codex-multi-auth 2.16.0 → 2.17.2

package/dist/lib/schemas.d.ts

@@ -153,6 +153,10 @@ export declare const AccountMetadataV3Schema: z.ZodObject<{
         isDefault: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     currentWorkspaceIndex: z.ZodOptional<z.ZodNumber>;
+    codexCliMirror: z.ZodOptional<z.ZodObject<{
+        forAccountId: z.ZodString;
+        accountId: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 /**
  * Account storage V3 - current storage format with per-family active indices.
@@ -202,6 +206,10 @@ export declare const AccountStorageV3Schema: z.ZodObject<{
             isDefault: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         currentWorkspaceIndex: z.ZodOptional<z.ZodNumber>;
+        codexCliMirror: z.ZodOptional<z.ZodObject<{
+            forAccountId: z.ZodString;
+            accountId: z.ZodString;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     activeIndex: z.ZodNumber;
     activeIndexByFamily: z.ZodOptional<z.ZodObject<{
@@ -339,6 +347,10 @@ export declare const AnyAccountStorageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
             isDefault: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         currentWorkspaceIndex: z.ZodOptional<z.ZodNumber>;
+        codexCliMirror: z.ZodOptional<z.ZodObject<{
+            forAccountId: z.ZodString;
+            accountId: z.ZodString;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     activeIndex: z.ZodNumber;
     activeIndexByFamily: z.ZodOptional<z.ZodObject<{
@@ -400,6 +412,10 @@ export declare const FlaggedAccountMetadataV1Schema: z.ZodObject<{
         isDefault: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     currentWorkspaceIndex: z.ZodOptional<z.ZodNumber>;
+    codexCliMirror: z.ZodOptional<z.ZodObject<{
+        forAccountId: z.ZodString;
+        accountId: z.ZodString;
+    }, z.core.$strip>>;
     flaggedAt: z.ZodNumber;
     flaggedReason: z.ZodOptional<z.ZodString>;
     lastError: z.ZodOptional<z.ZodString>;
@@ -452,6 +468,10 @@ export declare const FlaggedAccountStorageV1Schema: z.ZodObject<{
             isDefault: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         currentWorkspaceIndex: z.ZodOptional<z.ZodNumber>;
+        codexCliMirror: z.ZodOptional<z.ZodObject<{
+            forAccountId: z.ZodString;
+            accountId: z.ZodString;
+        }, z.core.$strip>>;
         flaggedAt: z.ZodNumber;
         flaggedReason: z.ZodOptional<z.ZodString>;
         lastError: z.ZodOptional<z.ZodString>;

