@namzu/cli 12.1.0 → 14.0.0

package/dist/integrations/providers/credential-store.js

@@ -35,15 +35,16 @@
  * ## What is in the file
  *
  *   { "version": 1,
- *     "subscription": { "accessToken", "refreshToken", "expiresAt", "scopes" } }
+ *     "subscription": { "accessToken", "refreshToken", "expiresAt", "scopes" },
+ *     "codexSubscription": { "accessToken", "refreshToken", "expiresAt", "accountId" } }
  *
- * `subscription` is the credential a person's plan grants, obtained by the
- * login flow in `subscription-login.ts` and refreshed in place by `oauth.ts`.
- * Nothing else writes here.
+ * Each sibling is owned by Namzu's corresponding login flow and conditionally
+ * refreshed in place. Credentials borrowed from Claude or Codex remain in
+ * their owners' files/keychain and are never copied here.
  */
 import { execFileSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
-import { closeSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeSync, } from 'node:fs';
+import { closeSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, writeSync, } from 'node:fs';
 import { homedir, platform, tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 const FILE_MODE = 0o600;
@@ -66,6 +67,13 @@ export function credentialsPath(home = homedir()) {
  * the operator to try again.
  */
 export function readStoredSubscriptionCredential(home = homedir()) {
+    return readCredentialDocument(home)?.subscription ?? null;
+}
+/** The Namzu-owned ChatGPT/Codex subscription, if one was obtained here. */
+export function readStoredCodexCredential(home = homedir()) {
+    return readCredentialDocument(home)?.codexSubscription ?? null;
+}
+function readCredentialDocument(home) {
     let raw;
     try {
         raw = readFileSync(credentialsPath(home), 'utf8');
@@ -82,10 +90,28 @@ export function readStoredSubscriptionCredential(home = homedir()) {
     }
     if (typeof parsed !== 'object' || parsed === null)
         return null;
-    const sub = parsed.subscription;
-    if (typeof sub !== 'object' || sub === null)
+    const root = parsed;
+    const subscription = parseCredential(root.subscription);
+    const codexBase = parseCredential(root.codexSubscription);
+    const codexRecord = typeof root.codexSubscription === 'object' && root.codexSubscription !== null
+        ? root.codexSubscription
+        : null;
+    const accountId = codexRecord?.accountId;
+    const codexSubscription = codexBase && typeof accountId === 'string' && accountId.length > 0
+        ? { ...codexBase, accountId }
+        : undefined;
+    if (!subscription && !codexSubscription)
         return null;
-    const rec = sub;
+    return {
+        version: CREDENTIALS_FILE_VERSION,
+        ...(subscription ? { subscription } : {}),
+        ...(codexSubscription ? { codexSubscription } : {}),
+    };
+}
+function parseCredential(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const rec = value;
     const accessToken = rec.accessToken;
     if (typeof accessToken !== 'string' || accessToken.length === 0)
         return null;
@@ -110,16 +136,67 @@ export function readStoredSubscriptionCredential(home = homedir()) {
 export function writeStoredSubscriptionCredential(cred, home = homedir()) {
     const path = credentialsPath(home);
     mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+    return withCredentialStoreLock(path, () => {
+        const current = readCredentialDocument(home);
+        return writeCredentialDocumentUnlocked({ version: CREDENTIALS_FILE_VERSION, ...current, subscription: cred }, path);
+    });
+}
+export function writeStoredCodexCredential(cred, home = homedir()) {
+    const path = credentialsPath(home);
+    mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+    return withCredentialStoreLock(path, () => {
+        const current = readCredentialDocument(home);
+        return writeCredentialDocumentUnlocked({
+            version: CREDENTIALS_FILE_VERSION,
+            ...current,
+            codexSubscription: cred,
+        }, path);
+    });
+}
+export function replaceStoredCodexCredential(expected, replacement, home = homedir()) {
+    const path = credentialsPath(home);
+    mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+    return withCredentialStoreLock(path, () => {
+        const current = readStoredCodexCredential(home);
+        if (!sameCodexCredential(current, expected))
+            return { replaced: false, current };
+        const document = readCredentialDocument(home);
+        writeCredentialDocumentUnlocked({
+            version: CREDENTIALS_FILE_VERSION,
+            ...document,
+            codexSubscription: replacement,
+        }, path);
+        return { replaced: true, current: replacement };
+    });
+}
+/**
+ * Replace exactly the credential a refresh was derived from.
+ *
+ * Comparison and rename happen under the same store-owned cross-process lock.
