@vercel/cli-auth 0.2.0 → 0.3.1

package/credentials-store.d.ts

@@ -1,29 +1,32 @@
-import { z } from 'zod/mini';
-declare const Credentials: z.ZodMiniObject<{
-    /** An `access_token` obtained using the OAuth Device Authorization flow. */
-    token: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    /** A `refresh_token` obtained using the OAuth Device Authorization flow. */
-    refreshToken: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    /**
-     * The absolute time (seconds) when the {@link Credentials.token} expires.
-     * Used to optimistically check if the token is still valid.
-     */
-    expiresAt: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    /** Whether to skip writing the credentials to disk during {@link CredentialsStore.update} */
-    skipWrite: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
-    '// Note': z.ZodMiniOptional<z.ZodMiniString<string>>;
-    '// Docs': z.ZodMiniOptional<z.ZodMiniString<string>>;
-}, z.core.$strip>;
-export type Credentials = z.infer<typeof Credentials>;
-/**
- * Returns in which directory the config should be present
- * @internal Should only be used in {@link CredentialsStore} or tests.
- */
-export declare function getGlobalPathConfig(dir: string): string;
-export declare function CredentialsStore(dir: string): {
+import * as cliConfig from '@vercel/cli-config';
+import type { AuthConfig as SharedAuthConfig, CredStorage, CredentialsStorageLocation, GlobalConfig as SharedGlobalConfig } from '@vercel/cli-config';
+type KeyringEntry = {
+    getPassword(): string | null;
+    setPassword(password: string): void;
+    deleteCredential(): boolean;
+};
+type KeyringEntryConstructor = new (service: string, account: string) => KeyringEntry;
+type LoadKeyringModule = () => {
+    Entry: KeyringEntryConstructor;
+};
+export type GlobalConfig = Pick<SharedGlobalConfig, 'credStorage'>;
+export type Credentials = Omit<SharedAuthConfig, 'tokenSource'>;
+type PersistableAuthConfig = SharedAuthConfig;
+export declare function resolveCredStorage(value: unknown): CredStorage;
+export declare function readGlobalConfig(dir: string): GlobalConfig;
+export declare function getCredStorage(dir: string, config?: GlobalConfig): CredStorage;
+export declare function setLoadKeyringModuleForTesting(nextLoadKeyringModule?: LoadKeyringModule): void;
+export declare function CredentialsStore(dir: string, config?: GlobalConfig): {
     configPath: string;
     get(): Credentials;
-    /** Update the credentials store. If `skipWrite` is set, the update will be skipped. */
-    update(config: Partial<Credentials>): void;
+    update(config: Partial<Credentials>): CredentialsStorageLocation | void;
+    delete(): void;
 };
+export declare function readCredentials(dir: string, config?: GlobalConfig): Credentials;
+export declare function readCliAuthConfig(dir: string, config?: GlobalConfig): Credentials;
+export declare function writeCredentials(dir: string, credentials: Partial<Credentials>, config?: GlobalConfig): void | cliConfig.CredentialsStorageLocation;
+export declare function persistCliAuthConfig(dir: string, authConfig: PersistableAuthConfig, config?: GlobalConfig): void | cliConfig.CredentialsStorageLocation;
+export declare function clearCredentials(dir: string, config?: GlobalConfig): void;
+export declare function clearAllCredentials(dir: string): void;
+export declare function clearAllCredentialsStrict(dir: string): void;
 export {};

package/credentials-store.js

@@ -36,73 +36,393 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getGlobalPathConfig = getGlobalPathConfig;
+exports.resolveCredStorage = resolveCredStorage;
+exports.readGlobalConfig = readGlobalConfig;
+exports.getCredStorage = getCredStorage;
+exports.setLoadKeyringModuleForTesting = setLoadKeyringModuleForTesting;
 exports.CredentialsStore = CredentialsStore;
-const node_path_1 = __importDefault(require("node:path"));
-const fs = __importStar(require("node:fs"));
-const node_os_1 = require("node:os");
-// NOTE: We are pinned on v5 because newer versions behave differently
-// when there are dots in the application name, eg. `com.vercel.cli` becomes `com.vercel`
-const xdg_app_paths_1 = __importDefault(require("xdg-app-paths"));
-const mini_1 = require("zod/mini");
-const Credentials = mini_1.z.object({
-    /** An `access_token` obtained using the OAuth Device Authorization flow. */
-    token: mini_1.z.optional(mini_1.z.string()),
-    /** A `refresh_token` obtained using the OAuth Device Authorization flow. */
-    refreshToken: mini_1.z.optional(mini_1.z.string()),
-    /**
-     * The absolute time (seconds) when the {@link Credentials.token} expires.
-     * Used to optimistically check if the token is still valid.