package/dist/lib/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../lib/schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmE7B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAMxE;;GAEG;AACH,QAAA,MAAM,qBAAqB;;;;;EAKzB,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAwB9E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;EAKtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAwBhF;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBlC,CAAC;AAkBH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOjC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAsBhF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAGlC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,uBAAuB,CAC9B,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI3B,CAAC;AAEjB;;GAEG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGxC,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,6BAA6B,CACpC,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;iBAMrC,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,0BAA0B,CACjC,CAAC;AAMF;;GAEG;AACH,QAAA,MAAM,wBAAwB;;;;;;;EAO5B,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,wBAAwB,CAC/B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;iBAO7B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBAK7B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;2BAG5B,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAMtE;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,wBAAwB,CAC/B,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,OAAO,GACX,sBAAsB,GAAG,IAAI,CAM/B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,2BAA2B,GAAG,IAAI,CAMpC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACxC,IAAI,EAAE,OAAO,GACX,0BAA0B,GAAG,IAAI,CAMnC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,IAAI,EAAE,OAAO,GACX,qBAAqB,GAAG,IAAI,CAM9B;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAC1C,IAAI,EAAE,OAAO,GACX,4BAA4B,GAAG,IAAI,CAMrC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC/C,IAAI,EAAE,OAAO,GACX,iCAAiC,GAAG,IAAI,CAM1C;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC5C,IAAI,EAAE,OAAO,GACX,8BAA8B,GAAG,IAAI,CAMvC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC9B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,SAAkB,GACvB,CAAC,GAAG,IAAI,CA8BV;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EACjB,IAAI,EAAE,OAAO,GACX,MAAM,EAAE,CASV"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../lib/schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmE7B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAMxE;;GAEG;AACH,QAAA,MAAM,qBAAqB;;;;;EAKzB,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAwB9E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;EAKtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAwBhF;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BlC,CAAC;AAkBH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOjC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAsBhF;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAGlC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,uBAAuB,CAC9B,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI3B,CAAC;AAEjB;;GAEG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGxC,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,6BAA6B,CACpC,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;iBAMrC,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,0BAA0B,CACjC,CAAC;AAMF;;GAEG;AACH,QAAA,MAAM,wBAAwB;;;;;;;EAO5B,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,wBAAwB,CAC/B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;iBAO7B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBAK7B,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;2BAG5B,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAMtE;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,wBAAwB,CAC/B,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,OAAO,GACX,sBAAsB,GAAG,IAAI,CAM/B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,2BAA2B,GAAG,IAAI,CAMpC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACxC,IAAI,EAAE,OAAO,GACX,0BAA0B,GAAG,IAAI,CAMnC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,IAAI,EAAE,OAAO,GACX,qBAAqB,GAAG,IAAI,CAM9B;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAC1C,IAAI,EAAE,OAAO,GACX,4BAA4B,GAAG,IAAI,CAMrC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC/C,IAAI,EAAE,OAAO,GACX,iCAAiC,GAAG,IAAI,CAM1C;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC5C,IAAI,EAAE,OAAO,GACX,8BAA8B,GAAG,IAAI,CAMvC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC9B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,SAAkB,GACvB,CAAC,GAAG,IAAI,CA8BV;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EACjB,IAAI,EAAE,OAAO,GACX,MAAM,EAAE,CASV"}

package/dist/lib/schemas.js

@@ -175,6 +175,9 @@ export const AccountMetadataV3Schema = z.object({
     // silently vanish after one read/write round-trip.
     workspaces: z.array(WorkspaceSchema).optional(),
     currentWorkspaceIndex: z.number().optional(),
+    codexCliMirror: z
+        .object({ forAccountId: z.string().min(1), accountId: z.string().min(1) })
+        .optional(),
 });
 /**
  * Build activeIndexByFamily schema dynamically from MODEL_FAMILIES.

package/dist/lib/storage/credential-sidecars.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Remove the files beside the account pool that hold raw API keys or
+ * per-account runtime state. `clearAccounts` only touches the account pool, so
+ * `uninstall --clear-accounts` and the dashboard reset call this as well.
+ */
+export declare function clearCredentialSidecars(): Promise<void>;
+/**
+ * Clear the account pool and the credential sidecars. The sidecars are removed
+ * even when the pool clear fails (e.g. a lasting Windows EBUSY), so raw API
+ * keys never survive a reset; the first failure is rethrown afterwards.
+ */
+export declare function clearAccountsAndCredentialSidecars(clearPool: () => Promise<void>): Promise<void>;
+//# sourceMappingURL=credential-sidecars.d.ts.map

package/dist/lib/storage/credential-sidecars.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-sidecars.d.ts","sourceRoot":"","sources":["../../../lib/storage/credential-sidecars.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAuB7D;AAED;;;;GAIG;AACH,wBAAsB,kCAAkC,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAYtG"}

