@modelprofile.com/authswitch 2.1.2

package/dist_ts/classes.credentialstore.d.ts

@@ -0,0 +1,32 @@
+export declare const credentialRecord: (value: unknown) => Record<string, unknown>;
+export declare const credentialText: (value: unknown) => string | undefined;
+export declare const credentialHash: (value: string) => string;
+/** A bounded file read; malformed secrets never become parser diagnostics in the CLI. */
+export declare const readCredentialDocument: (file: string) => {
+    raw: string | null;
+    data: Record<string, unknown>;
+};
+export interface IStoredCredential {
+    schemaVersion: 1;
+    id: string;
+    slotId: string;
+    identity: string;
+    label: string;
+    savedAt: string;
+    /** Harness-owned payload. This object must never cross the public account interface. */
+    credential: Record<string, unknown>;
+}
+/** A single atomic, owner-only record keeps the saved credential and its identity together. */
+export declare class CredentialStore {
+    readonly dir: string;
+    constructor(harness: string, root?: string);
+    id(slot: string, identity: string): string;
+    private file;
+    read(id: string): IStoredCredential;
+    list(): IStoredCredential[];
+    save(entry: Omit<IStoredCredential, 'schemaVersion' | 'id' | 'savedAt'>): IStoredCredential;
+    remove(id: string): void;
+    locked<T>(action: () => T): T;
+}
+/** Native harnesses retain credentials and may refresh them. Refuse writes while one is running. */
+export declare const requireHarnessStopped: (binary: "opencode" | "claude") => void;

package/dist_ts/classes.credentialstore.js

@@ -0,0 +1,115 @@
+import * as plugins from './plugins.js';
+import { writeSecretFileAtomically } from './helpers.js';
+export const credentialRecord = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Unsupported credential document.');
+    return value;
+};
+export const credentialText = (value) => typeof value === 'string' && value.length > 0 ? value : undefined;
+export const credentialHash = (value) => plugins.crypto.createHash('sha256').update(value).digest('hex');
+/** A bounded file read; malformed secrets never become parser diagnostics in the CLI. */
+export const readCredentialDocument = (file) => {
+    let fd;
+    try {
+        fd = plugins.fs.openSync(file, plugins.fs.constants.O_RDONLY | plugins.fs.constants.O_NONBLOCK);
+        const stat = plugins.fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size > 4 * 1024 * 1024)
+            throw new Error();
+        const buffer = Buffer.alloc(4 * 1024 * 1024 + 1);
+        let size = 0;
+        while (size < buffer.length) {
+            const count = plugins.fs.readSync(fd, buffer, size, buffer.length - size, null);
+            if (!count)
+                break;
+            size += count;
+        }
+        if (size === buffer.length)
+            throw new Error();
+        const raw = buffer.subarray(0, size).toString('utf8');
+        return { raw, data: credentialRecord(JSON.parse(raw)) };
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { raw: null, data: {} };
+        throw new Error('Credential file is unreadable, malformed, or too large; no changes were made.');
+    }
+    finally {
+        if (fd !== undefined)
+            plugins.fs.closeSync(fd);
+    }
+};
+/** A single atomic, owner-only record keeps the saved credential and its identity together. */
+export class CredentialStore {
+    dir;
+    constructor(harness, root = process.env.AUTHSWITCH_HOME || plugins.path.join(plugins.os.homedir(), '.authswitch')) {
+        this.dir = plugins.path.join(root, harness);
+    }
+    id(slot, identity) { return credentialHash(JSON.stringify([slot, identity])); }
+    file(id) {
+        if (!/^[a-f0-9]{64}$/.test(id))
+            throw new Error('Invalid saved account ID.');
+        return plugins.path.join(this.dir, `${id}.json`);
+    }
+    read(id) {
+        const value = readCredentialDocument(this.file(id)).data;
+        if (value.schemaVersion !== 1 || value.id !== id || !credentialText(value.slotId) || !credentialText(value.identity)
+            || !credentialText(value.label) || typeof value.savedAt !== 'string' || !Number.isFinite(Date.parse(value.savedAt))
+            || this.id(value.slotId, value.identity) !== id)
+            throw new Error('Saved account metadata is invalid; restore it from a verified backup.');
+        credentialRecord(value.credential);
+        return value;
+    }
+    list() {
+        if (!plugins.fs.existsSync(this.dir))
+            return [];
+        return plugins.fs.readdirSync(this.dir).filter(name => /^[a-f0-9]{64}\.json$/.test(name))
+            .map(name => this.read(name.slice(0, -5))).sort((a, b) => b.savedAt.localeCompare(a.savedAt));
+    }
+    save(entry) {
+        const record = { ...entry, schemaVersion: 1, id: this.id(entry.slotId, entry.identity), savedAt: new Date().toISOString() };
+        plugins.fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        plugins.fs.chmodSync(this.dir, 0o700);
+        const raw = JSON.stringify(record, null, 2) + '\n';
+        writeSecretFileAtomically(this.file(record.id), raw);