-     */
-    expiresAt: mini_1.z.optional(mini_1.z.number()),
-    /** Whether to skip writing the credentials to disk during {@link CredentialsStore.update} */
-    skipWrite: mini_1.z.optional(mini_1.z.boolean()),
-    '// Note': mini_1.z.optional(mini_1.z.string()),
-    '// Docs': mini_1.z.optional(mini_1.z.string()),
-});
-/** Returns whether a directory exists */
-function isDirectory(path) {
+exports.readCredentials = readCredentials;
+exports.readCliAuthConfig = readCliAuthConfig;
+exports.writeCredentials = writeCredentials;
+exports.persistCliAuthConfig = persistCliAuthConfig;
+exports.clearCredentials = clearCredentials;
+exports.clearAllCredentials = clearAllCredentials;
+exports.clearAllCredentialsStrict = clearAllCredentialsStrict;
+const node_crypto_1 = require("node:crypto");
+const node_assert_1 = __importDefault(require("node:assert"));
+const cliConfig = __importStar(require("@vercel/cli-config"));
+const KEYRING_SERVICE = 'com.vercel.vercel-cli';
+const TOKEN_STORAGE_ENV = 'VERCEL_TOKEN_STORAGE';
+const KEYRING_UNAVAILABLE_ENV = 'VERCEL_TEST_KEYRING_UNAVAILABLE';
+const KEYRING_UNAVAILABLE_ERROR = 'OS keyring support is unavailable. Set `credStorage` to `auto` or `file` to store credentials in auth.json instead.';
+const defaultLoadKeyringModule = () => require('@napi-rs/keyring');
+let loadKeyringModule = defaultLoadKeyringModule;
+function parseCredentials(value) {
+    const { tokenSource, ...credentials } = cliConfig.parseAuthConfig(value);
+    return credentials;
+}
+function formatCredStorageError(value, source) {
+    try {
+        cliConfig.parseGlobalConfig({ credStorage: value });
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            return error.message.replace('`credStorage`', `\`${source}\``);
+        }
+    }
+    return `Invalid value for \`${source}\`: ${JSON.stringify(value)}. Expected one of: ${cliConfig.CRED_STORAGE_CONFIG_VALUES.map(storage => JSON.stringify(storage)).join(', ')}.`;
+}
+function parseCredStorage(value, source) {
+    if (typeof value === 'undefined') {
+        return cliConfig.DEFAULT_CRED_STORAGE;
+    }
+    try {
+        const config = cliConfig.parseGlobalConfig({ credStorage: value });
+        (0, node_assert_1.default)(config.credStorage !== undefined, 'expected credStorage value to be non-empty');
+        return config.credStorage;
+    }
+    catch {
+        throw new Error(formatCredStorageError(value, source));
+    }
+}
+function resolveCredStorage(value) {
+    return parseCredStorage(value, 'credStorage');
+}
+function readRuntimeFlags() {
+    return {
+        keyringUnavailableForTesting: process.env[KEYRING_UNAVAILABLE_ENV] === '1',
+    };
+}
+function resolveCliAuthConfig(dir, config) {
+    const runtimeFlags = readRuntimeFlags();
+    if (config?.credStorage) {
+        return {
+            ...runtimeFlags,
+            credStorage: resolveCredStorage(config.credStorage),
+        };
+    }
+    const credStorageOverride = process.env[TOKEN_STORAGE_ENV];
+    if (typeof credStorageOverride !== 'undefined') {
+        return {
+            ...runtimeFlags,
+            credStorage: parseCredStorage(credStorageOverride, TOKEN_STORAGE_ENV),
+        };
+    }
+    return {
+        ...runtimeFlags,
+        credStorage: resolveCredStorage(readGlobalConfig(dir).credStorage),
+    };
+}
+function readGlobalConfig(dir) {
+    const configPath = cliConfig.getConfigFilePath(dir);
     try {
-        return fs.lstatSync(path).isDirectory();
+        const config = cliConfig.readGlobalConfigFile(configPath);
+        return {
+            credStorage: typeof config.credStorage === 'undefined'
+                ? undefined
+                : resolveCredStorage(config.credStorage),
+        };
     }
-    catch (_) {
-        // We don't care which kind of error occured, it isn't a directory anyway.
-        return false;
+    catch (error) {
+        if (isENOENTError(error)) {
+            return {};
+        }
+        throw error;
     }
 }
-/**
- * Returns in which directory the config should be present
- * @internal Should only be used in {@link CredentialsStore} or tests.
+function getCredStorage(dir, config) {
+    return resolveCliAuthConfig(dir, config).credStorage;
+}
+/** Return an account key suitable for use in keyrings for a given configPath.
+ *
+ *  `auth.json` and the keychain are supposed to be equivalent and exchangeable.
+ * Since file-based credentials storage is configurable (via config path),
+ * we must ensure that keyring entries are keyed by config path also.  We cannot
+ * use the full path as the key, so use a 16-byte prefix of sha256 hash of
+ * the path.
  */
-function getGlobalPathConfig(dir) {
-    const vercelDirectories = (0, xdg_app_paths_1.default)(dir).dataDirs();
-    const possibleConfigPaths = [
-        ...vercelDirectories, // latest vercel directory
-        node_path_1.default.join((0, node_os_1.homedir)(), '.now'), // legacy config in user's home directory
-        ...(0, xdg_app_paths_1.default)('now').dataDirs(), // legacy XDG directory
-    ];
-    // The customPath flag is the preferred location,
-    // followed by the vercel directory,
-    // followed by the now directory.
-    // If none of those exist, use the vercel directory.
-    return (possibleConfigPaths.find(configPath => isDirectory(configPath)) ||
-        vercelDirectories[0]);
-}
-function CredentialsStore(dir) {
-    const configPath = node_path_1.default.join(getGlobalPathConfig(dir), 'auth.json');
+function getKeyringAccount(configPath) {
+    const digest = (0, node_crypto_1.createHash)('sha256').update(configPath).digest('hex');
+    return `cli:${digest.slice(0, 16)}`;
+}
+function setLoadKeyringModuleForTesting(nextLoadKeyringModule) {
+    loadKeyringModule = nextLoadKeyringModule ?? defaultLoadKeyringModule;
+}
+function createKeyringEntry(configPath, runtimeFlags) {
+    try {
+        if (runtimeFlags.keyringUnavailableForTesting) {
+            throw new Error(`${KEYRING_UNAVAILABLE_ENV} is set`);
+        }
+        const { Entry } = loadKeyringModule();
+        return new Entry(KEYRING_SERVICE, getKeyringAccount(configPath));
+    }
+    catch (error) {
+        const wrappedError = new Error(KEYRING_UNAVAILABLE_ERROR);
+        wrappedError.cause = error;
+        throw wrappedError;
+    }
+}
+function isKeyringUnavailableError(error) {
+    return error instanceof Error && error.message === KEYRING_UNAVAILABLE_ERROR;
+}
+function readCredentialsFromFile(configPath) {
+    return cliConfig.readAuthFileConfig(configPath);
+}
+function isENOENTError(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ENOENT');
+}
+function createMissingCredentialsError(configPath) {
+    const error = new Error(`ENOENT: no such file or directory, open '${configPath}'`);
+    Object.assign(error, { code: 'ENOENT' });