package/dist/lib/storage/credential-sidecars.js

@@ -0,0 +1,52 @@
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import { getApiRoutesPath } from "../api-route-store.js";
+import { withRetry } from "../fs-retry.js";
+import { getCodexMultiAuthDir } from "../runtime-paths.js";
+import { withFileTransactionLock } from "./file-lock.js";
+import { withStorageLock } from "./transactions.js";
+const retry = { maxAttempts: 6, backoffMs: 25 };
+/**
+ * Remove the files beside the account pool that hold raw API keys or
+ * per-account runtime state. `clearAccounts` only touches the account pool, so
+ * `uninstall --clear-accounts` and the dashboard reset call this as well.
+ */
+export async function clearCredentialSidecars() {
+    const routes = getApiRoutesPath();
+    // Same locks as saveApiRoutes, so a concurrent menu save cannot resurrect keys.
+    await withStorageLock(() => withFileTransactionLock(routes, () => withRetry(() => fs.rm(routes, { force: true }), retry)));
+    const dir = getCodexMultiAuthDir();
+    // Each writer read-modify-writes under its file lock; deleting under the same
+    // lock stops an in-flight refresh or redemption renaming its old state (and a
+    // last-resort policy) back after the reset.
+    for (const path of [
+        join(dir, "reset-credits.json"),
+        join(dir, "api-capability-probes.json"),
+    ]) {
+        await withFileTransactionLock(path, () => withRetry(() => fs.rm(path, { force: true }), retry));
+    }
+    // Per-account timestamps only; their writers take no lock and hold no secrets.
+    const activity = join(dir, "inference-activity");
+    await withRetry(() => fs.rm(activity, { recursive: true, force: true }), retry);
+}
+/**
+ * Clear the account pool and the credential sidecars. The sidecars are removed
+ * even when the pool clear fails (e.g. a lasting Windows EBUSY), so raw API
+ * keys never survive a reset; the first failure is rethrown afterwards.
+ */
+export async function clearAccountsAndCredentialSidecars(clearPool) {
+    let failure;
+    let failed = false;
+    for (const step of [clearPool, clearCredentialSidecars]) {
+        try {
+            await step();
+        }
+        catch (error) {
+            if (!failed)
+                failure = error;
+            failed = true;
+        }
+    }
+    if (failed)
+        throw failure;
+}

package/dist/lib/storage/file-lock.d.ts

@@ -0,0 +1,9 @@
+/** Local-disk transaction lock. Live processes are never evicted by age.
+ * Publish an already-populated directory atomically: there is no ownerless acquisition window.
+ * Recovery unlinks only the dead owner's unique filename; rmdir cannot erase a new owner's lock.
+ * A reused PID fails closed (bounded contention) rather than risking two writers.
+ */
+export declare function withFileTransactionLock<T>(path: string, action: () => Promise<T>, options?: {
+    waitMs?: number;
+}): Promise<T>;
+//# sourceMappingURL=file-lock.d.ts.map

package/dist/lib/storage/file-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-lock.d.ts","sourceRoot":"","sources":["../../../lib/storage/file-lock.ts"],"names":[],"mappings":"AA0GA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,CAAC,CAAC,CA+DlB"}

