@qduc/term2 0.14.0 → 0.16.0

package/dist/providers/oauth-account-store.js

@@ -0,0 +1,193 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+/**
+ * A multi-account credential store, shared by every provider term2 logs in to
+ * over OAuth.
+ *
+ * One file holds several accounts and a pointer to the active one. Each account
+ * owns its own refresh token, and refreshes are written back to that account
+ * only — accounts never share a rotation chain, which is the same hazard that
+ * made us stop sharing files with the `grok` and `codex` CLIs in the first
+ * place (docs/plans/provider-oauth-independence.md).
+ */
+export const OAUTH_ACCOUNT_STORE_VERSION = 2;
+function emptyStore() {
+    return { version: OAUTH_ACCOUNT_STORE_VERSION, activeAccountId: null, accounts: [] };
+}
+export class OAuthAccountStore {
+    options;
+    filesystem;
+    constructor(options) {
+        this.options = options;
+        this.filesystem = options.filesystem ?? fs;
+        this.sweepTemporaryFiles();
+    }
+    get filePath() {
+        return this.options.filePath;
+    }
+    /**
+     * Reads the store, upgrading a v1 single-credential file in memory. The
+     * upgrade is not written back until something else writes, so merely reading
+     * a credential never rewrites it.
+     */
+    read() {
+        let parsed;
+        try {
+            parsed = JSON.parse(this.filesystem.readFileSync(this.options.filePath, 'utf8'));
+        }
+        catch {
+            return emptyStore();
+        }
+        if (parsed && Array.isArray(parsed.accounts)) {
+            const accounts = parsed.accounts.filter((account) => account && typeof account.id === 'string' && account.tokens);
+            const activeAccountId = typeof parsed.activeAccountId === 'string' && accounts.some((a) => a.id === parsed.activeAccountId)
+                ? parsed.activeAccountId
+                : accounts[0]?.id ?? null;
+            return { version: OAUTH_ACCOUNT_STORE_VERSION, activeAccountId, accounts };
+        }
+        const legacy = this.options.migrateLegacy(parsed);
+        if (!legacy)
+            return emptyStore();
+        const identity = this.options.identify(legacy);
+        return {
+            version: OAUTH_ACCOUNT_STORE_VERSION,
+            activeAccountId: identity.id,
+            accounts: [{ ...identity, tokens: legacy, addedAt: new Date().toISOString() }],
+        };
+    }
+    write(store) {
+        this.filesystem.mkdirSync(path.dirname(this.options.filePath), { recursive: true });
+        const tmpPath = `${this.options.filePath}.${process.pid}.${randomUUID()}.tmp`;
+        let fd;
+        let renamed = false;
+        try {
+            fd = this.filesystem.openSync(tmpPath, 'w', 0o600);
+            this.filesystem.writeFileSync(fd, JSON.stringify(store, null, 2), { encoding: 'utf8' });
+            this.filesystem.fsyncSync(fd);
+            this.filesystem.closeSync(fd);
+            fd = undefined;
+            this.filesystem.renameSync(tmpPath, this.options.filePath);
+            renamed = true;
+        }
+        finally {
+            if (fd !== undefined) {
+                try {
+                    this.filesystem.closeSync(fd);
+                }
+                catch {
+                    // Preserve the original write failure.
+                }
+            }
+            if (!renamed) {
+                try {
+                    this.filesystem.unlinkSync(tmpPath);
+                }
+                catch {
+                    // Best-effort cleanup; the next startup sweep retries it.
+                }
+            }
+        }
+    }
+    sweepTemporaryFiles() {
+        const directory = path.dirname(this.options.filePath);
+        const base = path.basename(this.options.filePath).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const unique = new RegExp(`^${base}\\.[^.]+\\.[A-Fa-f0-9-]{36}\\.tmp$`);
+        try {
+            for (const name of this.filesystem.readdirSync(directory)) {
