@modelprofile.com/authswitch 7.0.0 → 8.1.0

package/dist_ts/ts_migration/legacysources/authswitchstores.js

@@ -0,0 +1,244 @@
+import * as plugins from '../../plugins.js';
+import { accessTokenExpiry, claudeSourceIdentity, legacyHash, legacySourceDigest, legacySourceId, openAiSourceIdentity, openCodeOpenAiIdentity, parseLegacyJson, readLegacyFile } from './shared.js';
+/**
+ * Reads authswitch's own legacy stores: the Codex stash directories of `StashStore` and the saved records of
+ * `CredentialStore`.
+ *
+ * Both are copies authswitch made for itself. No other tool refreshes them, so the authority can become
+ * their owner outright -- unlike a native store, where the vendor tool keeps refreshing.
+ *
+ * `StashStore.list()` skips an incomplete directory and `CredentialStore.list()` throws on a malformed
+ * record; neither behaviour is acceptable here, because a source the owner cannot see is a source the
+ * cutover would delete unexamined. Every directory and every record is reported, with its defect.
+ */
+const STASH_AUTH_FILE = 'auth.json';
+const STASH_META_FILE = 'stash.json';
+/** The harness namespaces authswitch itself wrote, and the store layout each one uses. */
+const STASH_HARNESSES = ['codex'];
+const RECORD_HARNESSES = ['claude', 'opencode'];
+const RECORD_FILE = /^[a-f0-9]{64}\.json$/;
+const baseRecord = (path, files) => {
+    const sourcePathHash = legacyHash(path);
+    return {
+        id: legacySourceId('authswitch_stash', sourcePathHash),
+        sourceKind: 'authswitch_stash',
+        path,
+        sourcePathHash,
+        sourceDigest: legacySourceDigest(files),
+    };
+};
+/** One `~/.authswitch/codex/<slug>` directory: a Codex credential plus the enrollments saved with it. */
+const readStashDirectory = (path) => {
+    const problems = [];
+    const files = [];
+    for (const name of [STASH_AUTH_FILE, STASH_META_FILE]) {
+        const read = readLegacyFile(plugins.path.join(path, name), name);
+        if (read.problem)
+            problems.push(read.problem);
+        else if (read.file === null)
+            problems.push(`${name} is missing`);
+        else
+            files.push(read.file);
+    }
+    const record = {
+        ...baseRecord(path, files),
+        treatment: 'refuse',
+        proof: 'none',
+        accountId: null,
+        subject: null,
+        workspaceId: null,
+        providerId: null,
+        email: null,
+        plan: null,
+        label: null,
+        accessExpiresAt: null,
+        enrollmentCount: null,
+        problems,
+    };
+    const auth = files.find(file => file.name === STASH_AUTH_FILE);
+    const meta = files.find(file => file.name === STASH_META_FILE);
+    if (meta) {
+        const parsed = parseLegacyJson(meta.raw);
+        if (!parsed)
+            problems.push(`${STASH_META_FILE} is not a JSON object`);
+        else {
+            record.label = typeof parsed.email === 'string' ? parsed.email : null;
+            record.enrollmentCount = Array.isArray(parsed.enrollments) ? parsed.enrollments.length : null;
+            if (record.enrollmentCount === null)
+                problems.push(`${STASH_META_FILE} carries no enrollment list`);
+        }
+    }
+    if (!auth)
+        return record;
+    const parsed = parseLegacyJson(auth.raw);
+    const tokens = parsed?.tokens;
+    const tokenRecord = tokens && typeof tokens === 'object' && !Array.isArray(tokens)
+        ? tokens : null;
+    const idToken = typeof tokenRecord?.id_token === 'string' ? tokenRecord.id_token : null;
+    const refreshToken = typeof tokenRecord?.refresh_token === 'string' ? tokenRecord.refresh_token : null;
+    const identity = idToken === null ? null : openAiSourceIdentity(idToken);
+    if (identity === null) {
+        // An API-key credential is a stash authswitch can restore but not an OAuth grant the authority can hold.
