@pyxmate/memory 1.27.0 → 1.27.1

package/dist/chunk-7TATCSSN.mjs

@@ -0,0 +1,650 @@
+import {
+  EXIT
+} from "./chunk-4DXEQC6X.mjs";
+
+// src/cli/keychain/errors.ts
+var PLATFORM_GUIDANCE = {
+  darwin: {
+    code: "macos-keychain-denied",
+    message: "macOS Keychain is locked or access was denied.",
+    guidance: "Unlock Keychain Access, approve the pyx-mem prompt, then run: pyx-mem login"
+  },
+  linuxMissing: {
+    code: "linux-secret-service-missing",
+    message: "Linux Secret Service is unavailable.",
+    guidance: "Install and start a Secret Service provider such as gnome-keyring or KWallet, then run: pyx-mem login"
+  },
+  linuxDaemon: {
+    code: "linux-secret-service-not-running",
+    message: "Linux Secret Service is installed but no keyring daemon is reachable.",
+    guidance: "Start a DBus session and unlock gnome-keyring or KWallet, then run: pyx-mem login"
+  },
+  win32: {
+    code: "windows-credential-manager-unavailable",
+    message: "Windows Credential Manager is unavailable for this user session.",
+    guidance: "Enable Credential Manager and run pyx-mem from a normal Windows user session, then run: pyx-mem login"
+  }
+};
+var PROVIDER_IMPORT = {
+  code: "provider-import-failed",
+  message: "pyx-mem credential provider failed to load (@napi-rs/keyring).",
+  guidance: "Reinstall @pyxmate/memory; optional native keyring binaries may be missing for this platform. Re-run with `npm install --include=optional` if a package manager omitted them."
+};
+var RECORD_INVALID = {
+  code: "credential-record-invalid",
+  message: "Stored pyx-memory credentials are unreadable (schema mismatch or JSON corruption).",
+  guidance: "Run: pyx-mem logout && pyx-mem login"
+};
+var KeychainError = class extends Error {
+  code;
+  guidance;
+  exit;
+  constructor(args) {
+    super(args.message);
+    this.name = "KeychainError";
+    this.code = args.code;
+    this.guidance = args.guidance;
+    this.exit = args.exit;
+    if (args.cause !== void 0) this.cause = args.cause;
+  }
+};
+function platformAccessError(cause) {
+  const platform = process.platform;
+  const profile = platform === "darwin" ? PLATFORM_GUIDANCE.darwin : platform === "win32" ? PLATFORM_GUIDANCE.win32 : isHeadlessLinuxDaemon(cause) ? PLATFORM_GUIDANCE.linuxDaemon : PLATFORM_GUIDANCE.linuxMissing;
+  return new KeychainError({ ...profile, exit: EXIT.CRED_UNAVAILABLE, cause });
+}
+function providerImportError(cause) {
+  return new KeychainError({ ...PROVIDER_IMPORT, exit: EXIT.PROVIDER_BROKEN, cause });
+}
+function recordInvalidError(cause) {
+  return new KeychainError({ ...RECORD_INVALID, exit: EXIT.NOT_LOGGED_IN, cause });
+}
+function isHeadlessLinuxDaemon(cause) {
+  if (process.platform !== "linux") return false;
+  const msg = causeMessage(cause).toLowerCase();
+  return msg.includes("dbus") || msg.includes("session bus") || msg.includes("no such interface");
+}
+function causeMessage(cause) {
+  if (cause instanceof Error) return cause.message;
+  if (typeof cause === "string") return cause;
+  return "";
+}
+
+// src/cli/lifecycle/api.ts
+var REQUEST_TIMEOUT_MS = 15e3;
+var MAX_RESPONSE_BYTES = 64 * 1024;
+var MAX_ENDPOINT_CHARS = 256;
+var REQUEST_ID_RE = /^[A-Za-z0-9_-]{43}$/;
+var PROJECT_KEY_RE = /^pyx_proj_[A-Za-z0-9_-]{16,160}$/;
+var ERROR_MESSAGES = {
+  busy: { message: "Another pyx-mem sign-in or sign-out is in progress.", retryable: true },
+  cleanup_pending: {
+    message: "Cleanup of an earlier sign-in or sign-out is still pending. Run: pyx-mem login-recovery",
+    retryable: true
+  },
+  invalid_endpoint: {
+    message: "Endpoint must be an https URL (http only for loopback) without credentials, query or fragment.",
+    retryable: false
+  },
+  untrusted_authorization_url: {
+    message: "The server returned a browser sign-in address that is not trusted for this endpoint.",
+    retryable: false
+  },
+  browser_login_unsupported: {
+    message: "This endpoint does not support browser sign-in. Use: pyx-mem login --api-key",
+    retryable: false
+  },
+  network_error: { message: "Could not reach the pyx-memory server.", retryable: true },
+  rate_limited: { message: "Too many sign-in attempts. Wait a minute and retry.", retryable: true },
