zevairouter 1.0.0

package/src/sse/services/auth.js

@@ -0,0 +1,388 @@
+import { getProviderConnections, validateApiKey, updateProviderConnection, getSettings } from "@/lib/localDb";
+import { resolveConnectionProxyConfig } from "@/lib/network/connectionProxy";
+import { formatRetryAfter, checkFallbackError, isModelLockActive, buildModelLockUpdate, getEarliestModelLockUntil, isNonAccountError } from "open-sse/services/accountFallback.js";
+import { MAX_RATE_LIMIT_COOLDOWN_MS } from "open-sse/config/errorConfig.js";
+import { resolveProviderId, FREE_PROVIDERS } from "@/shared/constants/providers.js";
+import * as log from "../utils/logger.js";
+
+// Mutex to prevent race conditions during account selection
+let selectionMutex = Promise.resolve();
+
+/**
+ * Get provider credentials from localDb
+ * Filters out unavailable accounts and returns the selected account based on strategy
+ * @param {string} provider - Provider name
+ * @param {Set<string>|string|null} excludeConnectionIds - Connection ID(s) to exclude (for retry with next account)
+ * @param {string|null} model - Model name for per-model rate limit filtering
+ */
+export async function getProviderCredentials(provider, excludeConnectionIds = null, model = null, options = {}) {
+  // Normalize to Set for consistent handling
+  const excludeSet = excludeConnectionIds instanceof Set
+    ? excludeConnectionIds
+    : (excludeConnectionIds ? new Set([excludeConnectionIds]) : new Set());
+  const preferredConnectionId = options?.preferredConnectionId || null;
+  const strictPreferred = !!options?.strictPreferred;
+  // Acquire mutex to prevent race conditions
+  const currentMutex = selectionMutex;
+  let resolveMutex;
+  selectionMutex = new Promise(resolve => { resolveMutex = resolve; });
+
+  try {
+    await currentMutex;
+
+    // Resolve alias to provider ID (e.g., "kc" -> "kilocode")
+    const providerId = resolveProviderId(provider);
+
+    // Inject a virtual connection for no-auth free providers (with optional proxy pool from settings)
+    if (FREE_PROVIDERS[providerId]?.noAuth) {
+      const settings = await getSettings();
+      const override = (settings.providerStrategies || {})[providerId] || {};
+      const resolvedProxy = await resolveConnectionProxyConfig({ proxyPoolId: override.proxyPoolId || "" });
+      return {
+        id: "noauth",
+        connectionName: "Public",
+        isActive: true,
+        accessToken: "public",
+        providerSpecificData: {
+          connectionProxyEnabled: resolvedProxy.connectionProxyEnabled,
+          connectionProxyUrl: resolvedProxy.connectionProxyUrl,
+          connectionNoProxy: resolvedProxy.connectionNoProxy,
+          connectionProxyPoolId: resolvedProxy.proxyPoolId || null,
+          vercelRelayUrl: resolvedProxy.vercelRelayUrl || "",
+        },
+      };
+    }
+
+    const connections = await getProviderConnections({ provider: providerId, isActive: true });
+    log.debug("AUTH", `${provider} | total connections: ${connections.length}, excludeIds: ${excludeSet.size > 0 ? [...excludeSet].join(",") : "none"}, model: ${model || "any"}`);
+
+    if (connections.length === 0) {
+      log.warn("AUTH", `No credentials for ${provider}`);
+      return null;
+    }
+
+    const baseAvailableConnections = connections.filter(c => {
+      if (excludeSet.has(c.id)) return false;
+      if (isModelLockActive(c, model)) return false;
+      return true;
+    });
+
+    // Filter out model-locked and excluded connections. Strict pinning is used
+    // by Codex gateway account aliases, where silently switching identity would
+    // break the user's mental model of "this session/account".