+        problems.push('the saved credential carries no ChatGPT identity the authority can hold');
+        return record;
+    }
+    record.providerId = 'openai';
+    record.accountId = identity.accountId;
+    record.subject = identity.subject;
+    record.workspaceId = identity.workspaceId;
+    record.email = identity.email;
+    record.plan = identity.plan;
+    record.label = record.label ?? identity.email;
+    record.accessExpiresAt = accessTokenExpiry(typeof tokenRecord?.access_token === 'string' ? tokenRecord.access_token : null);
+    if (refreshToken === null)
+        problems.push('the saved credential carries no refresh token');
+    else if (problems.length === 0) {
+        record.treatment = 'import';
+        record.proof = 'rotating_refresh';
+    }
+    return record;
+};
+/** One `~/.authswitch/<harness>/<id>.json` record, validated as `CredentialStore.read` validates it. */
+const readCredentialRecord = (harness, path, id) => {
+    const problems = [];
+    const files = [];
+    const read = readLegacyFile(path, `${id}.json`);
+    if (read.problem)
+        problems.push(read.problem);
+    else if (read.file === null)
+        problems.push('the record disappeared while it was being read');
+    else
+        files.push(read.file);
+    const record = {
+        ...baseRecord(path, files),
+        treatment: 'refuse',
+        proof: 'none',
+        accountId: null,
+        subject: null,
+        workspaceId: null,
+        providerId: null,
+        email: null,
+        plan: null,
+        label: null,
+        accessExpiresAt: null,
+        enrollmentCount: null,
+        problems,
+    };
+    const file = files[0];
+    if (!file)
+        return record;
+    const parsed = parseLegacyJson(file.raw);
+    if (!parsed || parsed.schemaVersion !== 1 || parsed.id !== id || typeof parsed.slotId !== 'string'
+        || typeof parsed.label !== 'string' || !parsed.credential || typeof parsed.credential !== 'object'
+        || Array.isArray(parsed.credential)) {
+        problems.push('the saved record does not match the credential-store schema');
+        return record;
+    }
+    const credential = parsed.credential;
+    record.label = parsed.label;
+    if (harness === 'claude') {
+        const identity = claudeSourceIdentity(credential);
+        if (identity === null)
+            problems.push('the saved Claude login or its account metadata is incomplete');
+        else {
+            record.providerId = 'anthropic';
+            record.accountId = identity.accountId;
+            record.subject = identity.subject;
+            record.workspaceId = identity.workspaceId;
+            record.email = identity.email;
+            record.accessExpiresAt = identity.accessExpiresAt;
+            if (typeof credential.claudeAiOauth === 'object' && credential.claudeAiOauth !== null
+                && typeof credential.claudeAiOauth.refreshToken !== 'string') {
+                problems.push('the saved Claude login carries no refresh token');
+            }
+        }
+    }
+    else if (parsed.slotId === 'openai') {
+        const { identity, accessExpiresAt } = openCodeOpenAiIdentity(credential);
+        record.accessExpiresAt = accessExpiresAt;
+        if (identity === null)
+            problems.push('the saved OpenAI login carries no identity the authority can hold');
+        else {
+            record.providerId = 'openai';
+            record.accountId = identity.accountId;
+            record.subject = identity.subject;
+            record.workspaceId = identity.workspaceId;
+            record.email = identity.email;
+            record.plan = identity.plan;
+        }
+        if (typeof credential.refresh !== 'string')
+            problems.push('the saved login carries no refresh token');
+    }
+    else {
+        // API keys and other provider entries are credentials, but not grants the authority model can express.
+        problems.push(`provider ${parsed.slotId} is not a login the authority can hold`);
+    }
+    if (problems.length === 0) {
+        record.treatment = 'import';
+        record.proof = 'rotating_refresh';
+    }
+    return record;
+};
+export const readAuthSwitchStores = (locations) => {
+    const sources = [];
+    const problems = [];
+    let entries;
+    try {
+        entries = plugins.fs.readdirSync(locations.authSwitchHome, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { sources, problems };
+        return { sources, problems: [`${locations.authSwitchHome} could not be listed`] };
+    }
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+        const path = plugins.path.join(locations.authSwitchHome, entry.name);
+        if (!entry.isDirectory()) {
+            problems.push(`${entry.name} is not a harness directory`);
+            continue;
+        }
+        if (STASH_HARNESSES.includes(entry.name)) {
+            let stashes;
+            try {
+                stashes = plugins.fs.readdirSync(path, { withFileTypes: true });
+            }
+            catch {
+                problems.push(`${entry.name} could not be listed`);
+                continue;
+            }
+            for (const stash of stashes.sort((left, right) => left.name.localeCompare(right.name))) {
+                if (!stash.isDirectory()) {
+                    problems.push(`${entry.name}/${stash.name} is not a stash`);
+                    continue;
+                }
+                sources.push(readStashDirectory(plugins.path.join(path, stash.name)));
+            }
+        }
+        else if (RECORD_HARNESSES.includes(entry.name)) {
+            let records;
+            try {
+                records = plugins.fs.readdirSync(path, { withFileTypes: true });
+            }
+            catch {
+                problems.push(`${entry.name} could not be listed`);
+                continue;
+            }
+            for (const item of records.sort((left, right) => left.name.localeCompare(right.name))) {
+                // switches.json is authswitch's advisory record of the last switch, not a credential source.
+                if (item.name === 'switches.json' || item.name === '.lock')
+                    continue;
+                if (!item.isFile() || !RECORD_FILE.test(item.name)) {
+                    problems.push(`${entry.name}/${item.name} is not a saved account record`);
+                    continue;
+                }
+                sources.push(readCredentialRecord(entry.name, plugins.path.join(path, item.name), item.name.slice(0, -5)));
+            }
+        }
+        else {
+            // Guessing a store layout would be the one way this migration could lose an account silently.