+        if (readCredentialDocument(this.file(record.id)).raw !== raw)
+            throw new Error('Saved credential verification failed; the active login was preserved.');
+        return this.read(record.id);
+    }
+    remove(id) { this.read(id); plugins.fs.unlinkSync(this.file(id)); }
+    locked(action) {
+        plugins.fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        const file = plugins.path.join(this.dir, '.lock');
+        let fd;
+        try {
+            fd = plugins.fs.openSync(file, 'wx', 0o600);
+        }
+        catch {
+            throw new Error(`Account storage is locked. Close other authswitch operations; if none remain, remove ${file}.`);
+        }
+        try {
+            return action();
+        }
+        finally {
+            plugins.fs.closeSync(fd);
+            plugins.fs.unlinkSync(file);
+        }
+    }
+}
+/** Native harnesses retain credentials and may refresh them. Refuse writes while one is running. */
+export const requireHarnessStopped = (binary) => {
+    let names;
+    try {
+        if (process.platform === 'win32') {
+            names = plugins.childProcess.execFileSync('tasklist', ['/FO', 'CSV', '/NH'], { encoding: 'utf8', timeout: 5000 }).split('\n').map(line => line.split('",')[0].replace(/^"/, ''));
+        }
+        else {
+            names = plugins.childProcess.execFileSync('ps', ['-u', String(process.getuid()), '-o', 'comm='], { encoding: 'utf8', timeout: 5000 }).split('\n').map(line => plugins.path.basename(line.trim()));
+        }
+    }
+    catch {
+        throw new Error(`Could not verify that ${binary} is stopped. No login was changed.`);
+    }
+    if (names.some(name => name === binary || name === `${binary}.exe`))
+        throw new Error(`Exit running ${binary} processes before saving or switching credentials, then start ${binary} again.`);
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5jcmVkZW50aWFsc3RvcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLmNyZWRlbnRpYWxzdG9yZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUseUJBQXlCLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFFekQsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxLQUFjLEVBQTJCLEVBQUU7SUFDMUUsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7SUFDckgsT0FBTyxLQUFnQyxDQUFDO0FBQzFDLENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBRyxDQUFDLEtBQWMsRUFBc0IsRUFBRSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDeEksTUFBTSxDQUFDLE1BQU0sY0FBYyxHQUFHLENBQUMsS0FBYSxFQUFVLEVBQUUsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBRXpILHlGQUF5RjtBQUN6RixNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLElBQVksRUFBeUQsRUFBRTtJQUM1RyxJQUFJLEVBQXNCLENBQUM7SUFDM0IsSUFBSSxDQUFDO1FBQ0gsRUFBRSxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDaEcsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDdEMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxJQUFJLENBQUMsSUFBSSxHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSTtZQUFFLE1BQU0sSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUNyRSxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ2pELElBQUksSUFBSSxHQUFHLENBQUMsQ0FBQztRQUNiLE9BQU8sSUFBSSxHQUFHLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUM1QixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsTUFBTSxHQUFHLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztZQUNoRixJQUFJLENBQUMsS0FBSztnQkFBRSxNQUFNO1lBQ2xCLElBQUksSUFBSSxLQUFLLENBQUM7UUFDaEIsQ0FBQztRQUNELElBQUksSUFBSSxLQUFLLE1BQU0sQ0FBQyxNQUFNO1lBQUUsTUFBTSxJQUFJLEtBQUssRUFBRSxDQUFDO1FBQzlDLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLElBQUksQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN0RCxPQUFPLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUMxRCxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLElBQUssS0FBK0IsQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxFQUFFLEVBQUUsQ0FBQztRQUN2RixNQUFNLElBQUksS0FBSyxDQUFDLCtFQUErRSxDQUFDLENBQUM7SUFDbkcsQ0FBQztZQUFTLENBQUM7UUFBQyxJQUFJLEVBQUUsS0FBSyxTQUFTO1lBQUUsT0FBTyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7SUFBQyxDQUFDO0FBQy9ELENBQUMsQ0FBQztBQWFGLCtGQUErRjtBQUMvRixNQUFNLE9BQU8sZUFBZTtJQUNWLEdBQUcsQ0FBUztJQUM1QixZQUFZLE9BQWUsRUFBRSxJQUFJLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxlQUFlLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxhQUFhLENBQUM7UUFDdkgsSUFBSSxDQUFDLEdBQUcsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUNNLEVBQUUsQ0FBQyxJQUFZLEVBQUUsUUFBZ0IsSUFBWSxPQUFPLGNBQWMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDdEcsSUFBSSxDQUFDLEVBQVU7UUFDckIsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDJCQUEyQixDQUFDLENBQUM7UUFDN0UsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBQ00sSUFBSSxDQUFDLEVBQVU7UUFDcEIsTUFBTSxLQUFLLEdBQUcsc0JBQXNCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUN6RCxJQUFJLEtBQUssQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDO2VBQy9HLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxPQUFPLEtBQUssQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztlQUNoSCxJQUFJLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFnQixFQUFFLEtBQUssQ0FBQyxRQUFrQixDQUFDLEtBQUssRUFBRTtZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztRQUNoSyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDbkMsT0FBTyxLQUFxQyxDQUFDO0lBQy9DLENBQUM7SUFDTSxJQUFJO1FBQ1QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7WUFBRSxPQUFPLEVBQUUsQ0FBQztRQUNoRCxPQUFPLE9BQU8sQ0FBQyxFQUFFLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7YUFDdEYsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ00sSUFBSSxDQUFDLEtBQWtFO1FBQzVFLE1BQU0sTUFBTSxHQUFzQixFQUFFLEdBQUcsS0FBSyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsRUFBRSxFQUFFLElBQUksQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLEVBQUUsT0FBTyxFQUFFLElBQUksSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQztRQUMvSSxPQUFPLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUNqRSxPQUFPLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3RDLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUM7UUFDbkQseUJBQXlCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDckQsSUFBSSxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUcsS0FBSyxHQUFHO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO1FBQ3ZKLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDOUIsQ0FBQztJQUNNLE1BQU0sQ0FBQyxFQUFVLElBQVUsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDakYsTUFBTSxDQUFJLE1BQWU7UUFDOUIsT0FBTyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDakUsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNsRCxJQUFJLEVBQVUsQ0FBQztRQUNmLElBQUksQ0FBQztZQUFDLEVBQUUsR0FBRyxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUNwRCxNQUFNLENBQUM7WUFBQyxNQUFNLElBQUksS0FBSyxDQUFDLHdGQUF3RixJQUFJLEdBQUcsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUMzSCxJQUFJLENBQUM7WUFBQyxPQUFPLE1BQU0sRUFBRSxDQUFDO1FBQUMsQ0FBQztnQkFDaEIsQ0FBQztZQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUM7UUFBQyxDQUFDO0lBQ3BFLENBQUM7Q0FDRjtBQUVELG9HQUFvRztBQUNwRyxNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLE1BQTZCLEVBQVEsRUFBRTtJQUMzRSxJQUFJLEtBQWUsQ0FBQztJQUNwQixJQUFJLENBQUM7UUFDSCxJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDakMsS0FBSyxHQUFHLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLFVBQVUsRUFBRSxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNuTCxDQUFDO2FBQU0sQ0FBQztZQUNOLEtBQUssR0FBRyxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxNQUFPLEVBQUUsQ0FBQyxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsRUFBRSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDck0sQ0FBQztJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixNQUFNLG9DQUFvQyxDQUFDLENBQUM7SUFBQyxDQUFDO0lBQ2pHLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEdBQUcsTUFBTSxNQUFNLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdCQUFnQixNQUFNLGlFQUFpRSxNQUFNLFNBQVMsQ0FBQyxDQUFDO0FBQy9MLENBQUMsQ0FBQyJ9

package/dist_ts/classes.fileharness.d.ts

@@ -0,0 +1,47 @@
+import type { IAuthHarness, IHarnessAccountStatus, IHarnessOutcome, IHarnessState } from './interfaces.harness.js';
+import { CredentialStore } from './classes.credentialstore.js';
+export interface IFileAccount {
+    slotId: string;
+    identity: string;
+    label: string;
+    credential: Record<string, unknown>;
+}
+export interface IFileHarnessSnapshot {
+    accounts: IFileAccount[];
+    unavailable: string | null;
+}
+/** Shared verified preservation for harnesses with independently replaceable credential slots. */
+export declare abstract class FileHarness implements IAuthHarness {
+    abstract readonly id: string;
+    abstract readonly label: string;
+    abstract readonly loginHint: string;
+    readonly diagnosticsLabel = "Check credential storage and account availability";
+    protected abstract readonly store: CredentialStore;
+    protected abstract snapshot(): IFileHarnessSnapshot;
+    protected abstract apply(slotId: string, previous: IFileAccount | undefined, target: IFileAccount | undefined): void;
+    protected abstract beforeMutation(): void;
+    protected abstract inspect(credential: Record<string, unknown>, slotId: string): IFileAccount;
+    abstract readAccountStatus(id: string): Promise<IHarnessAccountStatus>;
+    private saved;
+    readState(): IHarnessState;
+    protected readCredential(id: string): IFileAccount;
+    /** Save a newly authenticated credential without changing a native harness's login. */
+    importCredential(slotId: string, credential: Record<string, unknown>): {
+        accountId: string;
+    };
+    /** Backend-only login handoff. Preserve the outgoing credential before replacing its slot. */
+    activateCredential(slotId: string, credential: Record<string, unknown>): IHarnessOutcome;
+    resolveAccount(reference: string): {
+        id: string;
+    } | {
+        candidates: string[];
+    };
+    private outcome;
+    saveCurrent(options: {
+        keepActive: boolean;
+        accountId?: string;
+    }): IHarnessOutcome;
+    switchAccount(id: string): IHarnessOutcome;
+    removeAccount(id: string): IHarnessOutcome;
+    diagnose(): IHarnessOutcome;
+}

package/dist_ts/classes.fileharness.js

@@ -0,0 +1,119 @@
+import { CredentialStore } from './classes.credentialstore.js';
+import { plainText } from './formatting.js';
+/** Shared verified preservation for harnesses with independently replaceable credential slots. */
+export class FileHarness {