+    let availableConnections = baseAvailableConnections;
+    if (strictPreferred && preferredConnectionId) {
+      const preferred = connections.find((c) => c.id === preferredConnectionId);
+      if (!preferred) {
+        log.warn("AUTH", `${provider} | pinned account not found: ${preferredConnectionId}`);
+        return null;
+      }
+      if (excludeSet.has(preferred.id)) {
+        log.warn("AUTH", `${provider} | pinned account excluded after failure: ${preferred.id?.slice(0, 8)}`);
+        return null;
+      }
+      if (isModelLockActive(preferred, model)) {
+        const retryAfter = getEarliestModelLockUntil(preferred);
+        return {
+          allRateLimited: true,
+          retryAfter,
+          retryAfterHuman: formatRetryAfter(retryAfter),
+          lastError: preferred.lastError || "Pinned account unavailable",
+          lastErrorCode: preferred.errorCode || null,
+        };
+      }
+      availableConnections = [preferred];
+    }
+
+    log.debug("AUTH", `${provider} | available: ${availableConnections.length}/${connections.length}`);
+    connections.forEach(c => {
+      const excluded = excludeSet.has(c.id);
+      const locked = isModelLockActive(c, model);
+      if (excluded || locked) {
+        const lockUntil = getEarliestModelLockUntil(c);
+        log.debug("AUTH", `  \u2192 ${c.id?.slice(0, 8)} | ${excluded ? "excluded" : ""} ${locked ? `modelLocked(${model}) until ${lockUntil}` : ""}`);
+      }
+    });
+
+    if (availableConnections.length === 0) {
+      // Find earliest lock expiry across all connections for retry timing
+      const lockedConns = connections.filter(c => isModelLockActive(c, model));
+      const expiries = lockedConns.map(c => getEarliestModelLockUntil(c)).filter(Boolean);
+      const earliest = expiries.sort()[0] || null;
+      if (earliest) {
+        const earliestConn = lockedConns[0];
+        log.warn("AUTH", `${provider} | all ${connections.length} accounts locked for ${model || "all"} (${formatRetryAfter(earliest)}) | lastError=${earliestConn?.lastError?.slice(0, 50)}`);
+        return {
+          allRateLimited: true,
+          retryAfter: earliest,
+          retryAfterHuman: formatRetryAfter(earliest),
+          lastError: earliestConn?.lastError || null,
+          lastErrorCode: earliestConn?.errorCode || null
+        };
+      }
+      log.warn("AUTH", `${provider} | all ${connections.length} accounts unavailable`);
+      return null;
+    }
+
+    const settings = await getSettings();
+    // Per-provider strategy overrides global setting
+    const providerOverride = (settings.providerStrategies || {})[providerId] || {};
+    const strategy = providerOverride.fallbackStrategy || settings.fallbackStrategy || "fill-first";
+
+    let connection;
+    // Pin to preferred connection if specified and available
+    if (preferredConnectionId) {
+      connection = availableConnections.find((c) => c.id === preferredConnectionId);
+      if (connection) {
+        log.info("AUTH", `${provider} | pinned to ${connection.id?.slice(0, 8)} (${connection.name || connection.email || "unnamed"})`);
+      }
+    }
+    if (connection) {
+      // skip strategy
+    } else if (strictPreferred && preferredConnectionId) {
+      log.warn("AUTH", `${provider} | pinned account unavailable: ${preferredConnectionId}`);
+      return null;
+    } else if (strategy === "round-robin") {
+      const stickyLimit = providerOverride.stickyRoundRobinLimit || settings.stickyRoundRobinLimit || 3;
+
+      // Sort by lastUsed (most recent first) to find current candidate
+      const byRecency = [...availableConnections].sort((a, b) => {
+        if (!a.lastUsedAt && !b.lastUsedAt) return (a.priority || 999) - (b.priority || 999);
+        if (!a.lastUsedAt) return 1;
+        if (!b.lastUsedAt) return -1;
+        return new Date(b.lastUsedAt) - new Date(a.lastUsedAt);
+      });
+
+      const current = byRecency[0];
+      const currentCount = current?.consecutiveUseCount || 0;
+
+      if (current && current.lastUsedAt && currentCount < stickyLimit) {
+        // Stay with current account
+        connection = current;
