zevairouter 1.0.154 → 1.0.156

package/src/lib/oauth/services/kiroBulkImportManager.js

@@ -1,1522 +0,0 @@
-import { randomUUID, createCipheriv, createDecipheriv, randomBytes, createHash } from "crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { DATA_DIR } from "../../dataDir.js";
-import { getProxyPoolById, getProxyPools } from "../../../models/index.js";
-import { getOptimalWorkerCount, isAutoConcurrencyValue } from "../../systemSpecs.js";
-import { redactCredentialText, redactCredentialUrl } from "../../providerConnectionSanitizer.js";
-import { KiroService } from "./kiro.js";
-import { createKiroCallbackMonitor, runKiroGoogleAutomation } from "./kiroGoogleAutomation.js";
-
-export const KIRO_BULK_IMPORT_DEFAULT_CONCURRENCY = 4;
-export const KIRO_BULK_IMPORT_MIN_CONCURRENCY = 1;
-export const KIRO_BULK_IMPORT_MAX_CONCURRENCY = 8;
-
-const TERMINAL_ACCOUNT_STATUSES = new Set([
-  "success",
-  "failed",
-  "failed_invalid_credentials",
-  "failed_exchange",
-  "failed_timeout",
-  "failed_restricted",
-  "failed_browser_blocked",
-  "cancelled",
-]);
-
-const MAX_ACCOUNT_LOG_ENTRIES = 40;
-const MAX_JOB_ACTIVITY_ENTRIES = 80;
-const PREVIEW_CAPTURE_INTERVAL_MS = 1500;
-const RECENT_TERMINAL_JOB_WINDOW_MS = 30 * 60_000;
-const KIRO_BULK_IMPORT_DIR = path.join(DATA_DIR, "kiro-bulk-import");
-const KIRO_BULK_IMPORT_META_FILE = path.join(KIRO_BULK_IMPORT_DIR, "meta.json");
-const ACTIVE_JOB_STATUSES = new Set(["queued", "running", "needs_manual"]);
-
-export function nowIso() {
-  return new Date().toISOString();
-}
-
-function ensurePersistenceDir(dir = KIRO_BULK_IMPORT_DIR) {
-  fs.mkdirSync(dir, { recursive: true });
-}
-
-function getJobFile(jobId, dir = KIRO_BULK_IMPORT_DIR) {
-  ensurePersistenceDir(dir);
-  return path.join(dir, `${jobId}.json`);
-}
-
-function readJsonFile(filePath) {
-  try {
-    if (!fs.existsSync(filePath)) return null;
-    return JSON.parse(fs.readFileSync(filePath, "utf8"));
-  } catch {
-    return null;
-  }
-}
-
-function writeJsonFile(filePath, payload) {
-  ensurePersistenceDir(path.dirname(filePath));
-  const tempFile = `${filePath}.${process.pid}.tmp`;
-  fs.writeFileSync(tempFile, JSON.stringify(payload, null, 2), "utf8");
-  fs.renameSync(tempFile, filePath);
-}
-
-// --- Encrypted resume vault -------------------------------------------------
-// Job snapshots are sanitized and deliberately omit credentials, so they
-// cannot be used to continue a job after a restart. The resume vault stores
-// the minimum sensitive data (credentials + proxy/engine config) encrypted at
-// rest so an interrupted job can be rebuilt and continued automatically.
-
-function getResumeFile(jobId, dir = KIRO_BULK_IMPORT_DIR) {
-  ensurePersistenceDir(dir);
-  return path.join(dir, `${jobId}.resume.enc`);
-}
-
-function loadResumeSecret() {
-  if (process.env.BULK_IMPORT_RESUME_SECRET) return process.env.BULK_IMPORT_RESUME_SECRET;
-  const file = path.join(DATA_DIR, "bulk-import-resume-key");
-  try {
-    return fs.readFileSync(file, "utf8").trim();
-  } catch {}
-  try {
-    ensurePersistenceDir(DATA_DIR);
-    const generated = randomBytes(32).toString("hex");
-    fs.writeFileSync(file, generated, { mode: 0o600 });
-    return generated;
-  } catch {
-    // Fall back to an ephemeral key. Resume will only work within this process
-    // lifetime, but encryption of the at-rest blob is still enforced.
-    return randomBytes(32).toString("hex");
-  }
-}
-
-function getResumeKey() {
-  return createHash("sha256").update(String(loadResumeSecret())).digest();
-}
-
-function encryptResumePayload(payload) {
-  const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", getResumeKey(), iv);
-  const json = Buffer.from(JSON.stringify(payload), "utf8");
-  const ciphertext = Buffer.concat([cipher.update(json), cipher.final()]);
-  const authTag = cipher.getAuthTag();
-  return {
-    v: 1,
-    alg: "aes-256-gcm",
-    iv: iv.toString("base64"),
-    tag: authTag.toString("base64"),
-    data: ciphertext.toString("base64"),
-  };
-}
-
-function decryptResumePayload(envelope) {
-  if (!envelope || envelope.alg !== "aes-256-gcm" || !envelope.iv || !envelope.tag || !envelope.data) {
-    return null;
-  }
-  try {
-    const decipher = createDecipheriv("aes-256-gcm", getResumeKey(), Buffer.from(envelope.iv, "base64"));
-    decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
-    const plaintext = Buffer.concat([
-      decipher.update(Buffer.from(envelope.data, "base64")),
-      decipher.final(),
-    ]);
-    return JSON.parse(plaintext.toString("utf8"));
-  } catch {
-    return null;
-  }
-}
-
-function writeResumeBlob(filePath, payload) {
-  try {
-    ensurePersistenceDir(path.dirname(filePath));
-    const tempFile = `${filePath}.${process.pid}.tmp`;
-    fs.writeFileSync(tempFile, JSON.stringify(encryptResumePayload(payload)), { mode: 0o600 });
-    fs.renameSync(tempFile, filePath);
-  } catch {}
-}
-
-function readResumeBlob(filePath) {
-  const envelope = readJsonFile(filePath);
-  if (!envelope) return null;
-  return decryptResumePayload(envelope);
-}
-
-function deleteResumeBlob(filePath) {
-  try {
-    if (fs.existsSync(filePath)) fs.rmSync(filePath);
-  } catch {}
-}
-
-function readPersistedLatestJobId(metaFile = KIRO_BULK_IMPORT_META_FILE) {
-  return readJsonFile(metaFile)?.latestJobId || null;
-}
-
-function writePersistedLatestJobId(jobId, metaFile = KIRO_BULK_IMPORT_META_FILE) {
-  writeJsonFile(metaFile, {
-    latestJobId: jobId || null,
-    updatedAt: nowIso(),
-  });
-}
-
-export function clampConcurrency(value) {
-  if (isAutoConcurrencyValue(value)) {
-    const optimal = getOptimalWorkerCount();
-    return Math.min(KIRO_BULK_IMPORT_MAX_CONCURRENCY, Math.max(KIRO_BULK_IMPORT_MIN_CONCURRENCY, optimal));
-  }
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed)) return KIRO_BULK_IMPORT_DEFAULT_CONCURRENCY;
-  return Math.min(KIRO_BULK_IMPORT_MAX_CONCURRENCY, Math.max(KIRO_BULK_IMPORT_MIN_CONCURRENCY, parsed));
