@huaweidevtools/aishell-dsh-credentials-store 0.0.15 → 0.0.16

package/lib/accounts.d.ts

@@ -1,6 +1,6 @@
-import "./scope-CFetnbG3.js";
-import { CredentialsStore } from "./index-JlyJE1E8.js";
-import { SignCredentials } from "./signer-Et0DIH6o.js";
+import "./scope-C7w2eTvE.js";
+import { CredentialsStore } from "./index-Cdsu1kDC.js";
+import { SignCredentials } from "./signer-Bx88x7dI.js";
 
 //#region src/accounts.d.ts
 /**
@@ -18,18 +18,22 @@ import { SignCredentials } from "./signer-Et0DIH6o.js";
  */
 declare const CREDENTIAL_ACCOUNT = "aishell-credential";
 /**
- * Entries written by the earlier three-key layout, in the order they are read
- * during migration.
+ * The per-field account names a store may still hold beside the bundle.
  *
- * Kept only so an existing install keeps working: see {@link readCredentials}.
- * New writes never touch these.
+ * These are the read-side names of a store written field-by-field instead of
+ * as one record. {@link readCredentials} folds them into
+ * {@link CREDENTIAL_ACCOUNT} on first read, so a machine that holds them keeps
+ * working; nothing writes them.
+ *
+ * The order is the order the migration reads them: access key, secret key,
+ * token.
  */
 declare const LEGACY_ACCOUNTS: readonly ["HW_ACCESS_KEY", "HW_SECRET_KEY", "HW_SECURITY_TOKEN"];
 /**
- * The legacy entry holding an e2b API key on its own.
+ * The standalone e2b key entry, beside the per-field names above.
  *
- * Folded into the bundle by {@link readCredentials}. Kept as a constant because
- * the migration has to name it.
+ * Folded into the bundle by {@link readCredentials}, for the same reason: a
+ * store written before the bundle existed keeps working. Nothing writes it.
  */
 declare const LEGACY_E2B_ACCOUNT = "AISHELL_E2B_API_KEY";
 /** The Huawei Cloud pair, as the bundle stores it. Snake-case on disk. */
@@ -81,12 +85,12 @@ declare function encodeBundle(bundle: CredentialBundle): string;
  */
 declare function decodeBundle(raw: string | undefined): CredentialBundle;
 /**
- * Read the whole bundle, migrating a legacy layout on the way.
+ * Read the whole bundle, folding a per-field store into it on the way.
  *
- * Migration is lazy and idempotent: the first read that finds no bundle but
- * finds legacy entries merges them into one record, writes it, and removes the
- * old entries. A failed write leaves the legacy entries alone, so the next read
- * tries again — the person is never left with neither layout.
+ * The fold is lazy and idempotent: a read that finds no bundle but finds the
+ * per-field names merges them into one record, writes it, and removes the old
+ * entries. A failed write leaves them in place so the next read tries again —
+ * a store is never left with neither layout.
  *
  * @param store - the caller's credential store.
  * @returns the bundle; empty when nothing is stored.
@@ -135,11 +139,11 @@ declare function readE2BKey(store: CredentialsStore): E2BSection | undefined;
  */
 declare function updateCredentials(store: CredentialsStore, update: (current: CredentialBundle) => CredentialBundle | undefined): CredentialBundle;
 /**
- * Store the Huawei Cloud pair, replacing any previous one.
+ * Store the Huawei Cloud pair, replacing whatever is there.
  *
  * One write, so the pair can never be left half-replaced. A save without a
- * token removes a previously stored one: a token belongs to the credential set
- * that carried it, and inheriting a stale one would sign the next request with
+ * token removes a stored one: a token belongs to the credential set that
+ * carried it, and inheriting a stale one would sign the next request with
  * someone else's session.
  *
  * @param store - the caller's credential store.
@@ -164,10 +168,17 @@ declare function clearE2BKey(store: CredentialsStore): void;
  *
  * The whole record goes, so a clear cannot leave a token or a key behind for
  * the next pair to inherit. Deleting an absent entry is a no-op in every
- * backend, and the legacy entries are removed too so a half-migrated store does
- * not come back.
+ * backend.
+ *
+ * The per-field names are removed as well, so a store the fold never reached
+ * does not keep answering after a clear. Those deletes are best-effort and the
+ * main record's is not: a refusal on `CREDENTIAL_ACCOUNT` means the credentials
+ * are still there and the person has to be told, while the per-field names are
+ * leftovers whose removal nothing depends on. Swallowing the first would report
+ * a clear that did not happen.
  *
  * @param store - the caller's credential store.
+ * @throws when the backend refused to remove the main record.
  */
 declare function clearCredentials(store: CredentialsStore): void;
 /**

package/lib/accounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.d.ts","names":[],"sources":["../../src/accounts.ts"],"sourcesContent":null,"mappings":";;;;;;;;;;;;;;;;;;AA4IgB,cAxEH,kBAAA,GAwE0C,oBAAgB;;;;;;;;cA/D1D;;;;AAkIb;;;AAA0D,cA1H7C,kBAAA,GA0H6C,qBAAA;AAAgB;UAvHzD,kBAAA;EAqMJ,SAAA,UAAc,EAAA,MAAA;;;;;;;;;;;;;AAcX,UApMC,UAAA,CAoMa;EAAA,SAAA,OAAA,EAAA,MAAA;EAAA;EAAwB,SAAG,UAAA,EAAA,MAAA;EAAe;;;;UA3LvD,gBAAA;yBACQ;EAyMT,SAAA,WAAa,CAAA,EAxMJ,UAwMY;;;;;;;AAUrC;AAA0B,iBAzMV,YAAA,CAyMU,MAAA,EAzMW,gBAyMX,CAAA,EAAA,MAAA;;;AAAqC;;;;;;;;;;;iBAxL/C,YAAA,2BAAuC;;;AAyMvD;;;;;;AAGmB;;;iBAzIH,eAAA,QAAuB,mBAAmB;;cA8E7C,cAAA;;;;;;;AA8Eb;;;;AAAsF;;iBAhEtE,cAAA,QAAsB,mBAAmB;;;;;AAiFzD;AAA2B,iBAlEX,aAAA,CAkEW,KAAA,EAlEU,gBAkEV,CAAA,EAAA,OAAA;;;AAAyC;;;;iBAxDpD,UAAA,QAAkB,mBAAmB;;AAiErD;;;;;;;;;;;AAkBA;iBAlEgB,iBAAA,QACP,oCACW,qBAAqB,+BACtC;;;;;;;;;;AA+EH;;iBA5DgB,gBAAA,QAAwB,+BAA+B;;;;;;;iBAiBvD,WAAA,QAAmB,uBAAuB;;;;;;iBAS1C,WAAA,QAAmB;;;;;;;;;;;iBAkBnB,gBAAA,QAAwB;;;;;;;;;;;iBAgBxB,WAAA"}
+{"version":3,"file":"accounts.d.ts","names":[],"sources":["../../src/accounts.ts"],"sourcesContent":null,"mappings":";;;;;;;;;;;;;;;;;;cA+Ea,kBAAA;;;;;AA+Ib;;;;AAA0E;;AAsF1E;cAxNa;;;;;;;cAQA,kBAAA;;UAGI,kBAAA;;;EAoPD,SAAA,cAAc,CAAA,EAAA,MAAA;;;;AAA0C;;;;;;AAexE;UApPiB,UAAA;;;;;;AA8PjB;;AAAkC,UArPjB,gBAAA,CAqPiB;EAAgB,SAAG,WAAA,CAAA,EApP5B,kBAoP4B;EAAU,SAAA,WAAA,CAAA,EAnPtC,UAmPsC;;;;;;;;iBA1O/C,YAAA,SAAqB;;;;;;AA2PrC;;;;;;AAGmB;;iBA7OH,YAAA,2BAAuC;;;;;;;;;;AAgQvD;;AAAwC,iBA7LxB,eAAA,CA6LwB,KAAA,EA7LD,gBA6LC,CAAA,EA7LkB,gBA6LlB;;AAA8C,cAvGzE,cAAA,GAuGyE,0BAAA;;;;;;;AAiBtF;;;;AAAoE;;iBAjFpD,cAAA,QAAsB,mBAAmB;;;;AA0FzD;;iBA3EgB,aAAA,QAAqB;;;;;;;iBAUrB,UAAA,QAAkB,mBAAmB;;;;;;;;;AA0FrD;;;;;iBAzEgB,iBAAA,QACP,oCACW,qBAAqB,+BACtC;;;;;;AAsFH;;;;;;iBAnEgB,gBAAA,QAAwB,+BAA+B;;;;;;;iBAiBvD,WAAA,QAAmB,uBAAuB;;;;;;iBAS1C,WAAA,QAAmB;;;;;;;;;;;;;;;;;;iBAyBnB,gBAAA,QAAwB;;;;;;;;;;;iBAgBxB,WAAA"}

package/lib/accounts.js

@@ -9,11 +9,15 @@ import { createHash } from "node:crypto";
 */
 const CREDENTIAL_ACCOUNT = "aishell-credential";
 /**
-* Entries written by the earlier three-key layout, in the order they are read
-* during migration.
+* The per-field account names a store may still hold beside the bundle.
 *
-* Kept only so an existing install keeps working: see {@link readCredentials}.
-* New writes never touch these.
+* These are the read-side names of a store written field-by-field instead of
+* as one record. {@link readCredentials} folds them into
+* {@link CREDENTIAL_ACCOUNT} on first read, so a machine that holds them keeps
+* working; nothing writes them.
+*
+* The order is the order the migration reads them: access key, secret key,
+* token.
 */
 const LEGACY_ACCOUNTS = [
 	"HW_ACCESS_KEY",
@@ -21,10 +25,10 @@ const LEGACY_ACCOUNTS = [
 	"HW_SECURITY_TOKEN"
 ];
 /**
-* The legacy entry holding an e2b API key on its own.
+* The standalone e2b key entry, beside the per-field names above.
 *
-* Folded into the bundle by {@link readCredentials}. Kept as a constant because
-* the migration has to name it.
