anypick 1.0.0 → 1.1.0

package/dist/providers/kiro-secret-store.js

@@ -1,168 +0,0 @@
-import { openForeignDatabase } from "../core/db.js";
-import { join } from "node:path";
-import { homedir } from "node:os";
-import { execFile } from "node:child_process";
-//#region src/providers/kiro-secret-store.ts
-/**
-* kiro-cli's secret store.
-*
-* Since kiro-cli 2.x the login is no longer a file under ~/.aws/sso/cache. It
-* lives in the OS keychain, mirrored into an `auth_kv` table in kiro-cli's own
-* SQLite database, and kiro-cli reads the keychain *first* — so switching a Kiro
-* account has to write both tiers. Restoring only the database would be
-* silently ignored while a stale keychain item is still readable, which is the
-* worst possible outcome: anypick reports a switch that did not happen.
-*
-* Every access mirrors what kiro-cli itself does — `/usr/bin/security` and
-* `INSERT OR REPLACE INTO auth_kv` — so an item anypick writes carries the same
-* keychain ACL and kiro-cli reads it back without an authorization prompt.
-*
-* The secret never crosses `argv`: `security(1)` is driven through its `-i`
-* stdin mode, and the value is passed as hex (`-X`) because `-i` unquoting
-* mangles backslashes, which JSON escapes contain.
-*/
-/** Login kinds kiro-cli stores, each under its own keychain service name. */
-var KIRO_SECRET_KEYS = [
-	"kirocli:social:token",
-	"kirocli:odic:token",
-	"kirocli:odic:device-registration",
-	"kirocli:external-idp:token"
-];
-var SECURITY_BIN = "/usr/bin/security";
-var SECURITY_TIMEOUT_MS = 5e3;
-/** Set by the test suite so no test can touch the developer's real keychain. */
-function keychainEnabled() {
-	return process.platform === "darwin" && process.env.ANYPICK_KIRO_NO_KEYCHAIN !== "1";
-}
-/** kiro-cli's data directory, following the same platform rules it does. */
-function kiroSecretDbPath(home = homedir()) {
-	const override = process.env.ANYPICK_KIRO_SECRET_DB;
-	if (override) return override;
-	if (process.platform === "darwin") return join(home, "Library", "Application Support", "kiro-cli", "data.sqlite3");
-	if (process.platform === "win32") return join(process.env.LOCALAPPDATA ?? join(home, "AppData", "Local"), "kiro-cli", "data.sqlite3");
-	return join(process.env.XDG_DATA_HOME ?? join(home, ".local", "share"), "kiro-cli", "data.sqlite3");
-}
-/** Every secret kiro-cli currently holds. Empty when it is not logged in. */
-async function readKiroSecrets(home = homedir()) {
-	const secrets = {};
-	if (keychainEnabled()) for (const key of KIRO_SECRET_KEYS) {
-		const value = await keychainRead(key);
-		if (value) secrets[key] = value;
-	}
-	const rows = readAuthKv(kiroSecretDbPath(home));
-	for (const key of KIRO_SECRET_KEYS) {
-		const value = rows.get(key);
-		if (value && !secrets[key]) secrets[key] = value;
-	}
-	return secrets;
-}
-/** Replace the stored login. Writes both tiers; the keychain is best-effort. */
-async function writeKiroSecrets(secrets, home = homedir()) {
-	writeAuthKv(kiroSecretDbPath(home), secrets);
-	if (!keychainEnabled()) return;
-	for (const key of KIRO_SECRET_KEYS) {
-		const value = secrets[key];
-		if (value) await keychainWrite(key, value);
-		else await keychainDelete(key);
-	}
-}
-/** Forget the local login. Does not call Kiro/AWS logout. */
-async function clearKiroSecrets(home = homedir()) {
-	writeAuthKv(kiroSecretDbPath(home), {});
-	if (!keychainEnabled()) return;
-	for (const key of KIRO_SECRET_KEYS) await keychainDelete(key);
-}
-/**
-* A human label for the stored login.