+        // Update lastUsedAt and increment count (await to ensure persistence)
+        await updateProviderConnection(connection.id, {
+          lastUsedAt: new Date().toISOString(),
+          consecutiveUseCount: (connection.consecutiveUseCount || 0) + 1
+        });
+      } else {
+        // Pick the least recently used (excluding current if possible)
+        const sortedByOldest = [...availableConnections].sort((a, b) => {
+          if (!a.lastUsedAt && !b.lastUsedAt) return (a.priority || 999) - (b.priority || 999);
+          if (!a.lastUsedAt) return -1;
+          if (!b.lastUsedAt) return 1;
+          return new Date(a.lastUsedAt) - new Date(b.lastUsedAt);
+        });
+
+        connection = sortedByOldest[0];
+
+        // Update lastUsedAt and reset count to 1 (await to ensure persistence)
+        await updateProviderConnection(connection.id, {
+          lastUsedAt: new Date().toISOString(),
+          consecutiveUseCount: 1
+        });
+      }
+    } else {
+      // Default: fill-first (already sorted by priority in getProviderConnections)
+      connection = availableConnections[0];
+    }
+
+    const resolvedProxy = await resolveConnectionProxyConfig(connection.providerSpecificData || {});
+
+    return {
+      authType: connection.authType,
+      apiKey: connection.apiKey,
+      accessToken: connection.accessToken,
+      refreshToken: connection.refreshToken,
+      idToken: connection.idToken,
+      expiresAt: connection.expiresAt,
+      expiresIn: connection.expiresIn,
+      lastRefreshAt: connection.lastRefreshAt,
+      projectId: connection.projectId,
+      connectionName: connection.displayName || connection.name || connection.email || connection.id,
+      copilotToken: connection.providerSpecificData?.copilotToken,
+      providerSpecificData: {
+        ...(connection.providerSpecificData || {}),
+        connectionProxyEnabled: resolvedProxy.connectionProxyEnabled,
+        connectionProxyUrl: resolvedProxy.connectionProxyUrl,
+        connectionNoProxy: resolvedProxy.connectionNoProxy,
+        connectionProxyPoolId: resolvedProxy.proxyPoolId || null,
+        vercelRelayUrl: resolvedProxy.vercelRelayUrl || "",
+      },
+      connectionId: connection.id,
+      // Include current status for optimization check
+      testStatus: connection.testStatus,
+      lastError: connection.lastError,
+      // Pass full connection for clearAccountError to read modelLock_* keys
+      _connection: connection
+    };
+  } finally {
+    if (resolveMutex) resolveMutex();
+  }
+}
+
+/**
+ * Mark account+model as unavailable \u2014 locks modelLock_${model} in DB.
+ * All errors (429, 401, 5xx, etc.) lock per model, not per account.
+ * @param {string} connectionId
+ * @param {number} status - HTTP status code from upstream
+ * @param {string} errorText
+ * @param {string|null} provider
+ * @param {string|null} model - The specific model that triggered the error
+ * @returns shouldFallback: boolean, cooldownMs: number
+ */
+export async function markAccountUnavailable(connectionId, status, errorText, provider = null, model = null, resetsAtMs = null) {
+  if (!connectionId || connectionId === "noauth") return { shouldFallback: false, cooldownMs: 0 };
+  if (isNonAccountError(status, errorText)) {
+    log.warn("AUTH", `non-account error; no fallback [${status}] ${typeof errorText === "string" ? errorText.slice(0, 100) : "Provider error"}`);
+    return { shouldFallback: false, cooldownMs: 0 };
+  }
+  const connections = await getProviderConnections({ provider });
+  const conn = connections.find(c => c.id === connectionId);
+  const backoffLevel = conn?.backoffLevel || 0;
+
+  // Provider-specific precise cooldown (e.g. codex usage_limit_reached resets_at) overrides backoff
+  let shouldFallback, cooldownMs, newBackoffLevel;
+  if (resetsAtMs && resetsAtMs > Date.now()) {
+    shouldFallback = true;
+    cooldownMs = Math.min(resetsAtMs - Date.now(), MAX_RATE_LIMIT_COOLDOWN_MS);
+    newBackoffLevel = 0;
+  } else {
+    ({ shouldFallback, cooldownMs, newBackoffLevel } = checkFallbackError(status, errorText, backoffLevel));
+  }