+  expired: { message: "The sign-in request expired before it was completed.", retryable: true },
+  project_not_eligible: {
+    message: "That project can no longer be connected from this account.",
+    retryable: true
+  },
+  credential_changed: {
+    message: "The stored pyx-memory credential was changed by another program. Nothing was overwritten.",
+    retryable: true
+  },
+  lock_lost: {
+    message: "The sign-in was interrupted. Run: pyx-mem login-recovery",
+    retryable: true
+  },
+  credential_store_unavailable: {
+    message: "The OS credential store is unavailable.",
+    retryable: false
+  },
+  journal_invalid: {
+    message: 'The pending-cleanup record in the OS credential store is unreadable. Nothing was deleted, and pyx-memory stays blocked on this computer. To reset: revoke unexpected "Pyx CLI" keys in the dashboard, then run: pyx-mem login-recovery --discard-unreadable-journal (this signs this computer out).',
+    retryable: false
+  },
+  login_failed: { message: "Browser sign-in failed.", retryable: true }
+};
+var SERVER_CODES = {
+  rate_limited: "rate_limited",
+  cli_login_expired_or_unknown: "expired",
+  cli_login_project_not_eligible: "project_not_eligible",
+  cli_login_cancelled: "cancelled",
+  cli_login_denied: "cancelled"
+};
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
+var BROWSER_ORIGINS = {
+  "https://memory.api.pyxmate.com": "https://memory.pyxmate.com"
+};
+function parseSafeUrl(input) {
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    return null;
+  }
+  const secure = url.protocol === "https:" || url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+  if (!secure || url.username !== "" || url.password !== "" || url.hash !== "") return null;
+  return url;
+}
+function parseEndpoint(input) {
+  const url = parseSafeUrl(input);
+  if (url === null || url.search !== "" || input.includes("?") || input.includes("#")) return null;
+  const normalized = url.href.replace(/\/+$/, "");
+  return normalized.length <= MAX_ENDPOINT_CHARS ? normalized : null;
+}
+function boundLabel(value, maxChars) {
+  let label = value.replace(/\p{Cc}/gu, "").slice(0, maxChars);
+  while (JSON.stringify(label).length - 2 > maxChars) label = label.slice(0, -1);
+  return label;
+}
+function isTrustedAuthorizationUrl(authorizationUrl, endpoint, requestId) {
+  const url = parseSafeUrl(authorizationUrl);
+  if (url === null) return false;
+  const api = new URL(endpoint);
+  const trustedOrigin = LOOPBACK_HOSTS.has(api.hostname) ? LOOPBACK_HOSTS.has(url.hostname) : url.origin === (BROWSER_ORIGINS[api.origin] ?? api.origin);
+  const params = [...url.searchParams];
+  return trustedOrigin && url.pathname === "/cli/authorize" && params.length === 1 && params[0]?.[0] === "request" && params[0][1] === requestId;
+}
+async function readBounded(res) {
+  const reader = res.body?.getReader();
+  if (!reader) return void 0;
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > MAX_RESPONSE_BYTES) {
+      await reader.cancel();
+      return void 0;
+    }
+    chunks.push(value);
+  }
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function field(json, key) {
+  return typeof json === "object" && json !== null ? json[key] : void 0;
+}
+function failure(status, json) {
+  const serverCode = field(field(json, "error"), "code");
+  const mapped = typeof serverCode === "string" ? SERVER_CODES[serverCode] : void 0;
+  return { ok: false, code: mapped ?? (status === 429 ? "rate_limited" : "login_failed") };
+}
+function createCliLoginApi(fetchImpl = fetch) {
+  async function post(url, body, bearer, signal) {
+    const ctl = new AbortController();
+    const abort = () => ctl.abort();
+    const timer = setTimeout(abort, REQUEST_TIMEOUT_MS);
+    signal?.addEventListener("abort", abort);
+    try {
+      if (signal?.aborted) return null;
+      const res = await fetchImpl(url, {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json",
+          ...bearer === void 0 ? {} : { Authorization: `Bearer ${bearer}` }
+        },
+        body: JSON.stringify(body),
+        // A redirect would forward the proof or the key to another origin.