-}
-
-export function parseKiroBulkAccounts(accounts = []) {
-  const lines = Array.isArray(accounts) ? accounts : [];
-  const parsed = [];
-  const invalidLines = [];
-
-  lines.forEach((line, index) => {
-    const raw = String(line || "").trim();
-    if (!raw) return;
-    // Skip comment lines
-    if (raw.startsWith("#")) return;
-
-    let email = "";
-    let password = "";
-
-    if (raw.includes("|")) {
-      // Pipe separator (original behavior) \u2014 password may contain |
-      const [emailPart = "", ...passwordParts] = raw.split("|");
-      email = emailPart.trim();
-      password = passwordParts.join("|").trim();
-    } else if (raw.includes("\t")) {
-      // Tab separator (spreadsheet paste)
-      const tabIdx = raw.indexOf("\t");
-      email = raw.substring(0, tabIdx).trim();
-      password = raw.substring(tabIdx + 1).trim();
-    } else if (raw.includes(":")) {
-      // Colon separator \u2014 only if part before first : looks like email
-      const colonIdx = raw.indexOf(":");
-      const beforeColon = raw.substring(0, colonIdx).trim();
-      if (beforeColon.includes("@")) {
-        email = beforeColon;
-        password = raw.substring(colonIdx + 1).trim();
-      }
-    }
-
-    if (!email || !password) {
-      invalidLines.push(index + 1);
-      return;
-    }
-
-    parsed.push({
-      line: index + 1,
-      email,
-      password,
-    });
-  });
-
-  return {
-    parsed,
-    invalidLines,
-  };
-}
-
-function getFailedCount(accounts) {
-  return accounts.filter((account) => (
-    account.status === "failed"
-    || account.status === "failed_invalid_credentials"
-    || account.status === "failed_exchange"
-    || account.status === "failed_timeout"
-    || account.status === "failed_restricted"
-    || account.status === "failed_browser_blocked"
-  )).length;
-}
-
-function buildSummary(accounts) {
-  return {
-    total: accounts.length,
-    queued: accounts.filter((account) => account.status === "queued").length,
-    running: accounts.filter((account) => account.status === "running").length,
-    success: accounts.filter((account) => account.status === "success").length,
-    failed: getFailedCount(accounts),
-    needs_manual: accounts.filter((account) => account.status === "needs_manual").length,
-  };
-}
-
-export function createLogEntry(step, message, level = "info") {
-  return {
-    id: randomUUID(),
-    at: nowIso(),
-    step,
-    message,
-    level,
-  };
-}
-
-function appendAccountLog(account, step, message, level = "info") {
-  const entry = createLogEntry(step, message, level);
-  account.currentStep = step;
-  account.updatedAt = entry.at;
-  account.logs = account.logs || [];
-  account.logs.push(entry);
-  if (account.logs.length > MAX_ACCOUNT_LOG_ENTRIES) {
-    account.logs.splice(0, account.logs.length - MAX_ACCOUNT_LOG_ENTRIES);
-  }
-  return entry;
-}
-
-function buildJobActivity(accounts) {
-  return accounts
-    .flatMap((account) => (account.logs || []).map((entry) => ({
-      ...entry,
-      message: redactCredentialText(entry.message),
-      email: account.email,
-      line: account.line,
-      workerId: account.workerId || null,
-      status: account.status,
-    })))
-    .sort((left, right) => String(left.at).localeCompare(String(right.at)))
-    .slice(-MAX_JOB_ACTIVITY_ENTRIES);
-}
-
-function maskProxyUrl(proxyUrl) {
-  if (!proxyUrl) return null;
-  try {
-    // Validate first so malformed input still gets the conservative fallback.
-    new URL(proxyUrl);
-    return redactCredentialUrl(proxyUrl);
-  } catch {
-    // If not a valid URL, just mask middle portion
-    return proxyUrl.length > 20
-      ? `${proxyUrl.slice(0, 10)}***${proxyUrl.slice(-10)}`
-      : proxyUrl;
-  }
-}
-
-function sanitizeAccount(account) {
-  return {
-    email: account.email,
-    status: account.status,
-    error: redactCredentialText(account.error) || null,
-    connectionId: account.connectionId || null,
-    workerId: account.workerId || null,
-    line: account.line,
-    proxyUrl: maskProxyUrl(account.proxyUrl) || null,
-    currentStep: account.currentStep || null,
-    updatedAt: account.updatedAt || null,
-    logs: (account.logs || []).slice(-20).map((entry) => ({
-      ...entry,
-      message: redactCredentialText(entry.message),
-    })),
-    manualSessionAvailable: Boolean(account.manualSession?.page) && account.status === "needs_manual",
-    manualSessionOpened: Boolean(account.manualSession?.opened),
-  };
-}
-
-function sanitizeJob(job, extras = {}) {
-  return {
-    jobId: job.jobId,
-    status: job.status,
-    summary: buildSummary(job.accounts),
-    concurrency: job.concurrency,
-    createdAt: job.createdAt,
-    startedAt: job.startedAt,
-    finishedAt: job.finishedAt,
-    accounts: job.accounts.map(sanitizeAccount),
-    activity: buildJobActivity(job.accounts),
-    error: redactCredentialText(job.error) || null,
-    preview: extras.preview || null,
-  };
-}
-
-function buildPersistedSnapshot(job) {
-  return sanitizeJob(job, {
-    preview: job.lastPreview || null,
-  });
-}
-
-function isRecentTerminalJob(job) {
-  if (!job || ACTIVE_JOB_STATUSES.has(job.status)) return false;
-  const finishedAtMs = job.finishedAt ? Date.parse(job.finishedAt) : NaN;
-  if (!Number.isFinite(finishedAtMs)) return false;
-  return (Date.now() - finishedAtMs) <= RECENT_TERMINAL_JOB_WINDOW_MS;
-}
-
-export function buildLookupResponse(job, extras = {}) {
-  if (!job) {
-    return {
-      found: false,
-      stale: Boolean(extras.stale),
-      recoverable: false,
-      job: null,
-    };
-  }
-
-  return {
-    found: true,
-    stale: false,
-    recoverable: ACTIVE_JOB_STATUSES.has(job.status) || isRecentTerminalJob(job),
-    job,
-  };
-}
-
-async function defaultBrowserLauncher(job) {
-  const { launchBulkImportBrowser } = await import("./bulkImportBrowserEngine.js");
-  // CloakBrowser-only: headed by default (Turnstile / Google bot checks fail headless).
