@agentorg/cli 0.0.5 → 0.0.6

package/dist/node_modules/assistant/dist/src/settings.js

@@ -0,0 +1,43 @@
+/** The longest instructions a request can carry. */
+export const MAX_INSTRUCTIONS = 200_000;
+const SLOT = "settings";
+const HEADING = `## Skills
+A skill is written instructions for a kind of task. When one fits what you're asked, read it with settings__skill and follow it before you start. Pass path to read a file its SKILL.md refers to.`;
+/** The agent's instructions and the skills that fit in them; any that don't are reported. */
+export function instructionsWith(instructions, skills) {
+    const leftOut = [];
+    if (skills.length === 0)
+        return { instructions, leftOut };
+    let text = `${instructions}\n\n${HEADING}`;
+    for (const { name, description } of skills) {
+        const line = `\n- ${name}: ${description}`;
+        if (text.length + line.length > MAX_INSTRUCTIONS)
+            leftOut.push({ slot: SLOT, tool: name, reason: "limit" });
+        else
+            text += line;
+    }
+    return leftOut.length === skills.length
+        ? { instructions, leftOut }
+        : { instructions: text, leftOut };
+}
+/** The one way the model reads a skill: its `SKILL.md`, or a file of its folder by `path`. */
+export function skillTool(slot) {
+    return {
+        slot: SLOT,
+        name: "skill",
+        description: "Read a skill: its SKILL.md, or with path a file in its folder.",
+        parameters: {
+            type: "object",
+            properties: {
+                name: { type: "string", description: "The skill's name, as your instructions list it." },
+                path: { type: "string", description: "A file in the skill's folder, relative to it." },
+            },
+            required: ["name"],
+            additionalProperties: false,
+        },
+        run: async (args) => {
+            const { text } = await slot.call.skill(args);
+            return { output: text, ok: true };
+        },
+    };
+}

package/dist/node_modules/assistant/dist/src/tools.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The assistant's tools, gathered afresh for each model request. A `tools@1` slot gives whatever
+ * it lists now, with its server's own input schemas. Each is offered as
+ * `<slot>__<name>`, and a call runs through the slot, so the Hub checks and audits it like any
+ * other.
+ */
+import { type Tool } from "@agentorg/interfaces";
+import { type DescribedInterface } from "@agentorg/sdk";
+import type { z } from "zod";
+/** How a function call ended, as the model and the record see it. */
+export interface Outcome {
+    output: string;
+    ok: boolean;
+    code?: string;
+}
+interface Found {
+    tool: z.input<typeof Tool>;
+    run(input: unknown): Promise<Outcome>;
+}
+export type Tools = Map<string, Found>;
+/** A tool as its slot gives it, before it has the name a request offers it under. */
+export interface Candidate {
+    slot: string;
+    name: string;
+    description?: string;
+    parameters: Record<string, z.core.util.JSONType>;
+    run: Found["run"];
+}
+/**
+ * Something the model isn't offered, and why: `name` (past 64 characters as a function name),
+ * `duplicate` (its function name is already taken), `limit` (past what a request can carry), or,
+ * with no `tool`, the code its slot's list failed with.
+ */
+export interface LeftOut {
+    slot: string;
+    tool?: string;
+    reason: string;
+}
+/** A function's output is cut to this many bytes of UTF-8, so one result can't fill a request. */
+export declare const MAX_OUTPUT: number;
+/** What a request can carry: its tools count, and, with the record and instructions, one frame. */
+export declare const MAX_TOOLS = 128;
+export declare const TOOLS_BUDGET: number;
+/** The code and message of anything a call or a turn can throw. */
+export declare function codeOf(error: unknown): {
+    code: string;
+    message: string;
+};
+/** At most `MAX_OUTPUT` bytes of `text`, cut at a character, saying so when it is cut. */
+export declare function capped(text: string): string;
+/** Whether a slot is a `tools@1`, whose tools are whatever it lists. */
+export declare const listsTools: (described: DescribedInterface) => boolean;
+/**
+ * What a `tools@1` slot lists now. A slot that can't answer gives no tools and says why, and is
+ * asked again at the next request.
+ */
+export declare function listedBy(name: string, slot: {
+    readonly call: Readonly<Record<string, (input: unknown) => Promise<unknown>>>;
+}): Promise<{
+    candidates: Candidate[];
+    leftOut: LeftOut[];
+}>;
+/**
+ * The tools one request offers, by function name, and what it can't. A character a function name
+ * can't have becomes `_`. Candidates are taken in order, so the first ones given are the ones kept
+ * when a request is full; what doesn't fit is reported, never sent.
+ */
+export declare function offered(candidates: Candidate[]): {
+    tools: Tools;
+    leftOut: LeftOut[];
+};
+/** Run a function call through its slot: the result, or the refusal, as the function's output. */
+export declare function runTool(tools: Tools, name: string, args: string): Promise<Outcome>;
+export {};

