {
+    return USE_SOURCE;
+  }
+  return KEEP_DESTINATION;
+}
+
+if (require.main === module) {
+  const [sourceAuthPath, destinationAuthPath] = process.argv.slice(2);
+  const source = parseAuthFile(sourceAuthPath);
+  const destination = parseAuthFile(destinationAuthPath);
+  process.exit(decide(source, destination, Date.now()));
+}
+
+module.exports = {
+  decide,
+  parseAuthValue,
+  parseAuthFile,
+  readExpiry,
+  USE_SOURCE,
+  KEEP_DESTINATION,
+  UNREADABLE_EXPIRY,
+  IMPLAUSIBLE_EXPIRY,
+  MAX_PLAUSIBLE_EXPIRY_MS,
+};

package/dist/server/grok-auth-merge-decision.d.ts

@@ -0,0 +1,21 @@
+/** Exit code: install the source credential over the destination. */
+export declare const USE_SOURCE_EXIT = 10;
+/** Exit code: keep the destination credential. */
+export declare const KEEP_DESTINATION_EXIT = 20;
+/** Exit code: keep the destination; an expiry was present but unreadable. */
+export declare const UNREADABLE_EXPIRY_EXIT = 21;
+/** Exit code: keep the destination; the source expiry was implausibly far ahead. */
+export declare const IMPLAUSIBLE_EXPIRY_EXIT = 22;
+export interface DecideGrokAuthMergeOptions {
+    /** The caller name that prefixes a predicate error, for example
+     *  `grok auth copy-out`. */
+    errorLabel: string;
+}
+/**
+ * Runs the shared decision predicate and returns its exit code (10, 20, 21,
+ * or 22). Any other exit, or a failure to run `node`, is a hard failure: this
+ * throws so a broken predicate is never mistaken for a "keep destination"
+ * decision.
+ */
+export declare function decideGrokAuthMerge(sourcePath: string, destinationPath: string, options: DecideGrokAuthMergeOptions): Promise<number>;
+//# sourceMappingURL=grok-auth-merge-decision.d.ts.map

package/dist/server/grok-auth-merge-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-auth-merge-decision.d.ts","sourceRoot":"","sources":["../../src/server/grok-auth-merge-decision.ts"],"names":[],"mappings":"AAqBA,qEAAqE;AACrE,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,oFAAoF;AACpF,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAS1C,MAAM,WAAW,0BAA0B;IACzC;gCAC4B;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CAuBjB"}

package/dist/server/grok-auth-merge-decision.js

@@ -0,0 +1,58 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+const execFile = promisify(execFileCallback);
+// The single identity-and-freshness predicate for the Grok credential
+// copy-out lives in `grok-auth-merge-decision.cjs`. It reads only the two
+// files and exits with a code; it never prints token bytes. Argument order
+// sets source and destination (first = source, second = destination), so the
+// caller frames the direction. Exit 10 = use source; exit 20 = keep
+// destination; exit 21 = keep destination, an expiry was present but not a
+// recognized encoding; exit 22 = keep destination, the source expiry sat
+// further ahead of the host clock than the plausible bound. This module
+// gives every caller one shared entry point, so the predicate contract can
+// never drift between callers.
+const DECISION_SCRIPT_PATH = fileURLToPath(new URL("./grok-auth-merge-decision.cjs", import.meta.url));
+/** Exit code: install the source credential over the destination. */
+export const USE_SOURCE_EXIT = 10;
+/** Exit code: keep the destination credential. */
+export const KEEP_DESTINATION_EXIT = 20;
+/** Exit code: keep the destination; an expiry was present but unreadable. */
+export const UNREADABLE_EXPIRY_EXIT = 21;
+/** Exit code: keep the destination; the source expiry was implausibly far ahead. */
+export const IMPLAUSIBLE_EXPIRY_EXIT = 22;
+const KNOWN_EXIT_CODES = new Set([
+    USE_SOURCE_EXIT,
+    KEEP_DESTINATION_EXIT,
+    UNREADABLE_EXPIRY_EXIT,
+    IMPLAUSIBLE_EXPIRY_EXIT,
+]);
+/**
+ * Runs the shared decision predicate and returns its exit code (10, 20, 21,
+ * or 22). Any other exit, or a failure to run `node`, is a hard failure: this
+ * throws so a broken predicate is never mistaken for a "keep destination"
+ * decision.
+ */
+export async function decideGrokAuthMerge(sourcePath, destinationPath, options) {
+    try {
+        await execFile("node", [DECISION_SCRIPT_PATH, sourcePath, destinationPath]);
+    }
+    catch (error) {
+        const code = error.code;
+        if (typeof code === "number" && KNOWN_EXIT_CODES.has(code)) {
+            return code;
+        }
+        const detail = typeof code === "string"
+            ? `node could not be executed (${code})`
+            : typeof code === "number"
+                ? `unexpected predicate exit code ${code}`
+                : error instanceof Error
+                    ? error.message
+                    : String(error);
+        throw new Error(`${options.errorLabel} decision predicate failed: ${detail}`);
+    }
+    // `execFile` resolved, so the predicate exited 0. The predicate always
+    // exits 10, 20, 21, or 22, so a clean exit 0 is unexpected; fail loud.
+    throw new Error(`${options.errorLabel} decision predicate exited 0 (expected 10, 20, 21, or 22)`);
+}
+//# sourceMappingURL=grok-auth-merge-decision.js.map