+                if (name === `${path.basename(this.options.filePath)}.tmp` || unique.test(name)) {
+                    try {
+                        this.filesystem.unlinkSync(path.join(directory, name));
+                    }
+                    catch {
+                        // A concurrent writer or permission failure is handled on its own path.
+                    }
+                }
+            }
+        }
+        catch {
+            // A missing store directory has no temporary credentials to recover.
+        }
+    }
+    list() {
+        return this.read().accounts;
+    }
+    get(accountId) {
+        return this.read().accounts.find((account) => account.id === accountId) ?? null;
+    }
+    getActive() {
+        const store = this.read();
+        return store.accounts.find((account) => account.id === store.activeAccountId) ?? null;
+    }
+    getActiveTokens() {
+        return this.getActive()?.tokens ?? null;
+    }
+    /**
+     * Adds a freshly logged-in account, or replaces the credential of one already
+     * present, and makes it active. Re-logging in to an existing account replaces
+     * its tokens rather than adding a duplicate.
+     */
+    upsert(tokens) {
+        const store = this.read();
+        const identity = this.options.identify(tokens);
+        const existing = store.accounts.find((account) => account.id === identity.id);
+        const account = existing
+            ? { ...existing, label: identity.label, tokens }
+            : { ...identity, tokens, addedAt: new Date().toISOString() };
+        const accounts = existing
+            ? store.accounts.map((candidate) => (candidate.id === identity.id ? account : candidate))
+            : [...store.accounts, account];
+        this.write({ version: OAUTH_ACCOUNT_STORE_VERSION, activeAccountId: identity.id, accounts });
+        return account;
+    }
+    /**
+     * Replaces one account's credential in place, for a token refresh.
+     *
+     * The account is named explicitly rather than taken from the active pointer,
+     * because a running session stays pinned to the account it started with even
+     * after the user selects a different one. Refreshing must not change which
+     * account is active, and must not touch any other account's rotation chain.
+     */
+    updateTokens(accountId, tokens) {
+        const store = this.read();
+        if (!store.accounts.some((account) => account.id === accountId)) {
+            this.upsert(tokens);
+            return;
+        }
+        this.write({
+            ...store,
+            accounts: store.accounts.map((account) => (account.id === accountId ? { ...account, tokens } : account)),
+        });
+    }
+    /** Convenience for the common case of refreshing whatever is active. */
+    updateActiveTokens(tokens) {
+        const store = this.read();
+        if (!store.activeAccountId) {
+            this.upsert(tokens);
+            return;
+        }
+        this.updateTokens(store.activeAccountId, tokens);
+    }
+    /** Returns false when the id names no stored account. */
+    setActive(accountId) {
+        const store = this.read();
+        if (!store.accounts.some((account) => account.id === accountId))
+            return false;
+        this.write({ ...store, activeAccountId: accountId });
+        return true;
+    }
+    /**
+     * Forgets an account. If it was the active one, the next remaining account
+     * takes over so the provider does not silently become unusable.
+     */
+    remove(accountId) {
+        const store = this.read();
+        if (!store.accounts.some((account) => account.id === accountId))
+            return false;
+        const accounts = store.accounts.filter((account) => account.id !== accountId);
+        const activeAccountId = store.activeAccountId === accountId ? accounts[0]?.id ?? null : store.activeAccountId;
+        this.write({ version: OAUTH_ACCOUNT_STORE_VERSION, activeAccountId, accounts });
+        return true;
+    }
+}
+//# sourceMappingURL=oauth-account-store.js.map