+        redirect: "error",
+        signal: ctl.signal
+      });
+      return { status: res.status, json: await readBounded(res) };
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+    }
+  }
+  const base = (endpoint) => `${endpoint}/auth/cli-login`;
+  return {
+    async start(endpoint, body, signal) {
+      const res = await post(`${base(endpoint)}/start`, body, void 0, signal);
+      if (res === null) return { ok: false, code: "network_error" };
+      if (res.status === 404) return { ok: false, code: "browser_login_unsupported" };
+      if (res.status !== 201) return failure(res.status, res.json);
+      const requestId = field(res.json, "requestId");
+      const authorizationUrl = field(res.json, "authorizationUrl");
+      const expiresAt = new Date(String(field(res.json, "expiresAt")));
+      if (typeof requestId !== "string" || !REQUEST_ID_RE.test(requestId) || typeof authorizationUrl !== "string" || Number.isNaN(expiresAt.getTime())) {
+        return { ok: false, code: "login_failed" };
+      }
+      if (!isTrustedAuthorizationUrl(authorizationUrl, endpoint, requestId)) {
+        return { ok: false, code: "untrusted_authorization_url" };
+      }
+      return { ok: true, requestId, authorizationUrl, expiresAt };
+    },
+    async redeem(login, code, signal) {
+      const res = await post(
+        `${base(login.endpoint)}/${login.requestId}/redeem`,
+        { code, codeVerifier: login.codeVerifier },
+        void 0,
+        signal
+      );
+      if (res === null) return { ok: false, code: "network_error" };
+      if (res.status !== 200) return failure(res.status, res.json);
+      const credential = field(res.json, "credential");
+      const apiKey = field(credential, "apiKey");
+      const connection = field(credential, "connection");
+      const accountLabel = field(connection, "accountLabel");
+      const projectId = field(connection, "projectId");
+      const projectName = field(connection, "projectName");
+      if (typeof apiKey !== "string" || !PROJECT_KEY_RE.test(apiKey) || typeof accountLabel !== "string" || typeof projectId !== "string" || typeof projectName !== "string") {
+        return { ok: false, code: "login_failed" };
+      }
+      return {
+        ok: true,
+        apiKey,
+        // Display metadata only; bounded so the shared record fits every OS store.
+        connection: {
+          accountLabel: boundLabel(accountLabel, 254),
+          projectId: boundLabel(projectId, 64),
+          projectName: boundLabel(projectName, 128)
+        }
+      };
+    },
+    async confirm(login, signal) {
+      const res = await post(
+        `${base(login.endpoint)}/${login.requestId}/confirm`,
+        { codeVerifier: login.codeVerifier },
+        login.apiKey,
+        signal
+      );
+      if (res === null) return { ok: false, code: "network_error" };
+      if (res.status !== 200 || field(res.json, "status") !== "confirmed") {
+        return failure(res.status, res.json);
+      }
+      return { ok: true };
+    },
+    async cancel(login) {
+      const res = await post(`${base(login.endpoint)}/${login.requestId}/cancel`, {
+        codeVerifier: login.codeVerifier
+      });
+      if (res === null) return false;
+      if (res.status === 200) return field(res.json, "status") === "cancelled";
+      return res.status === 404 && field(field(res.json, "error"), "code") === "cli_login_expired_or_unknown";
+    },
+    async revoke(key) {
+      const res = await post(`${base(key.endpoint)}/revoke`, {}, key.apiKey);
+      return res !== null && res.status === 200 && field(res.json, "status") === "revoked";
+    }