package/dist/server/grok-auth-merge-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-auth-merge-decision.js","sourceRoot":"","sources":["../../src/server/grok-auth-merge-decision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,QAAQ,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAE7C,sEAAsE;AACtE,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,oEAAoE;AACpE,2EAA2E;AAC3E,yEAAyE;AACzE,wEAAwE;AACxE,2EAA2E;AAC3E,+BAA+B;AAE/B,MAAM,oBAAoB,GAAG,aAAa,CACxC,IAAI,GAAG,CAAC,gCAAgC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAC3D,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,kDAAkD;AAClD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,oFAAoF;AACpF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,eAAe;IACf,qBAAqB;IACrB,sBAAsB;IACtB,uBAAuB;CACxB,CAAC,CAAC;AAQH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,eAAuB,EACvB,OAAmC;IAEnC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,oBAAoB,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GACV,OAAO,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC,+BAA+B,IAAI,GAAG;YACxC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ;gBACxB,CAAC,CAAC,kCAAkC,IAAI,EAAE;gBAC1C,CAAC,CAAC,KAAK,YAAY,KAAK;oBACtB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,UAAU,+BAA+B,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,UAAU,2DAA2D,CACjF,CAAC;AACJ,CAAC"}

package/dist/server/grok-auth-merge-decision.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=grok-auth-merge-decision.test.d.ts.map

package/dist/server/grok-auth-merge-decision.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-auth-merge-decision.test.d.ts","sourceRoot":"","sources":["../../src/server/grok-auth-merge-decision.test.ts"],"names":[],"mappings":""}