package/dist/providers/oauth-account-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-account-store.js","sourceRoot":"","sources":["../../source/providers/oauth-account-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAqC7C,SAAS,UAAU;IACjB,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,OAAO,iBAAiB;IAGC,OAAO;IAFnB,UAAU,CAAY;IAEvC,YAA6B,OAA0C;uBAA1C,OAAO;QAClC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,EAAW,CAAC;QAC/B,CAAC;QAED,IAAI,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,OAAY,EAAE,EAAE,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CACnD,CAAC;YAC7B,MAAM,eAAe,GACnB,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,eAAe,CAAC;gBACjG,CAAC,CAAC,MAAM,CAAC,eAAe;gBACxB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,UAAU,EAAW,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,2BAA2B;YACpC,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;SAC/E,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,KAAqC;QACjD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;QAC9E,IAAI,EAAsB,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC9B,EAAE,GAAG,SAAS,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,0DAA0D;gBAC5D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,mBAAmB;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,oCAAoC,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1D,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChF,IAAI,CAAC;wBACH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;oBACzD,CAAC;oBAAC,MAAM,CAAC;wBACP,wEAAwE;oBAC1E,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;IAClF,CAAC;IAED,SAAS;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC;IACxF,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAe;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAA0B,QAAQ;YAC7C,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;YAChD,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAE/D,MAAM,QAAQ,GAAG,QAAQ;YACvB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEjC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7F,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,SAAiB,EAAE,MAAe;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC;YACT,GAAG,KAAK;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SACzG,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,kBAAkB,CAAC,MAAe;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,yDAAyD;IACzD,SAAS,CAAC,SAAiB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,SAAiB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAC9E,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9G,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/providers/oauth-accounts.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The provider-neutral view of stored OAuth logins, so the account switcher UI
+ * depends on one module instead of on each provider's credential file.
+ *
+ * Only providers term2 logs in to over OAuth appear here. API-key providers
+ * hold one credential in settings and are managed by the existing key editor.
+ */
+export declare const OAUTH_ACCOUNT_PROVIDERS: readonly ['codex', 'grok'];
+export type OAuthAccountProviderId = (typeof OAUTH_ACCOUNT_PROVIDERS)[number];
+export type OAuthAccountSummary = {
+    id: string;
+    label: string;
+    /** Selected by the user; applies from the next session onwards. */
+    isSelected: boolean;
+    /** Actually authenticating this run. Differs from `isSelected` after a switch. */
+    isInUse: boolean;
+};
+export declare function isOAuthAccountProvider(providerId: string): providerId is OAuthAccountProviderId;
+/** The command that adds another account for this provider. */
+export declare function oauthLoginCommand(providerId: OAuthAccountProviderId): string;
+export declare function listOAuthAccounts(providerId: OAuthAccountProviderId): OAuthAccountSummary[];
+export declare function setActiveOAuthAccount(providerId: OAuthAccountProviderId, accountId: string): boolean;
+export declare function removeOAuthAccount(providerId: OAuthAccountProviderId, accountId: string): boolean;
+//# sourceMappingURL=oauth-accounts.d.ts.map