-*
-* The token carries no email — the only per-account signal is the profile id at
-* the tail of `profile_arn`, so it is paired with the identity provider to give
-* something a person can tell two Google logins apart by.
-*/
-function kiroSecretIdentity(secrets) {
-	for (const key of KIRO_SECRET_KEYS) {
-		const raw = secrets[key];
-		if (!raw) continue;
-		let parsed;
-		try {
-			parsed = JSON.parse(raw);
-		} catch {
-			continue;
-		}
-		if (!parsed || typeof parsed !== "object") continue;
-		const record = parsed;
-		const arn = record.profile_arn ?? record.profileArn;
-		if (typeof arn !== "string") continue;
-		const profile = arn.split("/").pop();
-		if (!profile) continue;
-		const provider = record.provider;
-		return typeof provider === "string" && provider ? `${provider}:${profile}` : profile;
-	}
-}
-function readAuthKv(dbPath) {
-	const rows = /* @__PURE__ */ new Map();
-	let db;
-	try {
-		db = openForeignDatabase(dbPath, true);
-	} catch {
-		return rows;
-	}
-	try {
-		for (const row of db.prepare("SELECT key, value FROM auth_kv").all()) if (typeof row.key === "string" && typeof row.value === "string") rows.set(row.key, row.value);
-	} catch {} finally {
-		db.close();
-	}
-	return rows;
-}
-function writeAuthKv(dbPath, secrets) {
-	let db;
-	try {
-		db = openForeignDatabase(dbPath);
-	} catch {
-		return;
-	}
-	try {
-		db.exec("CREATE TABLE IF NOT EXISTS auth_kv (key TEXT PRIMARY KEY, value TEXT)");
-		db.transaction(() => {
-			const upsert = db.prepare("INSERT OR REPLACE INTO auth_kv (key, value) VALUES (?, ?)");
-			const remove = db.prepare("DELETE FROM auth_kv WHERE key = ?");
-			for (const key of KIRO_SECRET_KEYS) {
-				const value = secrets[key];
-				if (value) upsert.run(key, value);
-				else remove.run(key);
-			}
-		});
-	} finally {
-		db.close();
-	}
-}
-function keychainRead(service) {
-	return new Promise((resolve) => {
-		execFile(SECURITY_BIN, [
-			"find-generic-password",
-			"-s",
-			service,
-			"-w"
-		], { timeout: SECURITY_TIMEOUT_MS }, (err, stdout) => resolve(err ? void 0 : stdout.trim() || void 0));
-	});
-}
-function keychainWrite(service, value) {
-	return securityStdin(`add-generic-password -U -s "${service}" -a "" -X ${Buffer.from(value, "utf8").toString("hex")}\n`);
-}
-function keychainDelete(service) {
-	return securityStdin(`delete-generic-password -s "${service}"\n`);
-}
-/**
-* Drive `security(1)` through its batch mode so the secret is never an argument.
-* Failures are swallowed: the database mirror is already written, and a locked
-* or absent keychain must not fail an otherwise complete switch.