package/dist/server/grok-auth-merge-decision.test.js

@@ -0,0 +1,189 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { afterEach, describe, expect, it } from "vitest";
+const execFile = promisify(execFileCallback);
+const decisionScriptPath = fileURLToPath(new URL("./grok-auth-merge-decision.cjs", import.meta.url));
+// The exact-boundary cases below drive the predicate's pure `decide` function
+// directly (via `require`, never spawning a process), so the 400-day
+// plausibility bound can be tested to the exact millisecond without racing
+// subprocess-spawn wall-clock drift. Every other case drives the REAL `.cjs`
+// through a spawned `node` process (no stub), matching how the copy-out
+// module invokes it in production.
+const decisionModule = createRequire(import.meta.url)(decisionScriptPath);
+const { decide, USE_SOURCE, KEEP_DESTINATION, UNREADABLE_EXPIRY, IMPLAUSIBLE_EXPIRY, MAX_PLAUSIBLE_EXPIRY_MS } = decisionModule;
+const IDENTITY_A = "https://auth.x.ai::11111111-1111-1111-1111-111111111111";
+const IDENTITY_B = "https://auth.x.ai::22222222-2222-2222-2222-222222222222";
+describe("grok-auth-merge-decision predicate", () => {
+    const cleanupDirs = [];
+    afterEach(async () => {
+        while (cleanupDirs.length > 0) {
+            const dir = cleanupDirs.pop();
+            if (!dir)
+                continue;
+            await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+        }
+    });
+    function usableAuthJson(input) {
+        const value = {
+            key: `key-${input.marker}`,
+            refresh_token: `refresh-${input.marker}`,
+        };
+        if (input.expiresAt !== undefined)
+            value.expires_at = input.expiresAt;
+        return JSON.stringify({ [input.identityKey ?? IDENTITY_A]: value });
+    }
+    const ABSENT = Symbol("absent");
+    async function runDecision(input) {
+        const dir = await mkdtemp(path.join(os.tmpdir(), "paperclip-grok-merge-decision-"));
+        cleanupDirs.push(dir);
+        const sourcePath = path.join(dir, "source-auth.json");
+        const destinationPath = path.join(dir, "destination-auth.json");
+        if (input.sourceAuth !== ABSENT)
+            await writeFile(sourcePath, input.sourceAuth, { mode: 0o600 });
+        if (input.destinationAuth !== ABSENT)
+            await writeFile(destinationPath, input.destinationAuth, { mode: 0o600 });
+        try {
+            await execFile("node", [decisionScriptPath, sourcePath, destinationPath]);
+            return 0;
+        }
+        catch (error) {
+            const failure = error;
+            if (typeof failure.code === "number")
+                return failure.code;
+            throw error;
+        }
+    }
+    it("uses the source when the identity matches and the source expiry is later", async () => {
+        const now = Date.now();
+        const sourceAuth = usableAuthJson({ marker: "src", expiresAt: new Date(now + 2 * 60_000).toISOString() });
+        const destinationAuth = usableAuthJson({ marker: "dst", expiresAt: new Date(now + 60_000).toISOString() });
+        expect(await runDecision({ sourceAuth, destinationAuth })).toBe(USE_SOURCE);
+    });
+    it("keeps the destination when the identity key differs", async () => {
+        const now = Date.now();
+        const sourceAuth = usableAuthJson({
+            identityKey: IDENTITY_A,
+            marker: "src",
+            expiresAt: new Date(now + 2 * 60_000).toISOString(),
+        });
+        const destinationAuth = usableAuthJson({
+            identityKey: IDENTITY_B,
+            marker: "dst",
+            expiresAt: new Date(now + 60_000).toISOString(),
+        });
+        expect(await runDecision({ sourceAuth, destinationAuth })).toBe(KEEP_DESTINATION);
+    });
+    it("keeps the destination when the source expiry equals the destination expiry", async () => {
+        const sameExpiry = new Date(Date.now() + 60_000).toISOString();
+        const sourceAuth = usableAuthJson({ marker: "src", expiresAt: sameExpiry });
+        const destinationAuth = usableAuthJson({ marker: "dst", expiresAt: sameExpiry });
+        expect(await runDecision({ sourceAuth, destinationAuth })).toBe(KEEP_DESTINATION);
+    });
+    it("keeps the destination when either side is unusable", async () => {
+        const now = Date.now();
+        const usable = usableAuthJson({ marker: "ok", expiresAt: new Date(now + 60_000).toISOString() });
+        const cases = [
+            { name: "source malformed JSON", sourceAuth: "{not valid json", destinationAuth: usable },
+            {
+                name: "source missing refresh_token",
+                sourceAuth: JSON.stringify({ [IDENTITY_A]: { key: "k" } }),
+                destinationAuth: usable,
+            },
+            { name: "destination absent", sourceAuth: usable, destinationAuth: ABSENT },
+            { name: "destination malformed JSON", sourceAuth: usable, destinationAuth: "{not valid json" },
+        ];
+        for (const entry of cases) {
+            const code = await runDecision({ sourceAuth: entry.sourceAuth, destinationAuth: entry.destinationAuth });
+            expect(code, entry.name).toBe(KEEP_DESTINATION);
