@namzu/cli 8.2.0 → 8.3.0

package/dist/doctor/checks/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,YAAY,CAAA;AAIhE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAwCpC,CAAA"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,YAAY,CAAA;AAIhE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WA0CpC,CAAA"}

package/dist/doctor/checks/credentials.js

@@ -45,6 +45,8 @@ export const credentialSourcesCheck = {
                     return `${d.entry.id} (env · ${d.source.envName})`;
                 case 'keychain':
                     return `${d.entry.id} (keychain · ${d.source.service})`;
+                case 'stored':
+                    return `${d.entry.id} (signed in · ${d.source.path})`;
                 case 'probe':
                     return `${d.entry.id} (local · ${d.source.url.replace(/^https?:\/\//, '')})`;
             }

package/dist/doctor/checks/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/doctor/checks/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAE5E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgB;IAClD,EAAE,EAAE,uBAAuB;IAC3B,QAAQ,EAAE,WAAW;IACrB,GAAG,EAAE,KAAK,IAAgC,EAAE;QAC3C,IAAI,QAAuD,CAAA;QAC3D,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,sEAAsE;YACtE,OAAO;gBACN,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC3F,CAAA;QACF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,yBAAyB;gBAClC,WAAW,EACV,yXAAyX;aAC1X,CAAA;QACF,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACvB,KAAK,KAAK;oBACT,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAA;gBACnD,KAAK,UAAU;oBACd,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAA;gBACxD,KAAK,OAAO;oBACX,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,GAAG,CAAA;YAC9E,CAAC;QACF,CAAC,CAAC,CAAA;QACF,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,kCAAkC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC/E,CAAA;IACF,CAAC;CACD,CAAA"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/doctor/checks/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAE5E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAgB;IAClD,EAAE,EAAE,uBAAuB;IAC3B,QAAQ,EAAE,WAAW;IACrB,GAAG,EAAE,KAAK,IAAgC,EAAE;QAC3C,IAAI,QAAuD,CAAA;QAC3D,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oEAAoE;YACpE,sEAAsE;YACtE,OAAO;gBACN,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC3F,CAAA;QACF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,yBAAyB;gBAClC,WAAW,EACV,yXAAyX;aAC1X,CAAA;QACF,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACvB,KAAK,KAAK;oBACT,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAA;gBACnD,KAAK,UAAU;oBACd,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAA;gBACxD,KAAK,QAAQ;oBACZ,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;gBACtD,KAAK,OAAO;oBACX,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,GAAG,CAAA;YAC9E,CAAC;QACF,CAAC,CAAC,CAAA;QACF,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,kCAAkC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC/E,CAAA;IACF,CAAC;CACD,CAAA"}

package/dist/integrations/providers/credential-store.d.ts

@@ -0,0 +1,118 @@
+/**
+ * `~/.namzu/credentials.json` — the subscription credential namzu obtained itself.
+ *
+ * ## Why a file, said as a choice rather than a default
+ *
+ * The durable home a credential deserves is the operating system's own secret
+ * store. namzu does not have one. The helper next door reads the macOS login
+ * Keychain and belongs to a DIFFERENT product's entry — namzu borrows a token
+ * from it — so writing namzu's own secret there would file our secret under
+ * somebody else's name. On the platform this was asked for the store is not
+ * that one at all, and no cross-platform binding exists in this package.
+ *
+ * So the options were: ship no durable credential, bind a native store per
+ * platform, or own a file. This owns a file, and pays for it by making the
+ * file's protection a CHECKED property rather than an assumption:
+ *
+ *  - it is created `0600` from birth (`wx` + mode, never a world-readable
+ *    window), inside a `0700` directory;
+ *  - after writing, the protection is READ BACK and asserted;
+ *  - if the assertion cannot be made, the file is deleted and the write
+ *    throws. A credential store that cannot prove it is private is a worse
+ *    outcome than no credential store, and refusing is the rule this
+ *    repository already holds (`docs/conventions/refuse-do-not-degrade.md`).