package/dist/lib/storage/file-lock.js

@@ -0,0 +1,186 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash, randomUUID } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { hostname } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { logWarn } from "../logger.js";
+import { withRetry } from "../fs-retry.js";
+const abandonedOwners = new Set();
+const leases = new AsyncLocalStorage();
+const host = createHash("sha256").update(hostname()).digest("hex").slice(0, 16);
+const ownerPattern = /^([a-f0-9]{16})\.([1-9][0-9]*)\.([a-f0-9-]{36})$/;
+function code(error) {
+    return error?.code;
+}
+function dead(pid) {
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (error) {
+        return code(error) === "ESRCH";
+    }
+}
+async function removeEmpty(path) {
+    try {
+        await fs.rmdir(path);
+    }
+    catch (error) {
+        if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(code(error) ?? ""))
+            throw error;
+    }
+}
+function retryAbandonedRelease(path, owner, remaining = 30) {
+    const timer = setTimeout(() => {
+        void (async () => {
+            try {
+                try {
+                    await fs.unlink(join(path, owner));
+                }
+                catch (error) {
+                    if (code(error) !== "ENOENT")
+                        throw error;
+                }
+                // Owner filenames are unique; never delete another owner's contents.
+                await removeEmpty(path);
+                abandonedOwners.delete(owner);
+            }
+            catch {
+                if (remaining > 1)
+                    retryAbandonedRelease(path, owner, remaining - 1);
+            }
+        })();
+    }, 250);
+    timer.unref();
+}
+async function recoverDeadOwner(path) {
+    let entries;
+    try {
+        const stat = await fs.lstat(path);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw Error("Invalid storage lock; manual repair required");
+        entries = await fs.readdir(path);
+    }
+    catch (error) {
+        if (code(error) === "ENOENT")
+            return;
+        throw error;
+    }
+    // Published locks always have an owner. Empty means a release/recovery was interrupted.
+    if (!entries.length) {
+        await removeEmpty(path);
+        return;
+    }
+    if (entries.length !== 1)
+        throw Error("Invalid storage lock contents; manual repair required");
+    const name = entries[0];
+    if (!name)
+        return;
+    const owner = ownerPattern.exec(name);
+    if (!owner || owner[1] !== host || !Number.isSafeInteger(Number(owner[2])))
+        return;
+    if (!abandonedOwners.has(name) && !dead(Number(owner[2])))
+        return;
+    try {
+        await fs.unlink(join(path, name));
+    }
+    catch (error) {
+        if (code(error) === "ENOENT")
+            return;
+        throw error;
+    }
+    // Never recursively remove: another writer may already have published a new nonempty lock.
+    abandonedOwners.delete(name);
+    await removeEmpty(path);
+}
+async function recoverDeadCandidates(lock) {
+    const parent = dirname(lock), prefix = `${basename(lock)}.candidate-`;
+    for (const entry of await fs.readdir(parent, { withFileTypes: true })) {
+        if (!entry.name.startsWith(prefix) || !entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        const candidate = join(parent, entry.name);
+        try {
+            const owners = await fs.readdir(candidate);
+            // An empty candidate may belong to a live writer still publishing its owner.
+            if (owners.length !== 1 || !ownerPattern.test(owners[0] ?? ""))
+                continue;
+            await recoverDeadOwner(candidate);
+        }
+        catch (error) {
+            if (code(error) !== "ENOENT")
+                logWarn("Storage candidate cleanup deferred", { code: code(error) ?? "unknown" });
+        }
+    }
+}
+/** Local-disk transaction lock. Live processes are never evicted by age.
+ * Publish an already-populated directory atomically: there is no ownerless acquisition window.
+ * Recovery unlinks only the dead owner's unique filename; rmdir cannot erase a new owner's lock.
+ * A reused PID fails closed (bounded contention) rather than risking two writers.
+ */
+export async function withFileTransactionLock(path, action, options = {}) {
+    const absolute = resolve(path);
+    await fs.mkdir(dirname(absolute), { recursive: true, mode: 0o700 });
+    // Canonicalize the existing parent so /tmp and its symlink aliases share a lock.
+    const key = join(await fs.realpath(dirname(absolute)), absolute.slice(dirname(absolute).length + 1));
+    if (leases.getStore()?.get(key)?.active)
+        return action();
+    const lock = `${key}.write-lock`;
+    await recoverDeadCandidates(lock);
+    const candidate = await fs.mkdtemp(`${lock}.candidate-`);
+    const owner = `${host}.${process.pid}.${randomUUID()}`;
+    let published = false;
+    try {
+        await fs.chmod(candidate, 0o700);
+        await fs.writeFile(join(candidate, owner), "", { flag: "wx", mode: 0o600 });
+        await withRetry(async () => {
+            try {
+                await fs.rename(candidate, lock);
+                published = true;
+            }
+            catch (error) {
+                if (!["ENOTEMPTY", "EEXIST", "EPERM", "EACCES"].includes(code(error) ?? ""))
+                    throw error;
+                // Permission errors without a destination are not lock contention.
+                if (["EPERM", "EACCES"].includes(code(error) ?? "")) {
+                    try {
+                        await fs.lstat(lock);
+                    }
+                    catch {
+                        throw error;
+                    }
+                }
+                await recoverDeadOwner(lock);
+                throw Object.assign(Error("Storage is busy with another live writer; retry shortly."), { code: "ELOCKED" });
+            }
+        }, { maxAttempts: Math.max(1, Math.ceil((options.waitMs ?? 10000) / 25) + 1), backoffMs: 25, retryableCodes: ["ELOCKED", "EBUSY", "EPERM", "EACCES", "EAGAIN"] });
+        const lease = { active: true };
+        const context = new Map(leases.getStore());
+        context.set(key, lease);
+        try {
+            return await leases.run(context, action);
+        }
+        finally {
+            lease.active = false;
+        }
+    }
+    finally {
+        const directory = published ? lock : candidate;
+        try {
+            await withRetry(async () => {
+                try {
+                    await fs.unlink(join(directory, owner));
+                }
+                catch (error) {
+                    if (code(error) !== "ENOENT")
+                        throw error;
+                }
+                await removeEmpty(directory);
+            }, { maxAttempts: 6, backoffMs: 25 });
+        }
+        catch (error) {
+            abandonedOwners.add(owner);
+            retryAbandonedRelease(directory, owner);
+            logWarn("Storage lock cleanup deferred", { code: code(error) ?? "unknown" });
+        }
+    }
+}