+    diagnosticsLabel = 'Check credential storage and account availability';
+    saved(entry) {
+        const account = this.inspect(entry.credential, entry.slotId);
+        if (account.identity !== entry.identity)
+            throw new Error('Saved credential does not match its account identity.');
+        return account;
+    }
+    readState() {
+        const snapshot = this.snapshot();
+        const saved = this.store.list();
+        const accounts = saved.map(entry => {
+            this.saved(entry);
+            return { id: entry.id, slotId: entry.slotId, label: entry.label, isActive: false, isStashed: true, savedAt: entry.savedAt, details: [`Provider: ${entry.slotId}`] };
+        });
+        for (const active of snapshot.accounts) {
+            const id = this.store.id(active.slotId, active.identity);
+            const existing = accounts.find(account => account.id === id);
+            if (existing) {
+                existing.isActive = true;
+                existing.label = active.label;
+            }
+            else
+                accounts.unshift({ id, slotId: active.slotId, label: active.label, isActive: true, isStashed: false, savedAt: null, details: [`Provider: ${active.slotId}`] });
+        }
+        for (const account of accounts) {
+            if (accounts.some(other => other.id !== account.id && other.label === account.label))
+                account.details.push(`Account ID: ${account.id}`);
+        }
+        return { accounts, saveUnavailableReason: snapshot.unavailable };
+    }
+    readCredential(id) {
+        const active = this.snapshot().accounts.find(account => this.store.id(account.slotId, account.identity) === id);
+        return active ?? this.saved(this.store.read(id));
+    }
+    /** Save a newly authenticated credential without changing a native harness's login. */
+    importCredential(slotId, credential) {
+        return this.store.locked(() => ({ accountId: this.store.save(this.inspect(credential, slotId)).id }));
+    }
+    /** Backend-only login handoff. Preserve the outgoing credential before replacing its slot. */
+    activateCredential(slotId, credential) {
+        return this.outcome(() => {
+            this.beforeMutation();
+            const target = this.inspect(credential, slotId);
+            const snapshot = this.snapshot();
+            if (snapshot.unavailable)
+                throw new Error(snapshot.unavailable);
+            const previous = snapshot.accounts.find(account => account.slotId === slotId);
+            if (previous)
+                this.store.save(previous);
+            this.apply(slotId, previous, target);
+            return `Activated ${plainText(target.label)} (${plainText(slotId)}).`;
+        });
+    }
+    resolveAccount(reference) {
+        const accounts = this.store.list();
+        const exact = accounts.filter(account => account.id === reference || account.label.toLowerCase() === reference.toLowerCase()
+            || `${account.slotId}:${account.label}`.toLowerCase() === reference.toLowerCase());
+        const matches = exact.length ? exact : accounts.filter(account => account.label.toLowerCase().startsWith(reference.toLowerCase()));
+        return matches.length === 1 ? { id: matches[0].id } : { candidates: matches.map(account => `${account.slotId}:${account.label} (${account.id})`) };
+    }
+    outcome(action) {
+        try {
+            return this.store.locked(() => ({ lines: [action()], problems: [] }));
+        }
+        catch (error) {
+            return { lines: [], problems: [error instanceof Error ? error.message : 'Credential operation failed.'] };
+        }
+    }
+    saveCurrent(options) {
+        return this.outcome(() => {
+            this.beforeMutation();
+            const snapshot = this.snapshot();
+            if (snapshot.unavailable)
+                throw new Error(snapshot.unavailable);
+            const matches = snapshot.accounts.filter(account => !options.accountId || this.store.id(account.slotId, account.identity) === options.accountId || account.slotId === options.accountId || account.label === options.accountId);
+            if (matches.length !== 1)
+                throw new Error(matches.length ? 'Several logins are active. Select the account or provider to save.' : 'No matching active login to save.');
+            const active = matches[0];
+            this.store.save(active);
+            if (!options.keepActive)
+                this.apply(active.slotId, active, undefined);
+            return `Saved ${plainText(active.label)} (${plainText(active.slotId)})${options.keepActive ? '; login remains in place.' : `. Start ${this.label} to log in again.`}`;
+        });
+    }
+    switchAccount(id) {
+        return this.outcome(() => {
+            this.beforeMutation();
+            const target = this.saved(this.store.read(id));
+            const snapshot = this.snapshot();
+            if (snapshot.unavailable)
+                throw new Error(snapshot.unavailable);
+            const previous = snapshot.accounts.find(account => account.slotId === target.slotId);
+            // Refresh the outgoing stash even when this account was already saved.