+  if (!shouldFallback) return { shouldFallback: false, cooldownMs: 0 };
+
+  const reason = typeof errorText === "string" ? errorText.slice(0, 100) : "Provider error";
+  const lockUpdate = buildModelLockUpdate(model, cooldownMs);
+
+  await updateProviderConnection(connectionId, {
+    ...lockUpdate,
+    testStatus: "unavailable",
+    lastError: reason,
+    errorCode: status,
+    lastErrorAt: new Date().toISOString(),
+    backoffLevel: newBackoffLevel ?? backoffLevel
+  });
+
+  const lockKey = Object.keys(lockUpdate)[0];
+  const connName = conn?.displayName || conn?.name || conn?.email || connectionId.slice(0, 8);
+  log.warn("AUTH", `${connName} locked ${lockKey} for ${Math.round(cooldownMs / 1000)}s [${status}]`);
+
+  if (provider && status && reason) {
+    console.error(`\u274c ${provider} [${status}]: ${reason}`);
+  }
+
+  // --- Auto-disable on terminal auth errors ---
+  // Terminal errors: token expired/invalid/revoked (401), banned/suspended (403)
+  // Only disable after consecutive failures to avoid false positives from transient issues
+  const TERMINAL_AUTH_STATUSES = new Set([401, 403]);
+  const TERMINAL_ERROR_MARKERS = [
+    "token expired", "token invalid", "invalid token", "revoked",
+    "unauthorized", "invalid api key", "invalid_api_key",
+    "banned", "suspended", "restricted", "account disabled",
+    "insufficient_quota", "quota exceeded", "payment required",
+  ];
+
+  if (TERMINAL_AUTH_STATUSES.has(status)) {
+    const lowerError = (typeof errorText === "string" ? errorText : "").toLowerCase();
+    const isTerminalError = TERMINAL_ERROR_MARKERS.some(marker => lowerError.includes(marker));
+
+    if (isTerminalError) {
+      const prevFailures = conn?.consecutiveAuthFailures || 0;
+      const newFailures = prevFailures + 1;
+
+      if (newFailures >= 3) {
+        // Auto-disable after 3 consecutive terminal auth errors
+        await updateProviderConnection(connectionId, {
+          isActive: false,
+          autoDisabledAt: new Date().toISOString(),
+          autoDisabledReason: lowerError.includes("banned") || lowerError.includes("suspended") || lowerError.includes("restricted")
+            ? "banned"
+            : lowerError.includes("quota") || lowerError.includes("payment")
+              ? "quota_exhausted"
+              : "token_expired",
+          consecutiveAuthFailures: newFailures,
+        });
+        log.warn("AUTH", `\u26d4 Auto-disabled ${connName} after ${newFailures} consecutive auth failures [${status}]: ${reason}`);
+      } else {
+        // Increment failure counter
+        await updateProviderConnection(connectionId, {
+          consecutiveAuthFailures: newFailures,
+        });
+        log.warn("AUTH", `${connName} auth failure ${newFailures}/3 [${status}]: ${reason}`);
+      }
+    }
+  }
+
+  return { shouldFallback: true, cooldownMs };
+}
+
+/**
+ * Clear account error status on successful request.
+ * - Clears modelLock_${model} (the model that just succeeded)
+ * - Lazy-cleans any other expired modelLock_* keys
+ * - Resets error state only if no active locks remain
+ * @param {string} connectionId
+ * @param {object} currentConnection - credentials object (has _connection) or raw connection
+ * @param {string|null} model - model that succeeded
+ */
+export async function clearAccountError(connectionId, currentConnection, model = null) {
+  if (!connectionId || connectionId === "noauth") return;
+  const conn = currentConnection._connection || currentConnection;
+  const now = Date.now();
+  const allLockKeys = Object.keys(conn).filter(k => k.startsWith("modelLock_"));
+
+  if (!conn.testStatus && !conn.lastError && allLockKeys.length === 0) return;
+
+  // Keys to clear: current model's lock + all expired locks
+  const keysToClear = allLockKeys.filter(k => {
+    if (model && k === `modelLock_${model}`) return true; // succeeded model
+    if (model && k === "modelLock___all") return true;    // account-level lock
+    const expiry = conn[k];
+    return expiry && new Date(expiry).getTime() <= now;   // expired
+  });
+
+  if (keysToClear.length === 0 && conn.testStatus !== "unavailable" && !conn.lastError) return;