+            problems.push(`${entry.name} uses no legacy store layout this import knows`);
+        }
+    }
+    return { sources, problems };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aHN3aXRjaHN0b3Jlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL3RzX21pZ3JhdGlvbi9sZWdhY3lzb3VyY2VzL2F1dGhzd2l0Y2hzdG9yZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUM1QyxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsb0JBQW9CLEVBQUUsVUFBVSxFQUFFLGtCQUFrQixFQUFFLGNBQWMsRUFDOUYsb0JBQW9CLEVBQUUsc0JBQXNCLEVBQUUsZUFBZSxFQUFFLGNBQWMsRUFFbkQsTUFBTSxhQUFhLENBQUM7QUFFaEQ7Ozs7Ozs7Ozs7R0FVRztBQUVILE1BQU0sZUFBZSxHQUFHLFdBQVcsQ0FBQztBQUNwQyxNQUFNLGVBQWUsR0FBRyxZQUFZLENBQUM7QUFDckMsMEZBQTBGO0FBQzFGLE1BQU0sZUFBZSxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUM7QUFDbEMsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQztBQUNoRCxNQUFNLFdBQVcsR0FBRyxzQkFBc0IsQ0FBQztBQUUzQyxNQUFNLFVBQVUsR0FBRyxDQUFDLElBQVksRUFBRSxLQUFtQyxFQUNILEVBQUU7SUFDbEUsTUFBTSxjQUFjLEdBQUcsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3hDLE9BQU87UUFDTCxFQUFFLEVBQUUsY0FBYyxDQUFDLGtCQUFrQixFQUFFLGNBQWMsQ0FBQztRQUN0RCxVQUFVLEVBQUUsa0JBQWtCO1FBQzlCLElBQUk7UUFDSixjQUFjO1FBQ2QsWUFBWSxFQUFFLGtCQUFrQixDQUFDLEtBQUssQ0FBQztLQUN4QyxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYseUdBQXlHO0FBQ3pHLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxJQUFZLEVBQXVCLEVBQUU7SUFDL0QsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBQzlCLE1BQU0sS0FBSyxHQUF3QixFQUFFLENBQUM7SUFDdEMsS0FBSyxNQUFNLElBQUksSUFBSSxDQUFDLGVBQWUsRUFBRSxlQUFlLENBQUMsRUFBRSxDQUFDO1FBQ3RELE1BQU0sSUFBSSxHQUFHLGNBQWMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDakUsSUFBSSxJQUFJLENBQUMsT0FBTztZQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO2FBQ3pDLElBQUksSUFBSSxDQUFDLElBQUksS0FBSyxJQUFJO1lBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksYUFBYSxDQUFDLENBQUM7O1lBQzVELEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzdCLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBd0I7UUFDbEMsR0FBRyxVQUFVLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQztRQUMxQixTQUFTLEVBQUUsUUFBUTtRQUNuQixLQUFLLEVBQUUsTUFBTTtRQUNiLFNBQVMsRUFBRSxJQUFJO1FBQ2YsT0FBTyxFQUFFLElBQUk7UUFDYixXQUFXLEVBQUUsSUFBSTtRQUNqQixVQUFVLEVBQUUsSUFBSTtRQUNoQixLQUFLLEVBQUUsSUFBSTtRQUNYLElBQUksRUFBRSxJQUFJO1FBQ1YsS0FBSyxFQUFFLElBQUk7UUFDWCxlQUFlLEVBQUUsSUFBSTtRQUNyQixlQUFlLEVBQUUsSUFBSTtRQUNyQixRQUFRO0tBQ1QsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxLQUFLLGVBQWUsQ0FBQyxDQUFDO0lBQy9ELE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxLQUFLLGVBQWUsQ0FBQyxDQUFDO0lBQy9ELElBQUksSUFBSSxFQUFFLENBQUM7UUFDVCxNQUFNLE1BQU0sR0FBRyxlQUFlLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3pDLElBQUksQ0FBQyxNQUFNO1lBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLGVBQWUsdUJBQXVCLENBQUMsQ0FBQzthQUNqRSxDQUFDO1lBQ0osTUFBTSxDQUFDLEtBQUssR0FBRyxPQUFPLE1BQU0sQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7WUFDdEUsTUFBTSxDQUFDLGVBQWUsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUM5RixJQUFJLE1BQU0sQ0FBQyxlQUFlLEtBQUssSUFBSTtnQkFBRSxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsZUFBZSw2QkFBNkIsQ0FBQyxDQUFDO1FBQ3RHLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxDQUFDLElBQUk7UUFBRSxPQUFPLE1BQU0sQ0FBQztJQUN6QixNQUFNLE1BQU0sR0FBRyxlQUFlLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3pDLE1BQU0sTUFBTSxHQUFHLE1BQU0sRUFBRSxNQUFNLENBQUM7SUFDOUIsTUFBTSxXQUFXLEdBQUcsTUFBTSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQ2hGLENBQUMsQ0FBQyxNQUFpQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDN0MsTUFBTSxPQUFPLEdBQUcsT0FBTyxXQUFXLEVBQUUsUUFBUSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO0lBQ3hGLE1BQU0sWUFBWSxHQUFHLE9BQU8sV0FBVyxFQUFFLGFBQWEsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUN2RyxNQUFNLFFBQVEsR0FBRyxPQUFPLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLG9CQUFvQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3pFLElBQUksUUFBUSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3RCLHlHQUF5RztRQUN6RyxRQUFRLENBQUMsSUFBSSxDQUFDLHlFQUF5RSxDQUFDLENBQUM7UUFDekYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELE1BQU0sQ0FBQyxVQUFVLEdBQUcsUUFBUSxDQUFDO0lBQzdCLE1BQU0sQ0FBQyxTQUFTLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQztJQUN0QyxNQUFNLENBQUMsT0FBTyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUM7SUFDbEMsTUFBTSxDQUFDLFdBQVcsR0FBRyxRQUFRLENBQUMsV0FBVyxDQUFDO0lBQzFDLE1BQU0sQ0FBQyxLQUFLLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQztJQUM5QixNQUFNLENBQUMsSUFBSSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUM7SUFDNUIsTUFBTSxDQUFDLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxJQUFJLFFBQVEsQ0FBQyxLQUFLLENBQUM7SUFDOUMsTUFBTSxDQUFDLGVBQWUsR0FBRyxpQkFBaUIsQ0FDeEMsT0FBTyxXQUFXLEVBQUUsWUFBWSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDbkYsSUFBSSxZQUFZLEtBQUssSUFBSTtRQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQztTQUNyRixJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFBQyxNQUFNLENBQUMsU0FBUyxHQUFHLFFBQVEsQ0FBQztRQUFDLE1BQU0sQ0FBQyxLQUFLLEdBQUcsa0JBQWtCLENBQUM7SUFBQyxDQUFDO0lBQ25HLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLHdHQUF3RztBQUN4RyxNQUFNLG9CQUFvQixHQUFHLENBQUMsT0FBZSxFQUFFLElBQVksRUFBRSxFQUFVLEVBQXVCLEVBQUU7SUFDOUYsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBQzlCLE1BQU0sS0FBSyxHQUF3QixFQUFFLENBQUM7SUFDdEMsTUFBTSxJQUFJLEdBQUcsY0FBYyxDQUFDLElBQUksRUFBRSxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDaEQsSUFBSSxJQUFJLENBQUMsT0FBTztRQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1NBQ3pDLElBQUksSUFBSSxDQUFDLElBQUksS0FBSyxJQUFJO1FBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDOztRQUN4RixLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUMzQixNQUFNLE1BQU0sR0FBd0I7UUFDbEMsR0FBRyxVQUFVLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQztRQUMxQixTQUFTLEVBQUUsUUFBUTtRQUNuQixLQUFLLEVBQUUsTUFBTTtRQUNiLFNBQVMsRUFBRSxJQUFJO1FBQ2YsT0FBTyxFQUFFLElBQUk7UUFDYixXQUFXLEVBQUUsSUFBSTtRQUNqQixVQUFVLEVBQUUsSUFBSTtRQUNoQixLQUFLLEVBQUUsSUFBSTtRQUNYLElBQUksRUFBRSxJQUFJO1FBQ1YsS0FBSyxFQUFFLElBQUk7UUFDWCxlQUFlLEVBQUUsSUFBSTtRQUNyQixlQUFlLEVBQUUsSUFBSTtRQUNyQixRQUFRO0tBQ1QsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN0QixJQUFJLENBQUMsSUFBSTtRQUFFLE9BQU8sTUFBTSxDQUFDO0lBQ3pCLE1BQU0sTUFBTSxHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDekMsSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxPQUFPLE1BQU0sQ0FBQyxNQUFNLEtBQUssUUFBUTtXQUM3RixPQUFPLE1BQU0sQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsSUFBSSxPQUFPLE1BQU0sQ0FBQyxVQUFVLEtBQUssUUFBUTtXQUMvRixLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ3RDLFFBQVEsQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLFVBQXFDLENBQUM7SUFDaEUsTUFBTSxDQUFDLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDO0lBQzVCLElBQUksT0FBTyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sUUFBUSxHQUFHLG9CQUFvQixDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2xELElBQUksUUFBUSxLQUFLLElBQUk7WUFBRSxRQUFRLENBQUMsSUFBSSxDQUFDLDhEQUE4RCxDQUFDLENBQUM7YUFDaEcsQ0FBQztZQUNKLE1BQU0sQ0FBQyxVQUFVLEdBQUcsV0FBVyxDQUFDO1lBQ2hDLE1BQU0sQ0FBQyxTQUFTLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQztZQUN0QyxNQUFNLENBQUMsT0FBTyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUM7WUFDbEMsTUFBTSxDQUFDLFdBQVcsR0FBRyxRQUFRLENBQUMsV0FBVyxDQUFDO1lBQzFDLE1BQU0sQ0FBQyxLQUFLLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQztZQUM5QixNQUFNLENBQUMsZUFBZSxHQUFHLFFBQVEsQ0FBQyxlQUFlLENBQUM7WUFDbEQsSUFBSSxPQUFPLFVBQVUsQ0FBQyxhQUFhLEtBQUssUUFBUSxJQUFJLFVBQVUsQ0FBQyxhQUFhLEtBQUssSUFBSTttQkFDaEYsT0FBUSxVQUFVLENBQUMsYUFBeUMsQ0FBQyxZQUFZLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQzVGLFFBQVEsQ0FBQyxJQUFJLENBQUMsaURBQWlELENBQUMsQ0FBQztZQUNuRSxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7U0FBTSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDdEMsTUFBTSxFQUFFLFFBQVEsRUFBRSxlQUFlLEVBQUUsR0FBRyxzQkFBc0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN6RSxNQUFNLENBQUMsZUFBZSxHQUFHLGVBQWUsQ0FBQztRQUN6QyxJQUFJLFFBQVEsS0FBSyxJQUFJO1lBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO2FBQ3JHLENBQUM7WUFDSixNQUFNLENBQUMsVUFBVSxHQUFHLFFBQVEsQ0FBQztZQUM3QixNQUFNLENBQUMsU0FBUyxHQUFHLFFBQVEsQ0FBQyxTQUFTLENBQUM7WUFDdEMsTUFBTSxDQUFDLE9BQU8sR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDO1lBQ2xDLE1BQU0sQ0FBQyxXQUFXLEdBQUcsUUFBUSxDQUFDLFdBQVcsQ0FBQztZQUMxQyxNQUFNLENBQUMsS0FBSyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUM7WUFDOUIsTUFBTSxDQUFDLElBQUksR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDO1FBQzlCLENBQUM7UUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLE9BQU8sS0FBSyxRQUFRO1lBQUUsUUFBUSxDQUFDLElBQUksQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQ3hHLENBQUM7U0FBTSxDQUFDO1FBQ04sdUdBQXVHO1FBQ3ZHLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFBQyxNQUFNLENBQUMsU0FBUyxHQUFHLFFBQVEsQ0FBQztRQUFDLE1BQU0sQ0FBQyxLQUFLLEdBQUcsa0JBQWtCLENBQUM7SUFBQyxDQUFDO0lBQzlGLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsU0FBaUMsRUFBdUIsRUFBRTtJQUM3RixNQUFNLE9BQU8sR0FBMEIsRUFBRSxDQUFDO0lBQzFDLE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQztJQUM5QixJQUFJLE9BQTRCLENBQUM7SUFDakMsSUFBSSxDQUFDO1FBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxjQUFjLEVBQUUsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUFDLENBQUM7SUFDNUYsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNiLElBQUssS0FBK0IsQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLENBQUM7UUFDckYsT0FBTyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsQ0FBQyxHQUFHLFNBQVMsQ0FBQyxjQUFjLHNCQUFzQixDQUFDLEVBQUUsQ0FBQztJQUNwRixDQUFDO0lBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN2RixNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNyRSxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUM7WUFBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxDQUFDLElBQUksNkJBQTZCLENBQUMsQ0FBQztZQUFDLFNBQVM7UUFBQyxDQUFDO1FBQ2xHLElBQUksZUFBZSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUN6QyxJQUFJLE9BQTRCLENBQUM7WUFDakMsSUFBSSxDQUFDO2dCQUFDLE9BQU8sR0FBRyxPQUFPLENBQUMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUFDLENBQUM7WUFDeEUsTUFBTSxDQUFDO2dCQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxzQkFBc0IsQ0FBQyxDQUFDO2dCQUFDLFNBQVM7WUFBQyxDQUFDO1lBQ3ZFLEtBQUssTUFBTSxLQUFLLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQ3ZGLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQztvQkFBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxDQUFDLElBQUksSUFBSSxLQUFLLENBQUMsSUFBSSxpQkFBaUIsQ0FBQyxDQUFDO29CQUFDLFNBQVM7Z0JBQUMsQ0FBQztnQkFDcEcsT0FBTyxDQUFDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUN4RSxDQUFDO1FBQ0gsQ0FBQzthQUFNLElBQUksZ0JBQWdCLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2pELElBQUksT0FBNEIsQ0FBQztZQUNqQyxJQUFJLENBQUM7Z0JBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxFQUFFLGFBQWEsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1lBQUMsQ0FBQztZQUN4RSxNQUFNLENBQUM7Z0JBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssQ0FBQyxJQUFJLHNCQUFzQixDQUFDLENBQUM7Z0JBQUMsU0FBUztZQUFDLENBQUM7WUFDdkUsS0FBSyxNQUFNLElBQUksSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDdEYsNkZBQTZGO2dCQUM3RixJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssZUFBZSxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssT0FBTztvQkFBRSxTQUFTO2dCQUNyRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztvQkFDbkQsUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssQ0FBQyxJQUFJLElBQUksSUFBSSxDQUFDLElBQUksZ0NBQWdDLENBQUMsQ0FBQztvQkFDMUUsU0FBUztnQkFDWCxDQUFDO2dCQUNELE9BQU8sQ0FBQyxJQUFJLENBQUMsb0JBQW9CLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUM5RSxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDN0IsQ0FBQztRQUNILENBQUM7YUFBTSxDQUFDO1lBQ04sOEZBQThGO1lBQzlGLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxnREFBZ0QsQ0FBQyxDQUFDO1FBQy9FLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsQ0FBQztBQUMvQixDQUFDLENBQUMifQ==

package/dist_ts/ts_migration/legacysources/index.d.ts

@@ -0,0 +1,18 @@
+import { type ILegacySourceReport } from './shared.js';
+export { resolveLegacySourceLocations } from './shared.js';
+export type { ILegacySourceLocations, ILegacySourceRecord, ILegacySourceReport } from './shared.js';
+export { LegacySourceChangedError, readLegacySourceEnrollments, readLegacySourceMaterial } from './material.js';
+export type { TLegacySourceMaterial } from './material.js';
+export interface ILegacySourceOptions {
+    env: NodeJS.ProcessEnv;
+    homeDirectory: string;
+    now: number;
+}
+/**
+ * Every legacy credential source this host holds, read and never changed.
+ *
+ * One function so that the import and the inventory always see the same list: a submit re-runs this read to
+ * resolve a source's location from its hash and to re-check its digest, and a discrepancy between what the
+ * owner approved and what is imported would defeat the point of approving anything.
+ */
+export declare const readLegacySources: (options: ILegacySourceOptions) => ILegacySourceReport;

package/dist_ts/ts_migration/legacysources/index.js

@@ -0,0 +1,24 @@
+import { readAuthSwitchStores } from './authswitchstores.js';
+import { readNativeStores } from './nativestores.js';
+import { resolveLegacySourceLocations } from './shared.js';
+export { resolveLegacySourceLocations } from './shared.js';
+export { LegacySourceChangedError, readLegacySourceEnrollments, readLegacySourceMaterial } from './material.js';
+/**
+ * Every legacy credential source this host holds, read and never changed.
+ *
+ * One function so that the import and the inventory always see the same list: a submit re-runs this read to
+ * resolve a source's location from its hash and to re-check its digest, and a discrepancy between what the
+ * owner approved and what is imported would defeat the point of approving anything.
+ */
+export const readLegacySources = (options) => {
+    const locations = resolveLegacySourceLocations(options.env, options.homeDirectory);
+    const reports = [readAuthSwitchStores(locations), readNativeStores(locations, options.now)];
+    const sources = [];
+    const problems = [];
+    for (const report of reports) {
+        sources.push(...report.sources);
+        problems.push(...report.problems);
+    }
+    return { sources, problems };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy90c19taWdyYXRpb24vbGVnYWN5c291cmNlcy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSx1QkFBdUIsQ0FBQztBQUM3RCxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUNyRCxPQUFPLEVBQUUsNEJBQTRCLEVBQ1QsTUFBTSxhQUFhLENBQUM7QUFFaEQsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBRTNELE9BQU8sRUFBRSx3QkFBd0IsRUFBRSwyQkFBMkIsRUFDNUQsd0JBQXdCLEVBQUUsTUFBTSxlQUFlLENBQUM7QUFTbEQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxPQUE2QixFQUF1QixFQUFFO0lBQ3RGLE1BQU0sU0FBUyxHQUFHLDRCQUE0QixDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ25GLE1BQU0sT0FBTyxHQUFHLENBQUMsb0JBQW9CLENBQUMsU0FBUyxDQUFDLEVBQUUsZ0JBQWdCLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzVGLE1BQU0sT0FBTyxHQUEwQixFQUFFLENBQUM7SUFDMUMsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBQzlCLEtBQUssTUFBTSxNQUFNLElBQUksT0FBTyxFQUFFLENBQUM7UUFDN0IsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNoQyxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFDRCxPQUFPLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQy9CLENBQUMsQ0FBQyJ9

package/dist_ts/ts_migration/legacysources/material.d.ts

@@ -0,0 +1,37 @@
+import { type ILegacySourceRecord } from './shared.js';
+/**
+ * Re-opens the credential of one source, inside the daemon, from the location its hash stands for.