+ *
+ * The assertion is per-platform because the underlying protection is:
+ *
+ *  - POSIX: `chmod 0600`, then `stat` and require no group/other bits.
+ *  - Windows: POSIX modes do not exist — `fs.chmod` there only toggles the
+ *    read-only attribute, so a `0600` that "succeeded" would prove nothing.
+ *    The equivalent is a discretionary ACL, so inheritance is removed and a
+ *    single full-control entry is granted to the current user's SID; the ACL
+ *    is then saved back as SDDL and required to contain exactly that one
+ *    allow entry and nothing else.
+ *
+ * ## What is in the file
+ *
+ *   { "version": 1,
+ *     "subscription": { "accessToken", "refreshToken", "expiresAt", "scopes" } }
+ *
+ * `subscription` is the credential a person's plan grants, obtained by the
+ * login flow in `subscription-login.ts` and refreshed in place by `oauth.ts`.
+ * Nothing else writes here.
+ */
+import type { AgentOAuthCredential } from './keychain.js';
+export declare const CREDENTIALS_FILE_VERSION: 1;
+/** Thrown when a credential could not be stored *privately*. Never carries a secret. */
+export declare class CredentialStoreError extends Error {
+    readonly name = "CredentialStoreError";
+}
+export declare function credentialsPath(home?: string): string;
+/**
+ * The stored subscription credential, or `null` when there is none.
+ *
+ * Non-throwing on every shape of absence and corruption — a store that
+ * refuses to parse is "no credential", which is what discovery can act on.
+ * It does NOT swallow a permission error into `null` silently; that is still
+ * absence from the reader's point of view, and the login path is what tells
+ * the operator to try again.
+ */
+export declare function readStoredSubscriptionCredential(home?: string): AgentOAuthCredential | null;
+/**
+ * Write the credential, privately, or throw having written nothing that lasts.
+ *
+ * Ordering matters and is the whole point: the temporary file is created with
+ * the restrictive mode, secured, asserted, and only then renamed into place.
+ * A file that appears at the final path and is tightened afterwards has a
+ * window in which it is readable, and that window is the defect this ordering
+ * removes.
+ */
+export declare function writeStoredSubscriptionCredential(cred: AgentOAuthCredential, home?: string): string;
+/** Remove the stored credential. Absence is success. */
+export declare function clearStoredSubscriptionCredential(home?: string): void;
+/**
+ * Make `path` readable and writable by its owner and by nobody else, and
+ * PROVE it. Throws `CredentialStoreError` when the proof cannot be produced.
+ *
+ * Exported because it is the load-bearing half of this module and a security
+ * property nobody can check by reading the caller.
+ */
+export declare function restrictToOwner(path: string): void;
+/**
+ * Require a POSIX mode to grant nothing to group or other.
+ *
+ * Split out for the same reason `assertSoleOwnerSddl` is: it is the actual
+ * assertion, and one that only ever executes on some platforms is one most
+ * contributors never see fail. As a pure function it is checked everywhere,
+ * including by whoever is on the operating system where the branch that calls
+ * it is unreachable.
+ */
+export declare function assertOwnerOnlyMode(mode: number, path: string): void;
+/**
+ * The file's discretionary access-control list, as SDDL, or `null`.
+ *
+ * `null` off Windows and on any failure to read. Exported so a test can make
+ * the Windows arm a real assertion instead of "the write did not throw" —
+ * without it, deleting the entire protection step would kill no test on the
+ * platform the protection is FOR, and the only coverage would be the POSIX
+ * branch running somewhere else.
+ *
+ * `icacls /save` writes a UTF-16 file whose second line is the descriptor.
+ * SDDL names principals by security identifier, so nothing here depends on
+ * the machine's display language.