+            if (previous)
+                this.store.save(previous);
+            if (previous?.identity === target.identity)
+                return `${plainText(target.label)} is already active; its latest credential is saved.`;
+            this.apply(target.slotId, previous, target);
+            return `Activated ${plainText(target.label)} (${plainText(target.slotId)}). Start ${this.label} to use it.`;
+        });
+    }
+    removeAccount(id) {
+        return this.outcome(() => { const account = this.store.read(id); this.store.remove(id); return `Removed saved login for ${plainText(account.label)}; the active login is preserved.`; });
+    }
+    diagnose() {
+        try {
+            const state = this.readState();
+            return { lines: [`${this.label}: ${state.accounts.filter(account => account.isActive).length} active login(s), ${state.accounts.filter(account => account.isStashed).length} saved account(s).`, this.loginHint], problems: state.saveUnavailableReason ? [state.saveUnavailableReason] : [] };
+        }
+        catch {
+            return { lines: [], problems: ['Credential storage could not be verified. Check file permissions and saved credential records.'] };
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5maWxlaGFybmVzcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXNzZXMuZmlsZWhhcm5lc3MudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxFQUFFLGVBQWUsRUFBMEIsTUFBTSw4QkFBOEIsQ0FBQztBQUN2RixPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFhNUMsa0dBQWtHO0FBQ2xHLE1BQU0sT0FBZ0IsV0FBVztJQUlmLGdCQUFnQixHQUFHLG1EQUFtRCxDQUFDO0lBUS9FLEtBQUssQ0FBQyxLQUF3QjtRQUNwQyxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzdELElBQUksT0FBTyxDQUFDLFFBQVEsS0FBSyxLQUFLLENBQUMsUUFBUTtZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUNsSCxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBQ00sU0FBUztRQUNkLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNqQyxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2hDLE1BQU0sUUFBUSxHQUE4QixLQUFLLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFO1lBQzVELElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDbEIsT0FBTyxFQUFFLEVBQUUsRUFBRSxLQUFLLENBQUMsRUFBRSxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsS0FBSyxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxPQUFPLEVBQUUsQ0FBQyxhQUFhLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxFQUFFLENBQUM7UUFDdEssQ0FBQyxDQUFDLENBQUM7UUFDSCxLQUFLLE1BQU0sTUFBTSxJQUFJLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN2QyxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUN6RCxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUM3RCxJQUFJLFFBQVEsRUFBRSxDQUFDO2dCQUFDLFFBQVEsQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO2dCQUFDLFFBQVEsQ0FBQyxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQztZQUFDLENBQUM7O2dCQUNyRSxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDLGFBQWEsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3RLLENBQUM7UUFDRCxLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQy9CLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxFQUFFLEtBQUssT0FBTyxDQUFDLEVBQUUsSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLE9BQU8sQ0FBQyxLQUFLLENBQUM7Z0JBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsZUFBZSxPQUFPLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUMxSSxDQUFDO1FBQ0QsT0FBTyxFQUFFLFFBQVEsRUFBRSxxQkFBcUIsRUFBRSxRQUFRLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDbkUsQ0FBQztJQUNTLGNBQWMsQ0FBQyxFQUFVO1FBQ2pDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDaEgsT0FBTyxNQUFNLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFDRCx1RkFBdUY7SUFDaEYsZ0JBQWdCLENBQUMsTUFBYyxFQUFFLFVBQW1DO1FBQ3pFLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUN4RyxDQUFDO0lBQ0QsOEZBQThGO0lBQ3ZGLGtCQUFrQixDQUFDLE1BQWMsRUFBRSxVQUFtQztRQUMzRSxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO1lBQ3ZCLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN0QixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUNoRCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDakMsSUFBSSxRQUFRLENBQUMsV0FBVztnQkFBRSxNQUFNLElBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUNoRSxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssTUFBTSxDQUFDLENBQUM7WUFDOUUsSUFBSSxRQUFRO2dCQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3hDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUNyQyxPQUFPLGFBQWEsU0FBUyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQztRQUN4RSxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDTSxjQUFjLENBQUMsU0FBaUI7UUFDckMsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNuQyxNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLEtBQUssQ0FBQyxXQUFXLEVBQUUsS0FBSyxTQUFTLENBQUMsV0FBVyxFQUFFO2VBQ3ZILEdBQUcsT0FBTyxDQUFDLE1BQU0sSUFBSSxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsV0FBVyxFQUFFLEtBQUssU0FBUyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7UUFDckYsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxXQUFXLEVBQUUsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNuSSxPQUFPLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxNQUFNLElBQUksT0FBTyxDQUFDLEtBQUssS0FBSyxPQUFPLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxDQUFDO0lBQ3JKLENBQUM7SUFDTyxPQUFPLENBQUMsTUFBb0I7UUFDbEMsSUFBSSxDQUFDO1lBQUMsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUM5RSxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsOEJBQThCLENBQUMsRUFBRSxDQUFDO1FBQUMsQ0FBQztJQUM5SCxDQUFDO0lBQ00sV0FBVyxDQUFDLE9BQW9EO1FBQ3JFLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7WUFDdkIsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNqQyxJQUFJLFFBQVEsQ0FBQyxXQUFXO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQ2hFLE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLFFBQVEsQ0FBQyxLQUFLLE9BQU8sQ0FBQyxTQUFTLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsU0FBUyxJQUFJLE9BQU8sQ0FBQyxLQUFLLEtBQUssT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ2hPLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxDQUFDO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsb0VBQW9FLENBQUMsQ0FBQyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7WUFDdkssTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzFCLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3hCLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVTtnQkFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLFNBQVMsQ0FBQyxDQUFDO1lBQ3RFLE9BQU8sU0FBUyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLFNBQVMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsMkJBQTJCLENBQUMsQ0FBQyxDQUFDLFdBQVcsSUFBSSxDQUFDLEtBQUssbUJBQW1CLEVBQUUsQ0FBQztRQUN4SyxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDTSxhQUFhLENBQUMsRUFBVTtRQUM3QixPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO1lBQ3ZCLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN0QixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDL0MsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ2pDLElBQUksUUFBUSxDQUFDLFdBQVc7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7WUFDaEUsTUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUNyRix1RUFBdUU7WUFDdkUsSUFBSSxRQUFRO2dCQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3hDLElBQUksUUFBUSxFQUFFLFFBQVEsS0FBSyxNQUFNLENBQUMsUUFBUTtnQkFBRSxPQUFPLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMscURBQXFELENBQUM7WUFDbkksSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUM1QyxPQUFPLGFBQWEsU0FBUyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxTQUFTLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxZQUFZLElBQUksQ0FBQyxLQUFLLGFBQWEsQ0FBQztRQUM5RyxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDTSxhQUFhLENBQUMsRUFBVTtRQUM3QixPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLEdBQUcsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sMkJBQTJCLFNBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLGtDQUFrQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDM0wsQ0FBQztJQUNNLFFBQVE7UUFDYixJQUFJLENBQUM7WUFDSCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDL0IsT0FBTyxFQUFFLEtBQUssRUFBRSxDQUFDLEdBQUcsSUFBSSxDQUFDLEtBQUssS0FBSyxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLHFCQUFxQixLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxNQUFNLG9CQUFvQixFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFDLHFCQUFxQixDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNqUyxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsZ0dBQWdHLENBQUMsRUFBRSxDQUFDO1FBQUMsQ0FBQztJQUNqSixDQUFDO0NBQ0YifQ==

package/dist_ts/classes.login.d.ts

@@ -0,0 +1,42 @@
+import * as plugins from './plugins.js';
+import type { IHarnessLoginHandle, IHarnessLoginOptions, IHarnessLoginResult } from './interfaces.harness.js';
+export type TAuthLoginFlow = plugins.flexAccounts.TSmartAiProviderLoginFlow;
+export type TAuthLoginCredential = plugins.flexAccounts.TSmartAiProviderCredential;
+export type TAuthLoginPrompt = plugins.flexAccounts.TSmartAiProviderLoginPrompt;
+export interface IAuthLoginResult extends plugins.flexAccounts.ISmartAiProviderLoginResult {
+}
+export interface IAuthLoginHandle extends plugins.flexAccounts.ISmartAiProviderLoginHandle {
+}
+export interface IAuthLoginProvider extends Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'descriptor' | 'beginLogin' | 'dispose'> {
+}
+export interface IAuthLoginOptions extends plugins.flexAccounts.ISmartAiProviderLoginOptions {
+    providerId: string;
+}
+export interface IAuthSwitchLoginOptions {
+    /** False when an enclosing provider registry owns disposal of injected adapters. */
+    disposeProviders?: boolean;
+}
+/** Shared login owner for terminal and hosted UIs. Credential results stay on the backend. */
+export declare class AuthSwitchLogin {
+    private readonly options;
+    private readonly providers;
+    private pending;
+    private closed;
+    private closing?;
+    private readonly handles;
+    constructor(providers?: IAuthLoginProvider[], options?: IAuthSwitchLoginOptions);
+    listProviders(): plugins.flexAccounts.ISmartAiProviderDescriptor[];
+    beginLogin(options: IAuthLoginOptions): Promise<IAuthLoginHandle>;
+    close(): Promise<void>;
+    private closeOwnedResources;
+}
+/** A hosted or terminal UI sees only the prompt and saved-account outcome. */
+export declare const beginSavedOpenAiLogin: (save: (result: IAuthLoginResult) => IHarnessLoginResult, options: IHarnessLoginOptions, fetcher?: typeof fetch) => Promise<IHarnessLoginHandle>;
+/** Convert a verified OpenAI login for native OpenCode without exposing it in public account DTOs. */
+export declare const openCodeCredentialFromLogin: (credential: plugins.flexAccounts.IOpenAiChatGptOAuthCredential) => {
+    type: "oauth";
+    access: string;
+    refresh: string;
+    expires: number;
+    accountId?: string;
+};

package/dist_ts/classes.login.js

@@ -0,0 +1,102 @@
+import * as plugins from './plugins.js';
+/** Shared login owner for terminal and hosted UIs. Credential results stay on the backend. */
+export class AuthSwitchLogin {
+    options;
+    providers = new Map();
+    pending = 0;
+    closed = false;
+    closing;
+    handles = new Set();
+    constructor(providers = [new plugins.flexAccounts.OpenAiProviderAdapter()], options = {}) {
+        this.options = options;
+        for (const provider of providers) {
+            if (this.providers.has(provider.descriptor.providerId))
+                throw new Error('Duplicate login provider.');
+            this.providers.set(provider.descriptor.providerId, provider);
+        }
+    }
+    listProviders() {
+        return [...this.providers.values()].map(provider => ({ ...provider.descriptor, loginFlows: [...provider.descriptor.loginFlows] }));
+    }
+    async beginLogin(options) {
+        if (this.closed)
+            throw new Error('Login service is closed.');
+        const provider = this.providers.get(options.providerId);
+        if (!provider?.descriptor.loginFlows.includes(options.flow))
+            throw new Error('This provider does not support the requested login flow.');
+        if (this.pending + this.handles.size >= 8)
+            throw new Error('Too many pending logins. Complete or cancel an existing login first.');
+        this.pending++;
+        try {
+            const handle = await provider.beginLogin(options);
+            if (this.closed) {
+                await handle.close();
+                throw new Error('Login service is closed.');
+            }
+            this.handles.add(handle);
+            // Keep cancellation/close ownership until the consumer has persisted the secret result.