package/dist/lib/storage/flagged-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flagged-storage.d.ts","sourceRoot":"","sources":["../../../lib/storage/flagged-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGX,uBAAuB,EACvB,MAAM,mBAAmB,CAAC;AAE3B,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IACL,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/D,GAAG,EAAE,MAAM,MAAM,CAAC;CAClB,GACC,uBAAuB,CAyJzB"}
+{"version":3,"file":"flagged-storage.d.ts","sourceRoot":"","sources":["../../../lib/storage/flagged-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAIX,uBAAuB,EACvB,MAAM,mBAAmB,CAAC;AAa3B,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IACL,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/D,GAAG,EAAE,MAAM,MAAM,CAAC;CAClB,GACC,uBAAuB,CA0JzB"}

package/dist/lib/storage/flagged-storage.js

@@ -1,3 +1,14 @@
+function normalizeCodexCliMirror(value) {
+    if (typeof value !== "object" || value === null)
+        return undefined;
+    const { forAccountId, accountId } = value;
+    return typeof forAccountId === "string" &&
+        forAccountId.trim() &&
+        typeof accountId === "string" &&
+        accountId.trim()
+        ? { forAccountId, accountId }
+        : undefined;
+}
 export function normalizeFlaggedStorage(data, deps) {
     if (!deps.isRecord(data) ||
         data.version !== 1 ||
@@ -101,6 +112,7 @@ export function normalizeFlaggedStorage(data, deps) {
             currentWorkspaceIndex: typeof rawAccount.currentWorkspaceIndex === "number"
                 ? rawAccount.currentWorkspaceIndex
                 : undefined,
+            codexCliMirror: normalizeCodexCliMirror(rawAccount.codexCliMirror),
             flaggedAt,
             flaggedReason: typeof rawAccount.flaggedReason === "string"
                 ? rawAccount.flaggedReason

package/dist/lib/storage/path-state.d.ts

@@ -8,4 +8,6 @@ export declare function getStoragePathState(): StoragePathState;
 export declare function setStoragePathState(state: StoragePathState): void;
 export declare function setStoragePathDirectState(state: StoragePathState): void;
 export declare function runWithStoragePathState<T>(state: StoragePathState, fn: () => T | Promise<T>): Promise<T>;
+/** Temporarily use the shared pool without mutating the caller or sibling async scopes. */
+export declare function runWithGlobalStoragePath<T>(fn: () => T | Promise<T>): Promise<T>;
 //# sourceMappingURL=path-state.d.ts.map

package/dist/lib/storage/path-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-state.d.ts","sourceRoot":"","sources":["../../../lib/storage/path-state.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG;IAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+BAA+B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,gCAAgC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAwBF,wBAAgB,mBAAmB,IAAI,gBAAgB,CAatD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAOjE;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAQvE;AAED,wBAAsB,uBAAuB,CAAC,CAAC,EAC9C,KAAK,EAAE,gBAAgB,EACvB,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACtB,OAAO,CAAC,CAAC,CAAC,CAKZ"}
+{"version":3,"file":"path-state.d.ts","sourceRoot":"","sources":["../../../lib/storage/path-state.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG;IAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+BAA+B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,gCAAgC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAwBF,wBAAgB,mBAAmB,IAAI,gBAAgB,CAatD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAOjE;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAQvE;AAED,wBAAsB,uBAAuB,CAAC,CAAC,EAC9C,KAAK,EAAE,gBAAgB,EACvB,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACtB,OAAO,CAAC,CAAC,CAAC,CAKZ;AAED,2FAA2F;AAC3F,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAOhF"}