+* Folded into the bundle by {@link readCredentials}, for the same reason: a
+* store written before the bundle existed keeps working. Nothing writes it.
 */
 const LEGACY_E2B_ACCOUNT = "AISHELL_E2B_API_KEY";
 /**
@@ -90,12 +94,12 @@ function isE2BSection(value) {
 	return typeof section.api_key === "string" && section.api_key !== "" && typeof section.expired_at === "string" && section.expired_at !== "" && (section.ak_fingerprint === void 0 || typeof section.ak_fingerprint === "string");
 }
 /**
-* Read the whole bundle, migrating a legacy layout on the way.
+* Read the whole bundle, folding a per-field store into it on the way.
 *
-* Migration is lazy and idempotent: the first read that finds no bundle but
-* finds legacy entries merges them into one record, writes it, and removes the
-* old entries. A failed write leaves the legacy entries alone, so the next read
-* tries again — the person is never left with neither layout.
+* The fold is lazy and idempotent: a read that finds no bundle but finds the
+* per-field names merges them into one record, writes it, and removes the old
+* entries. A failed write leaves them in place so the next read tries again —
+* a store is never left with neither layout.
 *
 * @param store - the caller's credential store.
 * @returns the bundle; empty when nothing is stored.
@@ -108,10 +112,10 @@ function readCredentials(store) {
 	return migrated;
 }
 /**
-* Merge the legacy entries into one record and remove the old ones.
+* Merge the per-field entries into one record and remove the old ones.
 *
 * @param store - the caller's credential store.
-* @returns the migrated bundle, or `undefined` when there was nothing to move.
+* @returns the merged bundle, or `undefined` when there was nothing to move.
 */
 function migrateLegacy(store) {
 	const ak = store.get(LEGACY_ACCOUNTS[0]);
@@ -134,11 +138,11 @@ function migrateLegacy(store) {
 	} catch {
 		return bundle;
 	}
-	for (const account of LEGACY_ACCOUNTS) store.delete(account);
-	store.delete(LEGACY_E2B_ACCOUNT);
+	for (const account of LEGACY_ACCOUNTS) tryDelete(store, account);
+	tryDelete(store, LEGACY_E2B_ACCOUNT);
 	return bundle;
 }
-/** Read one legacy e2b entry into its bundle section. */
+/** Read one standalone e2b entry into its bundle section. */
 function legacyE2BSection(raw) {
 	if (raw === void 0 || raw === "") return void 0;
 	let parsed;
@@ -162,6 +166,28 @@ function legacyE2BSection(raw) {
 /** The expiry recorded for a key that does not expire. */
 const FOREVER_EXPIRY = "9999-12-31T23:59:59.000Z";
 /**
+* Delete an entry, swallowing a backend refusal.
+*
+* For every caller whose success does not depend on the delete landing — the
+* migration's cleanup above, and `clearCredentials` below it. The store is
+* allowed to refuse (a locked keyring rejects deletes, a read-only backend has
+* nothing to delete from), and in each of those cases the entry is either
+* already gone or will be superseded; throwing would report a failure for work
+* that is not needed.
+*
+* Not used where the delete *is* the operation — a save route clearing before
+* it writes must know the clear happened, and that path calls `store.delete`
+* directly.
+*
+* @param store - the caller's credential store.
+* @param account - the entry to remove.
+*/
+function tryDelete(store, account) {
+	try {
+		store.delete(account);
+	} catch {}
+}
+/**
 * Read the Huawei Cloud pair.
 *
 * AK and SK are read together and treated as one unit: half a pair reads as no
@@ -220,11 +246,11 @@ function updateCredentials(store, update) {
 	return next;
 }
 /**
-* Store the Huawei Cloud pair, replacing any previous one.
+* Store the Huawei Cloud pair, replacing whatever is there.
 *
 * One write, so the pair can never be left half-replaced. A save without a
-* token removes a previously stored one: a token belongs to the credential set
-* that carried it, and inheriting a stale one would sign the next request with
+* token removes a stored one: a token belongs to the credential set that
+* carried it, and inheriting a stale one would sign the next request with
 * someone else's session.
 *
 * @param store - the caller's credential store.
@@ -269,15 +295,22 @@ function clearE2BKey(store) {
 *
 * The whole record goes, so a clear cannot leave a token or a key behind for
 * the next pair to inherit. Deleting an absent entry is a no-op in every
-* backend, and the legacy entries are removed too so a half-migrated store does
-* not come back.
+* backend.
+*
+* The per-field names are removed as well, so a store the fold never reached
+* does not keep answering after a clear. Those deletes are best-effort and the
+* main record's is not: a refusal on `CREDENTIAL_ACCOUNT` means the credentials
+* are still there and the person has to be told, while the per-field names are
+* leftovers whose removal nothing depends on. Swallowing the first would report
+* a clear that did not happen.
 *
 * @param store - the caller's credential store.
+* @throws when the backend refused to remove the main record.
 */
 function clearCredentials(store) {
 	store.delete(CREDENTIAL_ACCOUNT);
-	for (const account of LEGACY_ACCOUNTS) store.delete(account);
-	store.delete(LEGACY_E2B_ACCOUNT);
+	for (const account of LEGACY_ACCOUNTS) tryDelete(store, account);
+	tryDelete(store, LEGACY_E2B_ACCOUNT);
 }
 /**
 * A short, stable digest of an AK, for recording which identity minted a key.

package/lib/accounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.js","names":["bundle: CredentialBundle","raw: string | undefined","parsed: unknown","raw: string","value: unknown","store: CredentialsStore","huaweicloud: HuaweiCloudSection | undefined","update: (current: CredentialBundle) => CredentialBundle | undefined","credentials: SignCredentials","key: E2BSection","ak: string"],"sources":["../src/accounts.ts"],"sourcesContent":["/**\n * The Huawei Cloud credential vocabulary every plugin in this set shares.\n *\n * ## Why this module exists\n *\n * This repo once read the same keyring entries from four places, each declaring\n * the account names itself and re-implementing \"read AK and SK as a pair\". The\n * account names are a *persistence* contract, so a divergence would not fail a\n * build — it would surface as one plugin working and another reporting \"not\n * authenticated\" on a machine where the person had stored exactly one pair, and\n * the cause would be invisible in the diff that introduced it.\n *\n * Everything now goes through this file.\n *\n * ## One entry, not three\n *\n * The store holds **one** record, `aishell-credential`, whose value is a single\n * JSON bundle encoded as base64:\n *\n * ```json\n * {\n *   \"huaweicloud\": { \"access_key\": \"…\", \"secret_key\": \"…\", \"security_token\": \"…\" },\n *   \"aishell_e2b\": { \"api_key\": \"…\", \"expired_at\": \"…\", \"ak_fingerprint\": \"…\" }\n * }\n * ```\n *\n * The earlier layout was three separate entries (`HW_ACCESS_KEY`,\n * `HW_SECRET_KEY`, `HW_SECURITY_TOKEN`). That had two problems this fixes:\n *\n *   - **A save was four operations.** Clear, then write AK, then SK, then\n *     token. Every backend is per-entry, so a failure between them left a\n *     half-set behind, and nothing rolled it back.\n *   - **A read was three reads.** A concurrent write landing between them could\n *     hand back a new AK with an old SK — a pair that passes \"both present\" and\n *     then fails at the gateway with 401, pointing nowhere near the cause.\n *\n * One entry makes a write one atomic operation and a read one consistent\n * snapshot.\n *\n * ## base64 is an encoding, not encryption\n *\n * It keeps the secret from sitting in a plaintext field a person or a log\n * prints while poking at the store. It is **not** a security boundary: anyone\n * who can read the entry can decode it. The actual protection is the backend —\n * the OS keyring, or AES-256-GCM in the file backend.\n *\n * ## Read-modify-write is not atomic across processes\n *\n * {@link updateCredentials} reads the bundle, applies a change and writes it\n * back. Two processes doing that concurrently can lose one of the changes. That\n * is accepted rather than solved: the only writer is a person via the\n * credential form, and both the e2b key and the AK/SK are refreshed by that\n * same person. A lost update would be corrected by the next save. Solving it\n * properly needs compare-and-swap, which the keyring API does not offer.\n *\n * @module @huaweidevtools/aishell-dsh-credentials-store/accounts\n */\n\nimport { createHash } from 'node:crypto'\nimport type { CredentialsStore } from './index.ts'\nimport type { SignCredentials } from './signer.ts'\n\n/**\n * The one store entry holding every credential this repo manages.