package/dist/node_modules/assistant/dist/src/tools.js

@@ -0,0 +1,123 @@
+/**
+ * The assistant's tools, gathered afresh for each model request. A `tools@1` slot gives whatever
+ * it lists now, with its server's own input schemas. Each is offered as
+ * `<slot>__<name>`, and a call runs through the slot, so the Hub checks and audits it like any
+ * other.
+ */
+import { tools as toolsInterface } from "@agentorg/interfaces";
+import { describeInterface, NotConnected, OutcomeUnknown, Refused, } from "@agentorg/sdk";
+import { head } from "./history.js";
+/** A function's output is cut to this many bytes of UTF-8, so one result can't fill a request. */
+export const MAX_OUTPUT = 16 * 1024;
+/** What a request can carry: its tools count, and, with the record and instructions, one frame. */
+export const MAX_TOOLS = 128;
+export const TOOLS_BUDGET = 256 * 1024;
+const MAX_NAME = 64;
+const MAX_DESCRIPTION = 1024;
+const encoder = new TextEncoder();
+const TOOLS_ID = describeInterface(toolsInterface).id;
+/** The code and message of anything a call or a turn can throw. */
+export function codeOf(error) {
+    if (error instanceof Refused)
+        return { code: error.code, message: error.message };
+    if (error instanceof NotConnected)
+        return { code: "not_connected", message: `${error.target} is not connected.` };
+    if (error instanceof OutcomeUnknown)
+        return { code: "outcome_unknown", message: error.message };
+    return { code: "failed", message: "The call failed." };
+}
+/** At most `MAX_OUTPUT` bytes of `text`, cut at a character, saying so when it is cut. */
+export function capped(text) {
+    const bytes = encoder.encode(text);
+    if (bytes.byteLength <= MAX_OUTPUT)
+        return text;
+    const head = new TextDecoder().decode(bytes.subarray(0, MAX_OUTPUT - 16)).replace(/�$/, "");
+    return `${head}… (cut)`;
+}
+/** Whether a slot is a `tools@1`, whose tools are whatever it lists. */
+export const listsTools = (described) => described.id === TOOLS_ID;
+/**
+ * What a `tools@1` slot lists now. A slot that can't answer gives no tools and says why, and is
+ * asked again at the next request.
+ */
+export async function listedBy(name, slot) {
+    const list = slot.call.list;
+    const call = slot.call.call;
+    let entries;
+    try {
+        ({ tools: entries } = (await list({})));
+    }
+    catch (error) {
+        return { candidates: [], leftOut: [{ slot: name, reason: codeOf(error).code }] };
+    }
+    const candidates = entries.map((entry) => ({
+        slot: name,
+        name: entry.name,
+        ...(entry.description ? { description: entry.description } : {}),
+        parameters: entry.inputSchema,
+        run: async (args) => {
+            const { output, failed } = (await call({ name: entry.name, arguments: args }));
+            return failed ? { output, ok: false, code: "failed" } : { output, ok: true };
+        },
+    }));
+    return { candidates, leftOut: [] };
+}
+/**
+ * The tools one request offers, by function name, and what it can't. A character a function name
+ * can't have becomes `_`. Candidates are taken in order, so the first ones given are the ones kept
+ * when a request is full; what doesn't fit is reported, never sent.
+ */
+export function offered(candidates) {
+    const tools = new Map();
+    const leftOut = [];
+    let bytes = 0;
+    for (const { slot, name, description, parameters, run } of candidates) {
+        const toolName = `${slot}__${name}`.replace(/[^A-Za-z0-9_-]/g, "_");
+        const tool = {
+            name: toolName,
+            ...(description ? { description: head(description, MAX_DESCRIPTION) } : {}),
+            parameters,
+        };
+        const size = encoder.encode(JSON.stringify(tool)).byteLength;
+        const reason = toolName.length > MAX_NAME
+            ? "name"
+            : tools.has(toolName)
+                ? "duplicate"
+                : tools.size >= MAX_TOOLS || bytes + size > TOOLS_BUDGET
+                    ? "limit"
+                    : undefined;
+        if (reason) {
+            leftOut.push({ slot, tool: name, reason });
+            continue;
+        }
+        bytes += size;
+        tools.set(toolName, { tool, run });
+    }
+    return { tools, leftOut };
+}
+const failure = ({ code, message }) => JSON.stringify({ error: { code, message } });
+/** Run a function call through its slot: the result, or the refusal, as the function's output. */
+export async function runTool(tools, name, args) {
+    const refused = (code, message) => ({
+        output: failure({ code, message }),
+        ok: false,
+        code,
+    });
+    const found = tools.get(name);
+    if (!found)
+        return refused("unknown_tool", `No tool is named ${name.slice(0, 64)}.`);
+    let input;
+    try {
+        input = args.trim() === "" ? {} : JSON.parse(args);
+    }
+    catch {
+        return refused("invalid", "The arguments aren't JSON.");
+    }
+    try {
+        return await found.run(input);
+    }
+    catch (error) {
+        const { code, message } = codeOf(error);
+        return refused(code, message);
+    }
+}