+ * A changed record is returned to the caller and is never overwritten. This is
+ * the durable authority boundary a post-network plain reread cannot provide:
+ * without the lock, another writer can still rotate the credential between
+ * the comparison and the rename.
+ */
+export function replaceStoredSubscriptionCredential(expected, replacement, home = homedir()) {
+    const path = credentialsPath(home);
+    mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+    return withCredentialStoreLock(path, () => {
+        const current = readStoredSubscriptionCredential(home);
+        if (!sameCredential(current, expected))
+            return { replaced: false, current };
+        const document = readCredentialDocument(home);
+        writeCredentialDocumentUnlocked({
+            version: CREDENTIALS_FILE_VERSION,
+            ...document,
+            subscription: replacement,
+        }, path);
+        return { replaced: true, current: replacement };
+    });
+}
+function writeCredentialDocumentUnlocked(document, path) {
     const tmp = `${path}.tmp.${process.pid}.${randomBytes(6).toString('hex')}`;
-    const body = `${JSON.stringify({
-        version: CREDENTIALS_FILE_VERSION,
-        subscription: {
-            accessToken: cred.accessToken,
-            ...(cred.refreshToken ? { refreshToken: cred.refreshToken } : {}),
-            ...(cred.expiresAt ? { expiresAt: cred.expiresAt } : {}),
-            ...(cred.scopes ? { scopes: cred.scopes } : {}),
-        },
-    }, null, 2)}\n`;
+    const body = `${JSON.stringify(serializeDocument(document), null, 2)}\n`;
     let fd;
     try {
         // `wx` — refuse an existing path rather than truncate one, so a name
@@ -150,9 +227,150 @@ export function writeStoredSubscriptionCredential(cred, home = homedir()) {
     }
     return path;
 }
+function serializeDocument(document) {
+    const credential = (value) => ({
+        accessToken: value.accessToken,
+        ...(value.refreshToken ? { refreshToken: value.refreshToken } : {}),
+        ...(value.expiresAt ? { expiresAt: value.expiresAt } : {}),
+        ...(value.scopes ? { scopes: value.scopes } : {}),
+    });
+    return {
+        version: CREDENTIALS_FILE_VERSION,
+        ...(document.subscription ? { subscription: credential(document.subscription) } : {}),
+        ...(document.codexSubscription
+            ? {
+                codexSubscription: {
+                    ...credential(document.codexSubscription),
+                    accountId: document.codexSubscription.accountId,
+                },
+            }
+            : {}),
+    };
+}
 /** Remove the stored credential. Absence is success. */
 export function clearStoredSubscriptionCredential(home = homedir()) {
-    rmSync(credentialsPath(home), { force: true });
+    const path = credentialsPath(home);
+    mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+    withCredentialStoreLock(path, () => {
+        const current = readCredentialDocument(home);
+        if (!current?.codexSubscription) {
+            rmSync(path, { force: true });
+            return;
+        }
+        writeCredentialDocumentUnlocked({
+            version: CREDENTIALS_FILE_VERSION,
+            codexSubscription: current.codexSubscription,
+        }, path);
+    });
+}
+/** Remove only the Namzu-owned Codex subscription; borrowed harness auth is untouched. */
+export function clearStoredCodexCredential(home = homedir()) {
+    const path = credentialsPath(home);
+    mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+    withCredentialStoreLock(path, () => {
+        const current = readCredentialDocument(home);
+        if (!current?.subscription) {
+            rmSync(path, { force: true });
+            return;
+        }
+        writeCredentialDocumentUnlocked({ version: CREDENTIALS_FILE_VERSION, subscription: current.subscription }, path);
+    });
+}
+/** Remove every credential Namzu owns in one store mutation. */
+export function clearAllStoredCredentials(home = homedir()) {
+    const path = credentialsPath(home);
+    mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+    withCredentialStoreLock(path, () => rmSync(path, { force: true }));
+}
+function sameCredential(left, right) {
+    if (!left)
+        return false;
+    if (left.accessToken !== right.accessToken ||
+        left.refreshToken !== right.refreshToken ||
+        left.expiresAt !== right.expiresAt) {
+        return false;
+    }
+    const leftScopes = left.scopes ?? [];
+    const rightScopes = right.scopes ?? [];
+    return (leftScopes.length === rightScopes.length &&
+        leftScopes.every((scope, index) => scope === rightScopes[index]));
+}
+function sameCodexCredential(left, right) {
+    return left?.accountId === right.accountId && sameCredential(left, right);
+}
+/**
+ * Run one synchronous store mutation with cross-process exclusion.