\n *\n * Part of the persistence contract: renaming it orphans every stored entry\n * while looking like a harmless constant change.\n */\nexport const CREDENTIAL_ACCOUNT = 'aishell-credential'\n\n/**\n * Entries written by the earlier three-key layout, in the order they are read\n * during migration.\n *\n * Kept only so an existing install keeps working: see {@link readCredentials}.\n * New writes never touch these.\n */\nexport const LEGACY_ACCOUNTS = ['HW_ACCESS_KEY', 'HW_SECRET_KEY', 'HW_SECURITY_TOKEN'] as const\n\n/**\n * The legacy entry holding an e2b API key on its own.\n *\n * Folded into the bundle by {@link readCredentials}. Kept as a constant because\n * the migration has to name it.\n */\nexport const LEGACY_E2B_ACCOUNT = 'AISHELL_E2B_API_KEY'\n\n/** The Huawei Cloud pair, as the bundle stores it. Snake-case on disk. */\nexport interface HuaweiCloudSection {\n  readonly access_key: string\n  readonly secret_key: string\n  readonly security_token?: string\n}\n\n/**\n * An e2b API key, as the bundle stores it.\n *\n * `ak_fingerprint` is not part of the key the gateway issued — it is a digest\n * of the AK that minted it, so a reader can tell whether the key still belongs\n * to the credentials in hand. Without it, an AK rotation would leave the old\n * key (and so the old tenant, with all its sandboxes) alive. It lives here\n * rather than only in the reader's memory because it has to survive a restart.\n */\nexport interface E2BSection {\n  readonly api_key: string\n  /** ISO 8601; `9999-12-31T23:59:59.000Z` when the key does not expire. */\n  readonly expired_at: string\n  /** {@link fingerprint} of the AK that minted this key, when known. */\n  readonly ak_fingerprint?: string\n}\n\n/** The whole bundle. Either section may be absent. */\nexport interface CredentialBundle {\n  readonly huaweicloud?: HuaweiCloudSection\n  readonly aishell_e2b?: E2BSection\n}\n\n/**\n * Encode a bundle for storage.\n *\n * @param bundle - the bundle to store.\n * @returns base64 of its JSON form.\n */\nexport function encodeBundle(bundle: CredentialBundle): string {\n  return Buffer.from(JSON.stringify(bundle), 'utf8').toString('base64')\n}\n\n/**\n * Decode a stored value.\n *\n * Anything unreadable reads as an empty bundle rather than throwing: a corrupt\n * entry should behave like \"nothing stored\" so the person is asked to\n * authenticate again, not so every tool call fails on a parse error.\n *\n * A value that is not base64 is tried as raw JSON first — that is what the\n * legacy e2b entry held, and migration reads it through here.\n *\n * @param raw - the stored string, if any.\n * @returns the decoded bundle; empty when nothing usable is there.\n */\nexport function decodeBundle(raw: string | undefined): CredentialBundle {\n  if (raw === undefined || raw === '') return {}\n  const text = decodeText(raw)\n  if (text === undefined) return {}\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(text)\n  } catch {\n    return {}\n  }\n  if (parsed === null || typeof parsed !== 'object') return {}\n  const candidate = parsed as { huaweicloud?: unknown, aishell_e2b?: unknown }\n  return {\n    ...(isHuaweiCloudSection(candidate.huaweicloud)\n      ? { huaweicloud: candidate.huaweicloud }\n      : {}),\n    ...(isE2BSection(candidate.aishell_e2b)\n      ? { aishell_e2b: candidate.aishell_e2b }\n      : {}),\n  }\n}\n\n/** Decode base64, falling back to the raw string when it is already text. */\nfunction decodeText(raw: string): string | undefined {\n  try {\n    const decoded = Buffer.from(raw, 'base64')\n    // `Buffer.from` never throws on bad base64 — it drops the unusable tail. So\n    // the round-trip check is what distinguishes real base64 from legacy JSON.\n    if (decoded.toString('base64') === raw.replace(/\\s/g, '')) {\n      const text = decoded.toString('utf8')\n      if (text.trimStart().startsWith('{')) return text\n    }\n  } catch {\n    // Fall through to raw.\n  }\n  return raw.trimStart().startsWith('{') ? raw : undefined\n}\n\n/** Whether a decoded field is a usable Huawei Cloud section. */\nfunction isHuaweiCloudSection(value: unknown): value is HuaweiCloudSection {\n  if (value === null || typeof value !== 'object') return false\n  const section = value as Record<string, unknown>\n  return typeof section.access_key === 'string' && section.access_key !== ''\n    && typeof section.secret_key === 'string' && section.secret_key !== ''\n    && (section.security_token === undefined || typeof section.security_token === 'string')\n}\n\n/** Whether a decoded field is a usable e2b section. */\nfunction isE2BSection(value: unknown): value is E2BSection {\n  if (value === null || typeof value !== 'object') return false\n  const section = value as Record<string, unknown>\n  return typeof section.api_key === 'string' && section.api_key !== ''\n    && typeof section.expired_at === 'string' && section.expired_at !== ''\n    && (section.ak_fingerprint === undefined || typeof section.ak_fingerprint === 'string')\n}\n\n/**\n * Read the whole bundle, migrating a legacy layout on the way.\n *\n * Migration is lazy and idempotent: the first read that finds no bundle but\n * finds legacy entries merges them into one record, writes it, and removes the\n * old entries. A failed write leaves the legacy entries alone, so the next read\n * tries again — the person is never left with neither layout.\n *\n * @param store - the caller's credential store.\n * @returns the bundle; empty when nothing is stored.\n */\nexport function readCredentials(store: CredentialsStore): CredentialBundle {\n  const stored = store.get(CREDENTIAL_ACCOUNT)\n  if (stored !== undefined) return decodeBundle(stored)\n\n  const migrated = migrateLegacy(store)\n  if (migrated === undefined) return {}\n  return migrated\n}\n\n/**\n * Merge the legacy entries into one record and remove the old ones.\n *\n * @param store - the caller's credential store.\n * @returns the migrated bundle, or `undefined` when there was nothing to move.\n */\nfunction migrateLegacy(store: CredentialsStore): CredentialBundle | undefined {\n  const ak = store.get(LEGACY_ACCOUNTS[0])\n  const sk = store.get(LEGACY_ACCOUNTS[1])\n  const token = store.get(LEGACY_ACCOUNTS[2])\n  const legacyKey = store.get(LEGACY_E2B_ACCOUNT)\n\n  const huaweicloud: HuaweiCloudSection | undefined =\n    ak !== undefined && ak !== '' && sk !== undefined && sk !== ''\n      ? {\n        access_key: ak,\n        secret_key: sk,\n        ...(token === undefined || token === '' ? {} : { security_token: token }),\n      }\n      : undefined\n\n  // The legacy e2b entry held `{ key, expiresAt, akFingerprint }`. Re-keyed to\n  // the bundle's snake-case spelling; an older bare key still reads as one that\n  // never expires, which is how the reader treated it.\n  const aisleE2B = legacyE2BSection(legacyKey)\n\n  if (huaweicloud === undefined && aisleE2B === undefined) return undefined\n\n  const bundle: CredentialBundle = {\n    ...(huaweicloud === undefined ? {} : { huaweicloud }),\n    ...(aisleE2B === undefined ? {} : { aishell_e2b: aisleE2B }),\n  }\n\n  try {\n    store.set(CREDENTIAL_ACCOUNT, encodeBundle(bundle))\n  } catch {\n    // Could not write the merged record — leave the legacy entries in place so\n    // the next read retries rather than losing the credentials.\n    return bundle\n  }\n  for (const account of LEGACY_ACCOUNTS) store.delete(account)\n  store.delete(LEGACY_E2B_ACCOUNT)\n  return bundle\n}\n\n/** Read one legacy e2b entry into its bundle section. */\nfunction legacyE2BSection(raw: string | undefined): E2BSection | undefined {\n  if (raw === undefined || raw === '') return undefined\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(raw)\n  } catch {\n    // Not JSON at all: a bare key. Its expiry is unknown, which reads the same\n    // as \"does not expire\"; the gateway's 401 path covers the difference.\n    return { api_key: raw, expired_at: FOREVER_EXPIRY }\n  }\n  const candidate = parsed as { key?: unknown, expiresAt?: unknown, akFingerprint?: unknown } | null\n  if (candidate === null || typeof candidate !== 'object') return undefined\n  if (typeof candidate.key !== 'string' || candidate.key === '') return undefined\n  return {\n    api_key: candidate.key,\n    expired_at: typeof candidate.expiresAt === 'string' ? candidate.expiresAt : FOREVER_EXPIRY,\n    ...(typeof candidate.akFingerprint === 'string' && candidate.akFingerprint !