@lightharu/krouter 1.8.0

package/out-server/server/services/kproxyRuntime.js

@@ -0,0 +1,264 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KProxyRuntime = void 0;
+exports.getKProxyRuntime = getKProxyRuntime;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = __importDefault(require("path"));
+const kproxy_1 = require("../../main/kproxy");
+const runtimePaths_1 = require("../../main/runtimePaths");
+function serializeCaInfo(caInfo) {
+    if (!caInfo)
+        return null;
+    return {
+        certPath: caInfo.certPath,
+        keyPath: caInfo.keyPath,
+        fingerprint: caInfo.fingerprint,
+        validFrom: caInfo.validFrom instanceof Date ? caInfo.validFrom.toISOString() : caInfo.validFrom,
+        validTo: caInfo.validTo instanceof Date ? caInfo.validTo.toISOString() : caInfo.validTo
+    };
+}
+class KProxyRuntime {
+    store;
+    userId;
+    emit;
+    service = null;
+    constructor(store, userId, emit) {
+        this.store = store;
+        this.userId = userId;
+        this.emit = emit;
+    }
+    get savedConfig() {
+        return this.store.getUserSetting(this.userId, 'kproxyConfig', {});
+    }
+    get mappings() {
+        return this.store.getUserSetting(this.userId, 'kproxyDeviceMappings', []);
+    }
+    async persistConfig() {
+        if (this.service)
+            await this.store.setUserSetting(this.userId, 'kproxyConfig', this.service.getConfig());
+    }
+    async persistMappings() {
+        if (this.service)
+            await this.store.setUserSetting(this.userId, 'kproxyDeviceMappings', this.service.getAllDeviceIdMappings());
+    }
+    getOrCreateService(config) {
+        if (!this.service) {
+            this.service = (0, kproxy_1.initKProxyService)({ ...this.savedConfig, ...config }, {
+                onRequest: (info) => this.emit('kproxy-request', info),
+                onResponse: (info) => this.emit('kproxy-response', info),
+                onError: (error) => this.emit('kproxy-error', error.message),
+                onStatusChange: (running, port) => this.emit('kproxy-status-change', { running, port }),
+                onMitmIntercept: (host, modified) => this.emit('kproxy-mitm', { host, modified })
+            });
+            for (const mapping of this.mappings)
+                this.service.addDeviceIdMapping(mapping);
+        }
+        else if (config) {
+            this.service.updateConfig(config);
+        }
+        return this.service;
+    }
+    async init() {
+        try {
+            const service = this.getOrCreateService();
+            const caInfo = await service.initialize();
+            await this.persistConfig();
+            return { success: true, caInfo: serializeCaInfo(caInfo) };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : 'Failed to initialize K-Proxy' };
+        }
+    }
+    async start(config) {
+        try {
+            const service = this.getOrCreateService(config);
+            await service.start();
+            await this.persistConfig();
+            return { success: true, port: service.getConfig().port };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : 'Failed to start K-Proxy' };
+        }
+    }
+    async stop() {
+        try {
+            if (this.service)
+                await this.service.stop();
+            await this.persistConfig();
+            return { success: true };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : 'Failed to stop K-Proxy' };
+        }
+    }
+    getStatus() {
+        const service = this.getOrCreateService();
+        return {
+            running: service.isRunning(),
+            config: service.getConfig(),
+            stats: service.getStats(),
+            caInfo: serializeCaInfo(service.getCACertInfo())
+        };
+    }
+    async updateConfig(config) {
+        try {
+            const service = this.getOrCreateService(config);
+            await this.persistConfig();
+            return { success: true, config: service.getConfig() };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : 'Failed to update K-Proxy config' };
+        }
+    }
+    async setDeviceId(deviceId) {
+        try {
+            this.getOrCreateService().setDeviceId(deviceId);