-*/
-function securityStdin(command) {
-	return new Promise((resolve) => {
-		execFile(SECURITY_BIN, ["-i"], { timeout: SECURITY_TIMEOUT_MS }, () => resolve()).stdin?.end(command);
-	});
-}
-//#endregion
-export { KIRO_SECRET_KEYS, clearKiroSecrets, kiroSecretDbPath, kiroSecretIdentity, readKiroSecrets, writeKiroSecrets };
-
-//# sourceMappingURL=kiro-secret-store.js.map

package/dist/providers/kiro-secret-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kiro-secret-store.js","names":[],"sources":["../../src/providers/kiro-secret-store.ts"],"sourcesContent":["/**\n * kiro-cli's secret store.\n *\n * Since kiro-cli 2.x the login is no longer a file under ~/.aws/sso/cache. It\n * lives in the OS keychain, mirrored into an `auth_kv` table in kiro-cli's own\n * SQLite database, and kiro-cli reads the keychain *first* — so switching a Kiro\n * account has to write both tiers. Restoring only the database would be\n * silently ignored while a stale keychain item is still readable, which is the\n * worst possible outcome: anypick reports a switch that did not happen.\n *\n * Every access mirrors what kiro-cli itself does — `/usr/bin/security` and\n * `INSERT OR REPLACE INTO auth_kv` — so an item anypick writes carries the same\n * keychain ACL and kiro-cli reads it back without an authorization prompt.\n *\n * The secret never crosses `argv`: `security(1)` is driven through its `-i`\n * stdin mode, and the value is passed as hex (`-X`) because `-i` unquoting\n * mangles backslashes, which JSON escapes contain.\n */\n\nimport { execFile } from 'node:child_process';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { openForeignDatabase } from '../core/db';\n\n/** Login kinds kiro-cli stores, each under its own keychain service name. */\nexport const KIRO_SECRET_KEYS = [\n  'kirocli:social:token',\n  'kirocli:odic:token',\n  'kirocli:odic:device-registration',\n  'kirocli:external-idp:token',\n] as const;\n\n/** Keyed by the names in `KIRO_SECRET_KEYS`; absent keys are simply not stored. */\nexport type KiroSecrets = Record<string, string>;\n\nconst SECURITY_BIN = '/usr/bin/security';\nconst SECURITY_TIMEOUT_MS = 5_000;\n\n/** Set by the test suite so no test can touch the developer's real keychain. */\nfunction keychainEnabled(): boolean {\n  return process.platform === 'darwin' && process.env.ANYPICK_KIRO_NO_KEYCHAIN !== '1';\n}\n\n/** kiro-cli's data directory, following the same platform rules it does. */\nexport function kiroSecretDbPath(home = homedir()): string {\n  const override = process.env.ANYPICK_KIRO_SECRET_DB;\n  if (override) {\n    return override;\n  }\n  if (process.platform === 'darwin') {\n    return join(home, 'Library', 'Application Support', 'kiro-cli', 'data.sqlite3');\n  }\n  if (process.platform === 'win32') {\n    const base = process.env.LOCALAPPDATA ?? join(home, 'AppData', 'Local');\n    return join(base, 'kiro-cli', 'data.sqlite3');\n  }\n  const xdg = process.env.XDG_DATA_HOME ?? join(home, '.local', 'share');\n  return join(xdg, 'kiro-cli', 'data.sqlite3');\n}\n\n/** Every secret kiro-cli currently holds. Empty when it is not logged in. */\nexport async function readKiroSecrets(home = homedir()): Promise<KiroSecrets> {\n  const secrets: KiroSecrets = {};\n\n  if (keychainEnabled()) {\n    for (const key of KIRO_SECRET_KEYS) {\n      const value = await keychainRead(key);\n      if (value) {\n        secrets[key] = value;\n      }\n    }\n  }\n\n  // Not an else: the keychain can hold a subset, and kiro-cli falls back to the\n  // database per key rather than per store.