+ *
+ * The lock is held only across local read/rename work, never across a network
+ * request. A dead owner can leave a complete lock behind. It is deliberately
+ * not stolen automatically: pathname-based stale reclamation cannot prove it
+ * is unlinking the inode it inspected, so a delayed reclaimer can delete a new
+ * owner's lock and admit two writers. A present lock is a refusal until an
+ * operator proves no process owns the store and removes it.
+ */
+function withCredentialStoreLock(path, operation) {
+    const lockPath = `${path}.lock`;
+    const token = `${process.pid}:${Date.now()}:${randomBytes(12).toString('hex')}`;
+    const published = publishLockAtomically(lockPath, token);
+    if (!published.acquired) {
+        throw new CredentialStoreError(`could not acquire the credential-store lock for ${path}: another owner or an unrecovered process lock is present (${published.error instanceof Error ? published.error.message : String(published.error)}). Refusing concurrent mutation; after proving no Namzu process is using this credential store, remove ${lockPath} and retry.`);
+    }
+    try {
+        return operation();
+    }
+    finally {
+        // Do not remove a successor's lock if an external actor replaced the file.
+        try {
+            if (readFileSync(lockPath, 'utf8') === token)
+                rmSync(lockPath, { force: true });
+        }
+        catch {
+            // The mutation already has its result. A missing/replaced lock is not
+            // evidence that the credential itself failed to publish.
+        }
+    }
+}
+/**
+ * Publish a complete owner record at the canonical name in one filesystem op.
+ *
+ * Creating the canonical file and then writing its token has a fatal crash
+ * window: an empty lock names no owner and can never be reclaimed safely. The
+ * candidate is completed and synced first; `linkSync` is the exclusive claim.
+ * A pre-link crash can leave candidate debris, but it never blocks the store.
+ */
+function publishLockAtomically(lockPath, token) {
+    const candidatePath = `${lockPath}.candidate.${process.pid}.${randomBytes(12).toString('hex')}`;
+    let fd;
+    try {
+        fd = openSync(candidatePath, 'wx', FILE_MODE);
+        writeFileSync(fd, token, 'utf8');
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+    }
+    catch (error) {
+        if (fd !== undefined)
+            closeSync(fd);
+        rmSync(candidatePath, { force: true });
+        throw new CredentialStoreError(`could not prepare the credential-store lock: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+        linkSync(candidatePath, lockPath);
+        return { acquired: true };
+    }
+    catch (error) {
+        return { acquired: false, error };
+    }
+    finally {
+        try {
+            rmSync(candidatePath, { force: true });
+        }
+        catch {
+            // Candidate debris is non-canonical and cannot block another owner.
+            // Once the hard link succeeds, cleanup must not erase that acquisition
+            // result and skip the token-checked canonical release path.
+        }
+    }
 }
 /**
  * Make `path` readable and writable by its owner and by nobody else, and

package/dist/integrations/providers/credential-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../../src/integrations/providers/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,SAAS,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIzC,MAAM,SAAS,GAAG,KAAK,CAAA;AACvB,MAAM,QAAQ,GAAG,KAAK,CAAA;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAU,CAAA;AAElD,wFAAwF;AACxF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC5B,IAAI,GAAG,sBAAsB,CAAA;CAC/C;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,OAAO,EAAE;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC/C,OAAe,OAAO,EAAE;IAExB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAI,MAAqC,CAAC,YAAY,CAAA;IAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,GAAG,GAAG,GAA8B,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAA;IACnC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO;QACN,WAAW;QACX,YAAY,EAAE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACjF,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACxE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAChC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAc;YAC/D,CAAC,CAAC,SAAS;KACZ,CAAA;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAChD,IAA0B,EAC1B,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC1E,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAC7B;QACC,OAAO,EAAE,wBAAwB;QACjC,YAAY,EAAE;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C;KACD,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CAAA;IAEL,IAAI,EAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,qEAAqE;QACrE,mEAAmE;QACnE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QACnC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAA;IACF,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAA;IAEb,IAAI,CAAC;QACJ,eAAe,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,GAAG,CAAA;IACV,CAAC;IAED,IAAI,CAAC;QACJ,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAA;IACF,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,iCAAiC,CAAC,OAAe,OAAO,EAAE;IACzE,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5B,OAAM;IACP,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACJ,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,oBAAoB,CAC7B,0CAA0C,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrG,CAAA;IACF,CAAC;IACD,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC7D,