package/dist/node_modules/assistant/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "assistant",
+  "version": "0.0.1",
+  "private": true,
+  "description": "The agent engine, and the bundled provider that runs it",
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    "./provider": {
+      "types": "./dist/src/provider.d.ts",
+      "default": "./dist/src/provider.js"
+    }
+  },
+  "files": [
+    "dist/src"
+  ],
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
+    "test": "node --test \"dist/test/**/*.test.js\""
+  },
+  "dependencies": {
+    "@agentorg/interfaces": "0.0.0",
+    "@agentorg/sdk": "0.0.0",
+    "zod": "^4.6.7"
+  },
+  "devDependencies": {
+    "@agentorg/hub": "0.0.0"
+  }
+}

package/dist/node_modules/chatgpt/dist/src/account.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The ChatGPT sign-in this Actor owns: its registration, its tokens and their refresh. The tokens
+ * stay inside, apart from where they are kept: nothing here returns, emits or logs one.
+ */
+import type { kv, LoginState } from "@agentorg/interfaces";
+import { Refused, type Slot } from "@agentorg/sdk";
+import type { z } from "zod";
+import { type Fetch } from "./oauth.js";
+type State = z.output<typeof LoginState>;
+/** Where the sign-in is kept: the program's own file. */
+export type Store = Pick<Slot<typeof kv>["call"], "get" | "set" | "delete">;
+export declare const notSignedIn: () => Refused;
+export declare const notEligible: () => Refused;
+export declare function createAccount(options: {
+    fetch: Fetch;
+    store: Store;
+    changed(state: State): void;
+    now?: () => number;
+}): {
+    status(): Promise<{
+        state: "ineligible" | "signed_in" | "signed_out";
+        account: {
+            email?: string | undefined;
+            plan?: string | undefined;
+        };
+    } | {
+        account?: undefined;
+        state: "ineligible" | "signed_in" | "signed_out";
+    }>;
+    start({ redirectUri }: {
+        redirectUri: string;
+    }): Promise<{
+        authorizeUrl: string;
+    }>;
+    complete({ callbackUrl }: {
+        callbackUrl: string;
+    }): Promise<{
+        account: {
+            email?: string | undefined;
+            plan?: string | undefined;
+        };
+    }>;
+    logout(): Promise<{
+        revoked: boolean;
+    }>;
+    /** A usable access token, refreshed when it's near expiry or when `stale`. */
+    token(stale?: boolean): Promise<string>;
+    /** OpenAI said the account isn't eligible: say so until the next sign-in. */
+    ineligible(): Promise<void>;
+};
+export type Account = ReturnType<typeof createAccount>;
+export {};