\n  const rows = readAuthKv(kiroSecretDbPath(home));\n  for (const key of KIRO_SECRET_KEYS) {\n    const value = rows.get(key);\n    if (value && !secrets[key]) {\n      secrets[key] = value;\n    }\n  }\n\n  return secrets;\n}\n\n/** Replace the stored login. Writes both tiers; the keychain is best-effort. */\nexport async function writeKiroSecrets(secrets: KiroSecrets, home = homedir()): Promise<void> {\n  writeAuthKv(kiroSecretDbPath(home), secrets);\n\n  if (!keychainEnabled()) {\n    return;\n  }\n  for (const key of KIRO_SECRET_KEYS) {\n    const value = secrets[key];\n    if (value) {\n      await keychainWrite(key, value);\n    } else {\n      await keychainDelete(key);\n    }\n  }\n}\n\n/** Forget the local login. Does not call Kiro/AWS logout. */\nexport async function clearKiroSecrets(home = homedir()): Promise<void> {\n  writeAuthKv(kiroSecretDbPath(home), {});\n  if (!keychainEnabled()) {\n    return;\n  }\n  for (const key of KIRO_SECRET_KEYS) {\n    await keychainDelete(key);\n  }\n}\n\n/**\n * A human label for the stored login.\n *\n * The token carries no email — the only per-account signal is the profile id at\n * the tail of `profile_arn`, so it is paired with the identity provider to give\n * something a person can tell two Google logins apart by.\n */\nexport function kiroSecretIdentity(secrets: KiroSecrets): string | undefined {\n  for (const key of KIRO_SECRET_KEYS) {\n    const raw = secrets[key];\n    if (!raw) {\n      continue;\n    }\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(raw);\n    } catch {\n      continue;\n    }\n    if (!parsed || typeof parsed !== 'object') {\n      continue;\n    }\n    const record = parsed as Record<string, unknown>;\n    const arn = record.profile_arn ?? record.profileArn;\n    if (typeof arn !== 'string') {\n      continue;\n    }\n    const profile = arn.split('/').pop();\n    if (!profile) {\n      continue;\n    }\n    const provider = record.provider;\n    return typeof provider === 'string' && provider ? `${provider}:${profile}` : profile;\n  }\n  return undefined;\n}\n\nfunction readAuthKv(dbPath: string): Map<string, string> {\n  const rows = new Map<string, string>();\n  let db;\n  try {\n    db = openForeignDatabase(dbPath, true);\n  } catch {\n    // No kiro-cli database at all, or an older schema: nothing stored.\n    return rows;\n  }\n  try {\n    for (const row of db.prepare('SELECT key, value FROM auth_kv').all() as {\n      key?: unknown;\n      value?: unknown;\n    }[]) {\n      if (typeof row.key === 'string' && typeof row.value === 'string') {\n        rows.set(row.key, row.value);\n      }\n    }\n  } catch {\n    // Table absent on an older kiro-cli schema.\n  } finally {\n    db.close();\n  }\n  return rows;\n}\n\nfunction writeAuthKv(dbPath: string, secrets: KiroSecrets): void {\n  let db;\n  try {\n    db = openForeignDatabase(dbPath);\n  } catch {\n    // kiro-cli has never run here; it will create the database on next login.