== ''\n      ? { ak_fingerprint: candidate.akFingerprint }\n      : {}),\n  }\n}\n\n/** The expiry recorded for a key that does not expire. */\nexport const FOREVER_EXPIRY = '9999-12-31T23:59:59.000Z'\n\n/**\n * Read the Huawei Cloud pair.\n *\n * AK and SK are read together and treated as one unit: half a pair reads as no\n * credentials rather than an error, so a partially-configured machine gets\n * \"authenticate first\" instead of a signing failure with no remedy. The\n * SecurityToken is optional and is omitted entirely when absent — an empty\n * string would sign as a third header the gateway then rejects.\n *\n * @param store - the caller's credential store.\n * @returns the pair, or `undefined` when the AK/SK pair is incomplete.\n */\nexport function readStoredPair(store: CredentialsStore): SignCredentials | undefined {\n  const section = readCredentials(store).huaweicloud\n  if (section === undefined) return undefined\n  return {\n    ak: section.access_key,\n    sk: section.secret_key,\n    ...(section.security_token === undefined ? {} : { securityToken: section.security_token }),\n  }\n}\n\n/**\n * Whether a complete Huawei Cloud pair is stored.\n *\n * @param store - the caller's credential store.\n */\nexport function hasStoredPair(store: CredentialsStore): boolean {\n  return readStoredPair(store) !== undefined\n}\n\n/**\n * Read the stored e2b key.\n *\n * @param store - the caller's credential store.\n * @returns the section, or `undefined` when no key is stored.\n */\nexport function readE2BKey(store: CredentialsStore): E2BSection | undefined {\n  return readCredentials(store).aishell_e2b\n}\n\n/**\n * Apply one change to the bundle and write it back.\n *\n * The updater receives the current bundle and returns the next one. Returning\n * `undefined` aborts the write, which is how a caller says \"nothing changed\" —\n * that matters because every write is a full re-encode, and needlessly\n * rewriting a record while another process reads it is how a spurious\n * \"credentials changed\" is produced.\n *\n * @param store - the caller's credential store.\n * @param update - computes the next bundle.\n * @returns the bundle now stored.\n */\nexport function updateCredentials(\n  store: CredentialsStore,\n  update: (current: CredentialBundle) => CredentialBundle | undefined,\n): CredentialBundle {\n  const current = readCredentials(store)\n  const next = update(current)\n  if (next === undefined) return current\n  store.set(CREDENTIAL_ACCOUNT, encodeBundle(next))\n  return next\n}\n\n/**\n * Store the Huawei Cloud pair, replacing any previous one.\n *\n * One write, so the pair can never be left half-replaced. A save without a\n * token removes a previously stored one: a token belongs to the credential set\n * that carried it, and inheriting a stale one would sign the next request with\n * someone else's session.\n *\n * @param store - the caller's credential store.\n * @param credentials - the verified pair.\n */\nexport function writeHuaweiCloud(store: CredentialsStore, credentials: SignCredentials): void {\n  updateCredentials(store, current => ({\n    ...current,\n    huaweicloud: {\n      access_key: credentials.ak,\n      secret_key: credentials.sk,\n      ...(credentials.securityToken === undefined ? {} : { security_token: credentials.securityToken }),\n    },\n  }))\n}\n\n/**\n * Store an e2b key.\n *\n * @param store - the caller's credential store.\n * @param key - the section to store.\n */\nexport function writeE2BKey(store: CredentialsStore, key: E2BSection): void {\n  updateCredentials(store, current => ({ ...current, aishell_e2b: key }))\n}\n\n/**\n * Remove the stored e2b key, leaving the Huawei Cloud pair alone.\n *\n * @param store - the caller's credential store.\n */\nexport function clearE2BKey(store: CredentialsStore): void {\n  updateCredentials(store, current => {\n    if (current.aishell_e2b === undefined) return undefined\n    const { aishell_e2b: _removed, ...rest } = current\n    return rest\n  })\n}\n\n/**\n * Remove every credential this repo writes.\n *\n * The whole record goes, so a clear cannot leave a token or a key behind for\n * the next pair to inherit. Deleting an absent entry is a no-op in every\n * backend, and the legacy entries are removed too so a half-migrated store does\n * not come back.\n *\n * @param store - the caller's credential store.\n */\nexport function clearCredentials(store: CredentialsStore): void {\n  store.delete(CREDENTIAL_ACCOUNT)\n  for (const account of LEGACY_ACCOUNTS) store.delete(account)\n  store.delete(LEGACY_E2B_ACCOUNT)\n}\n\n/**\n * A short, stable digest of an AK, for recording which identity minted a key.\n *\n * The AK rather than the pair: the SK can be rotated independently while the\n * account stays the same, and the tenant the gateway derives is the account. A\n * digest rather than the AK itself keeps the bundle from carrying a second\n * readable copy of a credential identifier.\n *\n * @param ak - the access key.\n */\nexport function fingerprint(ak: string): string {\n  return createHash('sha256').update(ak, 'utf8').digest('hex')\n}"],"mappings":";;;;;;;;;AAoEA,MAAa,qBAAqB;;;;;;;;AASlC,MAAa,kBAAkB;CAAC;CAAiB;CAAiB;AAAoB;;;;;;;AAQtF,MAAa,qBAAqB;;;;;;;AAsClC,SAAgB,aAAaA,QAAkC;AAC7D,QAAO,OAAO,KAAK,KAAK,UAAU,OAAO,EAAE,OAAO,CAAC,SAAS,SAAS;AACtE;;;;;;;;;;;;;;AAeD,SAAgB,aAAaC,KAA2C;AACtE,KAAI,kBAAqB,QAAQ,GAAI,QAAO,CAAE;CAC9C,MAAM,OAAO,WAAW,IAAI;AAC5B,KAAI,gBAAoB,QAAO,CAAE;CACjC,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,KAAK;CAC1B,QAAO;AACN,SAAO,CAAE;CACV;AACD,KAAI,WAAW,eAAe,WAAW,SAAU,QAAO,CAAE;CAC5D,MAAM,YAAY;AAClB,QAAO;EACL,GAAI,qBAAqB,UAAU,YAAY,GAC3C,EAAE,aAAa,UAAU,YAAa,IACtC,CAAE;EACN,GAAI,aAAa,UAAU,YAAY,GACnC,EAAE,aAAa,UAAU,YAAa,IACtC,CAAE;CACP;AACF;;AAGD,SAAS,WAAWC,KAAiC;AACnD,KAAI;EACF,MAAM,UAAU,OAAO,KAAK,KAAK,SAAS;AAG1C,MAAI,QAAQ,SAAS,SAAS,KAAK,IAAI,QAAQ,OAAO,GAAG,EAAE;GACzD,MAAM,OAAO,QAAQ,SAAS,OAAO;AACrC,OAAI,KAAK,WAAW,CAAC,WAAW,IAAI,CAAE,QAAO;EAC9C;CACF,QAAO,CAEP;AACD,QAAO,IAAI,WAAW,CAAC,WAAW,IAAI,GAAG;AAC1C;;AAGD,SAAS,qBAAqBC,OAA6C;AACzE,KAAI,UAAU,eAAe,UAAU,SAAU,QAAO;CACxD,MAAM,UAAU;AAChB,eAAc,QAAQ,eAAe,YAAY,QAAQ,eAAe,aAC5D,QAAQ,eAAe,YAAY,QAAQ,eAAe,OAChE,QAAQ,oCAAuC,QAAQ,mBAAmB;AACjF;;AAGD,SAAS,aAAaA,OAAqC;AACzD,KAAI,UAAU,eAAe,UAAU,SAAU,QAAO;CACxD,MAAM,UAAU;AAChB,eAAc,QAAQ,YAAY,YAAY,QAAQ,YAAY,aACtD,QAAQ,eAAe,YAAY,QAAQ,eAAe,OAChE,QAAQ,oCAAuC,QAAQ,mBAAmB;AACjF;;;;;;;;;;;;AAaD,SAAgB,gBAAgBC,OAA2C;CACzE,MAAM,SAAS,MAAM,IAAI,mBAAmB;AAC5C,KAAI,kBAAsB,QAAO,aAAa,OAAO;CAErD,MAAM,WAAW,cAAc,MAAM;AACrC,KAAI,oBAAwB,QAAO,CAAE;AACrC,QAAO;AACR;;;;;;;AAQD,SAAS,cAAcA,OAAuD;CAC5E,MAAM,KAAK,MAAM,IAAI,gBAAgB,GAAG;CACxC,MAAM,KAAK,MAAM,IAAI,gBAAgB,GAAG;CACxC,MAAM,QAAQ,MAAM,IAAI,gBAAgB,GAAG;CAC3C,MAAM,YAAY,MAAM,IAAI,mBAAmB;CAE/C,MAAMC,cACJ,iBAAoB,OAAO,MAAM,iBAAoB,OAAO,KACxD;EACA,YAAY;EACZ,YAAY;EACZ,GAAI,oBAAuB,UAAU,KAAK,CAAE,IAAG,EAAE,gBAAgB,MAAO;CACzE;CAML,MAAM,WAAW,iBAAiB,UAAU;AAE5C,KAAI,0BAA6B,oBAAwB;CAEzD,MAAMN,SAA2B;EAC/B,GAAI,yBAA4B,CAAE,IAAG,EAAE,YAAa;EACpD,GAAI,sBAAyB,CAAE,IAAG,EAAE,aAAa,SAAU;CAC5D;AAED,KAAI;AACF,QAAM,IAAI,oBAAoB,aAAa,OAAO,CAAC;CACpD,QAAO;AAGN,SAAO;CACR;AACD,MAAK,MAAM,WAAW,gBAAiB,OAAM,OAAO,QAAQ;AAC5D,OAAM,OAAO,mBAAmB;AAChC,QAAO;AACR;;AAGD,SAAS,iBAAiBC,KAAiD;AACzE,KAAI,kBAAqB,QAAQ,GAAI;CACrC,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,IAAI;CACzB,QAAO;AAGN,SAAO;GAAE,SAAS;GAAK,YAAY;EAAgB;CACpD;CACD,MAAM,YAAY;AAClB,KAAI,cAAc,eAAe,cAAc,SAAU;AACzD,YAAW,UAAU,QAAQ,YAAY,UAAU,QAAQ,GAAI;AAC/D,QAAO;EACL,SAAS,UAAU;EACnB,mBAAmB,UAAU,cAAc,WAAW,UAAU,YAAY;EAC5E,UAAW,UAAU,kBAAkB,YAAY,UAAU,kBAAkB,KAC3E,EAAE,gBAAgB,UAAU,cAAe,IAC3C,CAAE;CACP;AACF;;AAGD,MAAa,iBAAiB;;;;;;;;;;;;;AAc9B,SAAgB,eAAeG,OAAsD;CACnF,MAAM,UAAU,gBAAgB,MAAM,CAAC;AACvC,KAAI,mBAAuB;AAC3B,QAAO;EACL,IAAI,QAAQ;EACZ,IAAI,QAAQ;EACZ,GAAI,QAAQ,4BAA+B,CAAE,IAAG,EAAE,eAAe,QAAQ,eAAgB;CAC1F;AACF;;;;;;AAOD,SAAgB,cAAcA,OAAkC;AAC9D,QAAO,eAAe,MAAM;AAC7B;;;;;;;AAQD,SAAgB,WAAWA,OAAiD;AAC1E,QAAO,gBAAgB,MAAM,CAAC;AAC/B;;;;;;;;;;;;;;AAeD,SAAgB,kBACdA,OACAE,QACkB;CAClB,MAAM,UAAU,gBAAgB,MAAM;CACtC,MAAM,OAAO,OAAO,QAAQ;AAC5B,KAAI,gBAAoB,QAAO;AAC/B,OAAM,IAAI,oBAAoB,aAAa,KAAK,CAAC;AACjD,QAAO;AACR;;;;;;;;;;;;AAaD,SAAgB,iBAAiBF,OAAyBG,aAAoC;AAC5F,mBAAkB,OAAO,CAAA,aAAY;EACnC,GAAG;EACH,aAAa;GACX,YAAY,YAAY;GACxB,YAAY,YAAY;GACxB,GAAI,YAAY,2BAA8B,CAAE,IAAG,EAAE,gBAAgB,YAAY,cAAe;EACjG;CACF,GAAE;AACJ;;;;;;;AAQD,SAAgB,YAAYH,OAAyBI,KAAuB;AAC1E,mBAAkB,OAAO,CAAA,aAAY;EAAE,GAAG;EAAS,aAAa;CAAK,GAAE;AACxE;;;;;;AAOD,SAAgB,YAAYJ,OAA+B;AACzD,mBAAkB,OAAO,CAAA,YAAW;AAClC,MAAI,QAAQ,uBAA2B;EACvC,MAAM,EAAE,aAAa,SAAU,GAAG,MAAM,GAAG;AAC3C,SAAO;CACR,EAAC;AACH;;;;;;;;;;;AAYD,SAAgB,iBAAiBA,OAA+B;AAC9D,OAAM,OAAO,mBAAmB;AAChC,MAAK,MAAM,WAAW,gBAAiB,OAAM,OAAO,QAAQ;AAC5D,OAAM,OAAO,mBAAmB;AACjC;;;;;;;;;;;AAYD,SAAgB,YAAYK,IAAoB;AAC9C,QAAO,WAAW,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,MAAM;AAC7D"}