-  const envHeadless = process.env.ZEVAI_KIRO_HEADLESS;
-  const headless = envHeadless === "1" || envHeadless === "true";
-  return launchBulkImportBrowser({
-    engine: job?.engine || "cloakbrowser",
-    headless,
-    windowSize: { width: 1280, height: 900 },
-  });
-}
-
-async function defaultSocialExchange(args) {
-  const { exchangeAndSaveKiroSocialConnection } = await import("./kiroConnections.js");
-  return exchangeAndSaveKiroSocialConnection(args);
-}
-
-import { parsePlaywrightProxy } from "./proxyUtils.js";
-export { parsePlaywrightProxy };
-
-/**
- * @param {import('playwright-core').Browser} browser
- * @param {string|null} [proxy]
- * @param {object} [opts]
- * @param {"default"|"codebuddy-cn"} [opts.profile]
- * @param {"hongkong"|"china"|string} [opts.region]  Used by codebuddy-cn profile
- * @param {string|number} [opts.fingerprintSeed]  Per-account seed for viewport/HW fingerprint
- * @param {boolean} [opts.randomizeFingerprint]   Force fingerprint even outside codebuddy-cn
- * @param {boolean} [opts.nativeCloakProfile]     Keep CloakBrowser's binary profile untouched
- */
-export async function createFreshContext(browser, proxy, opts = {}) {
-  let effectiveProxy = proxy;
-  let socksBridge = null;
-  const {
-    DEFAULT_CONTEXT_CLOSE_TIMEOUT_MS,
-    DEFAULT_CONTEXT_CREATE_TIMEOUT_MS,
-    newStealthContext,
-    withAutomationTimeout,
-  } = await import("./bulkImportBrowserEngine.js");
-  const contextTimeoutMs = Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0
-    ? opts.timeoutMs
-    : DEFAULT_CONTEXT_CREATE_TIMEOUT_MS;
-  const closeTimeoutMs = Number.isFinite(opts.closeTimeoutMs) && opts.closeTimeoutMs > 0
-    ? opts.closeTimeoutMs
-    : DEFAULT_CONTEXT_CLOSE_TIMEOUT_MS;
-  const useNativeCloakProfile =
-    opts.profile === "codebuddy-cn" && opts.nativeCloakProfile === true;
-
-  // Chromium cannot authenticate SOCKS5 — bridge to local HTTP proxy first
-  if (proxy) {
-    const { ensureSocksHttpBridge, isSocksProxyUrl } = await import("./socksHttpBridge.js");
-    if (isSocksProxyUrl(proxy)) {
-      socksBridge = await withAutomationTimeout(ensureSocksHttpBridge(proxy), {
-        timeoutMs: contextTimeoutMs,
-        message: `SOCKS proxy bridge timed out after ${Math.round(contextTimeoutMs / 1000)}s`,
-        code: "SOCKS_BRIDGE_TIMEOUT",
-        onLateResolve: (bridge) => bridge?.release?.(),
-      });
-      if (socksBridge?.httpProxyUrl) {
-        effectiveProxy = socksBridge.httpProxyUrl;
-      }
-    }
-  }
-
-  const parsedProxy = parsePlaywrightProxy(effectiveProxy);
-  const contextOptions = parsedProxy ? { proxy: parsedProxy } : {};
-
-  // Per-account fingerprint (viewport + navigator.* + screen) via init script.
-  // Sticky residential IP alone still clusters if every session shares the same HW profile.
-  const wantFingerprint =
-    !useNativeCloakProfile
-    && (opts.randomizeFingerprint === true || opts.fingerprintSeed != null);
-  let fingerprint = null;
-  if (wantFingerprint) {
-    try {
-      const {
-        buildAccountFingerprint,
-        compactAccountFingerprint,
-      } = await import("./bulkImportBrowserEngine.js");
-      fingerprint = buildAccountFingerprint(
-        opts.fingerprintSeed ?? randomUUID(),
-      );
-      if (opts.lowMemory === true) {
-        fingerprint = compactAccountFingerprint(fingerprint);
-      }
-      contextOptions.viewport = { ...fingerprint.viewport };
-      contextOptions.deviceScaleFactor = fingerprint.deviceScaleFactor;
-      contextOptions.fingerprint = {
-        hardwareConcurrency: fingerprint.hardwareConcurrency,
-        deviceMemory: fingerprint.deviceMemory,
-        maxTouchPoints: fingerprint.maxTouchPoints,
-        screen: fingerprint.screen,
-      };
-    } catch {
-      fingerprint = null;
-    }
-  }
-  if (!contextOptions.viewport && !useNativeCloakProfile) {
-    contextOptions.viewport = { width: 1280, height: 900 };
-  }
-  // Ignore HTTPS errors common through residential proxies / MITM chains
-  contextOptions.ignoreHTTPSErrors = true;
-
-  if (opts.profile === "codebuddy-cn" && !useNativeCloakProfile) {
-    const isChinaMainland = String(opts.region || "").toLowerCase() === "china";
-    contextOptions.locale = "zh-CN";
-    contextOptions.languages = ["zh-CN", "zh", "en-US", "en"];
-    contextOptions.timezoneId = isChinaMainland ? "Asia/Shanghai" : "Asia/Hong_Kong";
-    contextOptions.geolocation = isChinaMainland
-      ? { longitude: 121.4737, latitude: 31.2304 }
-      : { longitude: 114.1694, latitude: 22.3193 };
-    contextOptions.permissions = ["geolocation"];
-    contextOptions.extraHTTPHeaders = {
-      ...(contextOptions.extraHTTPHeaders || {}),
-      "Accept-Language": "zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7",
-    };
-  }
-
-  // A pasted proxy inherits CloakBrowser's binary-level locale/timezone/WebRTC
-  // profile. Phone country and residential proxy country may legitimately differ.
-
-  // Allow callers to override any field
-  if (opts.locale) contextOptions.locale = opts.locale;
-  if (opts.timezoneId) contextOptions.timezoneId = opts.timezoneId;
-  if (opts.geolocation) contextOptions.geolocation = opts.geolocation;
-  if (Array.isArray(opts.languages)) contextOptions.languages = opts.languages;
-  if (opts.viewport) contextOptions.viewport = opts.viewport;
-  if (typeof opts.deviceScaleFactor === "number") {
-    contextOptions.deviceScaleFactor = opts.deviceScaleFactor;
-  }
-  if (opts.extraHTTPHeaders) {
-    contextOptions.extraHTTPHeaders = {
-      ...(contextOptions.extraHTTPHeaders || {}),
-      ...opts.extraHTTPHeaders,
-    };
-  }
-
-  let context;
-  try {
-    // Strip languages/fingerprint (not Playwright options) + attach HW init script.
-    context = await withAutomationTimeout(newStealthContext(browser, contextOptions), {
-      timeoutMs: contextTimeoutMs,
-      message: `Browser context creation timed out after ${Math.round(contextTimeoutMs / 1000)}s`,
-      code: "BROWSER_CONTEXT_TIMEOUT",
-      onLateResolve: (lateContext) => withAutomationTimeout(lateContext?.close?.(), {
-        timeoutMs: closeTimeoutMs,
-        message: `Late browser context close timed out after ${Math.round(closeTimeoutMs / 1000)}s`,
-        code: "BROWSER_CONTEXT_CLOSE_TIMEOUT",
-      }).catch(() => null),
-    });
-  } catch (error) {
-    await socksBridge?.release().catch(() => null);
-    throw error;
-  }
-
-  // Every caller inherits a bounded close, including derived provider managers.
-  // This keeps one dead renderer from pinning a worker forever on small VPS hosts.