\n    return;\n  }\n  try {\n    db.exec('CREATE TABLE IF NOT EXISTS auth_kv (key TEXT PRIMARY KEY, value TEXT)');\n    db.transaction(() => {\n      const upsert = db.prepare('INSERT OR REPLACE INTO auth_kv (key, value) VALUES (?, ?)');\n      const remove = db.prepare('DELETE FROM auth_kv WHERE key = ?');\n      for (const key of KIRO_SECRET_KEYS) {\n        const value = secrets[key];\n        if (value) {\n          upsert.run(key, value);\n        } else {\n          remove.run(key);\n        }\n      }\n    });\n  } finally {\n    db.close();\n  }\n}\n\nfunction keychainRead(service: string): Promise<string | undefined> {\n  return new Promise((resolve) => {\n    execFile(\n      SECURITY_BIN,\n      ['find-generic-password', '-s', service, '-w'],\n      { timeout: SECURITY_TIMEOUT_MS },\n      // A missing item and an unreadable keychain are both \"nothing here\"; the\n      // database mirror is the fallback either way.\n      (err, stdout) => resolve(err ? undefined : stdout.trim() || undefined),\n    );\n  });\n}\n\nfunction keychainWrite(service: string, value: string): Promise<void> {\n  const hex = Buffer.from(value, 'utf8').toString('hex');\n  // -a \"\" matches the NULL account kiro-cli's own items carry, so an update\n  // replaces its item instead of creating a second one beside it.\n  return securityStdin(`add-generic-password -U -s \"${service}\" -a \"\" -X ${hex}\\n`);\n}\n\nfunction keychainDelete(service: string): Promise<void> {\n  return securityStdin(`delete-generic-password -s \"${service}\"\\n`);\n}\n\n/**\n * Drive `security(1)` through its batch mode so the secret is never an argument.\n * Failures are swallowed: the database mirror is already written, and a locked\n * or absent keychain must not fail an otherwise complete switch.\n */\nfunction securityStdin(command: string): Promise<void> {\n  return new Promise((resolve) => {\n    const child = execFile(SECURITY_BIN, ['-i'], { timeout: SECURITY_TIMEOUT_MS }, () => resolve());\n    child.stdin?.end(command);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyBA,IAAa,mBAAmB;CAC9B;CACA;CACA;CACA;AACF;AAKA,IAAM,eAAe;AACrB,IAAM,sBAAsB;;AAG5B,SAAS,kBAA2B;CAClC,OAAO,QAAQ,aAAa,YAAY,QAAQ,IAAI,6BAA6B;AACnF;;AAGA,SAAgB,iBAAiB,OAAO,QAAQ,GAAW;CACzD,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI,UACF,OAAO;CAET,IAAI,QAAQ,aAAa,UACvB,OAAO,KAAK,MAAM,WAAW,uBAAuB,YAAY,cAAc;CAEhF,IAAI,QAAQ,aAAa,SAEvB,OAAO,KADM,QAAQ,IAAI,gBAAgB,KAAK,MAAM,WAAW,OAAO,GACpD,YAAY,cAAc;CAG9C,OAAO,KADK,QAAQ,IAAI,iBAAiB,KAAK,MAAM,UAAU,OAAO,GACpD,YAAY,cAAc;AAC7C;;AAGA,eAAsB,gBAAgB,OAAO,QAAQ,GAAyB;CAC5E,MAAM,UAAuB,CAAC;CAE9B,IAAI,gBAAgB,GAClB,KAAK,MAAM,OAAO,kBAAkB;EAClC,MAAM,QAAQ,MAAM,aAAa,GAAG;EACpC,IAAI,OACF,QAAQ,OAAO;CAEnB;CAKF,MAAM,OAAO,WAAW,iBAAiB,IAAI,CAAC;CAC9C,KAAK,MAAM,OAAO,kBAAkB;EAClC,MAAM,QAAQ,KAAK,IAAI,GAAG;EAC1B,IAAI,SAAS,CAAC,QAAQ,MACpB,QAAQ,OAAO;CAEnB;CAEA,OAAO;AACT;;AAGA,eAAsB,iBAAiB,SAAsB,OAAO,QAAQ,GAAkB;CAC5F,YAAY,iBAAiB,IAAI,GAAG,OAAO;CAE3C,IAAI,CAAC,gBAAgB,GACnB;CAEF,KAAK,MAAM,OAAO,kBAAkB;EAClC,MAAM,QAAQ,QAAQ;EACtB,IAAI,OACF,MAAM,cAAc,KAAK,KAAK;OAE9B,MAAM,eAAe,GAAG;CAE5B;AACF;;AAGA,eAAsB,iBAAiB,OAAO,QAAQ,GAAkB;CACtE,YAAY,iBAAiB,IAAI,GAAG,CAAC,CAAC;CACtC,IAAI,CAAC,gBAAgB,GACnB;CAEF,KAAK,MAAM,OAAO,kBAChB,MAAM,eAAe,GAAG;AAE5B;;;;;;;;AASA,SAAgB,mBAAmB,SAA