+            await this.persistConfig();
+            return { success: true };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : 'Failed to set device ID' };
+        }
+    }
+    generateDeviceId() {
+        return { success: true, deviceId: (0, kproxy_1.generateDeviceId)() };
+    }
+    async addDeviceMapping(mapping) {
+        try {
+            this.getOrCreateService().addDeviceIdMapping(mapping);
+            await this.persistMappings();
+            return { success: true };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : 'Failed to add device mapping' };
+        }
+    }
+    getDeviceMappings() {
+        return { success: true, mappings: this.getOrCreateService().getAllDeviceIdMappings() };
+    }
+    async switchToAccount(accountId) {
+        const service = this.getOrCreateService();
+        const success = service.switchToAccount(accountId);
+        await this.persistConfig();
+        await this.persistMappings();
+        return { success, error: success ? undefined : 'No device ID mapping for account' };
+    }
+    async getCaCert() {
+        const initResult = await this.init();
+        if (!initResult.success)
+            return { success: false, error: initResult.error };
+        const service = this.getOrCreateService();
+        const certPem = service.getCACertPem();
+        const caInfo = service.getCACertInfo();
+        if (!certPem || !caInfo)
+            return { success: false, error: 'CA certificate not available' };
+        return { success: true, certPem, certPath: caInfo.certPath, fingerprint: caInfo.fingerprint };
+    }
+    async exportCaCert(exportPath) {
+        const cert = await this.getCaCert();
+        if (!cert.success || !cert.certPem)
+            return { success: false, error: cert.error || 'CA certificate not available' };
+        const targetPath = exportPath || path_1.default.join((0, runtimePaths_1.getRuntimeUserDataPath)(), 'kproxy-ca.crt');
+        await fs_1.promises.mkdir(path_1.default.dirname(targetPath), { recursive: true });
+        await fs_1.promises.writeFile(targetPath, cert.certPem, 'utf8');
+        return { success: true, path: targetPath };
+    }
+    async checkCaCertInstalled() {
+        try {
+            const cert = await this.getCaCert();
+            if (!cert.success)
+                return { success: false, installed: false, error: cert.error };
+            if (process.platform === 'win32') {
+                try {
+                    const output = (0, child_process_1.execSync)('certutil -store -user Root "K-Proxy CA"', { encoding: 'utf8' });
+                    return { success: true, installed: output.includes('K-Proxy CA') };
+                }
+                catch {
+                    return { success: true, installed: false };
+                }
+            }
+            if (process.platform === 'darwin') {
+                try {
+                    (0, child_process_1.execSync)('security find-certificate -c "K-Proxy CA" ~/Library/Keychains/login.keychain-db', { encoding: 'utf8' });
+                    return { success: true, installed: true };
+                }
+                catch {
+                    return { success: true, installed: false };
+                }
+            }
+            const linuxPath = '/usr/local/share/ca-certificates/kproxy-ca.crt';
+            try {
+                await fs_1.promises.access(linuxPath);
+                return { success: true, installed: true };
+            }
+            catch {
+                return { success: true, installed: false };
+            }
+        }
+        catch (error) {
+            return { success: false, installed: false, error: error instanceof Error ? error.message : 'Failed to check CA certificate' };
+        }
+    }
+    async installCaCert() {
+        try {
+            const cert = await this.getCaCert();
+            if (!cert.success || !cert.certPath)
+                return { success: false, error: cert.error || 'CA certificate not available' };
+            if (process.platform === 'win32') {
+                (0, child_process_1.execSync)(`certutil -addstore -user Root "${cert.certPath}"`, { encoding: 'utf8' });