package/dist/lib/storage/path-state.js

@@ -47,3 +47,12 @@ export function setStoragePathDirectState(state) {
 export async function runWithStoragePathState(state, fn) {
     return await storagePathStateContext.run({ state, directGeneration: directStorageGeneration }, fn);
 }
+/** Temporarily use the shared pool without mutating the caller or sibling async scopes. */
+export function runWithGlobalStoragePath(fn) {
+    return runWithStoragePathState({
+        currentStoragePath: null,
+        currentLegacyProjectStoragePath: null,
+        currentLegacyWorktreeStoragePath: null,
+        currentProjectRoot: null,
+    }, fn);
+}

package/dist/lib/storage/paths.js

@@ -57,7 +57,7 @@ function resolveGitPath(basePath, pointerValue) {
         : resolve(basePath, normalizedPointer);
 }
 function readGitCommonDir(gitDirPath) {
-    const commonDirFile = join(gitDirPath, "commondir");
+    const commonDirFile = resolveGitPath(gitDirPath, "commondir");
     if (!existsSync(commonDirFile)) {
         return gitDirPath;
     }
@@ -107,7 +107,7 @@ function normalizeCanonicalPathForIdentityCheck(pathValue) {
     }
 }
 function worktreeGitDirBelongsToProject(projectRoot, gitDirPath) {
-    const gitdirBackRefPath = join(gitDirPath, "gitdir");
+    const gitdirBackRefPath = resolveGitPath(gitDirPath, "gitdir");
     if (!existsSync(gitdirBackRefPath)) {
         return false;
     }
@@ -268,8 +268,8 @@ export function resolveProjectStorageIdentityRoot(projectRoot) {
         if (!isGitDirUnderCommonWorktrees(gitDirPath, commonGitDir)) {
             return projectRoot;
         }
-        const candidateRepoRoot = dirname(commonGitDir);
-        if (!existsSync(join(candidateRepoRoot, ".git"))) {
+        const candidateRepoRoot = resolveGitPath(commonGitDir, "..");
+        if (!existsSync(resolveGitPath(candidateRepoRoot, ".git"))) {
             return projectRoot;
         }
         return candidateRepoRoot;

package/dist/lib/storage/pending-auth.d.ts

@@ -0,0 +1,18 @@
+import type { AccountStorageV3 } from "./public-types.js";
+export declare function getPendingAuthPath(storagePath: string): string;
+/** Record a rotated credential beside the account pool. */
+export declare function recordPendingAuth(storagePath: string, auth: {
+    priorRefreshToken: string;
+    recordId?: string;
+    refreshToken: string;
+    accessToken: string;
+    expiresAt: number;
+    at: number;
+}): Promise<void>;
+/** Overlay pending rotated credentials on rows that still hold the spent token. */
+export declare function applyPendingAuth(storagePath: string, storage: AccountStorageV3 | null): Promise<AccountStorageV3 | null>;
+/** After a save, drop entries whose spent token is no longer on disk (persisted or superseded). */
+export declare function prunePendingAuth(storagePath: string, saved: AccountStorageV3): Promise<void>;
+/** Coordinate resets with pending credential writers, including Windows rename locks. */
+export declare function clearPendingAuth(storagePath: string): Promise<void>;
+//# sourceMappingURL=pending-auth.d.ts.map

package/dist/lib/storage/pending-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-auth.d.ts","sourceRoot":"","sources":["../../../lib/storage/pending-auth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA0B1D,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAmCD,2DAA2D;AAC3D,wBAAsB,iBAAiB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,iBAAiB,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9H,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,mFAAmF;AACnF,wBAAsB,gBAAgB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAC9B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA6BlC;AAED,mGAAmG;AACnG,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUlG;AAED,yFAAyF;AACzF,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGzE"}