0C;CAC3E,KAAK,MAAM,OAAO,kBAAkB;EAClC,MAAM,MAAM,QAAQ;EACpB,IAAI,CAAC,KACH;EAEF,IAAI;EACJ,IAAI;GACF,SAAS,KAAK,MAAM,GAAG;EACzB,QAAQ;GACN;EACF;EACA,IAAI,CAAC,UAAU,OAAO,WAAW,UAC/B;EAEF,MAAM,SAAS;EACf,MAAM,MAAM,OAAO,eAAe,OAAO;EACzC,IAAI,OAAO,QAAQ,UACjB;EAEF,MAAM,UAAU,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI;EACnC,IAAI,CAAC,SACH;EAEF,MAAM,WAAW,OAAO;EACxB,OAAO,OAAO,aAAa,YAAY,WAAW,GAAG,SAAS,GAAG,YAAY;CAC/E;AAEF;AAEA,SAAS,WAAW,QAAqC;CACvD,MAAM,uBAAO,IAAI,IAAoB;CACrC,IAAI;CACJ,IAAI;EACF,KAAK,oBAAoB,QAAQ,IAAI;CACvC,QAAQ;EAEN,OAAO;CACT;CACA,IAAI;EACF,KAAK,MAAM,OAAO,GAAG,QAAQ,gCAAgC,CAAC,CAAC,IAAI,GAIjE,IAAI,OAAO,IAAI,QAAQ,YAAY,OAAO,IAAI,UAAU,UACtD,KAAK,IAAI,IAAI,KAAK,IAAI,KAAK;CAGjC,QAAQ,CAER,UAAU;EACR,GAAG,MAAM;CACX;CACA,OAAO;AACT;AAEA,SAAS,YAAY,QAAgB,SAA4B;CAC/D,IAAI;CACJ,IAAI;EACF,KAAK,oBAAoB,MAAM;CACjC,QAAQ;EAEN;CACF;CACA,IAAI;EACF,GAAG,KAAK,uEAAuE;EAC/E,GAAG,kBAAkB;GACnB,MAAM,SAAS,GAAG,QAAQ,2DAA2D;GACrF,MAAM,SAAS,GAAG,QAAQ,mCAAmC;GAC7D,KAAK,MAAM,OAAO,kBAAkB;IAClC,MAAM,QAAQ,QAAQ;IACtB,IAAI,OACF,OAAO,IAAI,KAAK,KAAK;SAErB,OAAO,IAAI,GAAG;GAElB;EACF,CAAC;CACH,UAAU;EACR,GAAG,MAAM;CACX;AACF;AAEA,SAAS,aAAa,SAA8C;CAClE,OAAO,IAAI,SAAS,YAAY;EAC9B,SACE,cACA;GAAC;GAAyB;GAAM;GAAS;EAAI,GAC7C,EAAE,SAAS,oBAAoB,IAG9B,KAAK,WAAW,QAAQ,MAAM,KAAA,IAAY,OAAO,KAAK,KAAK,KAAA,CAAS,CACvE;CACF,CAAC;AACH;AAEA,SAAS,cAAc,SAAiB,OAA8B;CAIpE,OAAO,cAAc,+BAA+B,QAAQ,aAHhD,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,SAAS,KAGyB,EAAI,GAAG;AAClF;AAEA,SAAS,eAAe,SAAgC;CACtD,OAAO,cAAc,+BAA+B,QAAQ,IAAI;AAClE;;;;;;AAOA,SAAS,cAAc,SAAgC;CACrD,OAAO,IAAI,SAAS,YAAY;EAE9B,SADuB,cAAc,CAAC,IAAI,GAAG,EAAE,SAAS,oBAAoB,SAAS,QAAQ,CAC7F,CAAA,CAAM,OAAO,IAAI,OAAO;CAC1B,CAAC;AACH"}

package/dist/providers/kiro.d.ts

@@ -1,50 +0,0 @@
-import type { Account, AccountMeta, CredentialInput, CredentialInputField, LiveAuthStatus, Provider, ProxyContext, ProxyHandle, ProxyStatus, SnapshotMeta, SourceAdapter } from '../types.js';
-export declare class KiroProvider implements Provider {
-    private readonly home;
-    readonly id = "kiro";
-    readonly name = "AWS Kiro";
-    readonly shortName = "Kiro";
-    readonly description = "Manages the kiro-cli secret store and ~/.aws/sso/cache (+ optional kirolink proxy)";
-    readonly defaultProxyPort = 4119;
-    readonly proxyCompatibility = "Anthropic + OpenAI API";
-    roleDefaults(): Record<string, string>;
-    roleFriendlyModels(): readonly string[];
-    constructor(home?: string);
-    sourceAdapter(account: Account): SourceAdapter;
-    poolSourceAdapter(): SourceAdapter;
-    private get cacheDir();
-    private livePath;
-    /** Cache entries that carry a credential, freshest first. */
-    private liveTokenFiles;
-    /** Token files a snapshot carries, by their original cache-dir names. */
-    private snapshotTokenFiles;
-    detectLive(): Promise<LiveAuthStatus>;
-    snapshotMatchesLive(snapshotDir: string): Promise<boolean>;
-    readonly credentialInputs: readonly ['api-key'];
-    credentialInputFields(kind: string): readonly CredentialInputField[];
-    /**
-     * Save a Kiro API key (`ksk_…`) as an account. There is no live login to read
-     * and nothing to restore later: the key only ever reaches the Kiro runtime
-     * through `kirolink`, which this account's proxy starts in `api-key` mode.