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,uCAAuC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kFAAkF,CAC1J,CAAA;IACF,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAuB,EAAU,EAAE;QAC5D,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBACnD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,WAAW,EAAE,IAAI;aACjB,CAAC,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAC7B,GAAG,GAAG,qBAAqB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2EAA2E,CAC/J,CAAA;QACF,CAAC;IACF,CAAC,CAAA;IAED,gEAAgE;IAChE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAC7B,uFAAuF,IAAI,yBAAyB,CACpH,CAAA;IACF,CAAC;IAED,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;IAEpE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,oBAAoB,CAC7B,kDAAkD,IAAI,oCAAoC,CAC1F,CAAA;IACF,CAAC;IACD,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACvC,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC;QACJ,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;YACpE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAA;QACF,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC;AACF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc;IAC7B,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE;YACtF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC7B,8BAA8B,IAAI,2DAA2D,CAC7F,CAAA;IACF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,+FAA+F,CACtG,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAC7B,8BAA8B,IAAI,2DAA2D,CAC7F,CAAA;IACF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5B,yEAAyE;QACzE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;YAAE,SAAQ;QAC3C,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,kDAAkD,OAAO,0CAA0C,CAC1G,CAAA;QACF,CAAC;IACF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,qFAAqF,CAC5F,CAAA;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../../src/integrations/providers/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,EACb,SAAS,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIzC,MAAM,SAAS,GAAG,KAAK,CAAA;AACvB,MAAM,QAAQ,GAAG,KAAK,CAAA;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAU,CAAA;AAElD,wFAAwF;AACxF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC5B,IAAI,GAAG,sBAAsB,CAAA;CAC/C;AAuBD,MAAM,UAAU,eAAe,CAAC,OAAe,OAAO,EAAE;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC/C,OAAe,OAAO,EAAE;IAExB,OAAO,sBAAsB,CAAC,IAAI,CAAC,EAAE,YAAY,IAAI,IAAI,CAAA;AAC1D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,OAAe,OAAO,EAAE;IACjE,OAAO,sBAAsB,CAAC,IAAI,CAAC,EAAE,iBAAiB,IAAI,IAAI,CAAA;AAC/D,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC3C,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,IAAI,GAAG,MAGZ,CAAA;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACvD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACzD,MAAM,WAAW,GAChB,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI;QAC5E,CAAC,CAAE,IAAI,CAAC,iBAA6C;QACrD,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,SAAS,GAAG,WAAW,EAAE,SAAS,CAAA;IACxC,MAAM,iBAAiB,GACtB,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QACjE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE;QAC7B,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAA;IACpD,OAAO;QACN,OAAO,EAAE,wBAAwB;QACjC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAA;AACF,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5D,MAAM,GAAG,GAAG,KAAgC,CAAA;IAC5C,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAA;IACnC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO;QACN,WAAW;QACX,YAAY,EAAE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACjF,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACxE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAChC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAc;YAC/D,CAAC,CAAC,SAAS;KACZ,CAAA;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAChD,IAA0B,EAC1B,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE;QACzC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5C,OAAO,+BAA+B,CACrC,EAAE,OAAO,EAAE,wBAAwB,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,EACrE,IAAI,CACJ,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,IAA2B,EAC3B,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE;QACzC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5C,OAAO,+BAA+B,CACrC;YACC,OAAO,EAAE,wBAAwB;YACjC,GAAG,OAAO;YACV,iBAAiB,EAAE,IAAI;SACvB,EACD,IAAI,CACJ,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,QAA+B,EAC/B,WAAkC,EAClC,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE;QACzC,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QAChF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC7C,+BAA+B,CAC9B;YACC,OAAO,EAAE,wBAAwB;YACjC,GAAG,QAAQ;YACX,iBAAiB,EAAE,WAAW;SAC9B,EACD,IAAI,CACJ,CAAA;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAClD,QAA8B,EAC9B,WAAiC,EACjC,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,OAAO,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE;QACzC,MAAM,OAAO,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC7C,+BAA+B,CAC9B;YACC,OAAO,EAAE,wBAAwB;YACjC,GAAG,QAAQ;YACX,YAAY,EAAE,WAAW;SACzB,EACD,IAAI,CACJ,CAAA;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAChD,CAAC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,+BAA+B,CAAC,QAA4B,EAAE,IAAY;IAClF,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC1E,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA;IAExE,IAAI,EAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,qEAAqE;QACrE,mEAAmE;QACnE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QACnC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAA;IACF,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAA;IAEb,IAAI,CAAC;QACJ,eAAe,