+        }
+    });
+    it("keeps the destination when the payload holds more than one top-level key", async () => {
+        const now = Date.now();
+        const destinationAuth = usableAuthJson({ marker: "dst", expiresAt: new Date(now + 60_000).toISOString() });
+        const multiKeySource = JSON.stringify({
+            [IDENTITY_A]: { key: "k", refresh_token: "r", expires_at: new Date(now + 120_000).toISOString() },
+            extra: { key: "k2", refresh_token: "r2" },
+        });
+        expect(await runDecision({ sourceAuth: multiKeySource, destinationAuth })).toBe(KEEP_DESTINATION);
+    });
+    it("reads an ISO-8601 expiry, an epoch-seconds expiry, and an epoch-milliseconds expiry", async () => {
+        const now = Date.now();
+        const encodings = [
+            {
+                name: "ISO-8601",
+                source: new Date(now + 2 * 60_000).toISOString(),
+                destination: new Date(now + 60_000).toISOString(),
+            },
+            {
+                name: "epoch seconds",
+                source: Math.round((now + 2 * 60_000) / 1000),
+                destination: Math.round((now + 60_000) / 1000),
+            },
+            { name: "epoch milliseconds", source: now + 2 * 60_000, destination: now + 60_000 },
+        ];
+        for (const entry of encodings) {
+            const sourceAuth = usableAuthJson({ marker: "src", expiresAt: entry.source });
+            const destinationAuth = usableAuthJson({ marker: "dst", expiresAt: entry.destination });
+            const code = await runDecision({ sourceAuth, destinationAuth });
+            expect(code, entry.name).toBe(USE_SOURCE);
+        }
+    });
+    it("exits 21 and keeps the destination for an unreadable expiry shape", async () => {
+        const now = Date.now();
+        const destinationAuth = usableAuthJson({ marker: "dst", expiresAt: new Date(now + 60_000).toISOString() });
+        const badShapes = [true, "not-a-date", "2026/01/01 00:00:00", {}, []];
+        for (const badExpiry of badShapes) {
+            const sourceAuth = usableAuthJson({ marker: "src", expiresAt: badExpiry });
+            const code = await runDecision({ sourceAuth, destinationAuth });
+            expect(code, JSON.stringify(badExpiry)).toBe(UNREADABLE_EXPIRY);
+        }
+    });
+    it("uses the source for a source expiry exactly at the 400-day bound", () => {
+        const nowMs = Date.now();
+        const source = { kind: "usable", identityKey: IDENTITY_A, expiresAtRaw: nowMs + MAX_PLAUSIBLE_EXPIRY_MS };
+        const destination = { kind: "usable", identityKey: IDENTITY_A, expiresAtRaw: nowMs };
+        expect(decide(source, destination, nowMs)).toBe(USE_SOURCE);
+    });
+    it("exits 22 and keeps the destination for a source expiry one millisecond beyond the 400-day bound", () => {
+        const nowMs = Date.now();
+        const source = {
+            kind: "usable",
+            identityKey: IDENTITY_A,
+            expiresAtRaw: nowMs + MAX_PLAUSIBLE_EXPIRY_MS + 1,
+        };
+        const destination = { kind: "usable", identityKey: IDENTITY_A, expiresAtRaw: nowMs };
+        expect(decide(source, destination, nowMs)).toBe(IMPLAUSIBLE_EXPIRY);
+    });
+    it("measures the 400-day bound against the host clock and not against a sandbox-supplied time", () => {
+        // Fixed, unambiguous epoch-millisecond instants (both well above the
+        // epoch-seconds/epoch-milliseconds threshold). Neither parsed side
+        // changes between the two assertions below — only the caller-supplied
+        // `nowMs` moves — so a passing/failing bound can only be explained by the
+        // caller's clock, never by a value embedded in either payload.
+        const sourceExpiryMs = 2_000_000_000_000;
+        const destinationExpiryMs = 1_000_000_000_000;
+        const source = { kind: "usable", identityKey: IDENTITY_A, expiresAtRaw: sourceExpiryMs };
+        const destination = { kind: "usable", identityKey: IDENTITY_A, expiresAtRaw: destinationExpiryMs };
+        expect(decide(source, destination, sourceExpiryMs - MAX_PLAUSIBLE_EXPIRY_MS)).toBe(USE_SOURCE);
+        expect(decide(source, destination, sourceExpiryMs - MAX_PLAUSIBLE_EXPIRY_MS - 1)).toBe(IMPLAUSIBLE_EXPIRY);
+    });
+    it("keeps the destination for a forged source that copies the destination identity and a far-future expiry", async () => {
+        const now = Date.now();
+        const destinationAuth = usableAuthJson({ marker: "dst", expiresAt: new Date(now + 60_000).toISOString() });
+        // 500 days ahead is comfortably beyond both the 400-day plausibility
+        // bound and any subprocess scheduling delay, so this integration-level
+        // check never depends on millisecond timing.
+        const forgedSourceAuth = usableAuthJson({
+            marker: "forged",
+            expiresAt: new Date(now + 500 * 24 * 60 * 60 * 1000).toISOString(),
+        });
+        const code = await runDecision({ sourceAuth: forgedSourceAuth, destinationAuth });
+        expect(code).toBe(IMPLAUSIBLE_EXPIRY);
+    });
+});
+//# sourceMappingURL=grok-auth-merge-decision.test.js.map