+                return { success: true, message: 'CA certificate installed to Windows certificate store' };
+            }
+            if (process.platform === 'darwin') {
+                (0, child_process_1.execSync)(`security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db "${cert.certPath}"`);
+                return { success: true, message: 'CA certificate installed to macOS Keychain' };
+            }
+            const linuxPath = '/usr/local/share/ca-certificates/kproxy-ca.crt';
+            await fs_1.promises.copyFile(cert.certPath, linuxPath);
+            (0, child_process_1.execSync)('update-ca-certificates');
+            return { success: true, message: 'CA certificate installed to Linux CA store' };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : 'Failed to install CA certificate' };
+        }
+    }
+    async uninstallCaCert() {
+        try {
+            if (process.platform === 'win32') {
+                (0, child_process_1.execSync)('certutil -delstore -user Root "K-Proxy CA"', { encoding: 'utf8' });
+                return { success: true, message: 'CA certificate removed from Windows certificate store' };
+            }
+            if (process.platform === 'darwin') {
+                (0, child_process_1.execSync)('security delete-certificate -c "K-Proxy CA" ~/Library/Keychains/login.keychain-db');
+                return { success: true, message: 'CA certificate removed from macOS Keychain' };
+            }
+            const linuxPath = '/usr/local/share/ca-certificates/kproxy-ca.crt';
+            try {
+                await fs_1.promises.unlink(linuxPath);
+            }
+            catch { /* not installed */ }
+            (0, child_process_1.execSync)('update-ca-certificates --fresh');
+            return { success: true, message: 'CA certificate removed from Linux CA store' };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : 'Failed to uninstall CA certificate' };
+        }
+    }
+    resetStats() {
+        this.getOrCreateService().resetStats();
+        return { success: true };
+    }
+}
+exports.KProxyRuntime = KProxyRuntime;
+const runtimes = new Map();
+function getKProxyRuntime(store, userId, emit) {
+    const existing = runtimes.get(userId);
+    if (existing)
+        return existing;
+    const runtime = new KProxyRuntime(store, userId, emit);
+    runtimes.set(userId, runtime);
+    return runtime;
+}

package/out-server/server/services/localKiroCredentials.js

@@ -0,0 +1,320 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLocalActiveAccount = getLocalActiveAccount;
+exports.loadKiroCredentials = loadKiroCredentials;
+exports.switchAccount = switchAccount;
+exports.switchAccountCli = switchAccountCli;
+exports.logoutAccount = logoutAccount;
+const child_process_1 = require("child_process");
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = require("fs");
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const kiroAccounts_1 = require("./kiroAccounts");
+const SOCIAL_PROFILE_ARN = 'arn:aws:codewhisperer:us-east-1:699475941385:profile/EHGA3GRVQMUK';
+const LEGACY_BUILDER_ID_PROFILE_ARN = 'arn:aws:codewhisperer:us-east-1:638616132270:profile/AAAACCCCXXXX';
+function ssoCacheDir() {
+    return path_1.default.resolve(process.env.KIRO_SSO_CACHE_DIR || path_1.default.join(os_1.default.homedir(), '.aws', 'sso', 'cache'));
+}
+function tokenPath() {
+    return path_1.default.join(ssoCacheDir(), 'kiro-auth-token.json');
+}
+function clientIdHashForStartUrl(startUrl = 'https://view.awsapps.com/start') {
+    return crypto_1.default.createHash('sha1').update(JSON.stringify({ startUrl })).digest('hex');
+}
+function cliDataDir() {
+    if (process.env.KIRO_CLI_DATA_DIR)
+        return path_1.default.resolve(process.env.KIRO_CLI_DATA_DIR);
+    return process.platform === 'win32'
+        ? path_1.default.join(os_1.default.homedir(), 'AppData', 'Local', 'kiro-cli')
+        : path_1.default.join(os_1.default.homedir(), '.local', 'share', 'kiro-cli');
+}
+function cliDbPath() {
+    return process.env.KIRO_CLI_DB_PATH
+        ? path_1.default.resolve(process.env.KIRO_CLI_DB_PATH)
+        : path_1.default.join(cliDataDir(), 'data.sqlite3');