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,GAAG,CAAA;IACV,CAAC;IAED,IAAI,CAAC;QACJ,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAA;IACF,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA4B;IACtD,MAAM,UAAU,GAAG,CAAC,KAA2B,EAAE,EAAE,CAAC,CAAC;QACpD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC,CAAA;IACF,OAAO;QACN,OAAO,EAAE,wBAAwB;QACjC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,QAAQ,CAAC,iBAAiB;YAC7B,CAAC,CAAC;gBACA,iBAAiB,EAAE;oBAClB,GAAG,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC;oBACzC,SAAS,EAAE,QAAQ,CAAC,iBAAiB,CAAC,SAAS;iBAC/C;aACD;YACF,CAAC,CAAC,EAAE,CAAC;KACN,CAAA;AACF,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,iCAAiC,CAAC,OAAe,OAAO,EAAE;IACzE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE;QAClC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7B,OAAM;QACP,CAAC;QACD,+BAA+B,CAC9B;YACC,OAAO,EAAE,wBAAwB;YACjC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;SAC5C,EACD,IAAI,CACJ,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,0BAA0B,CAAC,OAAe,OAAO,EAAE;IAClE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE;QAClC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7B,OAAM;QACP,CAAC;QACD,+BAA+B,CAC9B,EAAE,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EACzE,IAAI,CACJ,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,yBAAyB,CAAC,OAAe,OAAO,EAAE;IACjE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,uBAAuB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,IAAiC,EAAE,KAA2B;IACrF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IACC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;QACxC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EACjC,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;IACtC,OAAO,CACN,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAChE,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAC3B,IAAkC,EAClC,KAA4B;IAE5B,OAAO,IAAI,EAAE,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAI,IAAY,EAAE,SAAkB;IACnE,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAA;IAC/B,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC/E,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACxD,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC7B,mDAAmD,IAAI,8DAA8D,SAAS,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,0GAA0G,QAAQ,aAAa,CACxU,CAAA;IACF,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,SAAS,EAAE,CAAA;IACnB,CAAC;YAAS,CAAC;QACV,2EAA2E;QAC3E,IAAI,CAAC;YACJ,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,KAAK;gBAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChF,CAAC;QAAC,MAAM,CAAC;YACR,sEAAsE;YACtE,yDAAyD;QAC1D,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAC7B,QAAgB,EAChB,KAAa;IAEb,MAAM,aAAa,GAAG,GAAG,QAAQ,cAAc,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC/F,IAAI,EAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QAC7C,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAChC,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,EAAE,GAAG,SAAS,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,MAAM,IAAI,oBAAoB,CAC7B,gDAAgD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxG,CAAA;IACF,CAAC;IAED,IAAI,CAAC;QACJ,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAClC,CAAC;YAAS,CAAC;QACV,IAAI,CAAC;YACJ,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;YACpE,uEAAuE;YACvE,4DAA4D;QAC7D,CAAC;IACF,CAAC;AACF,CAAC;AACD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5B,OAAM;IACP,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACJ,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,oBAAoB,CAC7B,0CAA0C,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrG,CAAA;IACF,CAAC;IACD,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC7D,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,uCAAuC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kFAAkF,CAC1J,CAAA;IACF,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAuB,EAAU,EAAE;QAC5D,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBACnD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,WAAW,EAAE,IAAI;aACjB,CAAC,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAC7B,GAAG,GAAG,qBAAqB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2EAA2E,CAC/J,CAAA;QACF,CAAC;IACF,CAAC,CAAA;IAED,gEAAgE;IAChE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAC7B,uFAAuF,IAAI,yBAAyB,CACpH,CAAA;IACF,CAAC;IAED,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;IAEpE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,oBAAoB,CAC7B,kDAAkD,IAAI,oCAAoC,CAC1F,CAAA;IACF,CAAC;IACD,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACvC,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC;QACJ,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;YACpE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAA;QACF,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC;AACF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc;IAC7B,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE;YACtF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC7B,8BAA8B,IAAI,2DAA2D,CAC7F,CAAA;IACF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,+FAA+F,CACtG,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAC7B,8BAA8B,IAAI,2DAA2D,CAC7F,CAAA;IACF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5B,yEAAyE;QACzE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;YAAE,SAAQ;QAC3C,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,kDAAkD,OAAO,0CAA0C,CAC1G,CAAA;QACF,CAAC;IACF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,qFAAqF,CAC5F,CAAA;IACF,CAAC;AACF,CAAC"}

package/dist/integrations/providers/discover.d.ts

@@ -1,12 +1,10 @@
 /**
  * Credential discoverer for LLM provider clients.