package/dist/providers/oauth-accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-accounts.d.ts","sourceRoot":"","sources":["../../source/providers/oauth-accounts.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,YAAI,OAAO,EAAE,MAAM,CAAU,CAAC;AAClE,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,UAAU,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,IAAI,sBAAsB,CAE/F;AAED,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,sBAAsB,GAAG,MAAM,CAE5E;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,sBAAsB,GAAG,mBAAmB,EAAE,CAY3F;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEpG;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEjG"}

package/dist/providers/oauth-accounts.js

@@ -0,0 +1,37 @@
+import { getActiveCodexAccount, listCodexAccounts, removeCodexAccount, setActiveCodexAccount } from './codex-auth.js';
+import { getActiveGrokAccount, listGrokAccounts, removeGrokAccount, setActiveGrokAccount } from './grok-auth.js';
+import { getSessionAccount } from './oauth-session-account.js';
+/**
+ * The provider-neutral view of stored OAuth logins, so the account switcher UI
+ * depends on one module instead of on each provider's credential file.
+ *
+ * Only providers term2 logs in to over OAuth appear here. API-key providers
+ * hold one credential in settings and are managed by the existing key editor.
+ */
+export const OAUTH_ACCOUNT_PROVIDERS = ['codex', 'grok'];
+export function isOAuthAccountProvider(providerId) {
+    return OAUTH_ACCOUNT_PROVIDERS.includes(providerId);
+}
+/** The command that adds another account for this provider. */
+export function oauthLoginCommand(providerId) {
+    return providerId === 'codex' ? 'term2 --codex-login' : 'term2 --grok-login';
+}
+export function listOAuthAccounts(providerId) {
+    const [accounts, active] = providerId === 'codex'
+        ? [listCodexAccounts(), getActiveCodexAccount()]
+        : [listGrokAccounts(), getActiveGrokAccount()];
+    const inUse = getSessionAccount(providerId);
+    return accounts.map((account) => ({
+        id: account.id,
+        label: account.label,
+        isSelected: account.id === active?.id,
+        isInUse: account.id === inUse,
+    }));
+}
+export function setActiveOAuthAccount(providerId, accountId) {
+    return providerId === 'codex' ? setActiveCodexAccount(accountId) : setActiveGrokAccount(accountId);
+}
+export function removeOAuthAccount(providerId, accountId) {
+    return providerId === 'codex' ? removeCodexAccount(accountId) : removeGrokAccount(accountId);
+}
+//# sourceMappingURL=oauth-accounts.js.map

package/dist/providers/oauth-accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-accounts.js","sourceRoot":"","sources":["../../source/providers/oauth-accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACjH,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AAYlE,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,OAAQ,uBAA6C,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC7E,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,UAAkC;IAClE,OAAO,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAkC;IAClE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GACtB,UAAU,KAAK,OAAO;QACpB,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,qBAAqB,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChC,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,EAAE;QACrC,OAAO,EAAE,OAAO,CAAC,EAAE,KAAK,KAAK;KAC9B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAkC,EAAE,SAAiB;IACzF,OAAO,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAkC,EAAE,SAAiB;IACtF,OAAO,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAC/F,CAAC"}

package/dist/providers/oauth-pkce.d.ts

@@ -0,0 +1,61 @@
+import type { Readable } from 'node:stream';
+/**
+ * The browser half of an OAuth 2.0 + PKCE login for a public native client.
+ *
+ * Both providers term2 logs in to (Grok and Codex) borrow the official CLI's
+ * registered client id, so the redirect URI is *their* registered value and is
+ * not negotiable — see docs/plans/provider-oauth-independence.md. The only
+ * thing that differs between them is endpoints, scopes, and how the token
+ * endpoint wants its request body encoded, so all of that is configuration and
+ * the flow itself lives here once.
+ */
+export type PkceLoginConfig = {
+    /** Human-facing provider name, used in prompts and error messages. */
+    label: string;
+    clientId: string;
+    authorizeEndpoint: string;
+    tokenEndpoint: string;
+    /**
+     * The loopback ports the authorization server has registered, in preference
+     * order. These servers match the redirect against an allow-list rather than
+     * honouring RFC 8252 port flexibility, so we may only try ports the official
+     * client registered — a fallback exists to survive a concurrent CLI login,
+     * not to pick a free port.
+     */
+    redirectPorts: number[];
+    /** Builds the redirect for whichever registered port we managed to bind. */
+    redirectUriFor: (port: number) => string;
+    /** Path component of the redirect; requests to anything else get a 404. */
+    callbackPath: string;
+    scopes: string[];
+    /** Provider-specific authorize parameters beyond the standard PKCE set. */
+    extraAuthorizeParams?: Record<string, string>;
+    /** How the token endpoint wants the code exchange encoded. */
+    tokenRequestEncoding?: 'form' | 'json';
+    /** Appended to the EADDRINUSE message; names the likely conflicting process. */
+    portConflictHint?: string;
+};
+export type PkceLoginOptions = {
+    fetchImpl?: typeof fetch;
+    openBrowser?: (url: string) => void;
+    onPrompt?: (url: string) => void;
+    signal?: AbortSignal;
+    /**
+     * Line-oriented source for a pasted loopback redirect URL. Remote hosts never
+     * receive the browser's localhost callback; the address bar still holds it.
+     */
+    pasteInput?: Readable;
+    /** Called when a pasted line is not a usable callback, so the user can retry. */
+    onPasteRejected?: (message: string) => void;
+};
+export declare function openInBrowser(url: string): void;
+/**
+ * Runs the full browser login and returns the token endpoint's raw response
+ * body. Mapping that body into a provider's stored credential shape, and
+ * persisting it, belongs to the caller.
+ *
+ * Resolves only after the authorization server redirects back to the loopback
+ * listener, so callers should treat this as a long, human-paced operation.
+ */
+export declare function runPkceLoopbackLogin(config: PkceLoginConfig, options?: PkceLoginOptions): Promise<any>;
+//# sourceMappingURL=oauth-pkce.d.ts.map