+ */
+export declare function readAclSddl(path: string): string | null;
+/** The current account's security identifier, or `null` off Windows / on failure. */
+export declare function currentUserSid(): string | null;
+/**
+ * Require an SDDL discretionary ACL to grant exactly one principal, and that
+ * principal to be `sid`.
+ *
+ * Split out from the spawning above because it is the actual assertion, and
+ * an assertion that can only run on one operating system is an assertion
+ * nobody checks. Every entry is examined, not just the first: an ACL reading
+ * `(A;;FA;;;US)(A;;FA;;;WD)` grants us AND everyone, and a check that stopped
+ * at a match would call that private.
+ */
+export declare function assertSoleOwnerSddl(sddl: string, sid: string, path: string): void;
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/integrations/providers/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAiBH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAA;AAElD,wFAAwF;AACxF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,0BAAyB;CAC/C;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC/C,IAAI,GAAE,MAAkB,GACtB,oBAAoB,GAAG,IAAI,CA2B7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,oBAAoB,EAC1B,IAAI,GAAE,MAAkB,GACtB,MAAM,CAiDR;AAED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAAC,IAAI,GAAE,MAAkB,GAAG,IAAI,CAEhF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiBlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMpE;AAgDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBvD;AAED,qFAAqF;AACrF,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAc9C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAoCjF"}

package/dist/integrations/providers/credential-store.js

@@ -0,0 +1,322 @@
+/**
+ * `~/.namzu/credentials.json` — the subscription credential namzu obtained itself.
+ *
+ * ## Why a file, said as a choice rather than a default
+ *
+ * The durable home a credential deserves is the operating system's own secret
+ * store. namzu does not have one. The helper next door reads the macOS login
+ * Keychain and belongs to a DIFFERENT product's entry — namzu borrows a token
+ * from it — so writing namzu's own secret there would file our secret under
+ * somebody else's name. On the platform this was asked for the store is not
+ * that one at all, and no cross-platform binding exists in this package.
+ *
+ * So the options were: ship no durable credential, bind a native store per
+ * platform, or own a file. This owns a file, and pays for it by making the
+ * file's protection a CHECKED property rather than an assumption:
+ *
+ *  - it is created `0600` from birth (`wx` + mode, never a world-readable
+ *    window), inside a `0700` directory;
+ *  - after writing, the protection is READ BACK and asserted;
+ *  - if the assertion cannot be made, the file is deleted and the write
+ *    throws. A credential store that cannot prove it is private is a worse
+ *    outcome than no credential store, and refusing is the rule this
+ *    repository already holds (`docs/conventions/refuse-do-not-degrade.md`).
+ *
+ * The assertion is per-platform because the underlying protection is:
+ *
+ *  - POSIX: `chmod 0600`, then `stat` and require no group/other bits.
+ *  - Windows: POSIX modes do not exist — `fs.chmod` there only toggles the
+ *    read-only attribute, so a `0600` that "succeeded" would prove nothing.
+ *    The equivalent is a discretionary ACL, so inheritance is removed and a
+ *    single full-control entry is granted to the current user's SID; the ACL
+ *    is then saved back as SDDL and required to contain exactly that one
+ *    allow entry and nothing else.
+ *
+ * ## What is in the file
+ *
+ *   { "version": 1,
+ *     "subscription": { "accessToken", "refreshToken", "expiresAt", "scopes" } }
+ *
+ * `subscription` is the credential a person's plan grants, obtained by the
+ * login flow in `subscription-login.ts` and refreshed in place by `oauth.ts`.
+ * Nothing else writes here.
+ */
+import { execFileSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { closeSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeSync, } from 'node:fs';
+import { homedir, platform, tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+const FILE_MODE = 0o600;
+const DIR_MODE = 0o700;
+export const CREDENTIALS_FILE_VERSION = 1;
+/** Thrown when a credential could not be stored *privately*. Never carries a secret. */
+export class CredentialStoreError extends Error {
+    name = 'CredentialStoreError';
+}
+export function credentialsPath(home = homedir()) {
+    return join(home, '.namzu', 'credentials.json');
+}
+/**
+ * The stored subscription credential, or `null` when there is none.