+}
+function sqlEscape(value) {
+    return JSON.stringify(value).replace(/'/g, "''");
+}
+function runSqlite(dbPath, sql) {
+    try {
+        (0, child_process_1.execFileSync)(process.platform === 'win32' ? 'sqlite3.exe' : 'sqlite3', [dbPath], { input: sql, encoding: 'utf8', timeout: 10000 });
+        return;
+    }
+    catch (cliError) {
+        try {
+            const sqlite = require('node:sqlite');
+            const database = new sqlite.DatabaseSync(dbPath);
+            try {
+                database.exec(sql);
+            }
+            finally {
+                database.close();
+            }
+            return;
+        }
+        catch (nodeError) {
+            throw new Error(`sqlite3 command or Node node:sqlite is required for CLI switching on this VPS. sqlite3: ${cliError instanceof Error ? cliError.message : String(cliError)}; node:sqlite: ${nodeError instanceof Error ? nodeError.message : String(nodeError)}`);
+        }
+    }
+}
+function isSocialCredential(credentials) {
+    const authMethod = String(credentials.authMethod || '').toLowerCase();
+    const provider = String(credentials.provider || '').toLowerCase();
+    return authMethod === 'social' || provider === 'google' || provider === 'github';
+}
+function normalizeProfileArn(profileArn) {
+    let value = profileArn?.trim();
+    if (!value || value === LEGACY_BUILDER_ID_PROFILE_ARN)
+        return undefined;
+    if (!value.startsWith('arn:') && value.includes(':codewhisperer:'))
+        value = `arn:${value}`;
+    return value;
+}
+function resolveCredentialProfileArn(credentials) {
+    const explicit = normalizeProfileArn(credentials.profileArn);
+    if (explicit)
+        return explicit;
+    if (isSocialCredential(credentials))
+        return SOCIAL_PROFILE_ARN;
+    const authMethod = String(credentials.authMethod || '').toLowerCase();
+    const provider = String(credentials.provider || '').toLowerCase();
+    return provider === 'builderid' || (!provider && (authMethod === 'idc' || authMethod === 'oidc'))
+        ? LEGACY_BUILDER_ID_PROFILE_ARN
+        : undefined;
+}
+function kiroUserDataDirs() {
+    const dirs = new Set();
+    if (process.env.KIRO_USER_DATA_DIR)
+        dirs.add(path_1.default.resolve(process.env.KIRO_USER_DATA_DIR));
+    if (process.env.KIRO_IDE_USER_DATA_DIR)
+        dirs.add(path_1.default.resolve(process.env.KIRO_IDE_USER_DATA_DIR));
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA || path_1.default.join(os_1.default.homedir(), 'AppData', 'Roaming');
+        dirs.add(path_1.default.join(appData, 'Kiro'));
+    }
+    else if (process.platform === 'darwin') {
+        dirs.add(path_1.default.join(os_1.default.homedir(), 'Library', 'Application Support', 'Kiro'));
+    }
+    else {
+        dirs.add(path_1.default.join(os_1.default.homedir(), '.config', 'Kiro'));
+    }
+    return Array.from(dirs);
+}
+function kiroProfilePaths() {
+    const paths = new Set();
+    if (process.env.KIRO_IDE_PROFILE_PATH)
+        paths.add(path_1.default.resolve(process.env.KIRO_IDE_PROFILE_PATH));
+    for (const userDataDir of kiroUserDataDirs()) {
+        for (const extensionId of ['kiro.kiroagent', 'kiro.kiro-agent']) {
+            paths.add(path_1.default.join(userDataDir, 'User', 'globalStorage', extensionId, 'profile.json'));
+        }
+    }
+    return Array.from(paths);
+}
+async function readKiroIdeProfile() {
+    for (const profilePath of kiroProfilePaths()) {
+        try {
+            const data = JSON.parse(await fs_1.promises.readFile(profilePath, 'utf8'));
+            const profileArn = normalizeProfileArn(data.profileArn || data.profile_arn || data.arn);
+            if (profileArn)
+                return { profileArn, name: data.name, path: profilePath };
+        }
+        catch {
+            // Try the next known Kiro profile location.
+        }
+    }
+    return null;
+}
+async function findClientRegistration(clientIdHash) {
+    if (clientIdHash) {
+        try {
+            return JSON.parse(await fs_1.promises.readFile(path_1.default.join(ssoCacheDir(), `${clientIdHash}.json`), 'utf8'));
+        }
+        catch {
+            // Search below.