  *
- * For each entry in `PROVIDER_REGISTRY`, ask four questions in order:
- *   1. Is one of its env vars set in `process.env`?
- *   2. Is there a subscription credential in namzu's own store — the one the
- *      login flow writes? (every platform, and only `anthropic` consumes it.)
- *   3. Is there an OAuth credential in the login Keychain? (macOS only, and
- *      only `anthropic` consumes it.)
+ * For each entry in `PROVIDER_REGISTRY`, ask four questions:
+ *   1. Is there a usable session owned by an installed Claude or Codex harness?
+ *   2. Is there a subscription credential in namzu's own store?
+ *   3. Is one of its optional API-key env vars set in `process.env`?
  *   4. Is the probe URL (if any) reachable right now?
  *
  * The header used to say "three" and list two, and the one it omitted was the
@@ -19,14 +17,12 @@
  * hole.** `readAgentKeychainCredential` returns `null` on any other platform
  * before it looks at anything; it reads a credential belonging to a
  * co-installed tool, so it can only ever help someone who has that tool, on
- * that operating system. namzu's own store is asked first among the credential
- * sources and works everywhere, which is what makes signing in from inside
- * namzu useful on a machine that has neither.
+ * that operating system. namzu's own store works everywhere, which is what
+ * makes signing in from inside namzu useful on a machine that has neither.
  *
- * Order between the two matters when both answer. namzu's own store wins,
- * because it is the one namzu wrote and refreshes; preferring a borrowed
- * credential over the operator's own sign-in would make the login look
- * ineffective on precisely the machine where they bothered to run it.
+ * Order matters when both answer. A current device-harness session wins; a
+ * Namzu-owned sign-in is the fallback for a machine that has no usable harness
+ * session. API-key/env sources remain optional alternatives after both.
  *
  * The first positive answer per provider wins; subsequent sources are
  * recorded as "also available from" so the picker can show alternatives
@@ -72,6 +68,16 @@ export type DetectionSource = {
     readonly kind: 'keychain';
     readonly service: string;
 }
+/** A read-only Claude Code OAuth envelope owned by the Claude CLI. */
+ | {
+    readonly kind: 'claude-file';
+    readonly path: string;
+}
+/** A read-only ChatGPT/Codex OAuth envelope owned by the Codex CLI. */
+ | {
+    readonly kind: 'codex-file';
+    readonly path: string;
+}
 /**
  * namzu's own credential store — a subscription the operator signed in to
  * from inside namzu. Carries the path because "where did this come from"
@@ -115,6 +121,12 @@ export interface DetectedProvider {
         readonly expiresAt?: number;
         readonly origin?: CredentialOrigin;
     };
+    /** Account-routed OAuth metadata for the Codex Responses backend. */
+    readonly codex?: {
+        readonly accountId: string;
+        readonly expiresAt?: number;
+        readonly origin: 'codex-file' | 'stored';
+    };
     /** Other sources that also satisfy this provider — informational. */
     readonly alternatives: readonly DetectionSource[];
 }

package/dist/integrations/providers/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAqB,KAAK,UAAU,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAE9F,MAAM,MAAM,eAAe,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACzD;;;;GAIG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACpD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAE/B,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;KAClC,CAAA;IACD,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,eAAe;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAChC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC7B;AAID,wBAAsB,iBAAiB,CACtC,IAAI,GAAE,eAAoB,GACxB,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAyGtC;AAmBD,yEAAyE;AACzE,wBAAgB,YAAY,CAC3B,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,EAAE,EAAE,UAAU,GACZ,gBAAgB,GAAG,IAAI,CAEzB"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAiBH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAqB,KAAK,UAAU,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAE9F,MAAM,MAAM,eAAe,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACzD,sEAAsE;GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACzD,uEAAuE;GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACxD;;;;GAIG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACpD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAE/B,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;KAClC,CAAA;IACD,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAChB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,QAAQ,CAAA;KACxC,CAAA;IACD,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,eAAe;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAChC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC7B;AAID,wBAAsB,iBAAiB,CACtC,IAAI,GAAE,eAAoB,GACxB,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAsKtC;AAsBD,yEAAyE;AACzE,wBAAgB,YAAY,CAC3B,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,EAAE,EAAE,UAAU,GACZ,gBAAgB,GAAG,IAAI,CAEzB"}

package/dist/integrations/providers/discover.js

@@ -1,12 +1,10 @@
 /**
  * Credential discoverer for LLM provider clients.