+    return error;
+}
+function writeCredentialsToFile(configPath, config) {
+    cliConfig.writeAuthConfigFile(configPath, config);
+}
+function readCredentialsFromKeyring(configPath, runtimeFlags) {
+    const entry = createKeyringEntry(configPath, runtimeFlags);
+    const value = entry.getPassword();
+    if (value === null) {
+        return null;
+    }
+    return parseCredentials(JSON.parse(value));
+}
+function writeCredentialsToKeyring(configPath, config, runtimeFlags) {
+    const entry = createKeyringEntry(configPath, runtimeFlags);
+    entry.setPassword(JSON.stringify(config));
+}
+function deleteCredentialsFromKeyring(configPath, runtimeFlags) {
+    const entry = createKeyringEntry(configPath, runtimeFlags);
+    return entry.deleteCredential();
+}
+function deleteCredentialsFile(configPath) {
+    cliConfig.deleteAuthConfigFile(configPath);
+}
+function tryDeleteCredentialsFromKeyring(configPath, runtimeFlags) {
+    try {
+        deleteCredentialsFromKeyring(configPath, runtimeFlags);
+    }
+    catch { }
+}
+function deleteCredentialsFromKeyringIfAvailable(configPath, runtimeFlags) {
+    try {
+        deleteCredentialsFromKeyring(configPath, runtimeFlags);
+    }
+    catch (error) {
+        if (!isKeyringUnavailableError(error)) {
+            throw error;
+        }
+    }
+}
+function migrateCredentialsToFile(configPath, credentials, runtimeFlags) {
+    writeCredentialsToFile(configPath, credentials);
+    tryDeleteCredentialsFromKeyring(configPath, runtimeFlags);
+    return credentials;
+}
+function tryReadKeyringCredentialsIntoFile(configPath, runtimeFlags) {
+    try {
+        const credentials = readCredentialsFromKeyring(configPath, runtimeFlags);
+        if (credentials === null) {
+            return null;
+        }
+        return migrateCredentialsToFile(configPath, credentials, runtimeFlags);
+    }
+    catch {
+        return null;
+    }
+}
+function readFileStorageCredentials(configPath, runtimeFlags) {
+    try {
+        const credentials = readCredentialsFromFile(configPath);
+        if (cliConfig.authConfigHasUsableTokenData(credentials)) {
+            return credentials;
+        }
+        return (tryReadKeyringCredentialsIntoFile(configPath, runtimeFlags) ?? credentials);
+    }
+    catch (error) {
+        if (!isENOENTError(error)) {
+            throw error;
+        }
+        const credentials = tryReadKeyringCredentialsIntoFile(configPath, runtimeFlags);
+        if (credentials !== null) {
+            return credentials;
+        }
+        throw error;
+    }
+}
+function migrateCredentialsToKeyring(configPath, credentials, runtimeFlags) {
+    writeCredentialsToKeyring(configPath, credentials, runtimeFlags);
+    deleteCredentialsFile(configPath);
+    return credentials;
+}
+function readKeyringStorageCredentials(configPath, runtimeFlags) {
+    const credentials = readCredentialsFromKeyring(configPath, runtimeFlags);
+    if (credentials !== null) {
+        return credentials;
+    }
+    try {
+        const fileCredentials = readCredentialsFromFile(configPath);
+        return migrateCredentialsToKeyring(configPath, fileCredentials, runtimeFlags);
+    }
+    catch (error) {
+        if (isENOENTError(error)) {
+            throw createMissingCredentialsError(configPath);
+        }
+        throw error;
+    }
+}
+function readAutoStorageCredentials(configPath, runtimeFlags) {
+    try {
+        const credentials = readCredentialsFromKeyring(configPath, runtimeFlags);
+        if (credentials !== null) {
+            return credentials;
+        }
+    }
+    catch { }
+    return readCredentialsFromFile(configPath);
+}
+function writeFileStorageCredentials(configPath, credentials, runtimeFlags) {
+    writeCredentialsToFile(configPath, credentials);
+    tryDeleteCredentialsFromKeyring(configPath, runtimeFlags);
+    return 'file';
+}
+function writeKeyringStorageCredentials(configPath, credentials, runtimeFlags) {
+    writeCredentialsToKeyring(configPath, credentials, runtimeFlags);
+    deleteCredentialsFile(configPath);
+    return 'keyring';
+}
+function writeAutoStorageCredentials(configPath, credentials, runtimeFlags) {
+    try {
+        return writeKeyringStorageCredentials(configPath, credentials, runtimeFlags);
+    }
+    catch {
+        deleteCredentialsFromKeyringIfAvailable(configPath, runtimeFlags);
+        return writeFileStorageCredentials(configPath, credentials, runtimeFlags);
+    }
+}
+function deleteFileStorageCredentials(configPath, runtimeFlags) {
+    deleteCredentialsFile(configPath);
+    deleteCredentialsFromKeyringIfAvailable(configPath, runtimeFlags);
+}
+function deleteKeyringStorageCredentials(configPath, runtimeFlags) {
+    deleteCredentialsFromKeyring(configPath, runtimeFlags);
+    deleteCredentialsFile(configPath);
+}
+function deleteAutoStorageCredentials(configPath, runtimeFlags) {
+    try {
+        deleteCredentialsFromKeyring(configPath, runtimeFlags);
+    }
+    catch { }
+    deleteCredentialsFile(configPath);
+}
+function CredentialsStore(dir, config = {}) {
+    const configPath = cliConfig.getAuthConfigFilePath(dir);
+    const cliAuthConfig = resolveCliAuthConfig(dir, config);
+    const tokenStorage = cliAuthConfig.credStorage;
     return {
         configPath,
         get() {
-            return Credentials.parse(JSON.parse(fs.readFileSync(configPath, 'utf8')));
+            switch (tokenStorage) {
+                case 'file':
+                    return readFileStorageCredentials(configPath, cliAuthConfig);
+                case 'keyring':
+                    return readKeyringStorageCredentials(configPath, cliAuthConfig);
+                case 'auto':
+                    return readAutoStorageCredentials(configPath, cliAuthConfig);
+            }
+            throw new Error(`Unsupported credStorage: ${tokenStorage}`);
         },
-        /** Update the credentials store. If `skipWrite` is set, the update will be skipped. */
         update(config) {
             if (config.skipWrite)
                 return;
-            const parsedConfig = Credentials.parse(config);
-            fs.mkdirSync(node_path_1.default.dirname(configPath), { recursive: true });
-            fs.writeFileSync(configPath, JSON.stringify(parsedConfig, null, 2) + '\n', { mode: 0o600 });
+            const parsedConfig = parseCredentials(config);
+            switch (tokenStorage) {
+                case 'file':
+                    return writeFileStorageCredentials(configPath, parsedConfig, cliAuthConfig);
+                case 'keyring':
+                    return writeKeyringStorageCredentials(configPath, parsedConfig, cliAuthConfig);
+                case 'auto':
+                    return writeAutoStorageCredentials(configPath, parsedConfig, cliAuthConfig);
+            }
