@detergent-software/conductor 2.0.0-dev.1 → 2.0.0

package/build/config.js

@@ -49,18 +49,32 @@ export const BUILT_IN_PROFILES = {
         { kinds: ['npm-otp', 'permission', 'failed', 'conflict', 'operator', 'login'], to: ['remote-control', 'pushover'] },
     ],
 };
-// The accounts one project's provider calls use (credentials.ts). Each is optional: without it,
-// the machine's own login (az's default account, gh's active account, the machine's Linear key).
+// The credentials one project's provider calls use (credentials.ts), least privilege first: `token`
+// (Linear's `credential`) names the generic credential (Credential Manager) whose password is a token
+// scoped to this project, and wins over the machine's token and over the CLI login. `tenant` and
+// `user` pick the CLI login (az's tenant, gh's account) when there is no token. Each is optional.
 // The tenant reaches `az` through a shell on Windows, so it is a tenant id or domain and nothing else.
+const credentialTarget = z.string().trim().min(1);
 const projectAccountsSchema = z.strictObject({
     ado: z
-        .strictObject({ tenant: z.string().regex(/^[\w-]+(\.[\w-]+)*$/, 'a tenant id or domain, such as contoso.com') })
+        .strictObject({
+        tenant: z
+            .string()
+            .regex(/^[\w-]+(\.[\w-]+)*$/, 'a tenant id or domain, such as contoso.com')
+            .optional(),
+        token: credentialTarget.optional(),
+    })
         .optional(),
     github: z
-        .strictObject({ user: z.string().regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/, 'a GitHub user name') })
+        .strictObject({
+        token: credentialTarget.optional(),
+        user: z
+            .string()
+            .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/, 'a GitHub user name')
+            .optional(),
+    })
         .optional(),
-    // The generic credential (Credential Manager) whose password is the project's Linear key.
-    linear: z.strictObject({ credential: z.string().trim().min(1) }).optional(),
+    linear: z.strictObject({ credential: credentialTarget }).optional(),
 });
 // ~/.conductor/config.json: machine settings. Strict, so a misspelt key fails startup instead of
 // being ignored. Rules live beside it, in rules.json (rules-service.ts).

package/build/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,kGAAkG;AAClG,+DAA+D;AAC/D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAU,CAAC;AAGhE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAE/E,sCAAsC;AACtC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,EAAE,sCAAsC,CAAC,CAAC;AAExG,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAEH,kGAAkG;AAClG,sGAAsG;AACtG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,qFAAqF;IACrF,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,mDAAmD,EAAE,iDAAiD,CAAC;SAC7G,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;QAClB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,yBAAyB,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAChH,CAAC;KACF,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;CAC9B,CAAC,CAAC;AAIH,uGAAuG;AACvG,gGAAgG;AAChG,kGAAkG;AAClG,sGAAsG;AACtG,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAoD;IAChF,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5B,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,CAAC;IACjD,KAAK,EAAE;QACL,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE;KACpH;CACF,CAAC;AAEF,gGAAgG;AAChG,iGAAiG;AACjG,uGAAuG;AACvG,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,GAAG,EAAE,CAAC;SACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,EAAE,CAAC;SAC/G,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4CAA4C,EAAE,oBAAoB,CAAC,EAAE,CAAC;SAC5G,QAAQ,EAAE;IACb,0FAA0F;IAC1F,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5E,CAAC,CAAC;AAEH,iGAAiG;AACjG,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,mEAAmE;IACnE,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC;QACZ,uFAAuF;QACvF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,sFAAsF;QACtF,iEAAiE;QACjE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;KAC5D,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,sCAAsC;IACtC,KAAK,EAAE,CAAC;SACL,YAAY,CAAC;QACZ,6FAA6F;QAC7F,4FAA4F;QAC5F,oFAAoF;QACpF,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KACjD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,CAAC;SACH,YAAY,CAAC;QACZ,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,QAAQ,EAAE,CAAC;aACR,GAAG,EAAE;aACL,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC;aACd,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;KAC5B,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,YAAY,CAAC;QACZ,8FAA8F;QAC9F,0EAA0E;QAC1E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,4DAA4D;QAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,QAAQ,EAAE,CAAC;aACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,EACnF,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAC1B;aACA,OAAO,CAAC,EAAE,CAAC;QACd,+FAA+F;QAC/F,8EAA8E;QAC9E,QAAQ,EAAE,CAAC;aACR,YAAY,CAAC;YACZ,+FAA+F;YAC/F,0EAA0E;YAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YACxC,2FAA2F;YAC3F,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5C,CAAC;aACD,QAAQ,CAAC,EAAE,CAAC;QACf,0EAA0E;QAC1E,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,oFAAoF;QACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACpD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;QAClG,OAAO,EAAE,kEAAkE;QAC3E,IAAI,EAAE,CAAC,SAAS,CAAC;KAClB,CAAC;IACJ,iGAAiG;IACjG,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjG,yFAAyF;IACzF,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,8FAA8F;IAC9F,sFAAsF;IACtF,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,EAAE,qBAAqB,CAAC;SACjH,OAAO,CAAC,EAAE,CAAC;IACd,gGAAgG;IAChG,0EAA0E;IAC1E,UAAU,EAAE,CAAC;SACV,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;SACjF,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;IAChB,qEAAqE;IACrE,SAAS,EAAE,CAAC;SACT,YAAY,CAAC;QACZ,0FAA0F;QAC1F,iEAAiE;QACjE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/C,6FAA6F;QAC7F,iFAAiF;QACjF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,4FAA4F;QAC5F,8DAA8D;QAC9D,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,8CAA8C;QAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACvD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,gDAAgD;IAChD,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC;QACZ,gGAAgG;QAChG,8FAA8F;QAC9F,8CAA8C;QAC9C,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC9C,0CAA0C;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,iDAAiD;QACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,+DAA+D;QAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,6FAA6F;QAC7F,sDAAsD;QACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACrD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,+FAA+F;IAC/F,oGAAoG;IACpG,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC;QACZ,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACpB,8FAA8F;QAC9F,yCAAyC;QACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACvB,sFAAsF;QACtF,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACvB,iGAAiG;QACjG,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACpB,4EAA4E;QAC5E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACtD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,OAAO,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,eAAuB,EAAE,SAAiB;IACzD,OAAO,CAAC;SACL,YAAY,CAAC;QACZ,mFAAmF;QACnF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACrE,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KACtD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,kGAAkG;AAClG,+DAA+D;AAC/D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAU,CAAC;AAGhE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAE/E,sCAAsC;AACtC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,EAAE,sCAAsC,CAAC,CAAC;AAExG,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAEH,kGAAkG;AAClG,sGAAsG;AACtG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,qFAAqF;IACrF,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,mDAAmD,EAAE,iDAAiD,CAAC;SAC7G,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;QAClB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,yBAAyB,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAChH,CAAC;KACF,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;CAC9B,CAAC,CAAC;AAIH,uGAAuG;AACvG,gGAAgG;AAChG,kGAAkG;AAClG,sGAAsG;AACtG,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAoD;IAChF,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5B,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,CAAC;IACjD,KAAK,EAAE;QACL,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE;KACpH;CACF,CAAC;AAEF,oGAAoG;AACpG,sGAAsG;AACtG,iGAAiG;AACjG,kGAAkG;AAClG,uGAAuG;AACvG,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClD,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,GAAG,EAAE,CAAC;SACH,YAAY,CAAC;QACZ,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,KAAK,CAAC,qBAAqB,EAAE,4CAA4C,CAAC;aAC1E,QAAQ,EAAE;QACb,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE;KACnC,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,YAAY,CAAC;QACZ,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QAClC,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,KAAK,CAAC,4CAA4C,EAAE,oBAAoB,CAAC;aACzE,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAEH,iGAAiG;AACjG,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,mEAAmE;IACnE,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC;QACZ,uFAAuF;QACvF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,sFAAsF;QACtF,iEAAiE;QACjE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;KAC5D,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,sCAAsC;IACtC,KAAK,EAAE,CAAC;SACL,YAAY,CAAC;QACZ,6FAA6F;QAC7F,4FAA4F;QAC5F,oFAAoF;QACpF,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KACjD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