package/dist/providers/oauth-pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-pkce.d.ts","sourceRoot":"","sources":["../../source/providers/oauth-pkce.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4EAA4E;IAC5E,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,2EAA2E;IAC3E,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,UAAU,CAAC,EAAE,QAAQ,CAAC;IACtB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C,CAAC;AAMF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAc/C;AA+ND;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,CA2EhH"}

package/dist/providers/oauth-pkce.js

@@ -0,0 +1,272 @@
+import crypto from 'node:crypto';
+import http from 'node:http';
+import readline from 'node:readline';
+import { spawn } from 'node:child_process';
+function base64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export function openInBrowser(url) {
+    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        const child = spawn(command, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => {
+            // Ignored: opening a browser in a headless/server/minimal environment or when
+            // the browser launcher is missing (e.g. xdg-open ENOENT) is non-fatal.
+            // The caller always prints the URL, so the user can complete login manually.
+        });
+        child.unref();
+    }
+    catch {
+        // The caller always prints the URL, so a failed launcher is not fatal.
+    }
+}
+function buildAuthorizeUrl(config, redirectUri, challenge, state) {
+    const url = new URL(config.authorizeEndpoint);
+    url.searchParams.set('client_id', config.clientId);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('code_challenge', challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('scope', config.scopes.join(' '));
+    url.searchParams.set('state', state);
+    for (const [key, value] of Object.entries(config.extraAuthorizeParams ?? {})) {
+        url.searchParams.set(key, value);
+    }
+    return url;
+}
+/**
+ * Binds the first registered loopback port that is free.
+ *
+ * We may only try ports the official client registered, so an exhausted list is
+ * a real failure with a real cause: another login is almost certainly holding
+ * the port.
+ */
+function bindLoopbackListener(config) {
+    return new Promise((resolve, reject) => {
+        const attempt = (index) => {
+            const port = config.redirectPorts[index];
+            const server = http.createServer();
+            const onError = (err) => {
+                server.close();
+                if (err.code !== 'EADDRINUSE') {
+                    reject(err);
+                    return;
+                }
+                if (index + 1 < config.redirectPorts.length) {
+                    attempt(index + 1);
+                    return;
+                }
+                reject(new Error(`${config.label} login could not bind any of its registered redirect ports (${config.redirectPorts.join(', ')}). The authorization server only accepts those exact redirects, so close whatever holds them${config.portConflictHint ? ` (${config.portConflictHint})` : ''} and retry.`));
+            };
+            server.once('error', onError);
+            server.listen(port, '127.0.0.1', () => {
+                server.off('error', onError);
+                resolve({ server, port });
+            });
+        };
+        attempt(0);
+    });
+}
+function stripWrappingQuotes(value) {
+    const trimmed = value.trim();
+    if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+        return trimmed.slice(1, -1).trim();
+    }
+    return trimmed;
+}
+function isLoopbackHostname(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1' || host === '::1';
+}
+function exampleCallbackUrl(config) {
+    return `http://localhost:${config.redirectPorts[0]}${config.callbackPath}?code=...`;
+}
+function interpretCallbackParams(config, expectedState, error, code, state) {
+    if (error)
+        return new Error(`${config.label} login was rejected: ${error}`);