+            throw new Error(`Unsupported credStorage: ${tokenStorage}`);
+        },
+        delete() {
+            switch (tokenStorage) {
+                case 'file':
+                    deleteFileStorageCredentials(configPath, cliAuthConfig);
+                    break;
+                case 'keyring':
+                    deleteKeyringStorageCredentials(configPath, cliAuthConfig);
+                    break;
+                case 'auto':
+                    deleteAutoStorageCredentials(configPath, cliAuthConfig);
+                    break;
+            }
         },
     };
 }
+function readCredentials(dir, config = {}) {
+    return CredentialsStore(dir, config).get();
+}
+function readCliAuthConfig(dir, config = {}) {
+    return readCredentials(dir, config);
+}
+function writeCredentials(dir, credentials, config = {}) {
+    return CredentialsStore(dir, config).update(credentials);
+}
+function toPersistedAuthConfig(authConfig) {
+    const { skipWrite, tokenSource, ...persistedAuthConfig } = authConfig;
+    return persistedAuthConfig;
+}
+function persistCliAuthConfig(dir, authConfig, config = {}) {
+    if (authConfig.skipWrite) {
+        return;
+    }
+    const persistedAuthConfig = toPersistedAuthConfig(authConfig);
+    if (!cliConfig.authConfigHasUsableTokenData(persistedAuthConfig)) {
+        clearAllCredentialsStrict(dir);
+        return;
+    }
+    return writeCredentials(dir, persistedAuthConfig, config);
+}
+function clearCredentials(dir, config = {}) {
+    CredentialsStore(dir, config).delete();
+}
+function clearAllCredentials(dir) {
+    for (const credStorage of cliConfig.CRED_STORAGE_VALUES) {
+        try {
+            clearCredentials(dir, { credStorage });
+        }
+        catch { }
+    }
+}
+function clearAllCredentialsStrict(dir) {
+    const configPath = cliConfig.getAuthConfigFilePath(dir);
+    const runtimeFlags = readRuntimeFlags();
+    let fileError;
+    let keyringError;
+    try {
+        deleteCredentialsFile(configPath);
+    }
+    catch (error) {
+        fileError = error;
+    }
+    try {
+        deleteCredentialsFromKeyring(configPath, runtimeFlags);
+    }
+    catch (error) {
+        if (!isKeyringUnavailableError(error)) {
+            keyringError = error;
+        }
+    }
+    if (keyringError) {
+        throw keyringError;
+    }
+    if (fileError) {
+        throw fileError;
+    }
+}
 //# sourceMappingURL=credentials-store.js.map

package/credentials-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["credentials-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,kDAiBC;AAED,4CAmBC;AA9ED,0DAA6B;AAC7B,4CAA8B;AAC9B,qCAAkC;AAClC,sEAAsE;AACtE,yFAAyF;AACzF,kEAAwC;AACxC,mCAA6B;AAE7B,MAAM,WAAW,GAAG,QAAC,CAAC,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,KAAK,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IACjC,6FAA6F;IAC7F,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,OAAO,EAAE,CAAC;IAClC,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAIH,yCAAyC;AACzC,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,0EAA0E;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,MAAM,iBAAiB,GAAG,IAAA,uBAAW,EAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEtD,MAAM,mBAAmB,GAAG;QAC1B,GAAG,iBAAiB,EAAE,0BAA0B;QAChD,mBAAI,CAAC,IAAI,CAAC,IAAA,iBAAO,GAAE,EAAE,MAAM,CAAC,EAAE,yCAAyC;QACvE,GAAG,IAAA,uBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;KAC1D,CAAC;IAEF,iDAAiD;IACjD,oCAAoC;IACpC,iCAAiC;IACjC,oDAAoD;IACpD,OAAO,CACL,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC/D,iBAAiB,CAAC,CAAC,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG,mBAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACpE,OAAO;QACL,UAAU;QACV,GAAG;YACD,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,uFAAuF;QACvF,MAAM,CAAC,MAA4B;YACjC,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO;YAC7B,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/C,EAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,EAAE,CAAC,aAAa,CACd,UAAU,EACV,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAC5C,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["credentials-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwFA,gDAEC;AAoCD,4CAmBC;AAED,wCAKC;AAeD,wEAIC;AAyRD,4CA2DC;AAED,0CAEC;AAED,8CAEC;AAED,4CAMC;AAOD,oDAiBC;AAED,4CAEC;AAED,kDAMC;AAED,8DA4BC;AAjlBD,6CAAyC;AACzC,8DAAiC;AACjC,8DAAgD;AAQhD,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAChD,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACjD,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAClE,MAAM,yBAAyB,GAC7B,qHAAqH,CAAC;AAiBxH,MAAM,wBAAwB,GAAsB,GAAG,EAAE,CACvD,OAAO,CAAC,kBAAkB,CAEzB,CAAC;AAEJ,IAAI,iBAAiB,GAAG,wBAAwB,CAAC;AAgBjD,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,GAAG,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,MAAc;IAC5D,IAAI,CAAC;QACH,SAAS,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,OAAO,uBAAuB,MAAM,OAAO,IAAI,CAAC,SAAS,CACvD,KAAK,CACN,sBAAsB,SAAS,CAAC,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACpH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,MAAc;IACtD,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC,oBAAoB,CAAC;IACxC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAA,qBAAM,EACJ,MAAM,CAAC,WAAW,KAAK,SAAS,EAChC,4CAA4C,CAC7C,CAAC;QACF,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAc;IAC/C,OAAO,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;QACL,4BAA4B,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAW,EACX,MAAqB;IAErB,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IAExC,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;QACxB,OAAO;YACL,GAAG,YAAY;YACf,WAAW,EAAE,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAE3D,IAAI,OAAO,mBAAmB,KAAK,WAAW,EAAE,CAAC;QAC/C,OAAO;YACL,GAAG,YAAY;YACf,WAAW,EAAE,gBAAgB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,YAAY;QACf,WAAW,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAE1D,OAAO;YACL,WAAW,EACT,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW;gBACvC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;SAC7C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,cAAc,CAC5B,GAAW,EACX,MAAqB;IAErB,OAAO,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,WAAW,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAgB,8BAA8B,CAC5C,qBAAyC;IAEzC,iBAAiB,GAAG,qBAAqB,IAAI,wBAAwB,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CACzB,UAAkB,EAClB,YAA0B;IAE1B,IAAI,CAAC;QACH,IAAI,YAAY,CAAC,4BAA4B,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,uBAAuB,SAAS,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAEtC,OAAO,IAAI,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzD,YAA4C,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5D,MAAM,YAAY,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,yBAAyB,CAAC;AAC/E,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAkB;IACjD,OAAO,SAAS,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