+ *
+ * Non-throwing on every shape of absence and corruption — a store that
+ * refuses to parse is "no credential", which is what discovery can act on.
+ * It does NOT swallow a permission error into `null` silently; that is still
+ * absence from the reader's point of view, and the login path is what tells
+ * the operator to try again.
+ */
+export function readStoredSubscriptionCredential(home = homedir()) {
+    let raw;
+    try {
+        raw = readFileSync(credentialsPath(home), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return null;
+    const sub = parsed.subscription;
+    if (typeof sub !== 'object' || sub === null)
+        return null;
+    const rec = sub;
+    const accessToken = rec.accessToken;
+    if (typeof accessToken !== 'string' || accessToken.length === 0)
+        return null;
+    return {
+        accessToken,
+        refreshToken: typeof rec.refreshToken === 'string' ? rec.refreshToken : undefined,
+        expiresAt: typeof rec.expiresAt === 'number' ? rec.expiresAt : undefined,
+        scopes: Array.isArray(rec.scopes)
+            ? rec.scopes.filter((s) => typeof s === 'string')
+            : undefined,
+    };
+}
+/**
+ * Write the credential, privately, or throw having written nothing that lasts.
+ *
+ * Ordering matters and is the whole point: the temporary file is created with
+ * the restrictive mode, secured, asserted, and only then renamed into place.
+ * A file that appears at the final path and is tightened afterwards has a
+ * window in which it is readable, and that window is the defect this ordering
+ * removes.
+ */
+export function writeStoredSubscriptionCredential(cred, home = homedir()) {
+    const path = credentialsPath(home);
+    mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+    const tmp = `${path}.tmp.${process.pid}.${randomBytes(6).toString('hex')}`;
+    const body = `${JSON.stringify({
+        version: CREDENTIALS_FILE_VERSION,
+        subscription: {
+            accessToken: cred.accessToken,
+            ...(cred.refreshToken ? { refreshToken: cred.refreshToken } : {}),
+            ...(cred.expiresAt ? { expiresAt: cred.expiresAt } : {}),
+            ...(cred.scopes ? { scopes: cred.scopes } : {}),
+        },
+    }, null, 2)}\n`;
+    let fd;
+    try {
+        // `wx` — refuse an existing path rather than truncate one, so a name
+        // collision can never hand us a file somebody else already opened.
+        fd = openSync(tmp, 'wx', FILE_MODE);
+        writeSync(fd, body);
+    }
+    catch (err) {
+        if (fd !== undefined)
+            closeSync(fd);
+        rmSync(tmp, { force: true });
+        throw new CredentialStoreError(`could not write ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    closeSync(fd);
+    try {
+        restrictToOwner(tmp);
+    }
+    catch (err) {
+        rmSync(tmp, { force: true });
+        throw err;
+    }
+    try {
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        rmSync(tmp, { force: true });
+        throw new CredentialStoreError(`could not place ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return path;
+}
+/** Remove the stored credential. Absence is success. */
+export function clearStoredSubscriptionCredential(home = homedir()) {
+    rmSync(credentialsPath(home), { force: true });
+}
+/**
+ * Make `path` readable and writable by its owner and by nobody else, and
+ * PROVE it. Throws `CredentialStoreError` when the proof cannot be produced.
+ *
+ * Exported because it is the load-bearing half of this module and a security
+ * property nobody can check by reading the caller.
+ */
+export function restrictToOwner(path) {
+    if (platform() === 'win32') {
+        restrictToOwnerWindows(path);
+        return;
+    }
+    // POSIX. `openSync` already asked for the mode; a umask cannot loosen it,
+    // but an inherited ACL or an exotic filesystem can, so this reads it back
+    // instead of trusting the request.