package/dist/node_modules/chatgpt/dist/src/account.js

@@ -0,0 +1,270 @@
+import { Refused } from "@agentorg/sdk";
+import { challengeOf, random } from "./encoding.js";
+import { verifyIdToken } from "./jwt.js";
+import { AGENT_NAME, AUTHORIZE, DYNAMIC_CLIENT, discover, GrantError, grant, ISSUER, PLAN_SCOPE, RESOURCE, revoke, SCOPES, TERMINAL, } from "./oauth.js";
+/** How long a started sign-in can be completed, how many can wait, and how early to refresh. */
+const PENDING_FOR = 10 * 60_000;
+const MAX_PENDING = 16;
+const REFRESH_BEFORE = 5 * 60_000;
+export const notSignedIn = () => new Refused("not_signed_in", "Not signed in to ChatGPT. Continue with ChatGPT to sign in.");
+export const notEligible = () => new Refused("ineligible", "This ChatGPT account isn't eligible to use its plan in this app. Signing in again won't change that.");
+const unreachable = () => new Refused("unavailable", "OpenAI couldn't be reached. Try again later.");
+const address = (url) => `${url.origin}${url.pathname}`;
+/** Who signed in, from verified id_token claims; the plan claim isn't documented, so optional. */
+function identity(claims) {
+    const auth = claims["https://api.openai.com/auth"];
+    return {
+        ...(typeof claims.sub === "string" ? { sub: claims.sub } : {}),
+        ...(typeof claims.email === "string" ? { email: claims.email.slice(0, 320) } : {}),
+        ...(typeof auth?.chatgpt_plan_type === "string"
+            ? { plan: auth.chatgpt_plan_type.slice(0, 64) }
+            : {}),
+    };
+}
+const tokensOf = ({ accessToken, refreshToken, expiresAt, scopes }) => ({
+    accessToken,
+    refreshToken,
+    expiresAt,
+    scopes,
+});
+export function createAccount(options) {
+    const { fetch, store, changed } = options;
+    const now = options.now ?? Date.now;
+    const pending = new Map();
+    let issuer;
+    let refreshing;
+    /** Bumped by every sign-in and sign-out, so a refresh that lands after one is dropped. */
+    let generation = 0;
+    const issuerOf = () => {
+        issuer ??= discover(fetch).catch((error) => {
+            issuer = undefined;
+            throw error;
+        });
+        return issuer;
+    };
+    /** Verify an id_token; on a key the issuer no longer has, read its keys once more. */
+    const verify = async (token, expect) => {
+        const check = async () => verifyIdToken(token, (await issuerOf()).keys, { issuer: ISSUER, ...expect, now: now() });
+        try {
+            return await check();
+        }
+        catch (error) {
+            if (!(error instanceof Error && error.message === "no matching signing key"))
+                throw error;
+            issuer = undefined;
+            return check();
+        }
+    };
+    const read = async (key) => (await store.get({ key })).value;
+    const write = (key, value) => store.set({ key, value: value });
+    const credential = () => read("credential");
+    const registration = async () => {
+        const kept = await read("registration");
+        if (kept)
+            return kept;
+        const fresh = { hostId: `urn:uuid:${crypto.randomUUID()}` };
+        await write("registration", fresh);
+        return fresh;
+    };
+    const stateOf = (held) => !held ? "signed_out" : held.ineligible ? "ineligible" : "signed_in";
+    const accountOf = (held) => ({
+        ...(held.email === undefined ? {} : { email: held.email }),
+        ...(held.plan === undefined ? {} : { plan: held.plan }),
+    });
+    const clear = async () => {
+        generation++;
+        await store.delete({ key: "credential" });
+        changed("signed_out");
+    };
+    /** Revoke tokens that won't be kept, as well as we can; nothing waits for it. */
+    const discard = (clientId, refreshToken) => void issuerOf()
+        .then((found) => revoke(fetch, found, clientId, refreshToken))
+        .catch(() => false);
+    /** Refresh the tokens, one refresh at a time; the refresh token rotates each time. */
+    const refresh = () => {
+        refreshing ??= (async () => {
+            const started = generation;
+            try {
+                const held = await credential();
+                if (!held)
+                    throw notSignedIn();
+                const next = await grant(fetch, {
+                    grant_type: "refresh_token",
+                    client_id: held.clientId,
+                    refresh_token: held.refreshToken,
+                }, now());
+                let kept = { ...held, ...tokensOf(next) };
+                if (next.idToken) {
+                    const claims = await verify(next.idToken, { audience: held.clientId }).catch(() => undefined);
+                    if (claims)
+                        kept = { ...kept, ...identity(claims) };
+                }
+                // Signed out or in again meanwhile: these tokens belong to nothing now.
+                if (started !== generation) {
+                    discard(held.clientId, next.refreshToken);
+                    throw notSignedIn();
+                }
+                await write("credential", kept);
+                return kept;
+            }
+            catch (error) {
+                if (error instanceof GrantError) {
+                    if (!TERMINAL.has(error.code))
+                        throw new Refused("failed", `OpenAI refused to refresh the sign-in (${error.code}).`);
+                    if (started === generation)
+                        await clear();
+                    throw notSignedIn();
+                }
+                if (error instanceof Refused)
+                    throw error;
+                throw unreachable();
+            }
+            finally {
+                refreshing = undefined;
+            }
+        })();
+        return refreshing;
+    };
+    return {
+        async status() {
+            const held = await credential();
+            return held ? { state: stateOf(held), account: accountOf(held) } : { state: stateOf(held) };
+        },
+        async start({ redirectUri }) {
+            const { hostId, clientId = DYNAMIC_CLIENT } = await registration();
+            for (const [state, attempt] of pending)
+                if (now() - attempt.at > PENDING_FOR || pending.size >= MAX_PENDING)