package/dist/server/grok-auth-merge-decision.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-auth-merge-decision.test.js","sourceRoot":"","sources":["../../src/server/grok-auth-merge-decision.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,MAAM,QAAQ,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAE7C,MAAM,kBAAkB,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,gCAAgC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAErG,8EAA8E;AAC9E,qEAAqE;AACrE,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,mCAAmC;AACnC,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,kBAAkB,CAWvE,CAAC;AACF,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,GAC5G,cAAc,CAAC;AAEjB,MAAM,UAAU,GAAG,yDAAyD,CAAC;AAC7E,MAAM,UAAU,GAAG,yDAAyD,CAAC;AAE7E,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,SAAS,cAAc,CAAC,KAAoE;QAC1F,MAAM,KAAK,GAA4B;YACrC,GAAG,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE;YAC1B,aAAa,EAAE,WAAW,KAAK,CAAC,MAAM,EAAE;SACzC,CAAC;QACF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACtE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEhC,KAAK,UAAU,WAAW,CAAC,KAG1B;QACC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAC,CAAC;QACpF,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACtD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM;YAAE,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM;YAAE,MAAM,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/G,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,kBAAkB,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,CAAC;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAA2B,CAAC;YAC5C,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1G,MAAM,eAAe,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3G,MAAM,CAAC,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,cAAc,CAAC;YAChC,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,cAAc,CAAC;YACrC,WAAW,EAAE,UAAU;YACvB,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5E,MAAM,eAAe,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,MAAM,KAAK,GAAoG;YAC7G,EAAE,IAAI,EAAE,uBAAuB,EAAE,UAAU,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,EAAE;YACzF;gBACE,IAAI,EAAE,8BAA8B;gBACpC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;gBAC1D,eAAe,EAAE,MAAM;aACxB;YACD,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;YAC3E,EAAE,IAAI,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE;SAC/F,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;YACzG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3G,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;YACjG,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAA8D;YAC3E;gBACE,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;gBAChD,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;aAClD;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC;gBAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC;aAC/C;YACD,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,MAAM,EAAE;SACpF,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,MAAM,eAAe,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3G,MAAM,SAAS,GAAc,CAAC,IAAI,EAAE,YAAY,EAAE,qBAAqB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjF,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,GAAG,uBAAuB,EAAE,CAAC;QACnH,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC9F,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;QACzG,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,QAAiB;YACvB,WAAW,EAAE,UAAU;YACvB,YAAY,EAAE,KAAK,GAAG,uBAAuB,GAAG,CAAC;SAClD,CAAC;QACF,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC9F,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,qEAAqE;QACrE,mEAAmE;QACnE,sEAAsE;QACtE,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,cAAc,GAAG,iBAAiB,CAAC;QACzC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;QAC9C,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;QAClG,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;QAE5G,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,GAAG,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,GAAG,uBAAuB,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,KAAK,IAAI,EAAE;QACtH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3G,qEAAqE;QACrE,uEAAuE;QACvE,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,cAAc,CAAC;YACtC,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACnE,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/grok-home.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The allowlist of managed `GROK_HOME` entries that the grok-local adapter