,CAAC;SACH,YAAY,CAAC;QACZ,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,QAAQ,EAAE,CAAC;aACR,GAAG,EAAE;aACL,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC;aACd,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;KAC5B,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,YAAY,CAAC;QACZ,8FAA8F;QAC9F,0EAA0E;QAC1E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,4DAA4D;QAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,QAAQ,EAAE,CAAC;aACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,EACnF,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAC1B;aACA,OAAO,CAAC,EAAE,CAAC;QACd,+FAA+F;QAC/F,8EAA8E;QAC9E,QAAQ,EAAE,CAAC;aACR,YAAY,CAAC;YACZ,+FAA+F;YAC/F,0EAA0E;YAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;YACxC,2FAA2F;YAC3F,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5C,CAAC;aACD,QAAQ,CAAC,EAAE,CAAC;QACf,0EAA0E;QAC1E,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,oFAAoF;QACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACpD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;QAClG,OAAO,EAAE,kEAAkE;QAC3E,IAAI,EAAE,CAAC,SAAS,CAAC;KAClB,CAAC;IACJ,iGAAiG;IACjG,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjG,yFAAyF;IACzF,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,8FAA8F;IAC9F,sFAAsF;IACtF,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,EAAE,qBAAqB,CAAC;SACjH,OAAO,CAAC,EAAE,CAAC;IACd,gGAAgG;IAChG,0EAA0E;IAC1E,UAAU,EAAE,CAAC;SACV,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;SACjF,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;IAChB,qEAAqE;IACrE,SAAS,EAAE,CAAC;SACT,YAAY,CAAC;QACZ,0FAA0F;QAC1F,iEAAiE;QACjE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/C,6FAA6F;QAC7F,iFAAiF;QACjF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,4FAA4F;QAC5F,8DAA8D;QAC9D,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,8CAA8C;QAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACvD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,gDAAgD;IAChD,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC;QACZ,gGAAgG;QAChG,8FAA8F;QAC9F,8CAA8C;QAC9C,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC9C,0CAA0C;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,iDAAiD;QACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,+DAA+D;QAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,6FAA6F;QAC7F,sDAAsD;QACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACrD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,+FAA+F;IAC/F,oGAAoG;IACpG,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC;QACZ,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACpB,8FAA8F;QAC9F,yCAAyC;QACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACvB,sFAAsF;QACtF,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACvB,iGAAiG;QACjG,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;QACpB,4EAA4E;QAC5E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACtD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,OAAO,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,eAAuB,EAAE,SAAiB;IACzD,OAAO,CAAC;SACL,YAAY,CAAC;QACZ,mFAAmF;QACnF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACrE,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KACtD,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/build/credential.js

@@ -29,10 +29,20 @@ try {
 } finally { [AtkConduct.Cred]::CredFree($p) }
 } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 4 }
 `;
+export async function credentialSaved(target, env = process.env) {
+    if (process.platform !== 'win32')
+        return 'missing';
+    const result = await run('cmdkey', [`/list:${target}`], { env, timeoutMs: 15_000 });
+    if (result.code !== 0)
+        return 'unknown';
+    if (/\*\s*NONE\s*\*/.test(result.stdout))
+        return 'missing';
+    return /^\s*Target:/m.test(result.stdout) ? 'saved' : 'unknown';
+}
 // Reads the generic credential `target`. Windows only.
 export async function readCredential(target, env = process.env) {
     if (process.platform !== 'win32')
-        return { found: false, reason: `the ${target} credential is Windows-only` };
+        return { found: false, missing: true, reason: `the ${target} credential is Windows-only` };
     const result = await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(CRED_READ, 'utf16le').toString('base64')], { env: { ...env, ATK_CONDUCT_CRED_TARGET: target }, timeoutMs: 30_000 });
     if (result.code === 0) {
         const newline = result.stdout.indexOf('\n');
@@ -41,7 +51,7 @@ export async function readCredential(target, env = process.env) {
             return { credential: { secret, user: result.stdout.slice(0, newline).trim() }, found: true };
     }
     if (result.code === NOT_FOUND)
-        return { found: false, reason: `no credential ${target}` };
+        return { found: false, missing: true, reason: `no credential ${target}` };
     // Never echo stdout here: on a partial failure it could hold the secret.