+ *
+ * Nothing carries this material over a socket: a caller names a source by id and digest, and the daemon reads
+ * the bytes itself. The digest is re-checked here, so a source that changed between the owner's approval and
+ * the import is refused rather than imported unseen.
+ */
+/** Exactly the envelope the authority already seals for each provider, so no new stored shape appears. */
+export type TLegacySourceMaterial = {
+    providerId: 'openai';
+    credential: {
+        kind: 'chatgptOAuth';
+        providerId: 'openai';
+        accessToken: string;
+        refreshToken: string;
+        idToken: string;
+    };
+} | {
+    providerId: 'anthropic';
+    login: {
+        claudeAiOauth: Record<string, unknown>;
+        oauthAccount: Record<string, unknown>;
+    };
+};
+export declare class LegacySourceChangedError extends Error {
+    constructor();
+}
+/** Reads the source named by `record`, proves it is still the inventoried source, and returns its envelope. */
+export declare const readLegacySourceMaterial: (record: ILegacySourceRecord) => TLegacySourceMaterial;
+/**
+ * The remote-control enrollments a Codex stash saved beside its credential.
+ *
+ * They are separate from the refresh grant and are the pairing between this machine's Codex app-server and a
+ * ChatGPT client: a migration that dropped them would silently unpair the account.
+ */
+export declare const readLegacySourceEnrollments: (record: ILegacySourceRecord) => Record<string, unknown>[];

package/dist_ts/ts_migration/legacysources/material.js

@@ -0,0 +1,120 @@
+import * as plugins from '../../plugins.js';
+import { legacySourceDigest, parseLegacyJson, readLegacyFile } from './shared.js';
+export class LegacySourceChangedError extends Error {
+    constructor() { super('The source changed after it was inventoried; no credential was read.'); }
+}
+const files = (record, names, base) => {
+    const read = [];
+    for (const name of names) {
+        const item = readLegacyFile(plugins.path.join(base, name), name);
+        if (item.file === null)
+            throw new LegacySourceChangedError();
+        read.push(item.file);
+    }
+    return read;
+};
+const openAiFromTokens = (tokens) => {
+    if (!tokens || typeof tokens !== 'object' || Array.isArray(tokens))
+        return null;
+    const record = tokens;
+    const accessToken = record.access_token;
+    const refreshToken = record.refresh_token;
+    const idToken = record.id_token;
+    if (typeof accessToken !== 'string' || typeof refreshToken !== 'string'
+        || typeof idToken !== 'string')
+        return null;
+    return { providerId: 'openai',
+        credential: { kind: 'chatgptOAuth', providerId: 'openai', accessToken, refreshToken, idToken } };
+};
+const claudeFromComposite = (credential) => {
+    const oauth = credential.claudeAiOauth;
+    const account = credential.oauthAccount;
+    if (!oauth || typeof oauth !== 'object' || Array.isArray(oauth)
+        || !account || typeof account !== 'object' || Array.isArray(account))
+        return null;
+    return { providerId: 'anthropic',
+        login: { claudeAiOauth: oauth,
+            oauthAccount: account } };
+};
+/** Reads the source named by `record`, proves it is still the inventoried source, and returns its envelope. */
+export const readLegacySourceMaterial = (record) => {
+    const assertUnchanged = (read) => {
+        if (legacySourceDigest(read) !== record.sourceDigest)
+            throw new LegacySourceChangedError();
+    };
+    const fail = () => { throw new Error('The source holds no credential the authority can seal.'); };
+    if (record.sourceKind === 'authswitch_stash' && record.path.endsWith('.json')) {
+        const read = files(record, [plugins.path.basename(record.path)], plugins.path.dirname(record.path));
+        assertUnchanged(read);
+        const parsed = parseLegacyJson(read[0].raw);
+        const credential = parsed?.credential;
+        if (!credential || typeof credential !== 'object' || Array.isArray(credential))
+            return fail();
+        const material = record.providerId === 'anthropic'
+            ? claudeFromComposite(credential)
+            : openCodeOpenAi(credential);
+        return material ?? fail();
+    }
+    if (record.sourceKind === 'authswitch_stash' || record.sourceKind === 'codex_native') {
+        const base = record.sourceKind === 'codex_native' ? plugins.path.dirname(record.path) : record.path;
+        const names = record.sourceKind === 'codex_native' ? ['auth.json'] : ['auth.json', 'stash.json'];
+        const read = files(record, names, base);
+        assertUnchanged(read);
+        return openAiFromTokens(parseLegacyJson(read[0].raw)?.tokens) ?? fail();
+    }
+    if (record.sourceKind === 'claude_native') {
+        const credentials = readLegacyFile(record.path, '.credentials.json');
+        const configFile = plugins.path.join(plugins.path.dirname(record.path), '.claude.json');
+        const config = readLegacyFile(configFile, '.claude.json');
+        const read = [credentials.file, config.file].filter((file) => file !== null);
+        assertUnchanged(read);
+        const credentialData = credentials.file === null ? null : parseLegacyJson(credentials.file.raw);
+        const configData = config.file === null ? null : parseLegacyJson(config.file.raw);
+        return claudeFromComposite({ claudeAiOauth: credentialData?.claudeAiOauth,
+            oauthAccount: configData?.oauthAccount }) ?? fail();
+    }
+    if (record.sourceKind === 'opencode_native') {
+        // The provider entries share a file; the location names the entry, and the digest covers that entry only.