+  };
+}
+
+// src/cli/lifecycle/journal.ts
+import { createHash } from "crypto";
+var MAX_STORE_CHARS = 1200;
+var MAX_REVOKE_ENTRIES = 8;
+var TOKEN_RE = /^[A-Za-z0-9_-]{43}$/;
+var FINGERPRINT_RE = /^[0-9a-f]{16}$/;
+var PLACEHOLDER_KEY = `pyx_proj_${"x".repeat(160)}`;
+var SERVER_CONVERGENCE_SECONDS = 30;
+var JournalInvalidError = class extends Error {
+};
+var JournalFullError = class extends Error {
+};
+function credentialFingerprint(endpoint, apiKey) {
+  return createHash("sha256").update(`${endpoint}
+${apiKey}`).digest("hex").slice(0, 16);
+}
+function isEmpty(journal) {
+  return journal.login === null && journal.logout === null && journal.revoke.length === 0;
+}
+function emptyJournal() {
+  return { schemaVersion: 1, login: null, logout: null, revoke: [] };
+}
+function convergenceSeconds(journal, now = Date.now()) {
+  if (journal.revokedAt === void 0) return null;
+  const elapsed = Math.max(now - journal.revokedAt, 0);
+  const left = Math.ceil(SERVER_CONVERGENCE_SECONDS - elapsed / 1e3);
+  return left > 0 ? left : null;
+}
+function isExactObject(value, required, optional = []) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const keys = Object.keys(value);
+  return required.every((key) => keys.includes(key)) && keys.every((key) => required.includes(key) || optional.includes(key));
+}
+function isKeyRef(value) {
+  if (!isExactObject(value, ["endpoint", "apiKey"])) return false;
+  const v = value;
+  return typeof v.endpoint === "string" && parseEndpoint(v.endpoint) === v.endpoint && typeof v.apiKey === "string" && PROJECT_KEY_RE.test(v.apiKey);
+}
+function isLoginRecord(value) {
+  if (!isExactObject(
+    value,
+    ["phase", "endpoint", "requestId", "codeVerifier", "expiresAt"],
+    ["apiKey", "previous"]
+  )) {
+    return false;
+  }
+  const v = value;
+  const held = v.phase === "issued" || v.phase === "committing";
+  return (held || v.phase === "started") && typeof v.requestId === "string" && TOKEN_RE.test(v.requestId) && typeof v.codeVerifier === "string" && TOKEN_RE.test(v.codeVerifier) && Number.isSafeInteger(v.expiresAt) && (held ? isKeyRef({ endpoint: v.endpoint, apiKey: v.apiKey }) : v.apiKey === void 0 && isKeyRef({ endpoint: v.endpoint, apiKey: PLACEHOLDER_KEY })) && (v.previous === void 0 || v.phase === "committing" && isKeyRef(v.previous));
+}
+function isLogoutRecord(value) {
+  if (!isExactObject(value, ["fingerprint", "revoke"])) return false;
+  const v = value;
+  return typeof v.fingerprint === "string" && FINGERPRINT_RE.test(v.fingerprint) && (v.revoke === null || isKeyRef(v.revoke));
+}
+function isJournal(value) {
+  if (!isExactObject(value, ["schemaVersion", "login", "logout", "revoke"], ["revokedAt"])) {
+    return false;
+  }
+  const v = value;
+  return v.schemaVersion === 1 && (v.login === null || isLoginRecord(v.login)) && (v.logout === null || isLogoutRecord(v.logout)) && Array.isArray(v.revoke) && v.revoke.length <= MAX_REVOKE_ENTRIES && v.revoke.every(isKeyRef) && (v.revokedAt === void 0 || Number.isSafeInteger(v.revokedAt) && v.revokedAt >= 0);
+}
+function hasRoomForLogin(journal, endpoint, previous) {
+  const largest = {
+    ...journal,
+    login: {
+      phase: "committing",
+      endpoint,
+      requestId: "x".repeat(43),
+      codeVerifier: "x".repeat(43),
+      expiresAt: Number.MAX_SAFE_INTEGER,
+      apiKey: PLACEHOLDER_KEY,
+      ...previous ? { previous } : {}
+    },
+    revokedAt: Number.MAX_SAFE_INTEGER
+  };
+  return JSON.stringify(largest).length <= MAX_STORE_CHARS;
+}
+async function loadJournal(provider) {
+  const raw = await provider.readJournal();
+  if (raw === null) return emptyJournal();