+                    pending.delete(state);
+            const verifier = random(48);
+            const state = random();
+            const nonce = random();
+            const redirect = address(new URL(redirectUri));
+            pending.set(state, { verifier, nonce, redirectUri, redirect, clientId, at: now() });
+            const url = new URL(AUTHORIZE);
+            url.search = new URLSearchParams({
+                response_type: "code",
+                client_id: clientId,
+                redirect_uri: redirectUri,
+                scope: SCOPES,
+                resource: RESOURCE,
+                code_challenge: await challengeOf(verifier),
+                code_challenge_method: "S256",
+                state,
+                nonce,
+                ext_agent_host_id: hostId,
+                ...(clientId === DYNAMIC_CLIENT ? { agent_name_hint: AGENT_NAME } : {}),
+            }).toString();
+            return { authorizeUrl: url.toString() };
+        },
+        async complete({ callbackUrl }) {
+            let url;
+            try {
+                url = new URL(callbackUrl);
+            }
+            catch {
+                throw new Refused("invalid", "callbackUrl isn't an address.");
+            }
+            const params = url.searchParams;
+            const state = params.get("state");
+            const attempt = state === null ? undefined : pending.get(state);
+            if (state === null || !attempt || now() - attempt.at > PENDING_FOR)
+                throw new Refused("expired", "This sign-in wasn't started here, or it expired. Start again.");
+            if (address(url) !== attempt.redirect)
+                throw new Refused("invalid", "The callback isn't the address this sign-in redirects to.");
+            pending.delete(state);
+            const error = params.get("error");
+            if (error === "access_denied")
+                throw new Refused("denied", "Sign-in was declined.");
+            if (error !== null)
+                throw new Refused("failed", "OpenAI returned an error to the sign-in.");
+            const code = params.get("code");
+            if (!code)
+                throw new Refused("failed", "The callback carries no code.");
+            const issued = params.get("client_id");
+            let clientId = attempt.clientId;
+            if (clientId === DYNAMIC_CLIENT) {
+                if (!issued || issued === DYNAMIC_CLIENT)
+                    throw new Refused("failed", "OpenAI didn't issue a client id; registration isn't complete.");
+                clientId = issued;
+            }
+            else if (issued !== null && issued !== clientId)
+                throw new Refused("failed", "The callback names another client, so it was refused.");
+            let granted;
+            try {
+                granted = await grant(fetch, {
+                    grant_type: "authorization_code",
+                    client_id: clientId,
+                    code,
+                    code_verifier: attempt.verifier,
+                    redirect_uri: attempt.redirectUri,
+                }, now());
+            }
+            catch (error) {
+                if (error instanceof GrantError)
+                    throw new Refused("failed", `OpenAI refused the sign-in (${error.code}). Start again.`);
+                throw unreachable();
+            }
+            if (!granted.scopes.includes(PLAN_SCOPE)) {
+                discard(clientId, granted.refreshToken);
+                throw new Refused("failed", "The sign-in wasn't granted ChatGPT plan usage.");
+            }
+            try {
+                await issuerOf();
+            }
+            catch {
+                discard(clientId, granted.refreshToken);
+                throw unreachable();
+            }
+            let claims;
+            try {
+                if (!granted.idToken)
+                    throw new Error("no id_token");
+                claims = await verify(granted.idToken, { audience: clientId, nonce: attempt.nonce });
+            }
+            catch {
+                discard(clientId, granted.refreshToken);
+                throw new Refused("failed", "OpenAI's identity token didn't verify.");
+            }
+            // A refresh still running belongs to the sign-in this one replaces, which is revoked.
+            await refreshing?.catch(() => { });
+            generation++;
+            const replaced = await credential();
+            if (replaced)
+                discard(replaced.clientId, replaced.refreshToken);
+            const held = { clientId, ...tokensOf(granted), ...identity(claims) };
+            await write("registration", { ...(await registration()), clientId });
+            await write("credential", held);
+            changed("signed_in");
+            return { account: accountOf(held) };
+        },
+        async logout() {
+            // A refresh still running would write its tokens back after the sign-out.
+            await refreshing?.catch(() => { });
+            const held = await credential();
+            if (!held)
+                return { revoked: true };
+            await clear();
+            const revoked = await issuerOf().then((found) => revoke(fetch, found, held.clientId, held.refreshToken), () => false);
+            return { revoked };
+        },
+        /** A usable access token, refreshed when it's near expiry or when `stale`. */
+        async token(stale = false) {
+            const held = await credential();
+            if (!held)
+                throw notSignedIn();
+            if (held.ineligible)
+                throw notEligible();
+            if (!stale && held.expiresAt - REFRESH_BEFORE > now())
+                return held.accessToken;
+            return (await refresh()).accessToken;
+        },
+        /** OpenAI said the account isn't eligible: say so until the next sign-in. */
+        async ineligible() {
+            const held = await credential();
+            if (!held || held.ineligible)
+                return;
+            await write("credential", { ...held, ineligible: true });
+            changed("ineligible");
+        },
+    };
+}