+{"version":3,"file":"accounts.js","names":["bundle: CredentialBundle","raw: string | undefined","parsed: unknown","raw: string","value: unknown","store: CredentialsStore","huaweicloud: HuaweiCloudSection | undefined","account: string","update: (current: CredentialBundle) => CredentialBundle | undefined","credentials: SignCredentials","key: E2BSection","ak: string"],"sources":["../src/accounts.ts"],"sourcesContent":["/**\n * The Huawei Cloud credential vocabulary every plugin in this set shares.\n *\n * ## Why one module owns the account names\n *\n * The account names and the \"AK and SK are one unit\" rule are a *persistence*\n * contract. A second declaration of either does not fail a build: it surfaces\n * as one plugin working and another reporting \"not authenticated\" on a machine\n * where exactly one pair is stored, and the diff that introduced it looks\n * harmless. Keeping them in one file makes the contract have one owner.\n *\n * ## One record, holding the whole bundle\n *\n * The store holds **one** record, `aishell-credential`, whose value is a single\n * JSON bundle encoded as base64:\n *\n * ```json\n * {\n *   \"huaweicloud\": { \"access_key\": \"…\", \"secret_key\": \"…\", \"security_token\": \"…\" },\n *   \"aishell_e2b\": { \"api_key\": \"…\", \"expired_at\": \"…\", \"ak_fingerprint\": \"…\" }\n * }\n * ```\n *\n * One record is what makes a save one operation and a read one consistent\n * snapshot:\n *\n *   - **A save is one write.** Splitting the pair across entries makes every\n *     save a sequence, and every backend is per-entry, so a failure between two\n *     of them leaves a half-set behind that nothing rolls back.\n *   - **A read is one read.** Reading the AK and the SK separately lets a\n *     concurrent write land between them: the caller gets a new AK with an old\n *     SK, which passes \"both present\" and then fails at the gateway with 401,\n *     pointing nowhere near the cause.\n *\n * ## base64 is an encoding, not encryption\n *\n * It keeps the secret from sitting in a plaintext field a person or a log\n * prints while poking at the store. It is **not** a security boundary: anyone\n * who can read the entry can decode it. The actual protection is the backend —\n * the OS keyring, or AES-256-GCM in the file backend.\n *\n * ## Read-modify-write is not atomic across processes\n *\n * {@link updateCredentials} reads the bundle, applies a change and writes it\n * back. Two processes doing that concurrently can lose one of the changes. That\n * is accepted rather than solved: the only writer is a person via the\n * credential form, and both the e2b key and the AK/SK are refreshed by that\n * same person, so a lost update is corrected by the next save. Solving it\n * properly needs compare-and-swap, which the keyring API does not offer.\n *\n * ## One accepted consequence: a partial bundle can overwrite an unreadable one\n *\n * A read that cannot decrypt the file reports \"nothing stored\", so an\n * {@link updateCredentials} built on it computes its next bundle from an empty\n * one and writes that. For `clearE2BKey` that means the written record carries\n * only whatever the updater added, and the section it could not read is no\n * longer in the live file.\n *\n * That is not repaired here, because there is nothing to repair it *from* — the\n * bytes are unreadable. What limits the damage is the file backend's write path:\n * an unreadable file is moved to `<name>.unreadable-<timestamp>` rather than\n * overwritten, so the old record survives on disk and the next successful save\n * starts from an empty map. A reader who cannot decrypt the file has already\n * lost those credentials; the guarantee is only that the file they were in is\n * not destroyed.\n *\n * @module @huaweidevtools/aishell-dsh-credentials-store/accounts\n */\n\nimport { createHash } from 'node:crypto'\nimport type { CredentialsStore } from './index.ts'\nimport type { SignCredentials } from './signer.ts'\n\n/**\n * The one store entry holding every credential this repo manages.\n *\n * Part of the persistence contract: renaming it orphans every stored entry\n * while looking like a harmless constant change.\n */\nexport const CREDENTIAL_ACCOUNT = 'aishell-credential'\n\n/**\n * The per-field account names a store may still hold beside the bundle.\n *\n * These are the read-side names of a store written field-by-field instead of\n * as one record. {@link readCredentials} folds them into\n * {@link CREDENTIAL_ACCOUNT} on first read, so a machine that holds them keeps\n * working; nothing writes them.\n *\n * The order is the order the migration reads them: access key, secret key,\n * token.\n */\nexport const LEGACY_ACCOUNTS = ['HW_ACCESS_KEY', 'HW_SECRET_KEY', 'HW_SECURITY_TOKEN'] as const\n\n/**\n * The standalone e2b key entry, beside the per-field names above.\n *\n * Folded into the bundle by {@link readCredentials}, for the same reason: a\n * store written before the bundle existed keeps working. Nothing writes it.\n */\nexport const LEGACY_E2B_ACCOUNT = 'AISHELL_E2B_API_KEY'\n\n/** The Huawei Cloud pair, as the bundle stores it. Snake-case on disk. */\nexport interface HuaweiCloudSection {\n  readonly access_key: string\n  readonly secret_key: string\n  readonly security_token?: string\n}\n\n/**\n * An e2b API key, as the bundle stores it.\n *\n * `ak_fingerprint` is not part of the key the gateway issued — it is a digest\n * of the AK that minted it, so a reader can tell whether the key still belongs\n * to the credentials in hand. Without it, an AK rotation would leave the old\n * key (and so the old tenant, with all its sandboxes) alive. It lives here\n * rather than only in the reader's memory because it has to survive a restart.\n */\nexport interface E2BSection {\n  readonly api_key: string\n  /** ISO 8601; `9999-12-31T23:59:59.000Z` when the key does not expire. */\n  readonly expired_at: string\n  /** {@link fingerprint} of the AK that minted this key, when known. */\n  readonly ak_fingerprint?: string\n}\n\n/** The whole bundle. Either section may be absent. */\nexport interface CredentialBundle {\n  readonly huaweicloud?: HuaweiCloudSection\n  readonly aishell_e2b?: E2BSection\n}\n\n/**\n * Encode a bundle for storage.\n *\n * @param bundle - the bundle to store.\n * @returns base64 of its JSON form.\n */\nexport function encodeBundle(bundle: CredentialBundle): string {\n  return Buffer.from(JSON.stringify(bundle), 'utf8').toString('base64')\n}\n\n/**\n * Decode a stored value.\n *\n * Anything unreadable reads as an empty bundle rather than throwing: a corrupt\n * entry should behave like \"nothing stored\" so the person is asked to\n * authenticate again, not so every tool call fails on a parse error.\n *\n * A value that is not base64 is tried as raw JSON first — that is what the\n * legacy e2b entry held, and migration reads it through here.\n *\n * @param raw - the stored string, if any.\n * @returns the decoded bundle; empty when nothing usable is there.\n */\nexport function decodeBundle(raw: string | undefined): CredentialBundle {\n  if (raw === undefined || raw === '') return {}\n  const text = decodeText(raw)\n  if (text === undefined) return {}\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(text)\n  } catch {\n    return {}\n  }\n  if (parsed === null || typeof parsed !== 'object') return {}\n  const candidate = parsed as { huaweicloud?: unknown, aishell_e2b?: unknown }\n  return {\n    ...(isHuaweiCloudSection(candidate.huaweicloud)\n      ? { huaweicloud: candidate.huaweicloud }\n      : {}),\n    ...(isE2BSection(candidate.aishell_e2b)\n      ? { aishell_e2b: candidate.aishell_e2b }\n      : {}),\n  }\n}\n\n/** Decode base64, falling back to the raw string when it is already text. */\nfunction decodeText(raw: string): string | undefined {\n  try {\n    const decoded = Buffer.from(raw, 'base64')\n    // `Buffer.from` never throws on bad base64 — it drops the unusable tail. So\n    // the round-trip check is what distinguishes real base64 from legacy JSON.\n    if (decoded.toString('base64') === raw.replace(/\\s/g, '')) {\n      const text = decoded.toString('utf8')\n      if (text.trimStart().startsWith('{')) return text\n    }\n  } catch {\n    // Fall through to raw.\n  }\n  return raw.trimStart().startsWith('{') ? raw : undefined\n}\n\n/** Whether a decoded field is a usable Huawei Cloud section. */\nfunction isHuaweiCloudSection(value: unknown): value is HuaweiCloudSection {\n  if (value === null || typeof value !