  *
- * For each entry in `PROVIDER_REGISTRY`, ask four questions in order:
- *   1. Is one of its env vars set in `process.env`?
- *   2. Is there a subscription credential in namzu's own store — the one the
- *      login flow writes? (every platform, and only `anthropic` consumes it.)
- *   3. Is there an OAuth credential in the login Keychain? (macOS only, and
- *      only `anthropic` consumes it.)
+ * For each entry in `PROVIDER_REGISTRY`, ask four questions:
+ *   1. Is there a usable session owned by an installed Claude or Codex harness?
+ *   2. Is there a subscription credential in namzu's own store?
+ *   3. Is one of its optional API-key env vars set in `process.env`?
  *   4. Is the probe URL (if any) reachable right now?
  *
  * The header used to say "three" and list two, and the one it omitted was the
@@ -19,14 +17,12 @@
  * hole.** `readAgentKeychainCredential` returns `null` on any other platform
  * before it looks at anything; it reads a credential belonging to a
  * co-installed tool, so it can only ever help someone who has that tool, on
- * that operating system. namzu's own store is asked first among the credential
- * sources and works everywhere, which is what makes signing in from inside
- * namzu useful on a machine that has neither.
+ * that operating system. namzu's own store works everywhere, which is what
+ * makes signing in from inside namzu useful on a machine that has neither.
  *
- * Order between the two matters when both answer. namzu's own store wins,
- * because it is the one namzu wrote and refreshes; preferring a borrowed
- * credential over the operator's own sign-in would make the login look
- * ineffective on precisely the machine where they bothered to run it.
+ * Order matters when both answer. A current device-harness session wins; a
+ * Namzu-owned sign-in is the fallback for a machine that has no usable harness
+ * session. API-key/env sources remain optional alternatives after both.
  *
  * The first positive answer per provider wins; subsequent sources are
  * recorded as "also available from" so the picker can show alternatives
@@ -61,7 +57,8 @@
  * picker can render immediately and refine if discovery completes later.
  */
 import { EnvCredentialProvider } from '@namzu/sdk';
-import { credentialsPath, readStoredSubscriptionCredential } from './credential-store.js';
+import { credentialsPath, readStoredCodexCredential, readStoredSubscriptionCredential, } from './credential-store.js';
+import { claudeCredentialsPath, codexCredentialsPath, preferFresherCredential, readClaudeFileCredential, readCodexFileCredential, } from './harness-credentials.js';
 import { KEYCHAIN_SERVICE, readAgentKeychainCredential } from './keychain.js';
 import { PROVIDER_REGISTRY } from './registry.js';
 const DEFAULT_PROBE_TIMEOUT_MS = 500;
@@ -103,14 +100,96 @@ export async function discoverProviders(opts = {}) {
     const storedCredential = opts.skipStored
         ? null
         : readStoredSubscriptionCredential(...(opts.home === undefined ? [] : [opts.home]));
+    const storedCodexCredential = opts.skipStored
+        ? null
+        : readStoredCodexCredential(...(opts.home === undefined ? [] : [opts.home]));
     // macOS-only: the OAuth credential a co-installed tool keeps in the login
     // Keychain.
     const keychainCredential = opts.skipKeychain ? null : readAgentKeychainCredential();
+    const claudeFileCredential = readClaudeFileCredential(opts.home);
+    const codexFileCredential = readCodexFileCredential(opts.home, env);
+    const usableCodexFileCredential = codexFileCredential?.expiresAt === undefined ||
+        codexFileCredential.expiresAt - Date.now() > 60_000
+        ? codexFileCredential
+        : null;
     for (const id of Object.keys(PROVIDER_REGISTRY)) {
         const entry = PROVIDER_REGISTRY[id];
         const sources = [];
         let apiKey;
         let oauth;
+        let codex;
+        if (id === 'anthropic') {
+            const borrowed = preferFresherCredential(claudeFileCredential, keychainCredential);
+            const usableBorrowed = borrowed?.expiresAt === undefined || borrowed.expiresAt - Date.now() > 60_000
+                ? borrowed
+                : null;
+            const borrowedSource = usableBorrowed === claudeFileCredential && usableBorrowed
+                ? {
+                    kind: 'claude-file',
+                    path: claudeCredentialsPath(opts.home),
+                }
+                : usableBorrowed
+                    ? { kind: 'keychain', service: KEYCHAIN_SERVICE }
+                    : undefined;
+            if (usableBorrowed && borrowedSource) {
+                if (apiKey === undefined) {
+                    apiKey = usableBorrowed.accessToken;
+                    oauth = {
+                        refreshToken: usableBorrowed.refreshToken,
+                        expiresAt: usableBorrowed.expiresAt,
+                        origin: borrowedSource.kind === 'claude-file' ? 'claude-file' : 'keychain',