package/dist/lib/storage/pending-auth.js

@@ -0,0 +1,155 @@
+import { createHash } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { dirname } from "node:path";
+import { z } from "zod";
+import { withRetry } from "../fs-retry.js";
+import { createLogger } from "../logger.js";
+import { tempPathFor } from "../temp-path.js";
+import { withFileTransactionLock } from "./file-lock.js";
+import { getIntentionalResetMarkerPath } from "./backup-paths.js";
+/**
+ * Rotated OAuth credentials that could not be written to the account pool
+ * (a locked or unreadable accounts file). A refresh spends the previous
+ * refresh token upstream, so losing the new one with the process means the
+ * account needs a re-login. Every load applies these entries until a save
+ * persists them.
+ */
+const entrySchema = z.object({
+    /** sha256 of the spent refresh token: identifies the row without storing it. */
+    prior: z.string().regex(/^[0-9a-f]{64}$/),
+    recordId: z.string().trim().min(1).optional(),
+    refreshToken: z.string().min(1),
+    accessToken: z.string().min(1),
+    expiresAt: z.number(),
+    at: z.number(),
+});
+/** The writer keeps the journal at this size; the reader accepts any size so an
+ * over-cap file an earlier writer left behind still loads and is trimmed on the next write. */
+const MAX_ENTRIES = 1000;
+const fileSchema = z.object({ version: z.literal(1), entries: z.array(entrySchema) });
+const retry = { maxAttempts: 6, backoffMs: 25 };
+const log = createLogger("pending-auth");
+export function getPendingAuthPath(storagePath) {
+    return `${storagePath}.pending-auth.json`;
+}
+const hash = (token) => createHash("sha256").update(token).digest("hex");
+/**
+ * Only a missing file is empty. The entries are the only copy of rotated
+ * tokens, so a lock that outlasts the retries or a torn/corrupt file throws:
+ * a writer must never replace it with a partial list.
+ */
+async function read(path) {
+    let raw;
+    try {
+        raw = await withRetry(() => fs.readFile(path, "utf8"), retry);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    return fileSchema.parse(JSON.parse(raw)).entries;
+}
+async function write(path, entries) {
+    if (!entries.length) {
+        await withRetry(() => fs.rm(path, { force: true }), retry);
+        return;
+    }
+    await fs.mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temp = tempPathFor(path);
+    try {
+        await fs.writeFile(temp, `${JSON.stringify({ version: 1, entries })}\n`, { mode: 0o600, flag: "wx" });
+        await withRetry(() => fs.rename(temp, path), retry);
+    }
+    finally {
+        await fs.rm(temp, { force: true }).catch(() => undefined);
+    }
+}
+/** Record a rotated credential beside the account pool. */
+export async function recordPendingAuth(storagePath, auth) {
+    const path = getPendingAuthPath(storagePath);
+    await withFileTransactionLock(path, async () => {
+        try {
+            await fs.stat(getIntentionalResetMarkerPath(storagePath));
+            throw Object.assign(new Error("Account pool was reset; rotated credentials were not retained."), { code: "ESTALE" });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const prior = hash(auth.priorRefreshToken);
+        const entries = (await read(path)).filter((entry) => entry.prior !== prior && entry.prior !== hash(auth.refreshToken));
+        // Rotating a token that is itself only journaled: the row on disk still holds
+        // the original spent token, so extend that entry rather than add one that
+        // no disk row can match.
+        const chained = entries.find((entry) => entry.refreshToken === auth.priorRefreshToken);
+        const current = chained ?? { prior, recordId: auth.recordId, refreshToken: auth.refreshToken, accessToken: auth.accessToken, expiresAt: auth.expiresAt, at: auth.at };
+        if (chained)
+            Object.assign(chained, { recordId: chained.recordId ?? auth.recordId, refreshToken: auth.refreshToken, accessToken: auth.accessToken, expiresAt: auth.expiresAt, at: auth.at });
+        else
+            entries.push(current);
+        const excess = entries.length - MAX_ENTRIES;
+        if (excess > 0) {
+            // Drop the oldest other entries, never the credential being recorded now.
+            const dropped = new Set(entries.filter((entry) => entry !== current).sort((a, b) => a.at - b.at).slice(0, excess));
+            log.warn("Pending rotated credentials exceeded the journal cap; dropped the oldest entries", { dropped: dropped.size });
+            await write(path, entries.filter((entry) => !dropped.has(entry)));
+            return;
+        }
+        await write(path, entries);
+    });
+}
+/** Overlay pending rotated credentials on rows that still hold the spent token. */
+export async function applyPendingAuth(storagePath, storage) {
+    if (!storage)
+        return storage;
+    let entries;
+    try {
+        entries = await read(getPendingAuthPath(storagePath));
+    }
+    catch (error) {
+        // Loading must still work; the file is left untouched for a later load.
+        log.error("Pending rotated credentials could not be read; affected accounts may need a re-login if this persists", {
+            path: getPendingAuthPath(storagePath),
+            code: typeof error.code === "string" && /^[A-Z_]{1,40}$/.test(error.code ?? "") ? error.code : "INVALID_PENDING_AUTH",
+        });
+        return storage;
+    }
+    if (!entries.length)
+        return storage;
+    for (const account of storage.accounts) {
+        const entry = account.refreshToken ? entries.find((item) => item.prior === hash(account.refreshToken)) : undefined;
+        if (!entry)
+            continue;
+        account.recordId ??= entry.recordId;
+        account.refreshToken = entry.refreshToken;
+        account.accessToken = entry.accessToken;
+        account.expiresAt = entry.expiresAt;
+        delete account.authInvalidatedAt;
+        delete account.authInvalidationErrorCode;
+        if (account.cooldownReason === "auth-failure") {
+            delete account.coolingDownUntil;
+            delete account.cooldownReason;
+        }
+    }
+    return storage;
+}
+/** After a save, drop entries whose spent token is no longer on disk (persisted or superseded). */
+export async function prunePendingAuth(storagePath, saved) {
+    const path = getPendingAuthPath(storagePath);
+    const current = await read(path);
+    if (!current.length)
+        return;
+    await withFileTransactionLock(path, async () => {
+        const spent = new Set(saved.accounts.map((account) => hash(account.refreshToken)));
+        const entries = await read(path);
+        const remaining = entries.filter((entry) => spent.has(entry.prior));
+        if (remaining.length !== entries.length)
+            await write(path, remaining);
+    });
+}
+/** Coordinate resets with pending credential writers, including Windows rename locks. */
+export async function clearPendingAuth(storagePath) {
+    const path = getPendingAuthPath(storagePath);
+    await withFileTransactionLock(path, () => withRetry(() => fs.rm(path, { force: true }), retry));
+}