== 'object') return false\n  const section = value as Record<string, unknown>\n  return typeof section.access_key === 'string' && section.access_key !== ''\n    && typeof section.secret_key === 'string' && section.secret_key !== ''\n    && (section.security_token === undefined || typeof section.security_token === 'string')\n}\n\n/** Whether a decoded field is a usable e2b section. */\nfunction isE2BSection(value: unknown): value is E2BSection {\n  if (value === null || typeof value !== 'object') return false\n  const section = value as Record<string, unknown>\n  return typeof section.api_key === 'string' && section.api_key !== ''\n    && typeof section.expired_at === 'string' && section.expired_at !== ''\n    && (section.ak_fingerprint === undefined || typeof section.ak_fingerprint === 'string')\n}\n\n/**\n * Read the whole bundle, folding a per-field store into it on the way.\n *\n * The fold is lazy and idempotent: a read that finds no bundle but finds the\n * per-field names merges them into one record, writes it, and removes the old\n * entries. A failed write leaves them in place so the next read tries again —\n * a store is never left with neither layout.\n *\n * @param store - the caller's credential store.\n * @returns the bundle; empty when nothing is stored.\n */\nexport function readCredentials(store: CredentialsStore): CredentialBundle {\n  const stored = store.get(CREDENTIAL_ACCOUNT)\n  if (stored !== undefined) return decodeBundle(stored)\n\n  const migrated = migrateLegacy(store)\n  if (migrated === undefined) return {}\n  return migrated\n}\n\n/**\n * Merge the per-field entries into one record and remove the old ones.\n *\n * @param store - the caller's credential store.\n * @returns the merged bundle, or `undefined` when there was nothing to move.\n */\nfunction migrateLegacy(store: CredentialsStore): CredentialBundle | undefined {\n  const ak = store.get(LEGACY_ACCOUNTS[0])\n  const sk = store.get(LEGACY_ACCOUNTS[1])\n  const token = store.get(LEGACY_ACCOUNTS[2])\n  const legacyKey = store.get(LEGACY_E2B_ACCOUNT)\n\n  const huaweicloud: HuaweiCloudSection | undefined =\n    ak !== undefined && ak !== '' && sk !== undefined && sk !== ''\n      ? {\n        access_key: ak,\n        secret_key: sk,\n        ...(token === undefined || token === '' ? {} : { security_token: token }),\n      }\n      : undefined\n\n  // The standalone entry carries `{ key, expiresAt, akFingerprint }`; it is\n  // re-keyed to the bundle's snake-case spelling here. A bare key with no JSON\n  // around it reads as one that never expires, which is the reading the rest of\n  // the store gives an unknown expiry.\n  const aisleE2B = legacyE2BSection(legacyKey)\n\n  if (huaweicloud === undefined && aisleE2B === undefined) return undefined\n\n  const bundle: CredentialBundle = {\n    ...(huaweicloud === undefined ? {} : { huaweicloud }),\n    ...(aisleE2B === undefined ? {} : { aishell_e2b: aisleE2B }),\n  }\n\n  try {\n    store.set(CREDENTIAL_ACCOUNT, encodeBundle(bundle))\n  } catch {\n    // Could not write the merged record — leave the per-field entries in place\n    // so the next read retries rather than losing the credentials.\n    return bundle\n  }\n  // The merged record is durable, so the old entries are redundant now. Each\n  // delete is best-effort: a locked keyring rejects deletes as well as writes,\n  // and letting that propagate would make a **successful** migration look like\n  // a failed read to the caller. A leftover entry costs nothing — a read\n  // returns the bundle as soon as it exists, and `clearCredentials` removes\n  // these names too — whereas an exception here surfaces as \"could not read\n  // credentials\" on a store that is fine.\n  for (const account of LEGACY_ACCOUNTS) { tryDelete(store, account) }\n  tryDelete(store, LEGACY_E2B_ACCOUNT)\n  return bundle\n}\n\n/** Read one standalone e2b entry into its bundle section. */\nfunction legacyE2BSection(raw: string | undefined): E2BSection | undefined {\n  if (raw === undefined || raw === '') return undefined\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(raw)\n  } catch {\n    // Not JSON at all: a bare key. Its expiry is unknown, which reads the same\n    // as \"does not expire\"; the gateway's 401 path covers the difference.\n    return { api_key: raw, expired_at: FOREVER_EXPIRY }\n  }\n  const candidate = parsed as { key?: unknown, expiresAt?: unknown, akFingerprint?: unknown } | null\n  if (candidate === null || typeof candidate !== 'object') return undefined\n  if (typeof candidate.key !== 'string' || candidate.key === '') return undefined\n  return {\n    api_key: candidate.key,\n    expired_at: typeof candidate.expiresAt === 'string' ? candidate.expiresAt : FOREVER_EXPIRY,\n    ...(typeof candidate.akFingerprint === 'string' && candidate.akFingerprint !== ''\n      ? { ak_fingerprint: candidate.akFingerprint }\n      : {}),\n  }\n}\n\n/** The expiry recorded for a key that does not expire. */\nexport const FOREVER_EXPIRY = '9999-12-31T23:59:59.000Z'\n\n/**\n * Delete an entry, swallowing a backend refusal.\n *\n * For every caller whose success does not depend on the delete landing — the\n * migration's cleanup above, and `clearCredentials` below it. The store is\n * allowed to refuse (a locked keyring rejects deletes, a read-only backend has\n * nothing to delete from), and in each of those cases the entry is either\n * already gone or will be superseded; throwing would report a failure for work\n * that is not needed.\n *\n * Not used where the delete *is* the operation — a save route clearing before\n * it writes must know the clear happened, and that path calls `store.delete`\n * directly.\n *\n * @param store - the caller's credential store.\n * @param account - the entry to remove.\n */\nfunction tryDelete(store: CredentialsStore, account: string): void {\n  try {\n    store.delete(account)\n  } catch {\n    // Best-effort: see the note above.\n  }\n}\n\n/**\n * Read the Huawei Cloud pair.\n *\n * AK and SK are read together and treated as one unit: half a pair reads as no\n * credentials rather than an error, so a partially-configured machine gets\n * \"authenticate first\" instead of a signing failure with no remedy. The\n * SecurityToken is optional and is omitted entirely when absent — an empty\n * string would sign as a third header the gateway then rejects.\n *\n * @param store - the caller's credential store.\n * @returns the pair, or `undefined` when the AK/SK pair is incomplete.\n */\nexport function readStoredPair(store: CredentialsStore): SignCredentials | undefined {\n  const section = readCredentials(store).huaweicloud\n  if (section === undefined) return undefined\n  return {\n    ak: section.access_key,\n    sk: section.secret_key,\n    ...(section.security_token === undefined ? {} : { securityToken: section.security_token }),\n  }\n}\n\n/**\n * Whether a complete Huawei Cloud pair is stored.\n *\n * @param store - the caller's credential store.\n */\nexport function hasStoredPair(store: CredentialsStore): boolean {\n  return readStoredPair(store) !== undefined\n}\n\n/**\n * Read the stored e2b key.\n *\n * @param store - the caller's credential store.\n * @returns the section, or `undefined` when no key is stored.\n */\nexport function readE2BKey(store: CredentialsStore): E2BSection | undefined {\n  return readCredentials(store).aishell_e2b\n}\n\n/**\n * Apply one change to the bundle and write it back.\n *\n * The updater receives the current bundle and returns the next one. Returning\n * `undefined` aborts the write, which is how a caller says \"nothing changed\" —\n * that matters because every write is a full re-encode, and needlessly\n * rewriting a record while another process reads it is how a spurious\n * \"credentials changed\" is produced.\n *\n * @param store - the caller's credential store.\n * @param update - computes the next bundle.\n * @returns the bundle now stored.\n */\nexport function updateCredentials(\n  store: CredentialsStore,\n  update: (current: CredentialBundle) => CredentialBundle | undefined,\n): CredentialBundle {\n  const current = readCredentials(store)\n  const next = update(current)\n  if (next === undefined) return current\n  store.set(CREDENTIAL_ACCOUNT, encodeBundle(next))\n  return next\n}\n\n/**\n * Store the Huawei Cloud pair, replacing whatever is there.\n *\n * One write, so the pair can never be left half-replaced. A save without a\n * token removes a stored one: a token belongs to the credential set that\n * carried it, and inheriting a stale one would sign the next request with\n * someone else's session.\n *\n * @param store - the caller's credential store.