,UAAkB;IACvD,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,4CAA4C,UAAU,GAAG,CAC1D,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAkB,EAAE,MAAmB;IACrE,SAAS,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAkB,EAClB,YAA0B;IAE1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAElC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,yBAAyB,CAChC,UAAkB,EAClB,MAAmB,EACnB,YAA0B;IAE1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3D,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAkB,EAClB,YAA0B;IAE1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,gBAAgB,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,SAAS,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,+BAA+B,CACtC,UAAkB,EAClB,YAA0B;IAE1B,IAAI,CAAC;QACH,4BAA4B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC;AAED,SAAS,uCAAuC,CAC9C,UAAkB,EAClB,YAA0B;IAE1B,IAAI,CAAC;QACH,4BAA4B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,UAAkB,EAClB,WAAwB,EACxB,YAA0B;IAE1B,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAChD,+BAA+B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,iCAAiC,CACxC,UAAkB,EAClB,YAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,0BAA0B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,wBAAwB,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAkB,EAClB,YAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAExD,IAAI,SAAS,CAAC,4BAA4B,CAAC,WAAW,CAAC,EAAE,CAAC;YACxD,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,OAAO,CACL,iCAAiC,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,WAAW,CAC3E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,iCAAiC,CACnD,UAAU,EACV,YAAY,CACb,CAAC;QAEF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,UAAkB,EAClB,WAAwB,EACxB,YAA0B;IAE1B,yBAAyB,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACjE,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkB,EAClB,YAA0B;IAE1B,MAAM,WAAW,GAAG,0BAA0B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAEzE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAE5D,OAAO,2BAA2B,CAChC,UAAU,EACV,eAAe,EACf,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,6BAA6B,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,UAAkB,EAClB,YAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,0BAA0B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEzE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,OAAO,uBAAuB,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,2BAA2B,CAClC,UAAkB,EAClB,WAAwB,EACxB,YAA0B;IAE1B,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAChD,+BAA+B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,8BAA8B,CACrC,UAAkB,EAClB,WAAwB,EACxB,YAA0B;IAE1B,yBAAyB,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACjE,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAClC,UAAkB,EAClB,WAAwB,EACxB,YAA0B;IAE1B,IAAI,CAAC;QACH,OAAO,8BAA8B,CACnC,UAAU,EACV,WAAW,EACX,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAClE,OAAO,2BAA2B,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAkB,EAClB,YAA0B;IAE1B,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAClC,uCAAuC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,+BAA+B,CACtC,UAAkB,EAClB,YAA0B;IAE1B,4BAA4B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACvD,qBAAqB,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,4BAA4B,CACnC,UAAkB,EAClB,YAA0B;IAE1B,IAAI,CAAC;QACH,4BAA4B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,qBAAqB,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAW,EAAE,SAAuB,EAAE;IACrE,MAAM,UAAU,GAAG,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC;IAE/C,OAAO;QACL,UAAU;QACV,GAAG;YACD,QAAQ,YAAY,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACT,OAAO,0BAA0B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;gBAC/D,KAAK,SAAS;oBACZ,OAAO,6BAA6B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;gBAClE,KAAK,MAAM;oBACT,OAAO,0BAA0B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,CAAC,MAA4B;YACjC,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO;YAC7B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,QAAQ,YAAY,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACT,OAAO,2BAA2B,CAChC,UAAU,EACV,YAAY,EACZ,aAAa,CACd,CAAC;gBACJ,KAAK,SAAS;oBACZ,OAAO,8BAA8B,CACnC,UAAU,EACV,YAAY,EACZ,aAAa,CACd,CAAC;gBACJ,KAAK,MAAM;oBACT,OAAO,2BAA2B,CAChC,UAAU,EACV,YAAY,EACZ,aAAa,CACd,CAAC;YACN,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM;YACJ,QAAQ,YAAY,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACT,4BAA4B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;oBACxD,MAAM;gBACR,KAAK,SAAS;oBACZ,+BAA+B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;oBAC3D,MAAM;gBACR,KAAK,MAAM;oBACT,4BAA4B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;oBACxD,MAAM;YACV,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,GAAW,EAAE,SAAuB,EAAE;IACpE,OAAO,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;AAC7C,CAAC;AAED,SAAgB,iBAAiB,CAAC,GAAW,EAAE,SAAuB,EAAE;IACtE,OAAO,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,SAAgB,gBAAgB,CAC9B,GAAW,EACX,WAAiC,EACjC,SAAuB,EAAE;IAEzB,OAAO,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAiC;IAC9D,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,mBAAmB,EAAE,GAAG,UAAU,CAAC;IACtE,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAgB,oBAAoB,CAClC,GAAW,EACX,UAAiC,EACjC,SAAuB,EAAE;IAEzB,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAE9D,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjE,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,OAAO,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAW,EAAE,SAAuB,EAAE;IACrE,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,KAAK,MAAM,WAAW,IAAI,SAAS,CAAC,mBAAmB,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,gBAAgB,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,yBAAyB,CAAC,GAAW;IACnD,MAAM,UAAU,GAAG,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IAExC,IAAI,SAAkB,CAAC;IACvB,IAAI,YAAqB,CAAC;IAE1B,IAAI,CAAC;QACH,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACH,4BAA4B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,CAAC;IAClB,CAAC;AACH,CAAC"}

package/credentials-store.ts

@@ -1,79 +1,594 @@
-import path from 'node:path';
-import * as fs from 'node:fs';
-import { homedir } from 'node:os';
-// NOTE: We are pinned on v5 because newer versions behave differently
-// when there are dots in the application name, eg. `com.vercel.cli` becomes `com.vercel`
-import XDGAppPaths from 'xdg-app-paths';
-import { z } from 'zod/mini';
-
-const Credentials = z.object({
-  /** An `access_token` obtained using the OAuth Device Authorization flow. */
-  token: z.optional(z.string()),
-  /** A `refresh_token` obtained using the OAuth Device Authorization flow. */
-  refreshToken: z.optional(z.string()),
-  /**
-   * The absolute time (seconds) when the {@link Credentials.token} expires.
-   * Used to optimistically check if the token is still valid.