+
+  // Check if any active locks remain after clearing
+  const remainingActiveLocks = allLockKeys.filter(k => {
+    if (keysToClear.includes(k)) return false;
+    const expiry = conn[k];
+    return expiry && new Date(expiry).getTime() > now;
+  });
+
+  const clearObj = Object.fromEntries(keysToClear.map(k => [k, null]));
+
+  // Only reset error state if no active locks remain
+  if (remainingActiveLocks.length === 0) {
+    Object.assign(clearObj, { testStatus: "active", lastError: null, lastErrorAt: null, backoffLevel: 0, consecutiveAuthFailures: 0 });
+  }
+
+  await updateProviderConnection(connectionId, clearObj);
+}
+
+/**
+ * Extract API key from request headers
+ */
+export function extractApiKey(request) {
+  // Check Authorization header first
+  const authHeader = request.headers.get("Authorization");
+  if (authHeader?.startsWith("Bearer ")) {
+    return authHeader.slice(7);
+  }
+
+  // Check Anthropic x-api-key header
+  const xApiKey = request.headers.get("x-api-key");
+  if (xApiKey) {
+    return xApiKey;
+  }
+
+  return null;
+}
+
+/**
+ * Validate API key (optional - for local use can skip)
+ */
+export async function isValidApiKey(apiKey) {
+  if (!apiKey) return false;
+  return await validateApiKey(apiKey);
+}

package/src/sse/services/codexGateway.js

@@ -0,0 +1,215 @@
+import { getProviderConnections, getSettings } from "@/lib/localDb";
+import { PROVIDER_MODELS } from "open-sse/config/providerModels.js";
+
+export const CODEX_GATEWAY_DEFAULT_MODEL = "gpt-5.5";
+export const CODEX_GATEWAY_ACCOUNT_LIMIT = 5000;
+
+function cleanSegment(value) {
+  return String(value || "").trim().replace(/^\/+|\/+$/g, "");
+}
+
+function stripCodexPrefix(model) {
+  const value = cleanSegment(model);
+  if (value.startsWith("cx/")) return value.slice(3);
+  if (value.startsWith("codex/")) return value.slice(6);
+  return value || CODEX_GATEWAY_DEFAULT_MODEL;
+}
+
+function normalizeRouterTarget(value) {
+  const target = cleanSegment(value) || CODEX_GATEWAY_DEFAULT_MODEL;
+  if (!target.includes("/")) return `cx/${target}`;
+  return target;
+}
+
+function normalizeCodexTarget(value) {
+  return `cx/${stripCodexPrefix(value)}`;
+}
+
+export function parseCodexGatewayModel(modelStr) {
+  const value = cleanSegment(modelStr);
+  if (!value) return null;
+
+  if (value === "auto-codex") {
+    return {
+      mode: "router",
+      modelString: `cx/${CODEX_GATEWAY_DEFAULT_MODEL}`,
+      strictAccount: false,
+      label: "Auto Codex",
+    };
+  }
+
+  if (value.startsWith("router/")) {
+    return {
+      mode: "router",
+      modelString: normalizeRouterTarget(value.slice("router/".length)),
+      strictAccount: false,
+      label: "Router Pool",
+    };
+  }
+
+  if (value.startsWith("original/")) {
+    return {
+      mode: "original",
+      modelString: normalizeCodexTarget(value.slice("original/".length)),
+      strictAccount: true,
+      label: "Original Codex",
+    };
+  }
+
+  if (value === "original") {
+    return {
+      mode: "original",
+      modelString: `cx/${CODEX_GATEWAY_DEFAULT_MODEL}`,
+      strictAccount: true,
+      label: "Original Codex",
+    };
+  }
+
+  const accountPrefix = value.startsWith("account/")
+    ? "account/"
+    : (value.startsWith("codex-account/") ? "codex-account/" : null);
+  if (accountPrefix) {
+    const rest = value.slice(accountPrefix.length);
+    const slash = rest.indexOf("/");
+    const accountRef = slash === -1 ? rest : rest.slice(0, slash);
+    const model = slash === -1 ? CODEX_GATEWAY_DEFAULT_MODEL : rest.slice(slash + 1);
+    if (!accountRef) return null;
+    return {
+      mode: "account",
+      accountRef,
+      modelString: normalizeCodexTarget(model),
+      strictAccount: true,
+      label: "Pinned Codex Account",
+    };
+  }
+
+  return null;
+}
+
+export function getCodexConnectionLabel(connection) {
+  return (
+    connection?.displayName ||
+    connection?.name ||
+    connection?.email ||
+    connection?.id ||
+    "Codex account"
+  );
+}
+
+export function slugifyCodexAccount(connection) {
+  const raw = getCodexConnectionLabel(connection);