+  if (raw.length > MAX_STORE_CHARS) throw new JournalInvalidError();
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new JournalInvalidError();
+  }
+  if (!isJournal(parsed)) throw new JournalInvalidError();
+  return parsed;
+}
+async function saveJournal(provider, journal) {
+  if (isEmpty(journal) && convergenceSeconds(journal) === null) return provider.clearJournal();
+  const raw = JSON.stringify(journal);
+  if (raw.length > MAX_STORE_CHARS) throw new JournalFullError();
+  if (!isJournal(JSON.parse(raw))) throw new Error("refusing to write an invalid journal");
+  await provider.writeJournal(raw);
+}
+async function supersedeLogout(provider, endpoint, apiKey) {
+  let journal;
+  try {
+    journal = await loadJournal(provider);
+  } catch (err) {
+    if (err instanceof JournalInvalidError) return;
+    throw err;
+  }
+  if (journal.logout?.fingerprint !== credentialFingerprint(endpoint, apiKey)) return;
+  journal.logout = null;
+  await saveJournal(provider, journal);
+}
+function guardKeychain(provider) {
+  return {
+    write: (credentials) => provider.write(credentials),
+    delete: () => provider.delete(),
+    check: () => provider.check(),
+    readJournal: () => provider.readJournal(),
+    writeJournal: (raw) => provider.writeJournal(raw),
+    clearJournal: () => provider.clearJournal(),
+    acquireLock: (onLost) => provider.acquireLock(onLost),
+    isLocked: () => provider.isLocked(),
+    async read() {
+      const credentials = await provider.read();
+      if (credentials === null) return null;
+      let blocked;
+      try {
+        const { logout } = await loadJournal(provider);
+        blocked = logout?.fingerprint === credentialFingerprint(credentials.endpoint, credentials.apiKey);
+      } catch (err) {
+        if (!(err instanceof JournalInvalidError)) throw err;
+        blocked = true;
+      }
+      if (blocked) {
+        throw new KeychainError({
+          code: "logout-incomplete",
+          message: "A pyx-memory sign-out did not finish on this computer.",
+          guidance: "Run: pyx-mem login-recovery",
+          exit: EXIT.NOT_LOGGED_IN
+        });
+      }
+      return credentials;
+    }
+  };
+}
+
+// src/cli/lifecycle/lock.ts
+import { mkdir } from "fs/promises";
+import { dirname } from "path";
+import lockfile from "proper-lockfile";
+var LOCK_OPTIONS = { realpath: false, stale: 15e3 };
+function createFileLock(file) {
+  return {
+    async acquire(onLost) {
+      await mkdir(dirname(file), { recursive: true, mode: 448 });
+      let release;
+      try {
+        release = await lockfile.lock(file, { ...LOCK_OPTIONS, onCompromised: () => onLost() });
+      } catch (err) {
+        if (err.code === "ELOCKED") return null;
+        throw err;
+      }
+      return async () => {
+        try {
+          await release();
+        } catch (err) {
+          const code = err.code;
+          if (code !== "ERELEASED" && code !== "ENOTACQUIRED") throw err;
+        }
+      };
+    },
+    isLocked: () => lockfile.check(file, LOCK_OPTIONS)
+  };
+}
+var BUSY = /* @__PURE__ */ Symbol("lifecycle-lock-busy");
+var LockLostError = class extends Error {
+};
+async function releaseLifecycleLock(release) {
+  try {
+    await release();
+  } catch (err) {
+    const code = err?.code;
+    const reason = typeof code === "string" && /^[A-Z_]{1,32}$/.test(code) ? code : "unknown";
+    process.stderr.write(
+      `Warning: the pyx-mem lifecycle lock could not be released (${reason}). The reported result stands; other pyx-mem sign-in or sign-out commands may answer busy for up to ${LOCK_OPTIONS.stale / 1e3} seconds.