+        }
+    }
+    try {
+        for (const file of await fs_1.promises.readdir(ssoCacheDir())) {
+            if (!file.endsWith('.json') || file === 'kiro-auth-token.json')
+                continue;
+            try {
+                const data = JSON.parse(await fs_1.promises.readFile(path_1.default.join(ssoCacheDir(), file), 'utf8'));
+                if (data.clientId && data.clientSecret)
+                    return data;
+            }
+            catch {
+                // Ignore unrelated cache files.
+            }
+        }
+    }
+    catch {
+        // Cache directory does not exist.
+    }
+    return null;
+}
+async function getLocalActiveAccount() {
+    try {
+        const tokenData = JSON.parse(await fs_1.promises.readFile(tokenPath(), 'utf8'));
+        if (!tokenData.refreshToken)
+            return { success: false, error: 'No refreshToken found in VPS SSO cache' };
+        return {
+            success: true,
+            data: {
+                refreshToken: tokenData.refreshToken,
+                accessToken: tokenData.accessToken,
+                authMethod: tokenData.authMethod,
+                provider: tokenData.provider
+            }
+        };
+    }
+    catch (error) {
+        return { success: false, error: error instanceof Error ? error.message : 'Unable to read VPS SSO cache' };
+    }
+}
+async function loadKiroCredentials() {
+    try {
+        const tokenData = JSON.parse(await fs_1.promises.readFile(tokenPath(), 'utf8'));
+        if (!tokenData.refreshToken)
+            return { success: false, error: 'kiro-auth-token.json is missing refreshToken' };
+        const clientIdHash = tokenData.clientIdHash || clientIdHashForStartUrl();
+        const clientData = await findClientRegistration(clientIdHash);
+        const isSocial = tokenData.authMethod === 'social';
+        if (!isSocial && (!clientData?.clientId || !clientData.clientSecret)) {
+            return { success: false, error: 'Client registration file was not found in VPS SSO cache' };
+        }
+        const ideProfile = await readKiroIdeProfile();
+        const profileArn = resolveCredentialProfileArn({
+            authMethod: tokenData.authMethod,
+            provider: tokenData.provider,
+            profileArn: tokenData.profileArn || tokenData.profile_arn || ideProfile?.profileArn
+        });
+        return {
+            success: true,
+            data: {
+                accessToken: tokenData.accessToken || '',
+                refreshToken: tokenData.refreshToken,
+                clientId: clientData?.clientId || '',
+                clientSecret: clientData?.clientSecret || '',
+                region: tokenData.region || 'us-east-1',
+                authMethod: tokenData.authMethod || 'IdC',
+                provider: tokenData.provider || 'BuilderId',
+                profileArn,
+                startUrl: tokenData.startUrl || tokenData.start_url,
+                machineId: tokenData.machineId || tokenData.machine_id
+            }
+        };
+    }
+    catch (error) {
+        return { success: false, error: error instanceof Error ? error.message : 'Unable to load VPS Kiro credentials' };
+    }
+}
+async function switchAccount(credentials) {
+    try {
+        const region = credentials.region || 'us-east-1';
+        const authMethod = isSocialCredential(credentials) ? 'social' : 'IdC';
+        const provider = credentials.provider || 'BuilderId';
+        let accessToken = credentials.accessToken;
+        if (credentials.refreshToken) {
+            const refreshed = await (0, kiroAccounts_1.refreshTokenByMethod)({
+                refreshToken: credentials.refreshToken,
+                clientId: credentials.clientId,
+                clientSecret: credentials.clientSecret,
+                region,
+                authMethod
+            });
+            if (refreshed.success && refreshed.accessToken)
+                accessToken = refreshed.accessToken;
+        }
+        const startUrl = credentials.startUrl || 'https://view.awsapps.com/start';
+        const clientIdHash = clientIdHashForStartUrl(startUrl);
+        const profileArn = resolveCredentialProfileArn({ ...credentials, authMethod, provider });
+        await fs_1.promises.mkdir(ssoCacheDir(), { recursive: true });
+        const tokenData = authMethod === 'social'