+    let mode;
+    try {
+        mode = statSync(path).mode;
+    }
+    catch (err) {
+        throw new CredentialStoreError(`could not read back the permissions of ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    assertOwnerOnlyMode(mode, path);
+}
+/**
+ * Require a POSIX mode to grant nothing to group or other.
+ *
+ * Split out for the same reason `assertSoleOwnerSddl` is: it is the actual
+ * assertion, and one that only ever executes on some platforms is one most
+ * contributors never see fail. As a pure function it is checked everywhere,
+ * including by whoever is on the operating system where the branch that calls
+ * it is unreachable.
+ */
+export function assertOwnerOnlyMode(mode, path) {
+    if ((mode & 0o077) !== 0) {
+        throw new CredentialStoreError(`${path} is readable beyond its owner (mode ${(mode & 0o777).toString(8)}) and the filesystem would not tighten it — refusing to keep a credential there.`);
+    }
+}
+/**
+ * The Windows half: remove inheritance, grant the current user's SID full
+ * control, then read the resulting ACL back as SDDL and require it to be
+ * exactly that one allow entry.
+ *
+ * Both helpers are invoked by absolute path under `%SystemRoot%\System32`.
+ * Resolving them through `PATH` is how a same-named executable earlier on the
+ * path gets to answer a security question on our behalf, and on a developer
+ * machine `PATH` routinely carries a POSIX toolchain that shadows these names.
+ */
+function restrictToOwnerWindows(path) {
+    const system32 = join(process.env.SystemRoot ?? 'C:\\Windows', 'System32');
+    const run = (exe, args) => {
+        try {
+            return execFileSync(join(system32, exe), [...args], {
+                encoding: 'utf8',
+                timeout: 10_000,
+                stdio: ['ignore', 'pipe', 'ignore'],
+                windowsHide: true,
+            });
+        }
+        catch (err) {
+            throw new CredentialStoreError(`${exe} could not secure ${path} (${err instanceof Error ? err.message : String(err)}). namzu will not keep a credential in a file it cannot prove is private.`);
+        }
+    };
+    // `whoami /user /fo csv /nh` prints  "DOMAIN\user","S-1-5-21-…"
+    const sid = currentUserSid();
+    if (!sid) {
+        throw new CredentialStoreError(`could not determine the current account's security identifier, so the protection of ${path} cannot be established.`);
+    }
+    run('icacls.exe', [path, '/inheritance:r', '/grant:r', `*${sid}:F`]);
+    const saved = readAclSddl(path);
+    if (saved === null) {
+        throw new CredentialStoreError(`could not read back the access-control list of ${path}, so its privacy is unestablished.`);
+    }
+    assertSoleOwnerSddl(saved, sid, path);
+}
+/**
+ * The file's discretionary access-control list, as SDDL, or `null`.
+ *
+ * `null` off Windows and on any failure to read. Exported so a test can make
+ * the Windows arm a real assertion instead of "the write did not throw" —
+ * without it, deleting the entire protection step would kill no test on the
+ * platform the protection is FOR, and the only coverage would be the POSIX
+ * branch running somewhere else.
+ *
+ * `icacls /save` writes a UTF-16 file whose second line is the descriptor.
+ * SDDL names principals by security identifier, so nothing here depends on
+ * the machine's display language.