-  const originalClose = context.close.bind(context);
-  let closePromise = null;
-  context.close = (...args) => {
-    if (!closePromise) {
-      const closeTask = Promise.resolve().then(() => originalClose(...args));
-      closePromise = withAutomationTimeout(closeTask, {
-        timeoutMs: closeTimeoutMs,
-        message: `Browser context close timed out after ${Math.round(closeTimeoutMs / 1000)}s`,
-        code: "BROWSER_CONTEXT_CLOSE_TIMEOUT",
-      }).finally(() => socksBridge?.release().catch(() => null));
-    }
-    return closePromise;
-  };
-
-  let page;
-  try {
-    page = await withAutomationTimeout(context.newPage(), {
-      timeoutMs: contextTimeoutMs,
-      message: `Browser page creation timed out after ${Math.round(contextTimeoutMs / 1000)}s`,
-      code: "BROWSER_PAGE_TIMEOUT",
-    });
-  } catch (error) {
-    await context.close().catch(() => null);
-    throw error;
-  }
-  // Abort NON-Google trackers only. Do NOT block googletagmanager / gstatic /
-  // googleadservices / google-analytics — Google sign-in / reCAPTCHA enterprise
-  // load beacons from those hosts; aborting them raises CAPTCHA rate vs the
-  // old high-concurrency bulk that left Google domains alone.
-  // Also never intercept "**/*" with continue() (breaks OAuth Location:kiro://).
-  try {
-    await page.route(
-      /facebook\.net|hotjar|clarity\.ms|hm\.baidu|sentry\.io|browser\.sentry-cdn|doubleclick\.net/i,
-      (route) => route.abort(),
-    );
-  } catch {
-    // ignore if route fails
-  }
-  return { context, page };
-}
-
-function isHeadlessBrowser(browser) {
-  if (!browser) return false;
-  const opts = browser._options || browser._initializer || {};
-  if (typeof opts.headless === "boolean") return opts.headless;
-  return true;
-}
-
-async function relaunchAsHeaded(account) {
-  if (!account?.manualSession?.context) return false;
-  const oldContext = account.manualSession.context;
-  const oldPage = account.manualSession.page;
-
-  let engine;
-  try {
-    engine = await import("./bulkImportBrowserEngine.js");
-  } catch {
-    return false;
-  }
-
-  let storageState = null;
-  let lastUrl = "";
-  try {
-    storageState = await engine.withAutomationTimeout(
-      Promise.resolve().then(() => oldContext.storageState()),
-      {
-        timeoutMs: engine.DEFAULT_CONTEXT_CLOSE_TIMEOUT_MS,
-        message: "Browser storage-state capture timed out",
-        code: "BROWSER_STORAGE_STATE_TIMEOUT",
-      },
-    );
-  } catch {
-    storageState = null;
-  }
-  try {
-    lastUrl = oldPage?.url?.() || "";
-  } catch {
-    lastUrl = "";
-  }
-
-  // Manual assist: relaunch headed CloakBrowser (stock Chromium retired).
-  let newBrowser;
-  try {
-    newBrowser = await engine.launchBulkImportBrowser({
-      headless: false,
-      windowSize: { width: 1280, height: 900 },
-    });
-  } catch {
-    return false;
-  }
-
-  let newContext;
-  try {
-    newContext = await engine.withAutomationTimeout(
-      engine.newStealthContext(newBrowser, {
-        viewport: null,
-        ...(storageState ? { storageState } : {}),
-      }),
-      {
-        timeoutMs: engine.DEFAULT_CONTEXT_CREATE_TIMEOUT_MS,
-        message: "Headed browser context creation timed out",
-        code: "BROWSER_CONTEXT_TIMEOUT",
-        onLateResolve: (context) => engine.withAutomationTimeout(
-          Promise.resolve().then(() => context?.close?.()),
-          {
-            timeoutMs: engine.DEFAULT_CONTEXT_CLOSE_TIMEOUT_MS,
-            message: "Late headed browser context close timed out",
-            code: "BROWSER_CONTEXT_CLOSE_TIMEOUT",
-          },
-        ).catch(() => null),
-      },
-    );
-  } catch {
-    await engine.forceCloseBrowser(newBrowser).catch(() => null);
-    return false;
-  }
-
-  const originalClose = newContext.close.bind(newContext);
-  let closePromise = null;
-  newContext.close = (...args) => {
-    if (!closePromise) {
-      closePromise = engine.withAutomationTimeout(
-        Promise.resolve().then(() => originalClose(...args)),
-        {
-          timeoutMs: engine.DEFAULT_CONTEXT_CLOSE_TIMEOUT_MS,
-          message: "Headed browser context close timed out",
-          code: "BROWSER_CONTEXT_CLOSE_TIMEOUT",
-        },
-      );
-    }
-    return closePromise;
-  };
-
-  let newPage;
-  try {
-    newPage = await engine.withAutomationTimeout(newContext.newPage(), {
-      timeoutMs: engine.DEFAULT_CONTEXT_CREATE_TIMEOUT_MS,
-      message: "Headed browser page creation timed out",
-      code: "BROWSER_PAGE_TIMEOUT",
-    });
-  } catch {
-    await newContext.close().catch(() => null);
-    await engine.forceCloseBrowser(newBrowser).catch(() => null);
-    return false;
-  }
-  if (lastUrl) {
-    try {
-      await newPage.goto(lastUrl, { waitUntil: "domcontentloaded", timeout: 20_000 });
-    } catch {}
-  }
-
-  const rebind = account.manualSession.rebind;
-  account.manualSession.context = newContext;
-  account.manualSession.page = newPage;
-  account.manualSession.headedBrowser = {
-    close: () => engine.forceCloseBrowser(newBrowser),
-  };
-
-  if (typeof rebind === "function") {
-    try {
-      await rebind({ context: newContext, page: newPage });
-    } catch {}
-  }
-
-  // Only close this account's old context. Its browser is shared by other
-  // workers and is owned by runJob, which performs the process-level cleanup.
-  void Promise.resolve().then(() => oldContext.close()).catch(() => null);
-
-  return true;
-}
-
-async function revealBrowserWindow(page, { account } = {}) {
-  if (!page) return false;
-
-  try {
-    const context = page.context?.();
-    const browser = context?.browser?.();
-    let headless = isHeadlessBrowser(browser);
-    if (browser) {
-      try {
-        const { getBulkImportBrowserHeadless } = await import("./bulkImportBrowserEngine.js");
-        const tracked = getBulkImportBrowserHeadless(browser);
-        if (typeof tracked === "boolean") headless = tracked;
-      } catch {
-        // Fall back to Playwright's exposed initializer fields.