+            ? { accessToken, refreshToken: credentials.refreshToken, profileArn, expiresAt: new Date(Date.now() + 3600000).toISOString(), authMethod, provider }
+            : { accessToken, refreshToken: credentials.refreshToken, expiresAt: new Date(Date.now() + 3600000).toISOString(), clientIdHash, authMethod, provider, region, profileArn };
+        await fs_1.promises.writeFile(tokenPath(), JSON.stringify(tokenData, null, 2), 'utf8');
+        if (authMethod !== 'social' && credentials.clientId && credentials.clientSecret) {
+            await fs_1.promises.writeFile(path_1.default.join(ssoCacheDir(), `${clientIdHash}.json`), JSON.stringify({
+                clientId: credentials.clientId,
+                clientSecret: credentials.clientSecret,
+                expiresAt: new Date(Date.now() + 90 * 86400000).toISOString().replace('Z', ''),
+                scopes: [
+                    'codewhisperer:completions',
+                    'codewhisperer:analysis',
+                    'codewhisperer:conversations',
+                    'codewhisperer:transformations',
+                    'codewhisperer:taskassist'
+                ]
+            }, null, 2), 'utf8');
+        }
+        return { success: true };
+    }
+    catch (error) {
+        return { success: false, error: error instanceof Error ? error.message : 'Failed to switch VPS Kiro account' };
+    }
+}
+async function switchAccountCli(credentials) {
+    try {
+        const region = credentials.region || 'us-east-1';
+        const isSocial = isSocialCredential(credentials);
+        let accessToken = credentials.accessToken;
+        if (credentials.refreshToken) {
+            const refreshed = await (0, kiroAccounts_1.refreshTokenByMethod)({
+                refreshToken: credentials.refreshToken,
+                clientId: credentials.clientId,
+                clientSecret: credentials.clientSecret,
+                region,
+                authMethod: isSocial ? 'social' : undefined
+            });
+            if (refreshed.success && refreshed.accessToken)
+                accessToken = refreshed.accessToken;
+        }
+        const dbPath = cliDbPath();
+        await fs_1.promises.mkdir(path_1.default.dirname(dbPath), { recursive: true });
+        const tokenKey = isSocial ? 'kirocli:social:token' : 'kirocli:odic:token';
+        const profileArn = resolveCredentialProfileArn(credentials);
+        const tokenData = {
+            access_token: accessToken,
+            refresh_token: credentials.refreshToken,
+            expires_at: new Date(Date.now() + 3600000).toISOString(),
+            region,
+            profile_arn: profileArn
+        };
+        if (credentials.scopes)
+            tokenData.scopes = credentials.scopes;
+        const sql = [
+            'CREATE TABLE IF NOT EXISTS auth_kv (key TEXT PRIMARY KEY, value TEXT);',
+            `INSERT OR REPLACE INTO auth_kv (key, value) VALUES ('${tokenKey}', '${sqlEscape(tokenData)}');`,
+            ...(credentials.clientId && credentials.clientSecret && !isSocial
+                ? [`INSERT OR REPLACE INTO auth_kv (key, value) VALUES ('kirocli:odic:device-registration', '${sqlEscape({ client_id: credentials.clientId, client_secret: credentials.clientSecret, region })}');`]
+                : []),
+            ...['kirocli:social:token', 'kirocli:odic:token', 'codewhisperer:odic:token']
+                .filter((key) => key !== tokenKey)
+                .map((key) => `DELETE FROM auth_kv WHERE key = '${key}';`)
+        ].join('\n');
+        runSqlite(dbPath, sql);
+        return { success: true, dbPath };
+    }
+    catch (error) {
+        return { success: false, error: error instanceof Error ? error.message : 'Failed to switch VPS Kiro CLI account' };
+    }
+}
+async function logoutAccount() {
+    try {
+        const files = await fs_1.promises.readdir(ssoCacheDir()).catch(() => []);
+        let deletedCount = 0;
+        for (const file of files) {
+            await fs_1.promises.unlink(path_1.default.join(ssoCacheDir(), file)).then(() => { deletedCount++; }).catch(() => undefined);
+        }
+        return { success: true, deletedCount };
+    }
+    catch (error) {
+        return { success: false, error: error instanceof Error ? error.message : 'Failed to clear VPS SSO cache' };
+    }
+}