+    if (state !== expectedState) {
+        // A mismatched state means this callback did not come from the
+        // authorization request we started; the code may be an attacker's.
+        return new Error(`${config.label} login failed: OAuth state mismatch`);
+    }
+    if (!code)
+        return new Error(`${config.label} login failed: no authorization code in callback`);
+    return code;
+}
+function interpretPastedOAuthRedirect(line, config, expectedState) {
+    const raw = stripWrappingQuotes(line);
+    if (!raw)
+        return { kind: 'ignore', message: '' };
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return {
+            kind: 'ignore',
+            message: `That is not a URL. Paste the redirected localhost address (${exampleCallbackUrl(config)}).`,
+        };
+    }
+    if (!isLoopbackHostname(url.hostname) || url.pathname !== config.callbackPath) {
+        return {
+            kind: 'ignore',
+            message: `Paste the redirected localhost URL from the address bar (${exampleCallbackUrl(config)}).`,
+        };
+    }
+    const result = interpretCallbackParams(config, expectedState, url.searchParams.get('error'), url.searchParams.get('code'), url.searchParams.get('state'));
+    return result instanceof Error ? { kind: 'fail', error: result } : { kind: 'code', code: result };
+}
+function awaitCallback(config, server, redirectUri, expectedState, options = {}) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let paste;
+        const cleanup = () => {
+            options.signal?.removeEventListener('abort', onAbort);
+            server.off('error', onError);
+            paste?.close();
+        };
+        const doResolve = (value) => {
+            cleanup();
+            resolve(value);
+        };
+        const doReject = (err) => {
+            cleanup();
+            reject(err);
+        };
+        if (options.signal?.aborted) {
+            doReject(new Error(`${config.label} login cancelled`));
+            return;
+        }
+        const onAbort = () => {
+            settled = true;
+            server.close();
+            server.closeAllConnections?.();
+            doReject(new Error(`${config.label} login cancelled`));
+        };
+        options.signal?.addEventListener('abort', onAbort, { once: true });
+        // The callback is single-use. A retried or duplicated request after the
+        // socket has been torn down must not run the handler a second time.
+        server.on('request', (req, res) => {
+            if (settled) {
+                res.destroy();
+                return;
+            }
+            const requestUrl = new URL(req.url || '/', redirectUri);
+            if (requestUrl.pathname !== config.callbackPath) {
+                res.writeHead(404).end();
+                return;
+            }
+            settled = true;
+            const result = interpretCallbackParams(config, expectedState, requestUrl.searchParams.get('error'), requestUrl.searchParams.get('code'), requestUrl.searchParams.get('state'));
+            const failure = result instanceof Error ? result : null;
+            res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8', Connection: 'close' });
+            res.end(failure ? `${failure.message}\nYou can close this tab.` : 'Login complete. You can close this tab.');
+            // Free the callback port immediately: a keep-alive browser socket would
+            // otherwise hold it and make the next login attempt fail.
+            server.close();
+            server.closeAllConnections?.();
+            if (failure)
+                doReject(failure);
+            else
+                doResolve(result);
+        });
+        if (options.pasteInput) {
+            paste = readline.createInterface({ input: options.pasteInput, crlfDelay: Infinity });
+            paste.on('line', (line) => {
+                if (settled)
+                    return;
+                const interpreted = interpretPastedOAuthRedirect(line, config, expectedState);