     const line = result.stderr
         .split(/\r?\n/)
@@ -49,6 +59,7 @@ export async function readCredential(target, env = process.env) {
         .find((l) => l && !l.startsWith('#< CLIXML') && !l.startsWith('<Objs'));
     return {
         found: false,
+        missing: false,
         reason: `the credential ${target} couldn't be read (${result.error ?? line ?? `exit ${result.code}`})`,
     };
 }

package/build/credential.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential.js","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAY/B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,8FAA8F;AAC9F,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,sDAAsD;AACtD,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;kBAgBA,eAAe,YAAY,SAAS;;;;;;;;;CASrD,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACvF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,MAAM,6BAA6B,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAC1G,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CACxE,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,OAAO,IAAI,CAAC,IAAI,MAAM;YACxB,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,EAAE,EAAE,CAAC;IAC1F,yEAAyE;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM;SACvB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,kBAAkB,MAAM,sBAAsB,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,QAAQ,MAAM,CAAC,IAAI,EAAE,GAAG;KACvG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAe/B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,8FAA8F;AAC9F,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,sDAAsD;AACtD,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;kBAgBA,eAAe,YAAY,SAAS;;;;;;;;;CASrD,CAAC;AAMF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACvF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,MAAM,6BAA6B,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAC1G,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CACxE,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,OAAO,IAAI,CAAC,IAAI,MAAM;YACxB,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,MAAM,EAAE,EAAE,CAAC;IACzG,yEAAyE;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM;SACvB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,kBAAkB,MAAM,sBAAsB,MAAM,CAAC,KAAK,IAAI,IAAI,IAAI,QAAQ,MAAM,CAAC,IAAI,EAAE,GAAG;KACvG,CAAC;AACJ,CAAC"}

package/build/credentials.js

@@ -1,19 +1,35 @@
-import { readCredential as readWindowsCredential } from "./credential.js";
+import { credentialSaved, readCredential as readWindowsCredential, } from "./credential.js";
 import { ConductorError } from "./errors.js";
-import { NotFound } from "./lib/providers/index.js";
+import { adoBasic, adoOrgUrl, NotFound } from "./lib/providers/index.js";
 import { outputOf, run as runCommand } from "./run.js";
-// Each project's accounts (providers design note, section 6): which az tenant, gh account and
-// Linear key its provider calls use, from machine config (`projects.<name>`), else the machine's
-// own logins. A login that stops working is a spell: one `lost` change when it starts, one
+// Each project's credentials (design note v2, section 8): every provider takes the first credential
+// it finds, least privilege first.
+//   1. project-token: a token scoped to the project, in the generic credential that machine config
+//      names (`projects.<name>.ado.token`, `github.token`, `linear.credential`);
+//   2. machine-token: the machine's own token, from a conductor-only env var or generic credential
+//      (MACHINE_TOKENS), so another tool's env never changes what the conductor signs in as;
+//   3. cli-login: `az` (the project's tenant, else the default account) or `gh` (the project's user,
+//      else the active account), last because it usually carries the widest permissions. Linear has
+//      none.
+// Found means there: a token that is there but refused is a lost login, never a quiet fall back to a
+// wider credential. A login that stops working is a spell: one `lost` change when it starts, one
 // `restored` when a call or a probe works again.
 export const PROVIDERS = ['ado', 'github', 'linear'];
+export const SOURCES = ['project-token', 'machine-token', 'cli-login'];
 // Azure DevOps' resource id, for `az account get-access-token`.
 const ADO_RESOURCE = '499b84ac-1321-427f-aa17-267ca6975798';
-// An az token lasts about an hour, a gh token until it is revoked; both are asked again well before.
+// An az token lasts about an hour, a gh token until it is revoked; both are asked again well before,
+// and a token's credential is read again as often, so a replaced or removed one is seen.
 const TOKEN_MAX_AGE_MS = 20 * 60_000;
 export const LINEAR_CREDENTIAL = 'atk-conductor-linear';
-// The id of the machine's own login. No tenant, gh user or credential target in config can be it:
-// the schema allows no parentheses in the first two, and a target that spelt it would be odd.
+// The machine's own token for each provider: the env vars in order, then the generic credential.
+export const MACHINE_TOKENS = {
+    ado: { credential: 'conductor-ado', env: ['CONDUCTOR_ADO_TOKEN'] },
+    github: { credential: 'conductor-github', env: ['CONDUCTOR_GITHUB_TOKEN'] },
+    linear: { credential: LINEAR_CREDENTIAL, env: ['CONDUCTOR_LINEAR_KEY', 'LINEAR_API_KEY'] },
+};
+// The id of the machine's own credentials. No tenant, gh user or credential target in config can be
+// it: the schema allows no parentheses in the first two, and a target that spelt it would be odd.
 export const MACHINE = '(machine)';
 const LINEAR_API = 'https://api.linear.app/graphql';
 const TIMEOUT_MS = 20_000;
@@ -37,28 +53,39 @@ export class LoginNeeded extends ConductorError {
 export function loginText(account, project) {
     return `${account.provider} login lost${project === null ? '' : ` for ${project}`} (${account.label})`;
 }
+// The generic credential the machine's own token is saved under. For Linear,
+// ATK_CONDUCT_LINEAR_CREDENTIAL names another, as in conduct-atk.
+export function machineTarget(provider, env) {
+    if (provider === 'linear')
+        return env.ATK_CONDUCT_LINEAR_CREDENTIAL?.trim() || LINEAR_CREDENTIAL;
+    return MACHINE_TOKENS[provider].credential;
+}
 export function providerCredentials(deps) {
     const env = deps.env ?? process.env;
     const fetcher = deps.fetch ?? globalThis.fetch;
     const now = deps.now ?? Date.now;
     const exec = deps.run ?? runCommand;
     const read = deps.readCredential ?? readWindowsCredential;
+    // A seam that reads credentials but checks none is asked for every target.