-   */
-  expiresAt: z.optional(z.number()),
-  /** Whether to skip writing the credentials to disk during {@link CredentialsStore.update} */
-  skipWrite: z.optional(z.boolean()),
-  '// Note': z.optional(z.string()),
-  '// Docs': z.optional(z.string()),
-});
-
-export type Credentials = z.infer<typeof Credentials>;
-
-/** Returns whether a directory exists */
-function isDirectory(path: string): boolean {
+import { createHash } from 'node:crypto';
+import assert from 'node:assert';
+import * as cliConfig from '@vercel/cli-config';
+import type {
+  AuthConfig as SharedAuthConfig,
+  CredStorage,
+  CredentialsStorageLocation,
+  GlobalConfig as SharedGlobalConfig,
+} from '@vercel/cli-config';
+
+const KEYRING_SERVICE = 'com.vercel.vercel-cli';
+const TOKEN_STORAGE_ENV = 'VERCEL_TOKEN_STORAGE';
+const KEYRING_UNAVAILABLE_ENV = 'VERCEL_TEST_KEYRING_UNAVAILABLE';
+const KEYRING_UNAVAILABLE_ERROR =
+  'OS keyring support is unavailable. Set `credStorage` to `auto` or `file` to store credentials in auth.json instead.';
+
+type KeyringEntry = {
+  getPassword(): string | null;
+  setPassword(password: string): void;
+  deleteCredential(): boolean;
+};
+
+type KeyringEntryConstructor = new (
+  service: string,
+  account: string
+) => KeyringEntry;
+
+type LoadKeyringModule = () => {
+  Entry: KeyringEntryConstructor;
+};
+
+const defaultLoadKeyringModule: LoadKeyringModule = () =>
+  require('@napi-rs/keyring') as {
+    Entry: KeyringEntryConstructor;
+  };
+
+let loadKeyringModule = defaultLoadKeyringModule;
+
+type RuntimeFlags = {
+  keyringUnavailableForTesting: boolean;
+};
+
+type ResolvedCliAuthConfig = RuntimeFlags & {
+  credStorage: CredStorage;
+};
+
+export type GlobalConfig = Pick<SharedGlobalConfig, 'credStorage'>;
+
+export type Credentials = Omit<SharedAuthConfig, 'tokenSource'>;
+
+type PersistableAuthConfig = SharedAuthConfig;
+
+function parseCredentials(value: unknown): Credentials {
+  const { tokenSource, ...credentials } = cliConfig.parseAuthConfig(value);
+  return credentials;
+}
+
+function formatCredStorageError(value: unknown, source: string): string {
+  try {
+    cliConfig.parseGlobalConfig({ credStorage: value });
+  } catch (error) {
+    if (error instanceof Error) {
+      return error.message.replace('`credStorage`', `\`${source}\``);
+    }
+  }
+
+  return `Invalid value for \`${source}\`: ${JSON.stringify(
+    value
+  )}. Expected one of: ${cliConfig.CRED_STORAGE_CONFIG_VALUES.map(storage => JSON.stringify(storage)).join(', ')}.`;
+}
+
+function parseCredStorage(value: unknown, source: string): CredStorage {
+  if (typeof value === 'undefined') {
+    return cliConfig.DEFAULT_CRED_STORAGE;
+  }
+
   try {
-    return fs.lstatSync(path).isDirectory();
-  } catch (_) {
-    // We don't care which kind of error occured, it isn't a directory anyway.
-    return false;
+    const config = cliConfig.parseGlobalConfig({ credStorage: value });
+    assert(
+      config.credStorage !== undefined,
+      'expected credStorage value to be non-empty'
+    );
+    return config.credStorage;
+  } catch {
+    throw new Error(formatCredStorageError(value, source));
   }
 }
 
-/**
- * Returns in which directory the config should be present
- * @internal Should only be used in {@link CredentialsStore} or tests.
+export function resolveCredStorage(value: unknown): CredStorage {
+  return parseCredStorage(value, 'credStorage');
+}
+
+function readRuntimeFlags(): RuntimeFlags {
+  return {
+    keyringUnavailableForTesting: process.env[KEYRING_UNAVAILABLE_ENV] === '1',
+  };
+}
+
+function resolveCliAuthConfig(
+  dir: string,
+  config?: GlobalConfig
+): ResolvedCliAuthConfig {
+  const runtimeFlags = readRuntimeFlags();
+
+  if (config?.credStorage) {
+    return {
+      ...runtimeFlags,
+      credStorage: resolveCredStorage(config.credStorage),
+    };
+  }
+
+  const credStorageOverride = process.env[TOKEN_STORAGE_ENV];
+
+  if (typeof credStorageOverride !== 'undefined') {
+    return {
+      ...runtimeFlags,
+      credStorage: parseCredStorage(credStorageOverride, TOKEN_STORAGE_ENV),
+    };
+  }
+
+  return {
+    ...runtimeFlags,
+    credStorage: resolveCredStorage(readGlobalConfig(dir).credStorage),
+  };
+}
+
+export function readGlobalConfig(dir: string): GlobalConfig {
+  const configPath = cliConfig.getConfigFilePath(dir);
+
+  try {
+    const config = cliConfig.readGlobalConfigFile(configPath);
+
+    return {
+      credStorage:
+        typeof config.credStorage === 'undefined'
+          ? undefined
+          : resolveCredStorage(config.credStorage),
+    };
+  } catch (error) {
+    if (isENOENTError(error)) {
+      return {};
+    }
+
+    throw error;
+  }
+}
+
+export function getCredStorage(
+  dir: string,
+  config?: GlobalConfig
+): CredStorage {
+  return resolveCliAuthConfig(dir, config).credStorage;
+}
+
+/** Return an account key suitable for use in keyrings for a given configPath.
+ *
+ *  `auth.json` and the keychain are supposed to be equivalent and exchangeable.
+ * Since file-based credentials storage is configurable (via config path),
+ * we must ensure that keyring entries are keyed by config path also.  We cannot
+ * use the full path as the key, so use a 16-byte prefix of sha256 hash of
+ * the path.
  */
-export function getGlobalPathConfig(dir: string): string {
-  const vercelDirectories = XDGAppPaths(dir).dataDirs();
-
-  const possibleConfigPaths = [
-    ...vercelDirectories, // latest vercel directory
-    path.join(homedir(), '.now'), // legacy config in user's home directory
-    ...XDGAppPaths('now').dataDirs(), // legacy XDG directory
-  ];
-
-  // The customPath flag is the preferred location,
-  // followed by the vercel directory,
-  // followed by the now directory.
-  // If none of those exist, use the vercel directory.