+                    };
+                }
+                sources.push(borrowedSource);
+            }
+            const otherBorrowedSource = usableBorrowed && usableBorrowed === claudeFileCredential && keychainCredential
+                ? { kind: 'keychain', service: KEYCHAIN_SERVICE }
+                : usableBorrowed && usableBorrowed === keychainCredential && claudeFileCredential
+                    ? {
+                        kind: 'claude-file',
+                        path: claudeCredentialsPath(opts.home),
+                    }
+                    : undefined;
+            if (otherBorrowedSource)
+                sources.push(otherBorrowedSource);
+            if (storedCredential) {
+                if (apiKey === undefined) {
+                    apiKey = storedCredential.accessToken;
+                    oauth = {
+                        refreshToken: storedCredential.refreshToken,
+                        expiresAt: storedCredential.expiresAt,
+                        origin: 'stored',
+                    };
+                }
+                sources.push({
+                    kind: 'stored',
+                    path: credentialsPath(...(opts.home === undefined ? [] : [opts.home])),
+                });
+            }
+        }
+        if (id === 'codex' && (storedCodexCredential || usableCodexFileCredential)) {
+            const credential = usableCodexFileCredential ?? storedCodexCredential;
+            if (!credential)
+                throw new Error('unreachable');
+            apiKey = credential.accessToken;
+            sources.push({
+                kind: usableCodexFileCredential ? 'codex-file' : 'stored',
+                path: usableCodexFileCredential
+                    ? codexCredentialsPath(opts.home, env)
+                    : credentialsPath(...(opts.home === undefined ? [] : [opts.home])),
+            });
+            codex = {
+                accountId: credential.accountId,
+                expiresAt: credential.expiresAt,
+                origin: usableCodexFileCredential ? 'codex-file' : 'stored',
+            };
+            if (storedCodexCredential && usableCodexFileCredential) {
+                sources.push({
+                    kind: 'stored',
+                    path: credentialsPath(...(opts.home === undefined ? [] : [opts.home])),
+                });
+            }
+        }
         for (const envName of entry.envVars) {
             // Through the SDK's seam rather than a direct `env[envName]`. The
             // read is identical; what changes is that a host embedding the SDK
@@ -124,35 +203,6 @@ export async function discoverProviders(opts = {}) {
                 sources.push({ kind: 'env', envName });
             }
         }
-        if (id === 'anthropic' && storedCredential) {
-            if (apiKey === undefined)
-                apiKey = storedCredential.accessToken;
-            sources.push({
-                kind: 'stored',
-                path: credentialsPath(...(opts.home === undefined ? [] : [opts.home])),
-            });
-            // Only carry refresh metadata when this token is the one we'll
-            // actually use (an env/secrets token has no refresh path).
-            if (apiKey === storedCredential.accessToken) {
-                oauth = {
-                    refreshToken: storedCredential.refreshToken,
-                    expiresAt: storedCredential.expiresAt,
-                    origin: 'stored',
-                };
-            }
-        }
-        if (id === 'anthropic' && keychainCredential) {
-            if (apiKey === undefined)
-                apiKey = keychainCredential.accessToken;
-            sources.push({ kind: 'keychain', service: KEYCHAIN_SERVICE });
-            if (apiKey === keychainCredential.accessToken) {
-                oauth = {
-                    refreshToken: keychainCredential.refreshToken,
-                    expiresAt: keychainCredential.expiresAt,
-                    origin: 'keychain',
-                };
-            }
-        }
         if (sources.length === 0 && entry.probeUrl && !opts.skipProbes) {
             const reachable = await probe(entry.probeUrl, opts);
             if (reachable) {
@@ -166,6 +216,7 @@ export async function discoverProviders(opts = {}) {
                 apiKey,
                 baseUrl: entry.defaultBaseUrl,
                 ...(oauth ? { oauth } : {}),
+                ...(codex ? { codex } : {}),
                 alternatives: sources.slice(1),
             });
         }
@@ -177,7 +228,10 @@ async function probe(url, opts) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), opts.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS);
     try {
-        const res = await fetchFn(url, { method: 'GET', signal: controller.signal });
+        const res = await fetchFn(url, {
+            method: 'GET',
+            signal: controller.signal,
+        });
         return res.ok;
     }
     catch {