+                if (interpreted.kind === 'ignore') {
+                    if (interpreted.message)
+                        options.onPasteRejected?.(interpreted.message);
+                    return;
+                }
+                settled = true;
+                server.close();
+                server.closeAllConnections?.();
+                if (interpreted.kind === 'fail')
+                    doReject(interpreted.error);
+                else
+                    doResolve(interpreted.code);
+            });
+        }
+        const onError = (err) => {
+            doReject(err);
+        };
+        server.on('error', onError);
+    });
+}
+/**
+ * Runs the full browser login and returns the token endpoint's raw response
+ * body. Mapping that body into a provider's stored credential shape, and
+ * persisting it, belongs to the caller.
+ *
+ * Resolves only after the authorization server redirects back to the loopback
+ * listener, so callers should treat this as a long, human-paced operation.
+ */
+export async function runPkceLoopbackLogin(config, options = {}) {
+    const fetchImpl = options.fetchImpl || globalThis.fetch;
+    const openBrowser = options.openBrowser || openInBrowser;
+    const verifier = base64url(crypto.randomBytes(32));
+    const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
+    const state = base64url(crypto.randomBytes(16));
+    // Bind before building the URL: the redirect_uri we send must name the port
+    // we actually got, or the authorization server will refuse the callback.
+    const { server, port } = await bindLoopbackListener(config);
+    const redirectUri = config.redirectUriFor(port);
+    const authUrl = buildAuthorizeUrl(config, redirectUri, challenge, state).toString();
+    const callback = awaitCallback(config, server, redirectUri, state, {
+        signal: options.signal,
+        pasteInput: options.pasteInput,
+        onPasteRejected: options.onPasteRejected,
+    });
+    options.onPrompt?.(authUrl);
+    openBrowser(authUrl);
+    let code;
+    try {
+        code = await callback;
+    }
+    catch (error) {
+        server.close();
+        server.closeAllConnections?.();
+        throw error;
+    }
+    const params = {
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: verifier,
+        client_id: config.clientId,
+    };
+    const useJson = config.tokenRequestEncoding === 'json';
+    // The browser already showed "Login complete" on the loopback callback, so
+    // a later exchange failure must be explicit in the terminal — the code is
+    // one-time and the user will need to retry the login.
+    // Don't create a real timer in tests — fake timers make AbortSignal.timeout warn with NaN.
+    const timeoutSignal = process.env.NODE_ENV === 'test'
+        ? undefined
+        : AbortSignal.timeout
+            ? AbortSignal.timeout(30_000)
+            : undefined;
+    const fetchSignal = options.signal
+        ? timeoutSignal && AbortSignal.any
+            ? AbortSignal.any([options.signal, timeoutSignal])
+            : options.signal
+        : timeoutSignal;
+    const response = await fetchImpl(config.tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': useJson ? 'application/json' : 'application/x-www-form-urlencoded' },
+        body: useJson ? JSON.stringify(params) : new URLSearchParams(params).toString(),
+        ...(fetchSignal ? { signal: fetchSignal } : {}),
+    });
+    if (!response.ok) {
+        throw new Error(`${config.label} token exchange failed with status ${response.status} (the browser showed "Login complete" but the code could not be exchanged — retry ${config.label.toLowerCase() === 'grok' ? 'term2 --grok-login' : 'term2 --codex-login'})`);
+    }
+    const body = await response.json();
+    if (!body?.access_token) {
+        throw new Error(`${config.label} token exchange response did not contain access_token`);
+    }
+    return body;
+}
+//# sourceMappingURL=oauth-pkce.js.map