+        const separator = record.path.lastIndexOf('#');
+        const file = record.path.slice(0, separator);
+        const provider = record.path.slice(separator + 1);
+        const read = readLegacyFile(file, 'auth.json');
+        if (read.file === null)
+            throw new LegacySourceChangedError();
+        const entry = parseLegacyJson(read.file.raw)?.[provider];
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            throw new LegacySourceChangedError();
+        assertUnchanged([{ name: provider, raw: JSON.stringify(entry) }]);
+        return openCodeOpenAi(entry) ?? fail();
+    }
+    return fail();
+};
+/**
+ * The remote-control enrollments a Codex stash saved beside its credential.
+ *
+ * They are separate from the refresh grant and are the pairing between this machine's Codex app-server and a
+ * ChatGPT client: a migration that dropped them would silently unpair the account.
+ */
+export const readLegacySourceEnrollments = (record) => {
+    if (record.sourceKind !== 'authswitch_stash' || record.path.endsWith('.json'))
+        return [];
+    const read = readLegacyFile(plugins.path.join(record.path, 'stash.json'), 'stash.json');
+    if (read.file === null)
+        return [];
+    const enrollments = parseLegacyJson(read.file.raw)?.enrollments;
+    return Array.isArray(enrollments)
+        ? enrollments.filter((row) => Boolean(row) && typeof row === 'object' && !Array.isArray(row))
+        : [];
+};
+/** An OpenCode OAuth entry: access and refresh, with the identity claims carried by the access token. */
+const openCodeOpenAi = (entry) => {
+    const accessToken = entry.access;
+    const refreshToken = entry.refresh;
+    if (typeof accessToken !== 'string' || typeof refreshToken !== 'string')
+        return null;
+    // OpenCode stores no id_token; the access token carries the same claims the authority reads.
+    return { providerId: 'openai',
+        credential: { kind: 'chatgptOAuth', providerId: 'openai', accessToken, refreshToken,
+            idToken: accessToken } };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWF0ZXJpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy90c19taWdyYXRpb24vbGVnYWN5c291cmNlcy9tYXRlcmlhbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGtCQUFrQixDQUFDO0FBQzVDLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxlQUFlLEVBQUUsY0FBYyxFQUNoQyxNQUFNLGFBQWEsQ0FBQztBQWlCaEQsTUFBTSxPQUFPLHdCQUF5QixTQUFRLEtBQUs7SUFDakQsZ0JBQWdCLEtBQUssQ0FBQyxzRUFBc0UsQ0FBQyxDQUFDLENBQUMsQ0FBQztDQUNqRztBQUVELE1BQU0sS0FBSyxHQUFHLENBQUMsTUFBMkIsRUFBRSxLQUF3QixFQUNsRSxJQUFZLEVBQXVCLEVBQUU7SUFDckMsTUFBTSxJQUFJLEdBQXdCLEVBQUUsQ0FBQztJQUNyQyxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxHQUFHLGNBQWMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDakUsSUFBSSxJQUFJLENBQUMsSUFBSSxLQUFLLElBQUk7WUFBRSxNQUFNLElBQUksd0JBQXdCLEVBQUUsQ0FBQztRQUM3RCxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN2QixDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsTUFBZSxFQUFnQyxFQUFFO0lBQ3pFLElBQUksQ0FBQyxNQUFNLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDaEYsTUFBTSxNQUFNLEdBQUcsTUFBaUMsQ0FBQztJQUNqRCxNQUFNLFdBQVcsR0FBRyxNQUFNLENBQUMsWUFBWSxDQUFDO0lBQ3hDLE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxhQUFhLENBQUM7SUFDMUMsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQztJQUNoQyxJQUFJLE9BQU8sV0FBVyxLQUFLLFFBQVEsSUFBSSxPQUFPLFlBQVksS0FBSyxRQUFRO1dBQ2xFLE9BQU8sT0FBTyxLQUFLLFFBQVE7UUFBRSxPQUFPLElBQUksQ0FBQztJQUM5QyxPQUFPLEVBQUUsVUFBVSxFQUFFLFFBQVE7UUFDM0IsVUFBVSxFQUFFLEVBQUUsSUFBSSxFQUFFLGNBQWMsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQztBQUNyRyxDQUFDLENBQUM7QUFFRixNQUFNLG1CQUFtQixHQUFHLENBQUMsVUFBbUMsRUFBZ0MsRUFBRTtJQUNoRyxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsYUFBYSxDQUFDO0lBQ3ZDLE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxZQUFZLENBQUM7SUFDeEMsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7V0FDMUQsQ0FBQyxPQUFPLElBQUksT0FBTyxPQUFPLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDcEYsT0FBTyxFQUFFLFVBQVUsRUFBRSxXQUFXO1FBQzlCLEtBQUssRUFBRSxFQUFFLGFBQWEsRUFBRSxLQUFnQztZQUN0RCxZQUFZLEVBQUUsT0FBa0MsRUFBRSxFQUFFLENBQUM7QUFDM0QsQ0FBQyxDQUFDO0FBRUYsK0dBQStHO0FBQy9HLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsTUFBMkIsRUFBeUIsRUFBRTtJQUM3RixNQUFNLGVBQWUsR0FBRyxDQUFDLElBQWtDLEVBQVEsRUFBRTtRQUNuRSxJQUFJLGtCQUFrQixDQUFDLElBQUksQ0FBQyxLQUFLLE1BQU0sQ0FBQyxZQUFZO1lBQUUsTUFBTSxJQUFJLHdCQUF3QixFQUFFLENBQUM7SUFDN0YsQ0FBQyxDQUFDO0lBQ0YsTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyx3REFBd0QsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBRXpHLElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxrQkFBa0IsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQzlFLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUNwRyxlQUFlLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDdEIsTUFBTSxNQUFNLEdBQUcsZUFBZSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLEVBQUUsVUFBVSxDQUFDO1FBQ3RDLElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxVQUFVLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDO1lBQUUsT0FBTyxJQUFJLEVBQUUsQ0FBQztRQUM5RixNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsVUFBVSxLQUFLLFdBQVc7WUFDaEQsQ0FBQyxDQUFDLG1CQUFtQixDQUFDLFVBQXFDLENBQUM7WUFDNUQsQ0FBQyxDQUFDLGNBQWMsQ0FBQyxVQUFxQyxDQUFDLENBQUM7UUFDMUQsT0FBTyxRQUFRLElBQUksSUFBSSxFQUFFLENBQUM7SUFDNUIsQ0FBQztJQUNELElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxrQkFBa0IsSUFBSSxNQUFNLENBQUMsVUFBVSxLQUFLLGNBQWMsRUFBRSxDQUFDO1FBQ3JGLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxVQUFVLEtBQUssY0FBYyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUM7UUFDcEcsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFVBQVUsS0FBSyxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQ2pHLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ3hDLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN0QixPQUFPLGdCQUFnQixDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEVBQUUsTUFBTSxDQUFDLElBQUksSUFBSSxFQUFFLENBQUM7SUFDMUUsQ0FBQztJQUNELElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxlQUFlLEVBQUUsQ0FBQztRQUMxQyxNQUFNLFdBQVcsR0FBRyxjQUFjLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxtQkFBbUIsQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxjQUFjLENBQUMsQ0FBQztRQUN4RixNQUFNLE1BQU0sR0FBRyxjQUFjLENBQUMsVUFBVSxFQUFFLGNBQWMsQ0FBQyxDQUFDO1FBQzFELE1BQU0sSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUE2QixFQUFFLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDO1FBQ3hHLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN0QixNQUFNLGNBQWMsR0FBRyxXQUFXLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNoRyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNsRixPQUFPLG1CQUFtQixDQUFDLEVBQUUsYUFBYSxFQUFFLGNBQWMsRUFBRSxhQUFhO1lBQ3ZFLFlBQVksRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQztJQUN4RCxDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsVUFBVSxLQUFLLGlCQUFpQixFQUFFLENBQUM7UUFDNUMsMEdBQTBHO1FBQzFHLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQy9DLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQztRQUM3QyxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDbEQsTUFBTSxJQUFJLEdBQUcsY0FBYyxDQUFDLElBQUksRUFBRSxXQUFXLENBQUMsQ0FBQztRQUMvQyxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssSUFBSTtZQUFFLE1BQU0sSUFBSSx3QkFBd0IsRUFBRSxDQUFDO1FBQzdELE1BQU0sS0FBSyxHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7WUFBRSxNQUFNLElBQUksd0JBQXdCLEVBQUUsQ0FBQztRQUN0RyxlQUFlLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDbEUsT0FBTyxjQUFjLENBQUMsS0FBZ0MsQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDO0lBQ3BFLENBQUM7SUFDRCxPQUFPLElBQUksRUFBRSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsQ0FBQyxNQUEyQixFQUE2QixFQUFFO0lBQ3BHLElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxrQkFBa0IsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7UUFBRSxPQUFPLEVBQUUsQ0FBQztJQUN6RixNQUFNLElBQUksR0FBRyxjQUFjLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxZQUFZLENBQUMsRUFBRSxZQUFZLENBQUMsQ0FBQztJQUN4RixJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssSUFBSTtRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ2xDLE1BQU0sV0FBVyxHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLFdBQVcsQ0FBQztJQUNoRSxPQUFPLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQy9CLENBQUMsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxFQUFrQyxFQUFFLENBQzNELE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxPQUFPLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2pFLENBQUMsQ0FBQyxFQUFFLENBQUM7QUFDVCxDQUFDLENBQUM7QUFFRix5R0FBeUc7QUFDekcsTUFBTSxjQUFjLEdBQUcsQ0FBQyxLQUE4QixFQUFnQyxFQUFFO0lBQ3RGLE1BQU0sV0FBVyxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7SUFDakMsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQztJQUNuQyxJQUFJLE9BQU8sV0FBVyxLQUFLLFFBQVEsSUFBSSxPQUFPLFlBQVksS0FBSyxRQUFRO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDckYsNkZBQTZGO0lBQzdGLE9BQU8sRUFBRSxVQUFVLEVBQUUsUUFBUTtRQUMzQixVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsY0FBYyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLFlBQVk7WUFDakYsT0FBTyxFQUFFLFdBQVcsRUFBRSxFQUFFLENBQUM7QUFDL0IsQ0FBQyxDQUFDIn0=

package/dist_ts/ts_migration/legacysources/nativestores.d.ts

@@ -0,0 +1,2 @@
+import { type ILegacySourceLocations, type ILegacySourceReport } from './shared.js';
+export declare const readNativeStores: (locations: ILegacySourceLocations, now: number) => ILegacySourceReport;