+    const isSaved = deps.credentialSaved ?? (deps.readCredential ? async () => 'unknown' : credentialSaved);
     const lostNow = new Map();
-    // Each account's token or key, shared by every project on it. The calls that read them name
-    // their own project, so a lost login is put on the project whose call found it.
+    // Each identity's authorization (ADO's header value, gh's token, Linear's key) and the source it
+    // came from, shared by every project with that identity. The calls that read them name their own
+    // project, so a lost login is put on the project whose call found it.
     const adoTokens = new Map();
     const ghTokens = new Map();
     const linearKeys = new Map();
-    const spell = (account) => `${account.provider}:${account.id}`;
+    const foundAs = new Map();
+    const key = (account) => `${account.provider}:${account.id}`;
     const failed = (account, project, error) => {
-        if (!lostNow.has(spell(account))) {
-            lostNow.set(spell(account), { account, error, project });
+        if (!lostNow.has(key(account))) {
+            lostNow.set(key(account), { account, error, project });
             deps.onChange?.({ account, error, kind: 'lost', project });
         }
         return new LoginNeeded(account, project, error);
     };
     const worked = (account, project) => {
-        if (!lostNow.delete(spell(account)))
+        if (!lostNow.delete(key(account)))
             return;
         deps.onChange?.({ account, error: null, kind: 'restored', project });
     };
@@ -66,82 +93,167 @@ export function providerCredentials(deps) {
     // a login wait): every other call fails at once, so a pass with many waits on the account runs
     // no `az`, `gh` or Linear request for it. The re-probe is the spell's back-off.
     const refuseWhileLost = (account, project, probing) => {
-        const lost = probing ? undefined : lostNow.get(spell(account));
+        const lost = probing ? undefined : lostNow.get(key(account));
         if (lost)
-            throw new LoginNeeded(account, project, lost.error);
+            throw new LoginNeeded(lost.account, project, lost.error);
     };
-    const account = (provider, project) => {
+    // The project's credentials as machine config names them, before any is read: its token when it
+    // names one, else its CLI login (Linear: the machine's key), with no source yet.
+    const configured = (provider, project) => {
         const entry = project === null ? undefined : deps.projects[project];
+        const target = provider === 'linear' ? entry?.linear?.credential : entry?.[provider]?.token;
+        if (target !== undefined)
+            return tokenAccount(provider, target, target, 'project-token');
         switch (provider) {
             case 'ado': {
                 const tenant = entry?.ado?.tenant ?? null;
                 return tenant === null
-                    ? { command: 'az login', id: MACHINE, label: "az's default account", provider }
-                    : { command: `az login --tenant ${tenant}`, id: tenant, label: `az tenant ${tenant}`, provider };
+                    ? { command: 'az login', id: MACHINE, label: "az's default account", provider, source: null }
+                    : {
+                        command: `az login --tenant ${tenant}`,
+                        id: tenant,
+                        label: `az tenant ${tenant}`,
+                        provider,
+                        source: null,
+                    };
             }
             case 'github': {
                 const user = entry?.github?.user ?? null;
                 return user === null
-                    ? { command: 'gh auth login', id: MACHINE, label: "gh's active account", provider }
-                    : { command: 'gh auth login', id: user, label: `gh account ${user}`, provider };
+                    ? { command: 'gh auth login', id: MACHINE, label: "gh's active account", provider, source: null }
+                    : { command: 'gh auth login', id: user, label: `gh account ${user}`, provider, source: null };
             }
             case 'linear': {
-                const target = entry?.linear?.credential ?? null;
-                const shown = target ?? defaultLinearTarget(env);
+                const shown = machineTarget('linear', env);
                 return {
                     command: `cmdkey /generic:${shown} /user:linear /pass`,
-                    id: target ?? MACHINE,
-                    label: target === null ? `LINEAR_API_KEY or credential ${shown}` : `credential ${target}`,
+                    id: MACHINE,
+                    label: `${MACHINE_TOKENS.linear.env.join(', ')} or credential ${shown}`,
                     provider,
+                    source: null,
                 };
             }
         }
     };
-    // The az token for the project's tenant, kept 20 minutes.
+    // The account as last found: the configured identity with its source's words.