package/dist/providers/oauth-pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-pkce.js","sourceRoot":"","sources":["../../source/providers/oauth-pkce.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAsD3C,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3G,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,8EAA8E;YAC9E,uEAAuE;YACvE,6EAA6E;QAC/E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAuB,EAAE,WAAmB,EAAE,SAAiB,EAAE,KAAa;IACvG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,MAAuB;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,CAAC,GAA0B,EAAE,EAAE;gBAC7C,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9B,MAAM,CAAC,GAAG,CAAC,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;oBAC5C,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;oBACnB,OAAO;gBACT,CAAC;gBACD,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,MAAM,CAAC,KAAK,+DAA+D,MAAM,CAAC,aAAa,CAAC,IAAI,CACrG,IAAI,CACL,+FACC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,EAC9D,aAAa,CACd,CACF,CAAC;YACJ,CAAC,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBACpC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7B,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,OAAO,CAAC,CAAC,CAAC,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7G,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAuB;IACjD,OAAO,oBAAoB,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,WAAW,CAAC;AACtF,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAuB,EACvB,aAAqB,EACrB,KAAoB,EACpB,IAAmB,EACnB,KAAoB;IAEpB,IAAI,KAAK;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAC5E,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5B,+DAA+D;QAC/D,mEAAmE;QACnE,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,kDAAkD,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,SAAS,4BAA4B,CAAC,IAAY,EAAE,MAAuB,EAAE,aAAqB;IAChG,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEjD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,8DAA8D,kBAAkB,CAAC,MAAM,CAAC,IAAI;SACtG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QAC9E,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,4DAA4D,kBAAkB,CAAC,MAAM,CAAC,IAAI;SACpG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,uBAAuB,CACpC,MAAM,EACN,aAAa,EACb,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAC9B,CAAC;IACF,OAAO,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,aAAa,CACpB,MAAuB,EACvB,MAAmB,EACnB,WAAmB,EACnB,aAAqB,EACrB,OAAO,GAIH,EAAE;IAEN,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,KAAqC,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,KAAK,EAAE,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE;YAClC,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,GAAU,EAAE,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,WAAW,CAAC,CAAC;YACxD,IAAI,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;gBAChD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,MAAM,GAAG,uBAAuB,CACpC,MAAM,EACN,aAAa,EACb,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EACpC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EACnC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CACrC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAExD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACzF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC;YAC7G,wEAAwE;YACxE,0DAA0D;YAC1D,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,IAAI,OAAO;gBAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;;gBAC1B,SAAS,CAAC,MAAgB,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,KAAK,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,OAAO;oBAAE,OAAO;gBACpB,MAAM,WAAW,GAAG,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;gBAC9E,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClC,IAAI,WAAW,CAAC,OAAO;wBAAE,OAAO,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;oBACxE,OAAO;gBACT,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;gBAC/B,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM;oBAAE,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;;oBACxD,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;YAC7B,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAuB,EAAE,OAAO,GAAqB,EAAE;IAChG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,aAAa,CAAC;IAEzD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEpF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;QACjE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IAC5B,WAAW,CAAC,OAAO,CAAC,CAAC;IAErB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,QAAQ;QACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC3B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC;IACvD,2EAA2E;IAC3E,0EAA0E;IAC1E,sDAAsD;IACtD,2FAA2F;IAC3F,MAAM,aAAa,GACjB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAE,WAAmB,CAAC,OAAO;YAC9B,CAAC,CAAE,WAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;YACtC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM;QAChC,CAAC,CAAC,aAAa,IAAK,WAAmB,CAAC,GAAG;YACzC,CAAC,CAAE,WAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAC3D,CAAC,CAAC,OAAO,CAAC,MAAM;QAClB,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mCAAmC,EAAE;QAC/F,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QAC/E,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,CAAC,KAAK,sCACb,QAAQ,CAAC,MACX,qFACE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBACjE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,uDAAuD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/providers/oauth-session-account.d.ts

@@ -0,0 +1,5 @@
+export declare function recordSessionAccount(providerId: string, accountId: string): void;
+export declare function getSessionAccount(providerId: string): string | null;
+/** Test seam; production code never needs to forget a pin. */
+export declare function resetSessionAccounts(): void;
+//# sourceMappingURL=oauth-session-account.d.ts.map

package/dist/providers/oauth-session-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-session-account.d.ts","sourceRoot":"","sources":["../../source/providers/oauth-session-account.ts"],"names":[],"mappings":"AAcA,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAEhF;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEnE;AAED,8DAA8D;AAC9D,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}