package/dist/node_modules/chatgpt/dist/src/encoding.d.ts

@@ -0,0 +1,7 @@
+/** Base64url without padding, as PKCE and JWTs use it. */
+export declare function base64url(bytes: Uint8Array): string;
+export declare function fromBase64url(text: string): Uint8Array<ArrayBuffer>;
+/** A fresh random value, base64url: `bytes` of entropy. */
+export declare function random(bytes?: number): string;
+/** The PKCE S256 challenge of a verifier. */
+export declare function challengeOf(verifier: string): Promise<string>;

package/dist/node_modules/chatgpt/dist/src/encoding.js

@@ -0,0 +1,20 @@
+/** Base64url without padding, as PKCE and JWTs use it. */
+export function base64url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+export function fromBase64url(text) {
+    const binary = atob(text.replaceAll("-", "+").replaceAll("_", "/"));
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+/** A fresh random value, base64url: `bytes` of entropy. */
+export function random(bytes = 32) {
+    return base64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+/** The PKCE S256 challenge of a verifier. */
+export async function challengeOf(verifier) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return base64url(new Uint8Array(digest));
+}

package/dist/node_modules/chatgpt/dist/src/file-store.d.ts

@@ -0,0 +1,9 @@
+import type { Log } from "@agentorg/sdk";
+import type { Store } from "./account.js";
+/**
+ * The sign-in, in one private file, read each time so nothing is held that the file no longer says.
+ * Each change is on disk before it is acknowledged, since a refresh token that rotated can't be had
+ * again. A file that can't be read is removed, and the person signs in again; nothing of it is ever
+ * logged, a parse error's text included.
+ */
+export declare function fileStore(dir: string, log: Log): Store;