-      }
-    }
-
-    if (account && headless) {
-      const relaunched = await relaunchAsHeaded(account);
-      if (relaunched) {
-        await account.manualSession.page.bringToFront?.().catch(() => null);
-        return true;
-      }
-    }
-
-    if (!context?.newCDPSession) {
-      await page.bringToFront?.().catch(() => null);
-      return true;
-    }
-
-    const session = await context.newCDPSession(page);
-    let windowId = null;
-
-    try {
-      const targetInfo = await session.send("Target.getTargetInfo");
-      const targetId = targetInfo?.targetInfo?.targetId;
-      const windowInfo = await session.send("Browser.getWindowForTarget", targetId ? { targetId } : {});
-      windowId = windowInfo?.windowId ?? null;
-    } catch {
-      windowId = null;
-    }
-
-    if (windowId != null) {
-      await session.send("Browser.setWindowBounds", {
-        windowId,
-        bounds: {
-          windowState: "normal",
-          left: 80,
-          top: 80,
-          width: 1280,
-          height: 960,
-        },
-      }).catch(() => null);
-    }
-
-    await page.bringToFront?.().catch(() => null);
-    await session.detach?.().catch(() => null);
-    return true;
-  } catch {
-    await page.bringToFront?.().catch(() => null);
-    return true;
-  }
-}
-
-export class KiroBulkImportManager {
-  constructor({
-    browserLauncher = defaultBrowserLauncher,
-    googleAutomation = runKiroGoogleAutomation,
-    socialExchange = defaultSocialExchange,
-    kiroServiceFactory = () => new KiroService(),
-    storageName = "kiro-bulk-import",
-  } = {}) {
-    this.browserLauncher = browserLauncher;
-    this.googleAutomation = googleAutomation;
-    this.socialExchange = socialExchange;
-    this.kiroServiceFactory = kiroServiceFactory;
-    this.storageDir = path.join(DATA_DIR, storageName);
-    this.metaFile = path.join(this.storageDir, "meta.json");
-    this.jobs = new Map();
-    this.latestJobId = readPersistedLatestJobId(this.metaFile);
-  }
-
-  buildPersistedSnapshot(job) {
-    return buildPersistedSnapshot(job);
-  }
-
-  readPersistedJob(jobId) {
-    return jobId ? readJsonFile(getJobFile(jobId, this.storageDir)) : null;
-  }
-
-  writePersistedJob(jobId, snapshot) {
-    if (!jobId || !snapshot) return;
-    writeJsonFile(getJobFile(jobId, this.storageDir), snapshot);
-  }
-
-  persistLatestJobId(jobId) {
-    writePersistedLatestJobId(jobId, this.metaFile);
-  }
-
-  // Persist the encrypted resume vault for a job. Written once at start time;
-  // credentials are static for the lifetime of a job.
-  persistResumeBlob(job) {
-    try {
-      writeResumeBlob(getResumeFile(job.jobId, this.storageDir), {
-        jobId: job.jobId,
-        concurrency: job.concurrency,
-        proxyPoolMode: job.proxyPoolMode,
-        proxyUrls: job.proxyUrls || [],
-        createdAt: job.createdAt,
-        accounts: job.accounts.map((account) => ({
-          line: account.line,
-          email: account.email,
-          password: account.password,
-        })),
-      });
-    } catch {}
-  }
-
-  // If a persisted job is active but missing from memory (e.g. after a server
-  // restart), rebuild it and continue automatically. Returns true if a live
-  // job was (re)created in memory. Synchronous up to this.jobs.set so two
-  // concurrent polls cannot double-hydrate.
-  hydrateInterruptedJob(jobId) {
-    if (!jobId) return false;
-    if (this.jobs.has(jobId)) return false;
-
-    const snapshot = readJsonFile(getJobFile(jobId, this.storageDir));
-    if (!snapshot) return false;
-    if (!ACTIVE_JOB_STATUSES.has(snapshot.status)) return false;
-
-    const resume = readResumeBlob(getResumeFile(jobId, this.storageDir));
-
-    // No saved credentials -> cannot auto-resume. Mark interrupted so the job
-    // stops hanging at "waiting for worker" forever.
-    if (!resume || !Array.isArray(resume.accounts) || resume.accounts.length === 0) {
-      this.markJobInterrupted(jobId, snapshot);
-      return false;
-    }
-
-    const passwordByLine = new Map(resume.accounts.map((entry) => [entry.line, entry.password]));
-    const emailByLine = new Map(resume.accounts.map((entry) => [entry.line, entry.email]));
-    const createdAt = snapshot.createdAt || resume.createdAt || nowIso();
-
-    const accounts = (snapshot.accounts || []).map((account) => {
-      const isTerminal = TERMINAL_ACCOUNT_STATUSES.has(account.status);
-      const logs = Array.isArray(account.logs) ? [...account.logs] : [];
-      const rebuilt = {
-        line: account.line,
-        email: account.email || emailByLine.get(account.line) || "",
-        password: isTerminal ? undefined : (passwordByLine.get(account.line) ?? null),
-        proxyUrl: null,
-        status: account.status,
-        error: account.error || null,
-        connectionId: account.connectionId || null,
-        workerId: isTerminal ? (account.workerId || null) : null,
-        manualSession: null,
-        runtimeSession: null,
-        currentStep: account.currentStep || null,
-        updatedAt: account.updatedAt || createdAt,
-        logs,
-      };
-      if (!isTerminal) {
-        rebuilt.status = "queued";
-        rebuilt.currentStep = "queued";
-        rebuilt.error = null;
-        rebuilt.logs.push(createLogEntry("resumed", "Re-queued after a server restart to continue automatically"));
-      }
-      return rebuilt;
-    });
-
-    const job = {
-      jobId,
-      status: "running",
-      concurrency: clampConcurrency(resume.concurrency),
-      proxyPoolMode: resume.proxyPoolMode || "none",
-      proxyUrls: Array.isArray(resume.proxyUrls) ? resume.proxyUrls : [],
-      createdAt,
-      startedAt: snapshot.startedAt || createdAt,
-      finishedAt: null,
-      error: null,
-      cancelRequested: false,
-      browser: null,
-      nextIndex: 0,
-      manualFollowups: new Set(),
-      persistPromise: Promise.resolve(),
-      lastPreview: snapshot.preview || null,
-      lastPreviewCapturedAt: 0,
-      accounts,
-    };
-
-    this.jobs.set(jobId, job);
-    if (!this.latestJobId) this.latestJobId = jobId;
-
-    const hasQueued = accounts.some((account) => account.status === "queued");
-    if (!hasQueued) {
-      // Nothing left to do; finalize cleanly.
-      job.status = "completed";
-      job.finishedAt = nowIso();
-      void this.persistJobSnapshot(job, { forcePreview: false });
-      deleteResumeBlob(getResumeFile(jobId, this.storageDir));
-      return true;
-    }
-
-    void this.runJob(jobId);
-    return true;
-  }
-
-  // Mark an interrupted job (with no recoverable credentials) as failed so the
-  // UI shows a clear terminal state instead of hanging.