+ */
+export function readAclSddl(path) {
+    if (platform() !== 'win32')
+        return null;
+    const system32 = join(process.env.SystemRoot ?? 'C:\\Windows', 'System32');
+    const aclPath = join(tmpdir(), `namzu-acl-${randomBytes(6).toString('hex')}`);
+    try {
+        execFileSync(join(system32, 'icacls.exe'), [path, '/save', aclPath], {
+            encoding: 'utf8',
+            timeout: 10_000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        });
+        return readFileSync(aclPath, 'utf16le');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        rmSync(aclPath, { force: true });
+    }
+}
+/** The current account's security identifier, or `null` off Windows / on failure. */
+export function currentUserSid() {
+    if (platform() !== 'win32')
+        return null;
+    const system32 = join(process.env.SystemRoot ?? 'C:\\Windows', 'System32');
+    try {
+        const out = execFileSync(join(system32, 'whoami.exe'), ['/user', '/fo', 'csv', '/nh'], {
+            encoding: 'utf8',
+            timeout: 10_000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true,
+        });
+        return out.match(/"(S-1-[0-9-]+)"/)?.[1] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Require an SDDL discretionary ACL to grant exactly one principal, and that
+ * principal to be `sid`.
+ *
+ * Split out from the spawning above because it is the actual assertion, and
+ * an assertion that can only run on one operating system is an assertion
+ * nobody checks. Every entry is examined, not just the first: an ACL reading
+ * `(A;;FA;;;US)(A;;FA;;;WD)` grants us AND everyone, and a check that stopped
+ * at a match would call that private.
+ */
+export function assertSoleOwnerSddl(sddl, sid, path) {
+    const dacl = sddl.match(/D:([A-Z]*)((?:\([^)]*\))*)/);
+    const flags = dacl?.[1] ?? '';
+    const body = dacl?.[2] ?? '';
+    if (!dacl || body.length === 0) {
+        throw new CredentialStoreError(`the access-control list of ${path} could not be read back, so its privacy is unestablished.`);
+    }
+    if (!flags.includes('P')) {
+        throw new CredentialStoreError(`${path} still inherits permissions from its parent folder, so accounts other than yours may read it.`);
+    }
+    const aces = [...body.matchAll(/\(([^)]*)\)/g)].map((m) => (m[1] ?? '').split(';'));
+    if (aces.length === 0) {
+        throw new CredentialStoreError(`the access-control list of ${path} could not be read back, so its privacy is unestablished.`);
+    }
+    for (const ace of aces) {
+        const type = ace[0] ?? '';
+        const trustee = ace[5] ?? '';
+        // Only an ALLOW entry grants anything; a DENY entry narrows and is safe.
+        if (type !== 'A' && type !== 'AI')
+            continue;
+        if (trustee.toUpperCase() !== sid.toUpperCase()) {
+            throw new CredentialStoreError(`${path} grants access to an account other than yours (${trustee}) — refusing to keep a credential there.`);
+        }
+    }
+    if (!aces.some((ace) => (ace[0] ?? '') === 'A' || (ace[0] ?? '') === 'AI')) {
+        throw new CredentialStoreError(`${path} ended with no account able to read it, which is not a credential store — refusing.`);
+    }
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/integrations/providers/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../../src/integrations/providers/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,SAAS,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIzC,MAAM,SAAS,GAAG,KAAK,CAAA;AACvB,MAAM,QAAQ,GAAG,KAAK,CAAA;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAU,CAAA;AAElD,wFAAwF;AACxF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC5B,IAAI,GAAG,sBAAsB,CAAA;CAC/C;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,OAAO,EAAE;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC/C,OAAe,OAAO,EAAE;IAExB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAI,MAAqC,CAAC,YAAY,CAAA;IAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,GAAG,GAAG,GAA8B,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAA;IACnC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO;QACN,WAAW;QACX,YAAY,EAAE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACjF,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACxE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAChC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAc;YAC/D,CAAC,CAAC,SAAS;KACZ,CAAA;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAChD,IAA0B,EAC1B,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC1E,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAC7B;QACC,OAAO,EAAE,wBAAwB;QACjC,YAAY,EAAE;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C;KACD,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CAAA;IAEL,IAAI,EAAsB,CAAA;IAC1B,IAAI,CAAC;QACJ,qEAAqE;QACrE,mEAAmE;QACnE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