\n * @param credentials - the verified pair.\n */\nexport function writeHuaweiCloud(store: CredentialsStore, credentials: SignCredentials): void {\n  updateCredentials(store, current => ({\n    ...current,\n    huaweicloud: {\n      access_key: credentials.ak,\n      secret_key: credentials.sk,\n      ...(credentials.securityToken === undefined ? {} : { security_token: credentials.securityToken }),\n    },\n  }))\n}\n\n/**\n * Store an e2b key.\n *\n * @param store - the caller's credential store.\n * @param key - the section to store.\n */\nexport function writeE2BKey(store: CredentialsStore, key: E2BSection): void {\n  updateCredentials(store, current => ({ ...current, aishell_e2b: key }))\n}\n\n/**\n * Remove the stored e2b key, leaving the Huawei Cloud pair alone.\n *\n * @param store - the caller's credential store.\n */\nexport function clearE2BKey(store: CredentialsStore): void {\n  updateCredentials(store, current => {\n    if (current.aishell_e2b === undefined) return undefined\n    const { aishell_e2b: _removed, ...rest } = current\n    return rest\n  })\n}\n\n/**\n * Remove every credential this repo writes.\n *\n * The whole record goes, so a clear cannot leave a token or a key behind for\n * the next pair to inherit. Deleting an absent entry is a no-op in every\n * backend.\n *\n * The per-field names are removed as well, so a store the fold never reached\n * does not keep answering after a clear. Those deletes are best-effort and the\n * main record's is not: a refusal on `CREDENTIAL_ACCOUNT` means the credentials\n * are still there and the person has to be told, while the per-field names are\n * leftovers whose removal nothing depends on. Swallowing the first would report\n * a clear that did not happen.\n *\n * @param store - the caller's credential store.\n * @throws when the backend refused to remove the main record.\n */\nexport function clearCredentials(store: CredentialsStore): void {\n  store.delete(CREDENTIAL_ACCOUNT)\n  for (const account of LEGACY_ACCOUNTS) tryDelete(store, account)\n  tryDelete(store, LEGACY_E2B_ACCOUNT)\n}\n\n/**\n * A short, stable digest of an AK, for recording which identity minted a key.\n *\n * The AK rather than the pair: the SK can be rotated independently while the\n * account stays the same, and the tenant the gateway derives is the account. A\n * digest rather than the AK itself keeps the bundle from carrying a second\n * readable copy of a credential identifier.\n *\n * @param ak - the access key.\n */\nexport function fingerprint(ak: string): string {\n  return createHash('sha256').update(ak, 'utf8').digest('hex')\n}"],"mappings":";;;;;;;;;AA+EA,MAAa,qBAAqB;;;;;;;;;;;;AAalC,MAAa,kBAAkB;CAAC;CAAiB;CAAiB;AAAoB;;;;;;;AAQtF,MAAa,qBAAqB;;;;;;;AAsClC,SAAgB,aAAaA,QAAkC;AAC7D,QAAO,OAAO,KAAK,KAAK,UAAU,OAAO,EAAE,OAAO,CAAC,SAAS,SAAS;AACtE;;;;;;;;;;;;;;AAeD,SAAgB,aAAaC,KAA2C;AACtE,KAAI,kBAAqB,QAAQ,GAAI,QAAO,CAAE;CAC9C,MAAM,OAAO,WAAW,IAAI;AAC5B,KAAI,gBAAoB,QAAO,CAAE;CACjC,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,KAAK;CAC1B,QAAO;AACN,SAAO,CAAE;CACV;AACD,KAAI,WAAW,eAAe,WAAW,SAAU,QAAO,CAAE;CAC5D,MAAM,YAAY;AAClB,QAAO;EACL,GAAI,qBAAqB,UAAU,YAAY,GAC3C,EAAE,aAAa,UAAU,YAAa,IACtC,CAAE;EACN,GAAI,aAAa,UAAU,YAAY,GACnC,EAAE,aAAa,UAAU,YAAa,IACtC,CAAE;CACP;AACF;;AAGD,SAAS,WAAWC,KAAiC;AACnD,KAAI;EACF,MAAM,UAAU,OAAO,KAAK,KAAK,SAAS;AAG1C,MAAI,QAAQ,SAAS,SAAS,KAAK,IAAI,QAAQ,OAAO,GAAG,EAAE;GACzD,MAAM,OAAO,QAAQ,SAAS,OAAO;AACrC,OAAI,KAAK,WAAW,CAAC,WAAW,IAAI,CAAE,QAAO;EAC9C;CACF,QAAO,CAEP;AACD,QAAO,IAAI,WAAW,CAAC,WAAW,IAAI,GAAG;AAC1C;;AAGD,SAAS,qBAAqBC,OAA6C;AACzE,KAAI,UAAU,eAAe,UAAU,SAAU,QAAO;CACxD,MAAM,UAAU;AAChB,eAAc,QAAQ,eAAe,YAAY,QAAQ,eAAe,aAC5D,QAAQ,eAAe,YAAY,QAAQ,eAAe,OAChE,QAAQ,oCAAuC,QAAQ,mBAAmB;AACjF;;AAGD,SAAS,aAAaA,OAAqC;AACzD,KAAI,UAAU,eAAe,UAAU,SAAU,QAAO;CACxD,MAAM,UAAU;AAChB,eAAc,QAAQ,YAAY,YAAY,QAAQ,YAAY,aACtD,QAAQ,eAAe,YAAY,QAAQ,eAAe,OAChE,QAAQ,oCAAuC,QAAQ,mBAAmB;AACjF;;;;;;;;;;;;AAaD,SAAgB,gBAAgBC,OAA2C;CACzE,MAAM,SAAS,MAAM,IAAI,mBAAmB;AAC5C,KAAI,kBAAsB,QAAO,aAAa,OAAO;CAErD,MAAM,WAAW,cAAc,MAAM;AACrC,KAAI,oBAAwB,QAAO,CAAE;AACrC,QAAO;AACR;;;;;;;AAQD,SAAS,cAAcA,OAAuD;CAC5E,MAAM,KAAK,MAAM,IAAI,gBAAgB,GAAG;CACxC,MAAM,KAAK,MAAM,IAAI,gBAAgB,GAAG;CACxC,MAAM,QAAQ,MAAM,IAAI,gBAAgB,GAAG;CAC3C,MAAM,YAAY,MAAM,IAAI,mBAAmB;CAE/C,MAAMC,cACJ,iBAAoB,OAAO,MAAM,iBAAoB,OAAO,KACxD;EACA,YAAY;EACZ,YAAY;EACZ,GAAI,oBAAuB,UAAU,KAAK,CAAE,IAAG,EAAE,gBAAgB,MAAO;CACzE;CAOL,MAAM,WAAW,iBAAiB,UAAU;AAE5C,KAAI,0BAA6B,oBAAwB;CAEzD,MAAMN,SAA2B;EAC/B,GAAI,yBAA4B,CAAE,IAAG,EAAE,YAAa;EACpD,GAAI,sBAAyB,CAAE,IAAG,EAAE,aAAa,SAAU;CAC5D;AAED,KAAI;AACF,QAAM,IAAI,oBAAoB,aAAa,OAAO,CAAC;CACpD,QAAO;AAGN,SAAO;CACR;AAQD,MAAK,MAAM,WAAW,gBAAmB,WAAU,OAAO,QAAQ;AAClE,WAAU,OAAO,mBAAmB;AACpC,QAAO;AACR;;AAGD,SAAS,iBAAiBC,KAAiD;AACzE,KAAI,kBAAqB,QAAQ,GAAI;CACrC,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,IAAI;CACzB,QAAO;AAGN,SAAO;GAAE,SAAS;GAAK,YAAY;EAAgB;CACpD;CACD,MAAM,YAAY;AAClB,KAAI,cAAc,eAAe,cAAc,SAAU;AACzD,YAAW,UAAU,QAAQ,YAAY,UAAU,QAAQ,GAAI;AAC/D,QAAO;EACL,SAAS,UAAU;EACnB,mBAAmB,UAAU,cAAc,WAAW,UAAU,YAAY;EAC5E,UAAW,UAAU,kBAAkB,YAAY,UAAU,kBAAkB,KAC3E,EAAE,gBAAgB,UAAU,cAAe,IAC3C,CAAE;CACP;AACF;;AAGD,MAAa,iBAAiB;;;;;;;;;;;;;;;;;;AAmB9B,SAAS,UAAUG,OAAyBE,SAAuB;AACjE,KAAI;AACF,QAAM,OAAO,QAAQ;CACtB,QAAO,CAEP;AACF;;;;;;;;;;;;;AAcD,SAAgB,eAAeF,OAAsD;CACnF,MAAM,UAAU,gBAAgB,MAAM,CAAC;AACvC,KAAI,mBAAuB;AAC3B,QAAO;EACL,IAAI,QAAQ;EACZ,IAAI,QAAQ;EACZ,GAAI,QAAQ,4BAA+B,CAAE,IAAG,EAAE,eAAe,QAAQ,eAAgB;CAC1F;AACF;;;;;;AAOD,SAAgB,cAAcA,OAAkC;AAC9D,QAAO,eAAe,MAAM;AAC7B;;;;;;;AAQD,SAAgB,WAAWA,OAAiD;AAC1E,QAAO,gBAAgB,MAAM,CAAC;AAC/B;;;;;;;;;;;;;;AAeD,SAAgB,kBACdA,OACAG,QACkB;CAClB,MAAM,UAAU,gBAAgB,MAAM;CACtC,MAAM,OAAO,OAAO,QAAQ;AAC5B,KAAI,gBAAoB,QAAO;AAC/B,OAAM,IAAI,oBAAoB,aAAa,KAAK,CAAC;AACjD,QAAO;AACR;;;;;;;;;;;;AAaD,SAAgB,iBAAiBH,OAAyBI,aAAoC;AAC5F,mBAAkB,OAAO,CAAA,aAAY;EACnC,GAAG;EACH,aAAa;GACX,YAAY,YAAY;GACxB,YAAY,YAAY;GACxB,GAAI,YAAY,2BAA8B,CAAE,IAAG,EAAE,gBAAgB,YAAY,cAAe;EACjG;CACF,GAAE;AACJ;;;;;;;AAQD,SAAgB,YAAYJ,OAAyBK,KAAuB;AAC1E,mBAAkB,OAAO,CAAA,aAAY;EAAE,GAAG;EAAS,aAAa;CAAK,GAAE;AACxE;;;;;;AAOD,SAAgB,YAAYL,OAA+B;AACzD,mBAAkB,OAAO,CAAA,YAAW;AAClC,MAAI,QAAQ,uBAA2B;EACvC,MAAM,EAAE,aAAa,SAAU,GAAG,MAAM,GAAG;AAC3C,SAAO;CACR,EAAC;AACH;;;;;;;;;;;;;;;;;;AAmBD,SAAgB,iBAAiBA,OAA+B;AAC9D,OAAM,OAAO,mBAAmB;AAChC,MAAK,MAAM,WAAW,gBAAiB,WAAU,OAAO,QAAQ;AAChE,WAAU,OAAO,mBAAmB;AACrC;;;;;;;;;;;AAYD,SAAgB,YAAYM,IAAoB;AAC9C,QAAO,WAAW,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,MAAM;AAC7D"}

package/lib/{index-JlyJE1E8.d.ts → index-Cdsu1kDC.d.ts}

@@ -24,8 +24,8 @@ declare function __setKeyringModule(mock: KeyringModule | undefined): void;
  * Construction probes the keyring once — if the native module cannot be loaded
  * (no prebuilt binding for this platform), or the Linux Secret Service is
  * unavailable, it throws and {@link createCredentialsStore} falls back to the
- * next backend. Without the pin the absent-service case does not throw; see
- * the module note.
+ * next backend. The pin is what makes the second case throw; see the module
+ * note.
  */
 declare class KeyringBackend implements CredentialsStore {
   private readonly serviceName;
@@ -38,6 +38,21 @@ declare class KeyringBackend implements CredentialsStore {
   has(account: string): boolean;
 } //#endregion
 //#region src/backends/fingerprint.d.ts
+/**
+ * A credentials file that exists but cannot be decrypted or parsed.
+ *
+ * Its own type rather than a plain `Error` because the write path has to tell
+ * this case from every other failure: this is the one where overwriting the
+ * file would destroy credentials the person still has, so `set` moves it aside
+ * first. Anything else propagates unchanged.
+ */
+declare class UnreadableCredentialsFile extends Error {
+  /** The file that could not be read. */
+  readonly filePath: string;
+  constructor(/** The file that could not be read. */
+  filePath: string, /** What decryption or parsing reported. */
+  cause: unknown);
+}
 /**
  * Encrypted-file {@link CredentialsStore}. Each account is one entry in a
  * single JSON map, encrypted as one file under the resolved credentials
@@ -56,18 +71,78 @@ declare class FingerprintBackend implements CredentialsStore {
    * read, used, and dropped so plaintext does not linger in memory between
    * operations. The file I/O + scrypt decrypt per call is acceptable: this is
    * not a hot path (once per chat request, not per token).
+   *
+   * @throws {@link UnreadableCredentialsFile} when the file exists but cannot be
+   *   decrypted or parsed. Callers decide what that means; see the note on
+   *   {@link FingerprintBackend.loadForWrite}.
    */
   private load;
+  /**
+   * Load for a write, where an unreadable file must not be silently replaced.