-  markJobInterrupted(jobId, snapshot) {
-    const message = "Job was interrupted by a server restart and could not be auto-resumed (saved credentials were unavailable). Please start a new bulk login.";
-    const accounts = (snapshot.accounts || []).map((account) => {
-      if (TERMINAL_ACCOUNT_STATUSES.has(account.status)) return account;
-      const logs = Array.isArray(account.logs) ? [...account.logs] : [];
-      logs.push(createLogEntry("failed", message, "error"));
-      return {
-        ...account,
-        status: "failed",
-        error: message,
-        currentStep: "failed",
-        updatedAt: nowIso(),
-        manualSessionAvailable: false,
-        logs,
-      };
-    });
-    const updatedSnapshot = {
-      ...snapshot,
-      status: "failed",
-      error: snapshot.error || message,
-      finishedAt: snapshot.finishedAt || nowIso(),
-      accounts,
-      summary: buildSummary(accounts),
-      activity: buildJobActivity(accounts),
-    };
-    try {
-      writeJsonFile(getJobFile(jobId, this.storageDir), updatedSnapshot);
-    } catch {}
-    deleteResumeBlob(getResumeFile(jobId, this.storageDir));
-  }
-
-  async startJob({ accounts, concurrency, proxyPoolMode, proxyPoolId, engine } = {}) {
-    const { parsed, invalidLines } = parseKiroBulkAccounts(accounts);
-    if (!parsed.length) {
-      const error = invalidLines.length > 0
-        ? "Invalid account format. Use one account per line: gmail@example.com|password"
-        : "At least one account entry is required";
-      const response = { error };
-      if (invalidLines.length > 0) response.invalidLines = invalidLines;
-      throw Object.assign(new Error(error), response);
-    }
-
-    if (invalidLines.length > 0) {
-      const error = "Invalid account format. Use one account per line: gmail@example.com|password";
-      throw Object.assign(new Error(error), { error, invalidLines });
-    }
-
-    // Resolve proxy pool URLs for round-robin assignment
-    let proxyUrls = [];
-    if (proxyPoolMode === "all") {
-      const pools = await getProxyPools({ isActive: true });
-      proxyUrls = pools.map((p) => p.proxyUrl).filter(Boolean);
-    } else if (proxyPoolMode === "single" && proxyPoolId) {
-      const pool = await getProxyPoolById(proxyPoolId);
-      if (pool?.isActive && pool?.proxyUrl) {
-        proxyUrls = [pool.proxyUrl];
-      }
-    }
-
-    const jobId = randomUUID();
-    const createdAt = nowIso();
-
-    this.hydrateInterruptedJob(this.latestJobId);
-    const activeJob = [...this.jobs.values()].find((entry) => ACTIVE_JOB_STATUSES.has(entry.status));
-    if (activeJob) {
-      throw Object.assign(new Error("A bulk import job is already active"), {
-        error: "A bulk import job is already active",
-        code: "BULK_IMPORT_ACTIVE",
-        jobId: activeJob.jobId,
-      });
-    }
-
-    let resolvedEngine = engine;
-    try {
-      const { normalizeBulkImportEngine } = await import("./bulkImportBrowserEngine.js");
-      resolvedEngine = normalizeBulkImportEngine(engine);
-    } catch {
-      resolvedEngine = engine || "cloakbrowser";
-    }
-
-    const job = {
-      jobId,
-      status: "running",
-      concurrency: clampConcurrency(concurrency),
-      engine: resolvedEngine,
-      proxyPoolMode: proxyPoolMode || "none",
-      proxyUrls,
-      createdAt,
-      startedAt: createdAt,
-      finishedAt: null,
-      error: null,
-      cancelRequested: false,
-      browser: null,
-      nextIndex: 0,
-      manualFollowups: new Set(),
-      persistPromise: Promise.resolve(),
-      lastPreview: null,
-      lastPreviewCapturedAt: 0,
-      accounts: parsed.map((account) => ({
-        line: account.line,
-        email: account.email,
-        password: account.password,
-        proxyUrl: null,
-        status: "queued",
-        error: null,
-        connectionId: null,
-        workerId: null,
-        manualSession: null,
-        runtimeSession: null,
-        currentStep: "queued",
-        updatedAt: createdAt,
-        logs: [createLogEntry("queued", "Queued and waiting for an available worker")],
-      })),
-    };
-
-    this.jobs.set(jobId, job);
-    this.latestJobId = jobId;
-    this.persistLatestJobId(jobId);
-    await this.persistJobSnapshot(job, { forcePreview: false });
-    this.persistResumeBlob(job);
-    void this.runJob(jobId);
-    return sanitizeJob(job);
-  }
-
-  getJob(jobId) {
-    this.hydrateInterruptedJob(jobId);
-    const job = this.jobs.get(jobId);
-    if (job) return sanitizeJob(job, { preview: job.lastPreview || null });
-    return readJsonFile(getJobFile(jobId, this.storageDir));
-  }
-
-  async getJobWithPreview(jobId) {
-    this.hydrateInterruptedJob(jobId);
-    const job = this.jobs.get(jobId);
-    if (!job) return readJsonFile(getJobFile(jobId, this.storageDir));
-    const preview = await this.capturePreview(job);
-    job.lastPreview = preview || job.lastPreview || null;
-    await this.persistJobSnapshot(job, { forcePreview: false });
-    return sanitizeJob(job, { preview: job.lastPreview || null });
-  }
-
-  async getLatestJobWithPreview({ includeRecentTerminal = false } = {}) {
-    const latestJobId = this.latestJobId || readPersistedLatestJobId(this.metaFile);
-    if (!latestJobId) return null;
-    const job = await this.getJobWithPreview(latestJobId);
-    if (!job) return null;
-    if (ACTIVE_JOB_STATUSES.has(job.status)) {
-      return job;
-    }
-    if (includeRecentTerminal && isRecentTerminalJob(job)) {
-      return job;
-    }
-    return null;
-  }
-
-  cancelJob(jobId) {
-    const job = this.jobs.get(jobId);
-    if (!job) return readJsonFile(getJobFile(jobId, this.storageDir));
-
-    job.cancelRequested = true;
-
-    // Immediately terminalize ALL open accounts — including needs_manual.
-    // Previously cancel only flipped "queued" jobs and closed the browser, so
-    // needs_manual followups waited on a dead callback promise forever and the
-    // UI stayed "running" / Cancel did nothing.
-    for (const account of job.accounts || []) {
-      if (
-        account.status === "queued"
-        || account.status === "running"
-        || account.status === "needs_manual"
-      ) {
-        const ms = account.manualSession;
-        const rs = account.runtimeSession;
-        const ctx = ms?.context || rs?.context || null;
-        const headed = ms?.headedBrowser || null;
-        const owned = ms?.ownedBrowser || null;
-        if (ctx) void ctx.close().catch(() => null);
-        if (headed) void headed.close().catch(() => null);
-        if (owned) void import("./bulkImportBrowserEngine.js")
-          .then(({ forceCloseBrowser }) => forceCloseBrowser(owned))
-          .catch(() => owned.close().catch(() => null));
-        account.manualSession = null;
-        account.runtimeSession = null;
-        this.finalizeAccount(account, "cancelled", {
-          error: "Job cancelled",
-          step: "cancelled",
-          message: "Job cancelled by user",
-        });
-      }
-    }
-
-    if (job.browser) {
-      const browser = job.browser;
-      job.browser = null;
-      void import("./bulkImportBrowserEngine.js")
-        .then(({ forceCloseBrowser }) => forceCloseBrowser(browser))
-        .catch(() => browser.close().catch(() => null));
-    }
-
-    // Mark job cancelled immediately so UI unlocks; runJob finally still cleans up.