+            return {
+                prompt: handle.prompt,
+                completion: handle.completion,
+                cancel: () => handle.cancel(),
+                close: async () => { await handle.close(); this.handles.delete(handle); },
+            };
+        }
+        catch {
+            throw new Error('Provider login could not be started.');
+        }
+        finally {
+            this.pending--;
+        }
+    }
+    close() { return this.closing ??= this.closeOwnedResources(); }
+    async closeOwnedResources() {
+        this.closed = true;
+        const results = await Promise.allSettled([...this.handles].map(handle => handle.close()));
+        const disposed = this.options.disposeProviders === false ? [] : await Promise.allSettled([...this.providers.values()].map(provider => provider.dispose()));
+        if ([...results, ...disposed].some(result => result.status === 'rejected'))
+            throw new Error('Provider login cleanup failed.');
+        this.handles.clear();
+    }
+}
+/** A hosted or terminal UI sees only the prompt and saved-account outcome. */
+export const beginSavedOpenAiLogin = async (save, options, fetcher) => {
+    if (options.providerId !== 'openai' || options.flow !== 'device')
+        throw new Error('This harness supports OpenAI device login.');
+    const service = new AuthSwitchLogin([new plugins.flexAccounts.OpenAiProviderAdapter({ fetch: fetcher })]);
+    try {
+        const handle = await service.beginLogin({ providerId: 'openai', flow: 'device' });
+        const completion = handle.completion.then(save).catch(() => ({
+            outcome: { lines: [], problems: ['Login did not complete or its saved credential could not be verified. The active login was preserved.'] },
+        })).finally(() => service.close());
+        return { prompt: handle.prompt, completion, cancel: async () => { await handle.cancel(); }, close: () => service.close() };
+    }
+    catch {
+        await service.close();
+        throw new Error('Provider login could not be started.');
+    }
+};
+/** Convert a verified OpenAI login for native OpenCode without exposing it in public account DTOs. */
+export const openCodeCredentialFromLogin = (credential) => {
+    try {
+        const auth = plugins.flexAccounts.toOpenAiChatGptAuthCredentials(credential);
+        const payload = credential.accessToken.split('.')[1];
+        let expires = 0;
+        if (payload && payload.length <= 48 * 1024) {
+            try {
+                const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+                expires = typeof claims?.exp === 'number' ? claims.exp * 1000 : 0;
+            }
+            catch { /* Opaque access tokens are valid; native OpenCode refreshes an unknown expiry. */ }
+        }
+        return {
+            type: 'oauth', access: credential.accessToken, refresh: credential.refreshToken,
+            expires: Number.isSafeInteger(expires) && expires >= 0 ? expires : 0,
+            ...(auth.accountId ? { accountId: auth.accountId } : {}),
+        };
+    }
+    catch {
+        throw new Error('OpenAI login credential is invalid.');
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5sb2dpbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXNzZXMubG9naW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFpQnhDLDhGQUE4RjtBQUM5RixNQUFNLE9BQU8sZUFBZTtJQU95RjtJQU5sRyxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQThCLENBQUM7SUFDM0QsT0FBTyxHQUFHLENBQUMsQ0FBQztJQUNaLE1BQU0sR0FBRyxLQUFLLENBQUM7SUFDZixPQUFPLENBQWlCO0lBQ2YsT0FBTyxHQUFHLElBQUksR0FBRyxFQUFvQixDQUFDO0lBRXZELFlBQVksWUFBa0MsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMscUJBQXFCLEVBQUUsQ0FBQyxFQUFtQixVQUFtQyxFQUFFO1FBQXJDLFlBQU8sR0FBUCxPQUFPLENBQThCO1FBQ3RKLEtBQUssTUFBTSxRQUFRLElBQUksU0FBUyxFQUFFLENBQUM7WUFDakMsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQztnQkFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDJCQUEyQixDQUFDLENBQUM7WUFDckcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDL0QsQ0FBQztJQUNILENBQUM7SUFDTSxhQUFhO1FBQ2xCLE9BQU8sQ0FBQyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsR0FBRyxRQUFRLENBQUMsVUFBVSxFQUFFLFVBQVUsRUFBRSxDQUFDLEdBQUcsUUFBUSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNySSxDQUFDO0lBQ00sS0FBSyxDQUFDLFVBQVUsQ0FBQyxPQUEwQjtRQUNoRCxJQUFJLElBQUksQ0FBQyxNQUFNO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO1FBQzdELE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN4RCxJQUFJLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDekksSUFBSSxJQUFJLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxJQUFJLENBQUM7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHNFQUFzRSxDQUFDLENBQUM7UUFDbkksSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2YsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxRQUFRLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ2xELElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUFDLE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztZQUFDLENBQUM7WUFDdkYsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDekIsd0ZBQXdGO1lBQ3hGLE9BQU87Z0JBQ0wsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNO2dCQUNyQixVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7Z0JBQzdCLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFO2dCQUM3QixLQUFLLEVBQUUsS0FBSyxJQUFJLEVBQUUsR0FBRyxNQUFNLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQzthQUMxRSxDQUFDO1FBQ0osQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLENBQUMsQ0FBQztRQUMxRCxDQUFDO2dCQUFTLENBQUM7WUFBQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFBQyxDQUFDO0lBQy9CLENBQUM7SUFDTSxLQUFLLEtBQW9CLE9BQU8sSUFBSSxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDN0UsS0FBSyxDQUFDLG1CQUFtQjtRQUMvQixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQztRQUNuQixNQUFNLE9BQU8sR0FBRyxNQUFNLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQzFGLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDM0osSUFBSSxDQUFDLEdBQUcsT0FBTyxFQUFFLEdBQUcsUUFBUSxDQUFDLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUM7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7UUFDOUgsSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUN2QixDQUFDO0NBQ0Y7QUFFRCw4RUFBOEU7QUFDOUUsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsS0FBSyxFQUN4QyxJQUF1RCxFQUN2RCxPQUE2QixFQUM3QixPQUFzQixFQUNRLEVBQUU7SUFDaEMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLFFBQVE7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDaEksTUFBTSxPQUFPLEdBQUcsSUFBSSxlQUFlLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMscUJBQXFCLENBQUMsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUcsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUNsRixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBd0IsRUFBRSxDQUFDLENBQUM7WUFDaEYsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyx1R0FBdUcsQ0FBQyxFQUFFO1NBQzVJLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUNuQyxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxLQUFLLElBQUksRUFBRSxHQUFHLE1BQU0sTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQztJQUM3SCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsTUFBTSxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUM7UUFBQyxNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFBQyxDQUFDO0FBQzdGLENBQUMsQ0FBQztBQUVGLHNHQUFzRztBQUN0RyxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUFDLFVBQThELEVBRXhHLEVBQUU7SUFDRixJQUFJLENBQUM7UUFDSCxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsWUFBWSxDQUFDLDhCQUE4QixDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzdFLE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3JELElBQUksT0FBTyxHQUFHLENBQUMsQ0FBQztRQUNoQixJQUFJLE9BQU8sSUFBSSxPQUFPLENBQUMsTUFBTSxJQUFJLEVBQUUsR0FBRyxJQUFJLEVBQUUsQ0FBQztZQUMzQyxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQXNCLENBQUM7Z0JBQ25HLE9BQU8sR0FBRyxPQUFPLE1BQU0sRUFBRSxHQUFHLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3BFLENBQUM7WUFBQyxNQUFNLENBQUMsQ0FBQyxrRkFBa0YsQ0FBQyxDQUFDO1FBQ2hHLENBQUM7UUFDRCxPQUFPO1lBQ0wsSUFBSSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxDQUFDLFdBQVcsRUFBRSxPQUFPLEVBQUUsVUFBVSxDQUFDLFlBQVk7WUFDL0UsT0FBTyxFQUFFLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLElBQUksT0FBTyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3BFLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUN6RCxDQUFDO0lBQ0osQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMscUNBQXFDLENBQUMsQ0FBQztJQUFDLENBQUM7QUFDckUsQ0FBQyxDQUFDIn0=

package/dist_ts/classes.opencodeharness.d.ts

@@ -0,0 +1,34 @@
+import { FileHarness, type IFileAccount, type IFileHarnessSnapshot } from './classes.fileharness.js';
+import { CredentialStore } from './classes.credentialstore.js';
+import type { IHarnessAccountStatus, IHarnessLoginOptions, IHarnessLoginProvider } from './interfaces.harness.js';
+export interface IOpenCodeHarnessOptions {
+    dataHome?: string;
+    stashRoot?: string;
+    env?: NodeJS.ProcessEnv;
+    fetch?: typeof fetch;
+    /** Process inspection dependency, injectable for isolated installations and tests. */
+    checkStopped?: () => void;
+}
+/** OpenCode owns one login per provider. Replacing a slot never replaces the whole provider set. */
+export declare class OpenCodeHarness extends FileHarness {
+    readonly id = "opencode";
+    readonly label = "OpenCode";
+    readonly loginHint = "Use authswitch opencode login for OpenAI; use opencode auth login for other providers.";
+    readonly loginProviders: IHarnessLoginProvider[];
+    protected readonly store: CredentialStore;
+    private readonly file;
+    private readonly env;
+    private readonly status;
+    private readonly checkStopped;
+    private readonly fetcher?;
+    constructor(options?: IOpenCodeHarnessOptions);
+    protected beforeMutation(): void;
+    /** Public identity only, for reconciling a host's OpenAI association after native refresh/restart. */
+    activeOpenAiAccountId(): string | undefined;
+    beginLogin(options?: IHarnessLoginOptions): Promise<import("./interfaces.harness.js").IHarnessLoginHandle>;
+    private openAiInfo;
+    protected inspect(credential: Record<string, unknown>, slotId: string): IFileAccount;
+    protected snapshot(): IFileHarnessSnapshot;
+    protected apply(slotId: string, previous: IFileAccount | undefined, target: IFileAccount | undefined): void;
+    readAccountStatus(id: string): Promise<IHarnessAccountStatus>;
+}