+  const base = String(raw)
+    .toLowerCase()
+    .replace(/@/g, "-")
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 48) || "account";
+  return `${base}-${String(connection?.id || "").slice(0, 8)}`;
+}
+
+function normalizeRef(value) {
+  return String(value || "").trim().toLowerCase();
+}
+
+function isImportedGptJson(connection) {
+  const data = connection?.providerSpecificData || {};
+  return data.importedFrom === "GPTJson" || String(data.tokenSource || "").startsWith("ChatGPT_team");
+}
+
+export async function listCodexGatewayAccounts(limit = CODEX_GATEWAY_ACCOUNT_LIMIT) {
+  const connections = await getProviderConnections({ provider: "codex", isActive: true });
+  const accounts = connections.slice(0, limit).map((connection) => ({
+    id: connection.id,
+    slug: slugifyCodexAccount(connection),
+    label: getCodexConnectionLabel(connection),
+    email: connection.email || null,
+    imported: isImportedGptJson(connection),
+    priority: connection.priority || null,
+  }));
+
+  const original = findOriginalCodexConnection(connections);
+  return {
+    accounts,
+    original: original ? {
+      id: original.id,
+      slug: slugifyCodexAccount(original),
+      label: getCodexConnectionLabel(original),
+      email: original.email || null,
+      imported: isImportedGptJson(original),
+      priority: original.priority || null,
+    } : null,
+  };
+}
+
+export function findOriginalCodexConnection(connections) {
+  if (!Array.isArray(connections) || connections.length === 0) return null;
+  return connections.find((connection) => !isImportedGptJson(connection)) || connections[0];
+}
+
+export async function resolveCodexConnectionRef(ref) {
+  const target = normalizeRef(ref);
+  if (!target) return null;
+  const connections = await getProviderConnections({ provider: "codex", isActive: true });
+
+  const exact = connections.find((connection) => (
+    normalizeRef(connection.id) === target ||
+    slugifyCodexAccount(connection) === target ||
+    normalizeRef(connection.email) === target ||
+    normalizeRef(connection.name) === target ||
+    normalizeRef(connection.displayName) === target
+  ));
+  if (exact) return exact;
+
+  const prefixMatches = connections.filter((connection) => (
+    normalizeRef(connection.id).startsWith(target) ||
+    slugifyCodexAccount(connection).startsWith(target)
+  ));
+  if (prefixMatches.length === 1) return prefixMatches[0];
+
+  return null;
+}
+
+export async function resolveCodexGatewayConnection(gateway) {
+  if (!gateway || (gateway.mode !== "original" && gateway.mode !== "account")) return null;
+
+  if (gateway.mode === "account") {
+    return resolveCodexConnectionRef(gateway.accountRef);
+  }
+
+  const settings = await getSettings();
+  const configuredId = settings.codexGatewayOriginalConnectionId || settings.codexOriginalConnectionId || "";
+  if (configuredId) {
+    const configured = await resolveCodexConnectionRef(configuredId);
+    if (configured) return configured;
+  }
+
+  const connections = await getProviderConnections({ provider: "codex", isActive: true });
+  return findOriginalCodexConnection(connections);
+}
+
+export function buildCodexGatewayModelEntries(connections = []) {
+  const hasCodex = connections.some((connection) => connection.provider === "codex" && connection.isActive !== false);
+  if (!hasCodex) return [];
+
+  const codexModels = (PROVIDER_MODELS.cx || [])
+    .filter((model) => !model.type || model.type === "llm")
+    .map((model) => model.id);
+
+  const entries = [
+    { id: "auto-codex", object: "model", owned_by: "9router-codex-gateway" },
+    ...codexModels.flatMap((model) => [
+      { id: `router/${model}`, object: "model", owned_by: "9router-codex-gateway" },
+      { id: `original/${model}`, object: "model", owned_by: "9router-codex-gateway" },
+    ]),
+  ];
+
+  for (const connection of connections.filter((conn) => conn.provider === "codex" && conn.isActive !== false)) {
+    entries.push({
+      id: `account/${slugifyCodexAccount(connection)}`,
+      object: "model",
+      owned_by: "9router-codex-account",
+    });
+  }
+
+  return entries;
+}