+ * stages into the sandbox `home` asset (see {@link stageGrokHomeForSync}).
+ * Paperclip writes instructions and skills under the workspace, not under the
+ * Grok home, so the credential file is the only entry a sandbox run needs.
+ */
+export declare const GROK_SYNC_ALLOWLIST: readonly ["auth.json"];
+/** One parsed Grok auth payload: the composite identity key and its value object. */
+export interface GrokAuthPayload {
+    identityKey: string;
+    value: Record<string, unknown>;
+}
+/**
+ * Parses a decoded JSON value into a {@link GrokAuthPayload}. Returns null when
+ * the value is not an object, holds zero or more than one top-level key, or the
+ * single key does not match the `<issuer>::<uuid>` shape, or its value is not an
+ * object. Never assumes a fixed key name.
+ */
+export declare function parseGrokAuthPayload(raw: unknown): GrokAuthPayload | null;
+/** True when the payload value holds the two fields a run needs to authenticate. */
+export declare function hasUsableGrokAuthValue(value: Record<string, unknown>): boolean;
+/**
+ * True when `home` has a usable `auth.json`: a single `<issuer>::<uuid>`
+ * top-level key whose value holds a non-empty `key` and `refresh_token`. A
+ * missing file, invalid JSON, or an unusable shape all resolve false.
+ */
+export declare function grokHomeHasUsableAuth(home: string): Promise<boolean>;
+/**
+ * Resolves the managed Grok home directory. With a `companyId`, it resolves the
+ * company-scoped home under the Paperclip instance tree, the same isolation
+ * boundary `resolveManagedCodexHomeDir` uses. Without one, it resolves the
+ * instance-global home, which a promotion must never write.
+ */
+export declare function resolveManagedGrokHomeDir(env: NodeJS.ProcessEnv, companyId?: string): string;
+export interface StageGrokHomeForSyncOptions {
+    /** Run id, used only to make the staged temp-dir name traceable in logs. */
+    runId?: string;
+}
+/**
+ * Stages exactly {@link GROK_SYNC_ALLOWLIST} from `effectiveGrokHome` into a
+ * fresh private temp dir and returns its path, for registration as the sandbox
+ * `home` asset. Mirrors `stageCodexHomeForSync` in the codex-local adapter.
+ *
+ * - **The symlink is dereferenced to bytes** — the single-use `auth.json`
+ *   credential (a symlink into the shared source home) lands as a real file,
+ *   never a dangling link.
+ * - **A missing `auth.json` is not an error** — a company with no completed
+ *   device login yet stages an empty directory.
+ * - **`mkdtemp` guarantees the staged dir is `0700`** on POSIX, and the staged
+ *   `auth.json` is written `0600` (least privilege).
+ * - **Fail-closed** — any *unexpected* I/O error removes the partial temp dir
+ *   and re-throws, so a run never proceeds with a partial staged home.
+ *
+ * The caller owns removing the returned dir on run teardown.
+ */
+export declare function stageGrokHomeForSync(effectiveGrokHome: string, options?: StageGrokHomeForSyncOptions): Promise<string>;
+//# sourceMappingURL=grok-home.d.ts.map

package/dist/server/grok-home.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-home.d.ts","sourceRoot":"","sources":["../../src/server/grok-home.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,YAAI,WAAW,CAAU,CAAC;AAc1D,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CASzE;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAS9E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS1E;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CASR;AAED,MAAM,WAAW,2BAA2B;IAC1C,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,iBAAiB,EAAE,MAAM,EACzB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}