+function getKeyringAccount(configPath: string): string {
+  const digest = createHash('sha256').update(configPath).digest('hex');
+  return `cli:${digest.slice(0, 16)}`;
+}
+
+export function setLoadKeyringModuleForTesting(
+  nextLoadKeyringModule?: LoadKeyringModule
+) {
+  loadKeyringModule = nextLoadKeyringModule ?? defaultLoadKeyringModule;
+}
+
+function createKeyringEntry(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): KeyringEntry {
+  try {
+    if (runtimeFlags.keyringUnavailableForTesting) {
+      throw new Error(`${KEYRING_UNAVAILABLE_ENV} is set`);
+    }
+
+    const { Entry } = loadKeyringModule();
+
+    return new Entry(KEYRING_SERVICE, getKeyringAccount(configPath));
+  } catch (error) {
+    const wrappedError = new Error(KEYRING_UNAVAILABLE_ERROR);
+    (wrappedError as Error & { cause?: unknown }).cause = error;
+    throw wrappedError;
+  }
+}
+
+function isKeyringUnavailableError(error: unknown): boolean {
+  return error instanceof Error && error.message === KEYRING_UNAVAILABLE_ERROR;
+}
+
+function readCredentialsFromFile(configPath: string): Credentials {
+  return cliConfig.readAuthFileConfig(configPath);
+}
+
+function isENOENTError(error: unknown): boolean {
   return (
-    possibleConfigPaths.find(configPath => isDirectory(configPath)) ||
-    vercelDirectories[0]
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    error.code === 'ENOENT'
+  );
+}
+
+function createMissingCredentialsError(configPath: string): Error {
+  const error = new Error(
+    `ENOENT: no such file or directory, open '${configPath}'`
   );
+  Object.assign(error, { code: 'ENOENT' });
+  return error;
 }
 
-export function CredentialsStore(dir: string) {
-  const configPath = path.join(getGlobalPathConfig(dir), 'auth.json');
+function writeCredentialsToFile(configPath: string, config: Credentials): void {
+  cliConfig.writeAuthConfigFile(configPath, config);
+}
+
+function readCredentialsFromKeyring(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): Credentials | null {
+  const entry = createKeyringEntry(configPath, runtimeFlags);
+  const value = entry.getPassword();
+
+  if (value === null) {
+    return null;
+  }
+
+  return parseCredentials(JSON.parse(value));
+}
+
+function writeCredentialsToKeyring(
+  configPath: string,
+  config: Credentials,
+  runtimeFlags: RuntimeFlags
+): void {
+  const entry = createKeyringEntry(configPath, runtimeFlags);
+  entry.setPassword(JSON.stringify(config));
+}
+
+function deleteCredentialsFromKeyring(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): boolean {
+  const entry = createKeyringEntry(configPath, runtimeFlags);
+  return entry.deleteCredential();
+}
+
+function deleteCredentialsFile(configPath: string): void {
+  cliConfig.deleteAuthConfigFile(configPath);
+}
+
+function tryDeleteCredentialsFromKeyring(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): void {
+  try {
+    deleteCredentialsFromKeyring(configPath, runtimeFlags);
+  } catch {}
+}
+
+function deleteCredentialsFromKeyringIfAvailable(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): void {
+  try {
+    deleteCredentialsFromKeyring(configPath, runtimeFlags);
+  } catch (error) {
+    if (!isKeyringUnavailableError(error)) {
+      throw error;
+    }
+  }
+}
+
+function migrateCredentialsToFile(
+  configPath: string,
+  credentials: Credentials,
+  runtimeFlags: RuntimeFlags
+): Credentials {
+  writeCredentialsToFile(configPath, credentials);
+  tryDeleteCredentialsFromKeyring(configPath, runtimeFlags);
+  return credentials;
+}
+
+function tryReadKeyringCredentialsIntoFile(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): Credentials | null {
+  try {
+    const credentials = readCredentialsFromKeyring(configPath, runtimeFlags);
+
+    if (credentials === null) {
+      return null;
+    }
+
+    return migrateCredentialsToFile(configPath, credentials, runtimeFlags);
+  } catch {
+    return null;
+  }
+}
+
+function readFileStorageCredentials(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): Credentials {
+  try {
+    const credentials = readCredentialsFromFile(configPath);
+
+    if (cliConfig.authConfigHasUsableTokenData(credentials)) {
+      return credentials;
+    }
+
+    return (
+      tryReadKeyringCredentialsIntoFile(configPath, runtimeFlags) ?? credentials
+    );
+  } catch (error) {
+    if (!isENOENTError(error)) {
+      throw error;
+    }
+
+    const credentials = tryReadKeyringCredentialsIntoFile(
+      configPath,
+      runtimeFlags
+    );
+
+    if (credentials !== null) {
+      return credentials;
+    }
+
+    throw error;
+  }
+}
+
+function migrateCredentialsToKeyring(
+  configPath: string,
+  credentials: Credentials,
+  runtimeFlags: RuntimeFlags
+): Credentials {
+  writeCredentialsToKeyring(configPath, credentials, runtimeFlags);
+  deleteCredentialsFile(configPath);
+  return credentials;
+}
+
+function readKeyringStorageCredentials(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): Credentials {
+  const credentials = readCredentialsFromKeyring(configPath, runtimeFlags);
+
+  if (credentials !== null) {
+    return credentials;
+  }
+
+  try {
+    const fileCredentials = readCredentialsFromFile(configPath);
+
+    return migrateCredentialsToKeyring(
+      configPath,
+      fileCredentials,
+      runtimeFlags
+    );
+  } catch (error) {
+    if (isENOENTError(error)) {
+      throw createMissingCredentialsError(configPath);
+    }
+
+    throw error;
+  }
+}
+
+function readAutoStorageCredentials(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): Credentials {
+  try {
+    const credentials = readCredentialsFromKeyring(configPath, runtimeFlags);
+
+    if (credentials !== null) {
+      return credentials;
+    }
+  } catch {}
+
+  return readCredentialsFromFile(configPath);
+}
+
+function writeFileStorageCredentials(
+  configPath: string,
+  credentials: Credentials,
+  runtimeFlags: RuntimeFlags
+): CredentialsStorageLocation {
+  writeCredentialsToFile(configPath, credentials);
+  tryDeleteCredentialsFromKeyring(configPath, runtimeFlags);
+  return 'file';
+}
+
+function writeKeyringStorageCredentials(
+  configPath: string,
+  credentials: Credentials,
+  runtimeFlags: RuntimeFlags