+    const account = (provider, project) => {
+        const base = configured(provider, project);
+        return foundAs.get(key(base)) ?? base;
+    };
+    // The first credential the project has, in the order above. Throws LoginNeeded for a project
+    // token or a machine credential that is named but can't be read, and for Linear with no key.
+    const find = async (provider, project) => {
+        const base = configured(provider, project);
+        const as = (found) => ({ ...found, id: base.id });
+        if (base.source === 'project-token') {
+            const got = await read(base.id, env);
+            if (!got.found)
+                throw failed(base, project, got.reason);
+            return { account: base, token: got.credential.secret };
+        }
+        // A project that names its own CLI account (an az tenant, a gh user) keeps it: the machine's
+        // token is another identity, which may not even reach the project's organization.
+        const cli = { account: { ...base, source: 'cli-login' }, token: null };
+        if (base.id !== MACHINE && provider !== 'linear')
+            return cli;
+        const machine = MACHINE_TOKENS[provider];
+        for (const name of machine.env) {
+            const value = env[name]?.trim();
+            if (value) {
+                const command = `set ${name} to a working token, or unset it`;
+                return { account: as({ command, id: MACHINE, label: name, provider, source: 'machine-token' }), token: value };
+            }
+        }
+        // The machine's credential is optional: one that isn't saved, or can't be read, is passed over
+        // (the cheap cmdkey check first, so the usual case starts no PowerShell). Linear has nothing
+        // after it.
+        const target = machineTarget(provider, env);
+        const stored = as(tokenAccount(provider, target, MACHINE, 'machine-token'));
+        const saved = await isSaved(target, env);
+        const got = saved === 'missing' ? null : await read(target, env);
+        if (got?.found)
+            return { account: stored, token: got.credential.secret };
+        if (provider === 'linear') {
+            throw failed(base, project, `no ${machine.env.join(' or ')}, and ${got?.reason ?? `no credential ${target}`}`);
+        }
+        return cli;
+    };
+    const remember = (found) => {
+        foundAs.set(key(found.account), found.account);
+        return found.account;
+    };
+    // The ADO authorization for the project, kept 20 minutes: a token as Basic, else az's as Bearer.
     const adoToken = async (project, fresh, probing) => {
-        const which = account('ado', project);
-        refuseWhileLost(which, project, probing);
-        const cached = adoTokens.get(which.id);
+        const known = account('ado', project);
+        refuseWhileLost(known, project, probing);
+        const cached = adoTokens.get(known.id);
         if (!fresh && cached && now() - cached.at < TOKEN_MAX_AGE_MS)
             return cached.value;
-        const tenant = which.id === MACHINE ? [] : ['--tenant', which.id];
-        // `az` is a .cmd on Windows, so it runs through a shell; its arguments are constants and
-        // the tenant id from machine config, which the config schema keeps to an id or a domain.
-        const result = await exec('az', ['account', 'get-access-token', '--resource', ADO_RESOURCE, ...tenant, '--query', 'accessToken', '-o', 'tsv'], { shell: process.platform === 'win32', timeoutMs: 60_000 });
-        const value = result.stdout.trim();
-        if (result.code !== 0 || !value) {
-            throw failed(which, project, `az account get-access-token failed: ${outputOf(result, 300)}`);
+        const found = await find('ado', project);
+        const which = remember(found);
+        let value;
+        if (found.token !== null)
+            value = adoBasic(found.token);
+        else {
+            const tenant = which.id === MACHINE ? [] : ['--tenant', which.id];
+            // `az` is a .cmd on Windows, so it runs through a shell; its arguments are constants and
+            // the tenant id from machine config, which the config schema keeps to an id or a domain.
+            const result = await exec('az', ['account', 'get-access-token', '--resource', ADO_RESOURCE, ...tenant, '--query', 'accessToken', '-o', 'tsv'], { shell: process.platform === 'win32', timeoutMs: 60_000 });
+            const token = result.stdout.trim();
+            if (result.code !== 0 || !token) {
+                throw failed(which, project, `az account get-access-token failed: ${outputOf(result, 300)}`);
+            }
+            // A token from az works: az said so. A PAT's spell ends only when a probe sees ADO take it.
+            worked(which, project);
+            value = `Bearer ${token}`;
         }
-        worked(which, project);
         adoTokens.set(which.id, { at: now(), value });
         return value;
     };
-    const ado = (project) => (fresh) => adoToken(project, fresh, false);
-    const ghToken = async (which, project, fresh) => {
-        const cached = ghTokens.get(which.id);
+    const ado = (project) => async (fresh) => {
+        const known = account('ado', project);
+        const sent = adoTokens.get(known.id)?.value;
+        // ADO refused the PAT it was sent (401, or 203: its sign-in page). The credential is read
+        // again, so a replaced PAT is tried; the same one is refused again, so that is a lost login
+        // on it. az's token is renewed instead.