-    if (job.status === "queued" || job.status === "running") {
-      job.status = "cancelled";
-      job.finishedAt = job.finishedAt || nowIso();
-    }
-
-    void this.persistJobSnapshot(job, { forcePreview: true });
-
-    return sanitizeJob(job);
-  }
-
-  async openManualSession(jobId, workerId) {
-    const job = this.jobs.get(jobId);
-    if (!job) return null;
-
-    const numericWorkerId = Number.parseInt(workerId, 10);
-    const account = job.accounts.find((entry) => (
-      entry.workerId === numericWorkerId
-      && entry.status === "needs_manual"
-      && entry.manualSession?.page
-    ));
-
-    if (!account) {
-      return {
-        ok: false,
-        error: "Manual session not found for this worker",
-        job: sanitizeJob(job),
-      };
-    }
-
-    const opened = await revealBrowserWindow(account.manualSession.page, { account });
-    account.manualSession.opened = opened;
-    account.manualSession.openedAt = opened
-      ? (account.manualSession.openedAt || nowIso())
-      : account.manualSession.openedAt || null;
-    await this.persistJobSnapshot(job, { forcePreview: true });
-
-    return {
-      ok: true,
-      job: sanitizeJob(job),
-      account: sanitizeAccount(account),
-    };
-  }
-
-  dequeueAccount(job, workerId) {
-    while (job.nextIndex < job.accounts.length) {
-      const account = job.accounts[job.nextIndex];
-      job.nextIndex += 1;
-      if (account.status !== "queued") continue;
-      account.status = "running";
-      account.workerId = workerId;
-      account.error = null;
-      // Assign proxy via round-robin from the resolved pool
-      if (job.proxyUrls?.length) {
-        account.proxyUrl = job.proxyUrls[(job.nextIndex - 1) % job.proxyUrls.length];
-      }
-      appendAccountLog(account, "worker_assigned", `Worker ${workerId} picked up this account${account.proxyUrl ? ` (proxy: ${maskProxyUrl(account.proxyUrl)})` : ""}`);
-      void this.persistJobSnapshot(job, { forcePreview: false });
-      return account;
-    }
-    return null;
-  }
-
-  finalizeAccount(account, status, extras = {}) {
-    account.status = status;
-    account.error = extras.error || null;
-    account.connectionId = extras.connectionId || null;
-    if (extras.step || extras.message) {
-      appendAccountLog(
-        account,
-        extras.step || status,
-        extras.message || extras.error || status.replaceAll("_", " ")
-      );
-    }
-    return account;
-  }
-
-  setAccountStep(account, step, message, level = "info") {
-    appendAccountLog(account, step, message, level);
-  }
-
-  async persistJobSnapshot(job, { forcePreview = false } = {}) {
-    if (!job) return;
-
-    const runPersist = async () => {
-      const shouldCapturePreview = forcePreview || (Date.now() - (job.lastPreviewCapturedAt || 0) >= PREVIEW_CAPTURE_INTERVAL_MS);
-      if (shouldCapturePreview) {
-        const preview = await this.capturePreview(job);
-        if (preview) {
-          job.lastPreview = preview;
-        }
-        job.lastPreviewCapturedAt = Date.now();
-      }
-
-      this.writePersistedJob(job.jobId, this.buildPersistedSnapshot(job));
-    };
-
-    job.persistPromise = Promise.resolve(job.persistPromise).catch(() => null).then(runPersist);
-    await job.persistPromise;
-  }
-
-  async capturePreview(job) {
-    const previewAccount = job.accounts.find((account) => account.status === "running" && account.runtimeSession?.page)
-      || job.accounts.find((account) => account.status === "needs_manual" && account.manualSession?.page);
-
-    if (!previewAccount) return null;
-
-    const page = previewAccount.runtimeSession?.page || previewAccount.manualSession?.page;
-    if (!page) return null;
-
-    try {
-      const screenshot = await page.screenshot({
-        type: "jpeg",
-        quality: 55,
-        fullPage: false,
-        animations: "disabled",
-        caret: "hide",
-      });
-
-      return {
-        email: previewAccount.email || null,
-        phone: previewAccount.phone || null,
-        workerId: previewAccount.workerId || null,
-        status: previewAccount.status,
-        step: previewAccount.currentStep || null,
-        updatedAt: previewAccount.updatedAt || nowIso(),
-        imageData: `data:image/jpeg;base64,${screenshot.toString("base64")}`,
-      };
-    } catch {
-      return {
-        email: previewAccount.email || null,
-        phone: previewAccount.phone || null,
-        workerId: previewAccount.workerId || null,
-        status: previewAccount.status,
-        step: previewAccount.currentStep || null,
-        updatedAt: previewAccount.updatedAt || nowIso(),
-        imageData: null,
-      };
-    }
-  }
-
-  async runManualFollowup(job, account, workerId, context, callbackPromise, codeVerifier) {
-    const followupPromise = (async () => {
-      const closeManualResources = async () => {
-        const ms = account.manualSession;
-        const ctx = ms?.context || context;
-        const headed = ms?.headedBrowser || null;
-        if (ctx) await ctx.close().catch(() => null);
-        if (headed) await headed.close().catch(() => null);
-      };
-      try {
-        const callback = await callbackPromise;
-        if (job.cancelRequested) {
-          this.finalizeAccount(account, "cancelled", {
-            error: "Job cancelled",
-            step: "cancelled",
-            message: "Job cancelled while waiting for manual completion",
-          });
-          await this.persistJobSnapshot(job, { forcePreview: true });
-          return;
-        }
-
-        this.setAccountStep(account, "exchanging_tokens", "Exchanging Kiro callback for OAuth tokens");
-        await this.persistJobSnapshot(job, { forcePreview: true });
-        const { connection } = await this.socialExchange({
-          code: callback.code,
-          codeVerifier,
-          provider: "google",
-        });
-
-        this.finalizeAccount(account, "success", {
-          connectionId: connection.id,
-          step: "connection_saved",
-          message: "Kiro connection saved successfully",
-        });
-        await this.persistJobSnapshot(job, { forcePreview: true });
-      } catch (error) {
-        if (job.cancelRequested) {
-          this.finalizeAccount(account, "cancelled", {
-            error: "Job cancelled",
-            step: "cancelled",
-            message: "Job cancelled while waiting for manual completion",
-          });
-        } else {
-          this.finalizeAccount(account, "failed_exchange", {
-            error: error.message || "Manual assist flow failed during token exchange.",
-            step: "exchange_failed",
-            message: error.message || "Manual assist flow failed during token exchange.",
-          });
-        }
-        await this.persistJobSnapshot(job, { forcePreview: true });
-      } finally {
-        await closeManualResources();
-        account.manualSession = null;
-        account.runtimeSession = null;
-        job.manualFollowups.delete(followupPromise);
-        await this.persistJobSnapshot(job, { forcePreview: true });
-      }
-    })();
-
-    job.manualFollowups.add(followupPromise);
-  }
-
-  async processAccount(job, account, workerId) {
-    if (job.cancelRequested || !job.browser) {
-      this.finalizeAccount(account, "cancelled", { error: "Job cancelled" });
-      return;
-    }
-
-    const kiroService = this.kiroServiceFactory();
-    const socialAuth = kiroService.createSocialAuthorization("google");
-    let context = null;
-
-    try {
-      const session = await createFreshContext(job.browser, account.proxyUrl);
-      context = session.context;