+   *
+   * ## Why this is not just `load()` with the error swallowed
+   *
+   * `set` re-encrypts and rewrites the *whole* map. If load failed and returned
+   * empty, the next save would write a one-entry file over every other
+   * credential the person had stored — with no error, no backup and nothing to
+   * recover from. An unreadable file is not proof of an empty one: a truncated
+   * write, a machine-id that changed under the file, or a build whose salt
+   * moved all look identical from here.
+   *
+   * So the unreadable file is moved aside instead of overwritten. Saving
+   * therefore keeps working on a machine that inherited someone else's file —
+   * the documented VM-clone case — while whatever was in it stays on disk under
+   * a name that says what happened to it.
+   *
+   * @returns the current entries, or an empty map when the old file was moved
+   *   aside.
+   */
+  private loadForWrite;
+  /**
+   * Move an unreadable file out of the way.
+   *
+   * The suffix carries a timestamp and, if that name is taken, a counter — the
+   * quarantine must never itself throw over a name collision and must never
+   * overwrite a previous one, since the files it preserves are the only copy of
+   * what was there. The counter is bounded because an unbounded retry loop over
+   * a filesystem is a hang, not a fallback; reaching the bound means something
+   * outside this process is wrong and saying so is better than spinning.
+   */
+  private quarantine;
   /** Encrypt + write the map to disk with owner-only permissions. */
   private persist;
+  /**
+   * Read one entry.
+   *
+   * An unreadable file reads as absent rather than throwing. The alternative —
+   * failing every tool call on a parse error — leaves the person with no
+   * working path; "not authenticated" at least routes them to the form that can
+   * fix it. The write path is where the difference is preserved; see
+   * {@link FingerprintBackend.loadForWrite}.
+   */
   get(account: string): string | undefined;
   set(account: string, value: string): void;
+  /**
+   * Remove one entry.
+   *
+   * An unreadable file **throws** rather than being a silent no-op. There is
+   * nothing to remove from a map that cannot be read, and answering "done"
+   * would be a clear that did not clear: the file stays on disk, and the
+   * moment whatever made it unreadable is undone — a restored machine id, a
+   * repaired file — the credential reads back. `clearCredentials` relies on
+   * exactly this signal to tell the person the clear failed.
+   *
+   * Quarantining instead is not an option here: it would move the file out of
+   * the way, which is the destruction this method must not perform — a delete
+   * asked for one entry, not for every entry.
+   *
+   * @throws {@link UnreadableCredentialsFile} when the file cannot be read.
+   */
   delete(account: string): void;
   has(account: string): boolean;
-}
-
-//#endregion
+} //#endregion
 //#region src/backends/memory.d.ts
+
 //# sourceMappingURL=fingerprint.d.ts.map
 /** Process-scoped {@link CredentialsStore}; entries vanish on exit. */
 declare class MemoryBackend implements CredentialsStore {
@@ -108,9 +183,9 @@ interface FailoverStoreOptions {
  *
  * Stickiness is per instance, not per process: each plugin that consumes
  * credentials builds its own store, so one instance failing over does not stop
- * another from trying the primary. That is intended — the flag only exists to
+ * another from trying the primary. That is intentional — the flag exists to
  * avoid re-hitting a primary already known to be unwritable from *this* store,
- * and a second instance's attempt is one probe rather than a policy decision.
+ * so a second instance's attempt is one probe rather than a policy decision.
  * Correctness across instances comes from the persisted record, not the flag.
  *
  * Constructed by {@link createCredentialsStore} around a KeyringBackend whose
@@ -156,9 +231,9 @@ declare class FailoverStore implements CredentialsStore {
  * call {@link createCredentialsStore} and get a {@link CredentialsStore} —
  * they never learn which backend is serving. The factory probes backends in
  * priority order (OS keyring first, process memory last) and returns the
- * first that answers. New backends (fingerprint + encrypted file, etc.) slot
- * into the chain without touching callers. A keyring that answers the probe
- * but later rejects writes fails over to the next backend on first failure.
+ * first that answers, so a backend can be added to the chain without any
+ * caller changing. A keyring that answers the probe but later rejects writes
+ * fails over to the next backend on first failure.
  *
  * This is a tool library, not a DSH plugin — no `dsh.client`, no
  * `cordis.patch.yml`, no `apply`. DSH's own `ctx.credentials` is untouched;
@@ -215,5 +290,5 @@ interface CredentialsStore {
 declare function createCredentialsStore(config?: CredentialsStoreConfig): CredentialsStore;
 
 //#endregion
-export { CredentialsStore, CredentialsStoreConfig, FailoverStore, FingerprintBackend, KeyringBackend, MemoryBackend, __resetSharedMemoryBackend, __setKeyringModule, createCredentialsStore, sharedMemoryBackend };
-//# sourceMappingURL=index-JlyJE1E8.d.ts.map
+export { CredentialsStore, CredentialsStoreConfig, FailoverStore, FingerprintBackend, KeyringBackend, MemoryBackend, UnreadableCredentialsFile, __resetSharedMemoryBackend, __setKeyringModule, createCredentialsStore, sharedMemoryBackend };
+//# sourceMappingURL=index-Cdsu1kDC.d.ts.map

package/lib/index-Cdsu1kDC.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-Cdsu1kDC.d.ts","names":[],"sources":["../../src/backends/keyring.ts","../../src/backends/fingerprint.ts","../../src/backends/memory.ts","../../src/failover.ts","../../src/index.ts"],"sourcesContent":null,"mappings":";;KAuCK,YAAA;;;;;;KAMA,mBAAA;ECiEQ,KAAA,CAAA,EAAA;;;;KDhER,aAAA;0DACqD,wBAAwB;;;iBAKlE,kBAAA,OAAyB;;ACkFzC;;;;AAA2D;;;;;ACrH3D;AAA2B,cFuDd,cAAA,YAA0B,gBEvDZ,CAAA;EAAA,iBAGJ,WAAA;EAA2B,iBAHZ,OAAA;EAAgB,iBAAA,KAAA;EAwDtC,WAAA,CAAA,OAAmB,CAAnB,EFIO,sBEJY;EAAA,GAAA,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,SAAA;EAAA,GAAS,CAAA,OAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAA2B,MAAG,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAa,GAAA,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,OAAA;;;;;;;;;;;AFD1E,cCsCA,yBAAA,SAAkC,KAAK,CDtCxB;EAAA;EAAA,SAKL,QAAA,EAAA,MAAA;EAA2B,WALX,CAAgB;;;;;;;;;;;ACsCvD;;cAwBa,kBAAA,YAA8B;;;uBAIrB;;;;;AAJtB;;;;AAA2D;;;;;ACrH3D;;;;AAAsD;AAwDtD;;;;AAAuF;;;;;;;AAWvF;;;;;ACcA;;;;;;;;;;;;;;;;AAyBA;;;;EAOsE,GAPhC,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,SAAA;EAAgB,GAAA,CAAA,OAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;;;;;;;;;;;;;;;;;;;;;;;;cD1GzC,aAAA,YAAyB;;wBAGf;;;;EFoDV,GAAA,CAAA,OAAA,EAAA,MAAe,CAAA,EAAA,OAAA;;AAKL,iBEJP,mBAAA,CFIO,MAAA,CAAA,EEJqB,sBFIrB,CAAA,EEJmD,aFInD;;AALgC;;;;;iBEYvC,0BAAA,CAAA;;;;;;;UCcC,oBAAA;;;;;;;iCAOgB;;;;;;;AAkBjC;;;;;AAAsD;;;;;cAAzC,aAAA,YAAyB;;;;;;uBAOf,2BAA2B;;;;;;;;;;;EC1GjC,GAAA,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,MAAsB,GAAA,SAAA;;;;;;;;AAiBvC;;;;;;;;;AJT2E;AAO1D;AAMO;;;;AAEsE;;AAK9F;;;;;;;;;UI5BiB,sBAAA;;;AJgDjB;;;;EAAuD,SAAA,cAAA,CAAA,EAAA,MAAA;;;;;;;;;UI/BtC,gBAAA;;;EHqEJ;;;;;;;;;;AAwBb;;;;AAA2D;;;;;ACrH3D;;;;AAAsD;AAwDtD;;AAA4C,iBEF5B,sBAAA,CFE4B,MAAA,CAAA,EEFG,sBFEH,CAAA,EEFiC,gBFEjC"}

package/lib/index.d.ts

@@ -1,3 +1,3 @@
-import { CREDENTIALS_FILE_NAME$1 as CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE$1 as CREDENTIAL_SCOPE, DEFAULT_SCOPE$1 as DEFAULT_SCOPE, KEYRING_SERVICE$1 as KEYRING_SERVICE } from "./scope-CFetnbG3.js";
-import { CredentialsStore, CredentialsStoreConfig, FailoverStore, FingerprintBackend, KeyringBackend, MemoryBackend, __resetSharedMemoryBackend, __setKeyringModule, createCredentialsStore, sharedMemoryBackend } from "./index-JlyJE1E8.js";
-export { CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE, CredentialsStore, CredentialsStoreConfig, DEFAULT_SCOPE, FailoverStore, FingerprintBackend, KEYRING_SERVICE, KeyringBackend, MemoryBackend, __resetSharedMemoryBackend, __setKeyringModule, createCredentialsStore, sharedMemoryBackend };
+import { CREDENTIALS_FILE_NAME$1 as CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE$1 as CREDENTIAL_SCOPE, DEFAULT_SCOPE$1 as DEFAULT_SCOPE, KEYRING_SERVICE$1 as KEYRING_SERVICE } from "./scope-C7w2eTvE.js";
+import { CredentialsStore, CredentialsStoreConfig, FailoverStore, FingerprintBackend, KeyringBackend, MemoryBackend, UnreadableCredentialsFile, __resetSharedMemoryBackend, __setKeyringModule, createCredentialsStore, sharedMemoryBackend } from "./index-Cdsu1kDC.js";
+export { CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE, CredentialsStore, CredentialsStoreConfig, DEFAULT_SCOPE, FailoverStore, FingerprintBackend, KEYRING_SERVICE, KeyringBackend, MemoryBackend, UnreadableCredentialsFile, __resetSharedMemoryBackend, __setKeyringModule, createCredentialsStore, sharedMemoryBackend };