+        if (fresh && sent !== undefined && known.source !== null && known.source !== 'cli-login') {
+            const value = await adoToken(project, true, false);
+            if (value !== sent)
+                return value;
+            adoTokens.delete(known.id);
+            throw failed(account('ado', project), project, 'Azure DevOps refused the token (HTTP 401 or 203)');
+        }
+        return adoToken(project, fresh, false);
+    };
+    const ghToken = async (project, fresh) => {
+        const known = account('github', project);
+        const cached = ghTokens.get(known.id);
         if (!fresh && cached && now() - cached.at < TOKEN_MAX_AGE_MS)
-            return cached.value;
-        const user = which.id === MACHINE ? [] : ['--user', which.id];
-        const result = await exec('gh', ['auth', 'token', ...user], { env, timeoutMs: 30_000 });
-        const value = result.stdout.trim();
-        if (result.code !== 0 || !value)
-            throw failed(which, project, `gh auth token failed: ${outputOf(result, 300)}`);
-        ghTokens.set(which.id, { at: now(), value });
-        return value;
+            return { account: known, token: cached.value };
+        const found = await find('github', project);
+        const which = remember(found);
+        let token = found.token;
+        if (token === null) {
+            const user = which.id === MACHINE ? [] : ['--user', which.id];
+            const result = await exec('gh', ['auth', 'token', ...user], { env, timeoutMs: 30_000 });
+            token = result.stdout.trim();
+            if (result.code !== 0 || !token)
+                throw failed(which, project, `gh auth token failed: ${outputOf(result, 300)}`);
+        }
+        ghTokens.set(which.id, { at: now(), value: token });
+        return { account: which, token };
     };
-    // Each call runs `gh api` with the account's token in GH_TOKEN, so a project's gh user needs no
-    // `gh auth switch`. A 401 asks gh for the token again once; a second is a lost login. Only an
-    // answer from GitHub (success, or an HTTP status other than 401) says the token works: a
-    // timeout or a network error says nothing about the login.
-    // One gh command as the project's account: a 401 asks gh for the token again once (GitHub did
-    // nothing, so a write is safe to send again), and a second is a lost login. The result, with what
-    // gh said when it failed.
+    // One gh command as the project's credential, its token in GH_TOKEN, so a project's gh user needs
+    // no `gh auth switch`. A 401 asks for the token again once (GitHub did nothing, so a write is safe
+    // to send again), and a second is a lost login. Only an answer from GitHub (success, or an HTTP
+    // status other than 401) says the token works: a timeout or a network error says nothing about
+    // the login. The result, with what gh said when it failed.
     const ghExec = async (project, args, { input, probing = false, timeoutMs = 60_000 } = {}) => {
-        const which = account('github', project);
-        refuseWhileLost(which, project, probing);
+        refuseWhileLost(account('github', project), project, probing);
         for (let fresh = probing;; fresh = true) {
+            const { account: which, token } = await ghToken(project, fresh);
             const result = await exec('gh', args, {
-                env: { ...env, GH_TOKEN: await ghToken(which, project, fresh) },
+                env: { ...env, GH_TOKEN: token },
                 ...(input === undefined ? {} : { input }),
                 timeoutMs,
             });
@@ -172,52 +284,82 @@ export function providerCredentials(deps) {
     };
     const gh = (project) => (path) => ghApi(project, path);
     const ghWrite = (project) => (method, path, body) => ghApi(project, path, { body, method });
-    // Another gh command as the project's account, such as `run view --log-failed`; its output.
+    // Another gh command as the project's credential, such as `run view --log-failed`; its output.
     const ghRun = (project) => async (args) => {
         const { result, said } = await ghExec(project, args, { timeoutMs: 120_000 });
         if (result.code !== 0)
             throw new Error(`gh ${args.join(' ')} failed: ${said}`);
         return result.stdout;
     };
-    // The project's Linear key, kept per credential target. The key is only returned: never logged,
-    // stored or put on a command line.
-    const linear = (project, probing = false) => {
-        const which = account('linear', project);
-        return {
-            account: which,
-            key: async (fresh = false) => {
-                refuseWhileLost(which, project, probing);
-                const cached = linearKeys.get(which.id);
-                if (!fresh && cached !== undefined)
-                    return cached;
-                const found = await readLinearKey(which, env, read);
-                if (found.key === null)
-                    throw failed(which, project, found.reason);
-                linearKeys.set(which.id, found.key);
-                return found.key;
-            },
-            refused: (detail) => {
-                linearKeys.delete(which.id);
-                return failed(which, project, detail);
-            },
-            worked: () => worked(which, project),
-        };
-    };
+    // The project's Linear key, kept per identity. The key is only returned: never logged, stored or
+    // put on a command line.