QACnC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAA;IACF,CAAC;IACD,SAAS,CAAC,EAAE,CAAC,CAAA;IAEb,IAAI,CAAC;QACJ,eAAe,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,GAAG,CAAA;IACV,CAAC;IAED,IAAI,CAAC;QACJ,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5B,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAA;IACF,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,iCAAiC,CAAC,OAAe,OAAO,EAAE;IACzE,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC5B,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5B,OAAM;IACP,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACJ,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,oBAAoB,CAC7B,0CAA0C,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrG,CAAA;IACF,CAAC;IACD,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC7D,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,uCAAuC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kFAAkF,CAC1J,CAAA;IACF,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAuB,EAAU,EAAE;QAC5D,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBACnD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,WAAW,EAAE,IAAI;aACjB,CAAC,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,oBAAoB,CAC7B,GAAG,GAAG,qBAAqB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2EAA2E,CAC/J,CAAA;QACF,CAAC;IACF,CAAC,CAAA;IAED,gEAAgE;IAChE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAC7B,uFAAuF,IAAI,yBAAyB,CACpH,CAAA;IACF,CAAC;IAED,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;IAEpE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,oBAAoB,CAC7B,kDAAkD,IAAI,oCAAoC,CAC1F,CAAA;IACF,CAAC;IACD,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACvC,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC7E,IAAI,CAAC;QACJ,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;YACpE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAA;QACF,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC;AACF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc;IAC7B,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,CAAC,CAAA;IAC1E,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE;YACtF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,WAAW,EAAE,IAAI;SACjB,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC7B,8BAA8B,IAAI,2DAA2D,CAC7F,CAAA;IACF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,+FAA+F,CACtG,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IACnF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAC7B,8BAA8B,IAAI,2DAA2D,CAC7F,CAAA;IACF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5B,yEAAyE;QACzE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;YAAE,SAAQ;QAC3C,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,kDAAkD,OAAO,0CAA0C,CAC1G,CAAA;QACF,CAAC;IACF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,oBAAoB,CAC7B,GAAG,IAAI,qFAAqF,CAC5F,CAAA;IACF,CAAC;AACF,CAAC"}

package/dist/integrations/providers/discover.d.ts

@@ -1,11 +1,13 @@
 /**
  * Credential discoverer for LLM provider clients.
  *
- * For each entry in `PROVIDER_REGISTRY`, ask three questions in order:
+ * For each entry in `PROVIDER_REGISTRY`, ask four questions in order:
  *   1. Is one of its env vars set in `process.env`?
- *   2. Is there an OAuth credential in the login Keychain? (macOS only, and
+ *   2. Is there a subscription credential in namzu's own store — the one the
+ *      login flow writes? (every platform, and only `anthropic` consumes it.)
+ *   3. Is there an OAuth credential in the login Keychain? (macOS only, and
  *      only `anthropic` consumes it.)
- *   3. Is the probe URL (if any) reachable right now?
+ *   4. Is the probe URL (if any) reachable right now?
  *
  * The header used to say "three" and list two, and the one it omitted was the
  * Keychain — the question that reads a secret off the machine, so the one a
@@ -13,11 +15,18 @@
  * tell that the list stopped being maintained; in a file about credentials that
  * is worth more than a typo.
  *
- * **The Keychain path is macOS-only and that is a gap, not a nuance.**
- * `readAgentKeychainCredential` returns `null` on any other platform before it
- * looks at anything, so on Windows and Linux exactly two doors exist: an
- * environment variable, and a reachable local server. An operator whose
- * credential lives in their OS credential store gets no help from namzu there.
+ * **The Keychain path is macOS-only, and question 2 is why that is no longer a
+ * hole.** `readAgentKeychainCredential` returns `null` on any other platform
+ * before it looks at anything; it reads a credential belonging to a
+ * co-installed tool, so it can only ever help someone who has that tool, on
+ * that operating system. namzu's own store is asked first among the credential
+ * sources and works everywhere, which is what makes signing in from inside
+ * namzu useful on a machine that has neither.