package/dist/lib/storage/public-types.d.ts

@@ -41,6 +41,19 @@ export interface AccountMetadataV3 {
     authInvalidationErrorCode?: string;
     workspaces?: Workspace[];
     currentWorkspaceIndex?: number;
+    /** See {@link CodexCliMirror}. */
+    codexCliMirror?: CodexCliMirror;
+}
+/**
+ * The id written to ~/.codex/auth.json in place of an explicit `login --org` /
+ * CODEX_AUTH_ACCOUNT_ID binding the backend does not authorize (Codex CLI
+ * 0.156+ refuses such an id, issue #700). Applies only while `forAccountId`
+ * still equals the account's `accountId`, so any change of that id (re-login,
+ * a new explicit id, a token-follow, a rebind) makes it stale on its own.
+ */
+export interface CodexCliMirror {
+    forAccountId: string;
+    accountId: string;
 }
 export interface AccountStorageV3 {
     version: 3;

package/dist/lib/storage/public-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-types.d.ts","sourceRoot":"","sources":["../../../lib/storage/public-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,eAAe,GAAG,cAAc,GAAG,YAAY,CAAC;AAE9F,MAAM,WAAW,gBAAgB;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EACd,YAAY,GACZ,SAAS,GACT,UAAU,GACV,MAAM,GACN,SAAS,GACT,QAAQ,CAAC;IACZ,mBAAmB,CAAC,EAAE,gBAAgB,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACrC"}
+{"version":3,"file":"public-types.d.ts","sourceRoot":"","sources":["../../../lib/storage/public-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,eAAe,GAAG,cAAc,GAAG,YAAY,CAAC;AAE9F,MAAM,WAAW,gBAAgB;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EACd,YAAY,GACZ,SAAS,GACT,UAAU,GACV,MAAM,GACN,SAAS,GACT,QAAQ,CAAC;IACZ,mBAAmB,CAAC,EAAE,gBAAgB,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kCAAkC;IAClC,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACrC"}