+    const linear = (project, probing = false) => ({
+        get account() {
+            return account('linear', project);
+        },
+        key: async (fresh = false) => {
+            const known = account('linear', project);
+            refuseWhileLost(known, project, probing);
+            const cached = linearKeys.get(known.id);
+            if (!fresh && cached !== undefined)
+                return cached;
+            const found = await find('linear', project);
+            const which = remember(found);
+            // find gives Linear a key or throws: it has no CLI login.
+            if (found.token === null)
+                throw failed(which, project, 'no Linear key');
+            linearKeys.set(which.id, found.token);
+            return found.token;
+        },
+        refused: (detail) => {
+            const known = account('linear', project);
+            linearKeys.delete(known.id);
+            return failed(known, project, detail);
+        },
+        worked: () => worked(account('linear', project), project),
+    });
     const probe = async (provider, project) => {
-        const which = account(provider, project);
         try {
             if (provider === 'ado')
-                await adoToken(project, true, true);
+                await probeAdo(project);
             else if (provider === 'github')
                 await ghApi(project, 'user', { probing: true });
             else
                 await probeLinear(linear(project, true));
-            return { account: which, error: null };
+            return { account: account(provider, project), error: null };
         }
         catch (error) {
-            return { account: which, error: error instanceof Error ? error.message : String(error) };
+            return {
+                account: error instanceof LoginNeeded ? error.account : account(provider, project),
+                error: error instanceof Error ? error.message : String(error),
+            };
         }
     };
+    // A fresh ADO credential. az vouches for its own token; a token is asked who it is on the project's
+    // organization, which is the only way to learn ADO takes it (it answers 401, or 203 with its
+    // sign-in page, when it doesn't).
+    const probeAdo = async (project) => {
+        adoTokens.delete(account('ado', project).id);
+        const value = await adoToken(project, true, true);
+        const which = account('ado', project);
+        if (which.source === 'cli-login')
+            return;
+        const organization = deps.adoOrganization?.(project) ?? null;
+        if (organization === null)
+            throw new Error('no Azure DevOps organization to ask whether it takes the token');
+        const response = await fetcher(adoOrgUrl({ organization }, 'connectionData', '7.1-preview'), {
+            headers: { authorization: value },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        await response.body?.cancel();
+        if (response.status === 401 || response.status === 203) {
+            adoTokens.delete(which.id);
+            throw failed(which, project, `Azure DevOps refused the token (HTTP ${response.status})`);
+        }
+        if (!response.ok)
+            throw new Error(`Azure DevOps answered ${response.status}`);
+        worked(which, project);
+    };
     const probeLinear = async (auth) => {
         const secret = await auth.key(true);
         const response = await fetcher(deps.linearUrl ?? LINEAR_API, {
@@ -243,22 +385,16 @@ export function providerCredentials(deps) {
         probe,
     };
 }
-// The target the machine's own Linear key is saved under: ATK_CONDUCT_LINEAR_CREDENTIAL names
-// another, as in conduct-atk.
-function defaultLinearTarget(env) {
-    return env.ATK_CONDUCT_LINEAR_CREDENTIAL?.trim() || LINEAR_CREDENTIAL;
-}
-// A project's own credential target, else LINEAR_API_KEY, then the machine's target (ATK-272).
-async function readLinearKey(which, env, read) {
-    if (which.id === MACHINE) {
-        const fromEnv = env.LINEAR_API_KEY?.trim();
-        if (fromEnv)
-            return { key: fromEnv };
-    }
-    const target = which.id === MACHINE ? defaultLinearTarget(env) : which.id;
-    const found = await read(target, env);
-    if (found.found)
-        return { key: found.credential.secret };
-    return { key: null, reason: which.id === MACHINE ? `no LINEAR_API_KEY, and ${found.reason}` : found.reason };
+// The account of a token in the generic credential `target`.
+function tokenAccount(provider, target, id, source) {
+    const user = provider === 'linear' ? 'linear' : 'pat';
+    const whose = source === 'project-token' ? 'project token' : 'machine token';
+    return {
+        command: `cmdkey /generic:${target} /user:${user} /pass`,
+        id,
+        label: `${whose} in credential ${target}`,
+        provider,
+        source,
+    };
 }
 //# sourceMappingURL=credentials.js.map