+ *
+ * Order between the two matters when both answer. namzu's own store wins,
+ * because it is the one namzu wrote and refreshes; preferring a borrowed
+ * credential over the operator's own sign-in would make the login look
+ * ineffective on precisely the machine where they bothered to run it.
  *
  * The first positive answer per provider wins; subsequent sources are
  * recorded as "also available from" so the picker can show alternatives
@@ -51,6 +60,7 @@
  * Discovery is non-throwing. Network probes have short timeouts. The
  * picker can render immediately and refine if discovery completes later.
  */
+import type { CredentialOrigin } from './oauth.js';
 import { type ProviderId, type ProviderRegistryEntry } from './registry.js';
 export type DetectionSource = {
     readonly kind: 'env';
@@ -62,6 +72,15 @@ export type DetectionSource = {
     readonly kind: 'keychain';
     readonly service: string;
 }
+/**
+ * namzu's own credential store — a subscription the operator signed in to
+ * from inside namzu. Carries the path because "where did this come from"
+ * is the first question asked of a credential nobody typed.
+ */
+ | {
+    readonly kind: 'stored';
+    readonly path: string;
+}
 /**
  * Typed into a running namzu and held in memory for this session.
  *
@@ -83,12 +102,18 @@ export interface DetectedProvider {
     readonly baseUrl?: string;
     /**
      * OAuth refresh metadata, present only when `apiKey` is an OAuth access
-     * token carrying a refresh token + expiry (the Keychain source). Lets
-     * the session layer renew a lapsed token instead of failing with a 401.
+     * token carrying a refresh token + expiry (namzu's own store, or the
+     * Keychain). Lets the session layer renew a lapsed token instead of
+     * failing with a 401.
+     *
+     * `origin` travels with it because the refresh has to be written BACK, and
+     * the two sources are not interchangeable: one is namzu's file and the
+     * other is a co-installed tool's Keychain entry.
      */
     readonly oauth?: {
         readonly refreshToken?: string;
         readonly expiresAt?: number;
+        readonly origin?: CredentialOrigin;
     };
     /** Other sources that also satisfy this provider — informational. */
     readonly alternatives: readonly DetectionSource[];
@@ -106,6 +131,8 @@ export interface DiscoverOptions {
     readonly skipProbes?: boolean;
     /** Skip the macOS Keychain read (tests, non-darwin runs). */
     readonly skipKeychain?: boolean;
+    /** Skip namzu's own credential store (tests, and `--no-stored-credential`). */
+    readonly skipStored?: boolean;
 }
 export declare function discoverProviders(opts?: DiscoverOptions): Promise<readonly DetectedProvider[]>;
 /** Resolve a single detected provider by id from the discovered list. */

package/dist/integrations/providers/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAGH,OAAO,EAAqB,KAAK,UAAU,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAE9F,MAAM,MAAM,eAAe,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACzD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAE/B,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAChF,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,eAAe;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAChC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAC/B;AAID,wBAAsB,iBAAiB,CACtC,IAAI,GAAE,eAAoB,GACxB,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAmDtC;AAmBD,yEAAyE;AACzE,wBAAgB,YAAY,CAC3B,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,EAAE,EAAE,UAAU,GACZ,gBAAgB,GAAG,IAAI,CAEzB"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAqB,KAAK,UAAU,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAE9F,MAAM,MAAM,eAAe,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACzD;;;;GAIG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACpD;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAE/B,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;KAClC,CAAA;IACD,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,eAAe;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAChC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC7B;AAID,wBAAsB,iBAAiB,CACtC,IAAI,GAAE,eAAoB,GACxB,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAsEtC;AAmBD,yEAAyE;AACzE,wBAAgB,YAAY,CAC3B,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,EAAE,EAAE,UAAU,GACZ,gBAAgB,GAAG,IAAI,CAEzB"}