+`
+    );
+  }
+}
+async function withLifecycleLock(provider, fn) {
+  let lost = false;
+  const release = await provider.acquireLock(() => {
+    lost = true;
+  });
+  if (release === null) return BUSY;
+  try {
+    return await fn(() => lost);
+  } finally {
+    await releaseLifecycleLock(release);
+  }
+}
+
+// src/cli/keychain/napi-provider.ts
+import { homedir } from "os";
+import { join } from "path";
+
+// src/cli/keychain/types.ts
+var KEYCHAIN_SERVICE = "pyx-memory";
+var KEYCHAIN_ACCOUNT = "default";
+var CREDENTIAL_SCHEMA_VERSION = 1;
+var JOURNAL_ACCOUNT = "lifecycle-journal";
+
+// src/cli/keychain/napi-provider.ts
+var cached = /* @__PURE__ */ new Map();
+async function loadEntry(account = KEYCHAIN_ACCOUNT) {
+  const hit = cached.get(account);
+  if (hit) return hit;
+  try {
+    const mod = await import("@napi-rs/keyring");
+    const entry = new mod.Entry(KEYCHAIN_SERVICE, account);
+    cached.set(account, entry);
+    return entry;
+  } catch (err) {
+    throw providerImportError(err);
+  }
+}
+function parseRecord(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw recordInvalidError(err);
+  }
+  if (!isValidRecord(parsed)) throw recordInvalidError();
+  return parsed;
+}
+function isValidRecord(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return v.schemaVersion === CREDENTIAL_SCHEMA_VERSION && typeof v.endpoint === "string" && v.endpoint.length > 0 && typeof v.apiKey === "string" && v.apiKey.length > 0 && (v.provenance === void 0 || v.provenance === "browser-login" && isConnection(v.connection));
+}
+function isConnection(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const c = value;
+  return typeof c.accountLabel === "string" && typeof c.projectId === "string" && typeof c.projectName === "string";
+}
+var NapiKeychainProvider = class {
+  // The lock file holds no secrets; credentials and the journal stay in the OS store.
+  lock = createFileLock(join(homedir(), ".pyx-memory", "lifecycle"));
+  async read() {
+    const entry = await loadEntry();
+    let raw;
+    try {
+      raw = entry.getPassword();
+    } catch (err) {
+      throw platformAccessError(err);
+    }
+    if (raw === null) return null;
+    return parseRecord(raw);
+  }
+  async write(credentials) {
+    const entry = await loadEntry();
+    const payload = JSON.stringify({
+      schemaVersion: CREDENTIAL_SCHEMA_VERSION,
+      endpoint: credentials.endpoint,
+      apiKey: credentials.apiKey,
+      ...credentials.provenance === "browser-login" ? { connection: credentials.connection, provenance: credentials.provenance } : {}
+    });
+    try {
+      entry.setPassword(payload);
+    } catch (err) {
+      throw platformAccessError(err);
+    }
+  }
+  async delete() {
+    const entry = await loadEntry();
+    try {
+      entry.deletePassword();
+    } catch (err) {
+      throw platformAccessError(err);
+    }
+  }
+  async readJournal() {
+    const entry = await loadEntry(JOURNAL_ACCOUNT);
+    try {
+      return entry.getPassword();
+    } catch (err) {
+      throw platformAccessError(err);
+    }
+  }
+  async writeJournal(raw) {
+    const entry = await loadEntry(JOURNAL_ACCOUNT);
+    try {
+      entry.setPassword(raw);
+    } catch (err) {
+      throw platformAccessError(err);
+    }
+  }
+  async clearJournal() {
+    const entry = await loadEntry(JOURNAL_ACCOUNT);
+    try {
+      entry.deletePassword();
+    } catch (err) {
+      throw platformAccessError(err);
+    }
+  }
+  acquireLock(onLost) {
+    return this.lock.acquire(onLost);
+  }
+  isLocked() {
+    return this.lock.isLocked();
+  }
+  async check() {
+    try {
+      const entry = await loadEntry();
+      entry.getPassword();
+      return { ok: true, message: "OS credential store reachable" };
+    } catch (err) {
+      if (err instanceof Error && "code" in err && "guidance" in err) {
+        const ke = err;
+        return { ok: false, code: ke.code, message: ke.message, guidance: ke.guidance };
+      }
+      return { ok: false, message: err instanceof Error ? err.message : String(err) };
+    }
+  }
+};
+
+// src/cli/keychain/index.ts
+function getDefaultKeychain() {
+  return guardKeychain(new NapiKeychainProvider());
+}
+function getLifecycleKeychain() {
+  return new NapiKeychainProvider();
+}
+
+export {
+  KeychainError,
+  ERROR_MESSAGES,
+  parseEndpoint,
+  createCliLoginApi,
+  JournalInvalidError,
+  credentialFingerprint,
+  isEmpty,
+  emptyJournal,
+  convergenceSeconds,
+  isKeyRef,
+  hasRoomForLogin,
+  loadJournal,
+  saveJournal,
+  supersedeLogout,
+  guardKeychain,
+  BUSY,
+  LockLostError,
+  releaseLifecycleLock,
+  withLifecycleLock,
+  getDefaultKeychain,
+  getLifecycleKeychain
+};