-      const { page } = session;
-      const callbackPromise = createKiroCallbackMonitor(context, page);
-      account.runtimeSession = { context, page };
-      this.setAccountStep(account, "preparing_worker", `Worker ${workerId} is preparing a browser context`);
-      await this.persistJobSnapshot(job, { forcePreview: true });
-      const automationResult = await this.googleAutomation({
-        page,
-        authUrl: socialAuth.authUrl,
-        email: account.email,
-        password: account.password,
-        callbackPromise,
-        onStep: (step, message) => {
-          this.setAccountStep(account, step, message);
-          void this.persistJobSnapshot(job, { forcePreview: false });
-        },
-      });
-
-      if (automationResult.status === "success") {
-        this.setAccountStep(account, "exchanging_tokens", "Exchanging Kiro callback for OAuth tokens");
-        await this.persistJobSnapshot(job, { forcePreview: true });
-        const { connection } = await this.socialExchange({
-          code: automationResult.code,
-          codeVerifier: socialAuth.codeVerifier,
-          provider: "google",
-        });
-        this.finalizeAccount(account, "success", {
-          connectionId: connection.id,
-          step: "connection_saved",
-          message: "Kiro connection saved successfully",
-        });
-        account.runtimeSession = null;
-        await context?.close().catch(() => null);
-        await this.persistJobSnapshot(job, { forcePreview: true });
-        return;
-      }
-
-      if (automationResult.status === "needs_manual") {
-        account.manualSession = {
-          context,
-          page,
-          opened: false,
-          openedAt: null,
-          rebind: typeof callbackPromise?.rebind === "function" ? callbackPromise.rebind : null,
-        };
-        this.setAccountStep(account, "awaiting_manual", "Waiting for manual completion in the browser session");
-        this.finalizeAccount(account, "needs_manual", {
-          error: automationResult.error,
-          step: "awaiting_manual",
-          message: automationResult.error,
-        });
-        await this.persistJobSnapshot(job, { forcePreview: true });
-        await this.runManualFollowup(
-          job,
-          account,
-          workerId,
-          context,
-          callbackPromise,
-          socialAuth.codeVerifier
-        );
-        return;
-      }
-
-      const terminalStatus = TERMINAL_ACCOUNT_STATUSES.has(automationResult.status)
-        ? automationResult.status
-        : "failed";
-      this.finalizeAccount(account, terminalStatus, {
-        error: automationResult.error || "Kiro Google automation failed.",
-        step: terminalStatus,
-        message: automationResult.error || "Kiro Google automation failed.",
-      });
-      account.runtimeSession = null;
-      await context?.close().catch(() => null);
-      await this.persistJobSnapshot(job, { forcePreview: true });
-    } catch (error) {
-      this.finalizeAccount(account, "failed", {
-        error: error.message || "Unexpected Kiro bulk import failure.",
-        step: "failed",
-        message: error.message || "Unexpected Kiro bulk import failure.",
-      });
-      account.runtimeSession = null;
-      await context?.close().catch(() => null);
-      await this.persistJobSnapshot(job, { forcePreview: true });
-    } finally {
-      account.password = undefined;
-    }
-  }
-
-  async runWorker(job, workerId) {
-    while (!job.cancelRequested) {
-      const account = this.dequeueAccount(job, workerId);
-      if (!account) return;
-      await this.processAccount(job, account, workerId);
-    }
-  }
-
-  shouldPrelaunchBrowser(_job) {
-    return true;
-  }
-
-  async runJob(jobId) {
-    const job = this.jobs.get(jobId);
-    if (!job) return;
-
-    try {
-      const {
-        DEFAULT_BROWSER_LAUNCH_TIMEOUT_MS,
-        forceCloseBrowser,
-        withAutomationTimeout,
-      } = await import("./bulkImportBrowserEngine.js");
-      if (this.shouldPrelaunchBrowser(job)) {
-        const launchTask = Promise.resolve().then(() => this.browserLauncher(job));
-        job.browser = await withAutomationTimeout(launchTask, {
-          timeoutMs: DEFAULT_BROWSER_LAUNCH_TIMEOUT_MS,
-          message: `Automation browser launch timed out after ${Math.round(DEFAULT_BROWSER_LAUNCH_TIMEOUT_MS / 1000)}s`,
-          code: "BROWSER_LAUNCH_TIMEOUT",
-          onLateResolve: (browser) => forceCloseBrowser(browser),
-        });
-      }
-      job.accounts.forEach((account) => {
-        if (account.status === "queued" && (account.logs || []).length === 1) {
-          this.setAccountStep(account, "waiting_for_worker", "Waiting for a free worker");
-        }
-      });
-      await this.persistJobSnapshot(job, { forcePreview: false });
-      const workerCount = Math.min(job.concurrency, Math.max(job.accounts.length, 1));
-      const workers = Array.from({ length: workerCount }, (_, index) => this.runWorker(job, index + 1));
-
-      await Promise.allSettled(workers);
-
-      if (job.manualFollowups.size > 0) {
-        await Promise.allSettled([...job.manualFollowups]);
-      }
-
-      if (job.cancelRequested) {
-        job.status = "cancelled";
-        job.accounts.forEach((account) => {
-          if (
-            account.status === "queued"
-            || account.status === "running"
-            || account.status === "needs_manual"
-          ) {
-            this.finalizeAccount(account, "cancelled", {
-              error: "Job cancelled",
-              step: "cancelled",
-              message: "Job cancelled before completion",
-            });
-          }
-        });
-      } else {
-        // If only needs_manual left and user never cancelled, still complete the job
-        // once followups settle — do not leave status stuck on "running".
-        job.status = "completed";
-      }
-      await this.persistJobSnapshot(job, { forcePreview: true });
-    } catch (error) {
-      job.status = "failed";
-      job.error = error.message || "Failed to start Kiro bulk import job.";
-      job.accounts.forEach((account) => {
-        if (account.status === "queued" || account.status === "running") {
-          this.finalizeAccount(account, "failed", {
-            error: job.error,
-            step: "failed",
-            message: job.error,
-          });
-          account.password = undefined;
-        }
-      });
-      await this.persistJobSnapshot(job, { forcePreview: true });
-    } finally {
-      if (job.browser) {
-        const browser = job.browser;
-        job.browser = null;
-        try {
-          const { forceCloseBrowser } = await import("./bulkImportBrowserEngine.js");
-          await forceCloseBrowser(browser);
-        } catch {
-          await browser.close().catch(() => null);
-        }
-      }
-      job.finishedAt = nowIso();
-      await this.persistJobSnapshot(job, { forcePreview: true });
-      // Job has reached a terminal state; the encrypted resume vault is no
-      // longer needed.
-      deleteResumeBlob(getResumeFile(job.jobId, this.storageDir));
-    }
-  }
-}
-
-function getSingletonStore() {
-  if (!globalThis.__kiroBulkImportSingleton) {
-    globalThis.__kiroBulkImportSingleton = {
-      manager: new KiroBulkImportManager(),
-    };
-  }
-  return globalThis.__kiroBulkImportSingleton;
-}
-
-export function getKiroBulkImportManager() {
-  return getSingletonStore().manager;
-}
-
-export const __test__ = {
-  clampConcurrency,
-  parseKiroBulkAccounts,
-  sanitizeJob,
-  buildSummary,
-  isRecentTerminalJob,
-  buildLookupResponse,
-  maskProxyUrl,
-};