+): CredentialsStorageLocation {
+  writeCredentialsToKeyring(configPath, credentials, runtimeFlags);
+  deleteCredentialsFile(configPath);
+  return 'keyring';
+}
+
+function writeAutoStorageCredentials(
+  configPath: string,
+  credentials: Credentials,
+  runtimeFlags: RuntimeFlags
+): CredentialsStorageLocation {
+  try {
+    return writeKeyringStorageCredentials(
+      configPath,
+      credentials,
+      runtimeFlags
+    );
+  } catch {
+    deleteCredentialsFromKeyringIfAvailable(configPath, runtimeFlags);
+    return writeFileStorageCredentials(configPath, credentials, runtimeFlags);
+  }
+}
+
+function deleteFileStorageCredentials(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): void {
+  deleteCredentialsFile(configPath);
+  deleteCredentialsFromKeyringIfAvailable(configPath, runtimeFlags);
+}
+
+function deleteKeyringStorageCredentials(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): void {
+  deleteCredentialsFromKeyring(configPath, runtimeFlags);
+  deleteCredentialsFile(configPath);
+}
+
+function deleteAutoStorageCredentials(
+  configPath: string,
+  runtimeFlags: RuntimeFlags
+): void {
+  try {
+    deleteCredentialsFromKeyring(configPath, runtimeFlags);
+  } catch {}
+  deleteCredentialsFile(configPath);
+}
+
+export function CredentialsStore(dir: string, config: GlobalConfig = {}) {
+  const configPath = cliConfig.getAuthConfigFilePath(dir);
+  const cliAuthConfig = resolveCliAuthConfig(dir, config);
+  const tokenStorage = cliAuthConfig.credStorage;
+
   return {
     configPath,
     get(): Credentials {
-      return Credentials.parse(JSON.parse(fs.readFileSync(configPath, 'utf8')));
+      switch (tokenStorage) {
+        case 'file':
+          return readFileStorageCredentials(configPath, cliAuthConfig);
+        case 'keyring':
+          return readKeyringStorageCredentials(configPath, cliAuthConfig);
+        case 'auto':
+          return readAutoStorageCredentials(configPath, cliAuthConfig);
+      }
+
+      throw new Error(`Unsupported credStorage: ${tokenStorage}`);
     },
-    /** Update the credentials store. If `skipWrite` is set, the update will be skipped. */
-    update(config: Partial<Credentials>): void {
+    update(config: Partial<Credentials>): CredentialsStorageLocation | void {
       if (config.skipWrite) return;
-      const parsedConfig = Credentials.parse(config);
-      fs.mkdirSync(path.dirname(configPath), { recursive: true });
-      fs.writeFileSync(
-        configPath,
-        JSON.stringify(parsedConfig, null, 2) + '\n',
-        { mode: 0o600 }
-      );
+      const parsedConfig = parseCredentials(config);
+      switch (tokenStorage) {
+        case 'file':
+          return writeFileStorageCredentials(
+            configPath,
+            parsedConfig,
+            cliAuthConfig
+          );
+        case 'keyring':
+          return writeKeyringStorageCredentials(
+            configPath,
+            parsedConfig,
+            cliAuthConfig
+          );
+        case 'auto':
+          return writeAutoStorageCredentials(
+            configPath,
+            parsedConfig,
+            cliAuthConfig
+          );
+      }
+
+      throw new Error(`Unsupported credStorage: ${tokenStorage}`);
+    },
+    delete(): void {
+      switch (tokenStorage) {
+        case 'file':
+          deleteFileStorageCredentials(configPath, cliAuthConfig);
+          break;
+        case 'keyring':
+          deleteKeyringStorageCredentials(configPath, cliAuthConfig);
+          break;
+        case 'auto':
+          deleteAutoStorageCredentials(configPath, cliAuthConfig);
+          break;
+      }
     },
   };
 }
+
+export function readCredentials(dir: string, config: GlobalConfig = {}) {
+  return CredentialsStore(dir, config).get();
+}
+
+export function readCliAuthConfig(dir: string, config: GlobalConfig = {}) {
+  return readCredentials(dir, config);
+}
+
+export function writeCredentials(
+  dir: string,
+  credentials: Partial<Credentials>,
+  config: GlobalConfig = {}
+) {
+  return CredentialsStore(dir, config).update(credentials);
+}
+
+function toPersistedAuthConfig(authConfig: PersistableAuthConfig): Credentials {
+  const { skipWrite, tokenSource, ...persistedAuthConfig } = authConfig;
+  return persistedAuthConfig;
+}
+
+export function persistCliAuthConfig(
+  dir: string,
+  authConfig: PersistableAuthConfig,
+  config: GlobalConfig = {}
+) {
+  if (authConfig.skipWrite) {
+    return;
+  }
+
+  const persistedAuthConfig = toPersistedAuthConfig(authConfig);
+
+  if (!cliConfig.authConfigHasUsableTokenData(persistedAuthConfig)) {
+    clearAllCredentialsStrict(dir);
+    return;
+  }
+
+  return writeCredentials(dir, persistedAuthConfig, config);
+}
+
+export function clearCredentials(dir: string, config: GlobalConfig = {}) {
+  CredentialsStore(dir, config).delete();
+}
+
+export function clearAllCredentials(dir: string) {
+  for (const credStorage of cliConfig.CRED_STORAGE_VALUES) {
+    try {
+      clearCredentials(dir, { credStorage });
+    } catch {}
+  }
+}
+
+export function clearAllCredentialsStrict(dir: string) {
+  const configPath = cliConfig.getAuthConfigFilePath(dir);
+  const runtimeFlags = readRuntimeFlags();
+
+  let fileError: unknown;
+  let keyringError: unknown;
+
+  try {
+    deleteCredentialsFile(configPath);
+  } catch (error) {
+    fileError = error;
+  }
+
+  try {
+    deleteCredentialsFromKeyring(configPath, runtimeFlags);
+  } catch (error) {
+    if (!isKeyringUnavailableError(error)) {
+      keyringError = error;
+    }
+  }
+
+  if (keyringError) {
+    throw keyringError;
+  }
+
+  if (fileError) {
+    throw fileError;
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vercel/cli-auth",
   "description": "Used by Vercel's CLIs to handle authentication",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "publishConfig": {
     "access": "public"
   },
@@ -19,10 +19,11 @@
     "!**/*.test.ts"
   ],
   "dependencies": {
+    "@napi-rs/keyring": "1.2.0",
     "async-listen": "3.0.0",
     "open": "8.4.0",
-    "xdg-app-paths": "5",
-    "zod": "4.1.11"
+    "zod": "4.1.11",
+    "@vercel/cli-config": "0.2.1"
   },
   "devDependencies": {
     "@types/node": "20.11.0",