-     */
-    backupInput(input: CredentialInput, destDir: string): Promise<SnapshotMeta>;
-    backup(destDir: string): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>>;
-    restore(srcDir: string): Promise<void>;
-    describeSnapshot(srcDir: string): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>>;
-    /**
-     * Remove the local Kiro login only — does NOT call AWS/Kiro logout.
-     */
-    clearLive(): Promise<void>;
-    startProxy(ctx: ProxyContext): Promise<ProxyHandle>;
-    stopProxy(ctx: ProxyContext): Promise<void>;
-    proxyStatus(ctx: ProxyContext): Promise<ProxyStatus>;
-    readProxyLogs(ctx: ProxyContext, lines?: number): Promise<string>;
-    /**
-     * Pin the proxy to a cache file only when the secret store is empty. A pin is
-     * an override that stops kirolink searching, so pinning while kiro-cli holds
-     * the real login would force the proxy onto a stale file.
-     */
-    private resolveTokenPath;
-}
-export declare const kiroProvider: KiroProvider;
-//# sourceMappingURL=kiro.d.ts.map

package/dist/providers/kiro.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kiro.d.ts","sourceRoot":"","sources":["../../src/providers/kiro.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,OAAO,EACP,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,WAAW,EACX,YAAY,EACZ,aAAa,EACd,MAAM,UAAU,CAAC;AAqFlB,qBAAa,YAAa,YAAW,QAAQ;IAwB/B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAvBjC,QAAQ,CAAC,EAAE,UAAU;IACrB,QAAQ,CAAC,IAAI,cAAc;IAC3B,QAAQ,CAAC,SAAS,UAAU;IAC5B,QAAQ,CAAC,WAAW,wFACmE;IACvF,QAAQ,CAAC,gBAAgB,QAAgB;IACzC,QAAQ,CAAC,kBAAkB,4BAA4B;IAEvD,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAErC;IAED,kBAAkB,IAAI,SAAS,MAAM,EAAE,CAStC;IAED,YAA6B,IAAI,SAAY,EAAI;IAEjD,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAE7C;IAED,iBAAiB,IAAI,aAAa,CAGjC;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,CAAC,QAAQ;IAIhB,6DAA6D;YAC/C,cAAc;IA8B5B,yEAAyE;YAC3D,kBAAkB;IAW1B,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC,CAiB1C;IAEK,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwB/D;IAED,QAAQ,CAAC,gBAAgB,YAAI,SAAS,EAAW;IAEjD,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,oBAAoB,EAAE,CAKnE;IAED;;;;OAIG;IACG,WAAW,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAsChF;IAEK,MAAM,CACV,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CA4BrE;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B3C;IAEK,gBAAgB,CACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAYrE;IAED;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAK/B;IAIK,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAoDxD;IAEK,SAAS,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhD;IAEK,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAWzD;IAEK,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEtE;IAED;;;;OAIG;YACW,gBAAgB;CAO/B;AA0FD,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/dist/providers/kiro.js

@@ -1,373 +0,0 @@
-import { AnyPickError } from "../utils/errors.js";
-import { copyFileSafe, ensureDir, pathExists, readJsonFile, removePath, restoreRequiredFile, writeJsonFile } from "../utils/fs.js";
-import { KIRO_PROXY_BINARIES, resolveKiroProxyCommand } from "../sources/kiro-proxy-bin.js";
-import { kiroAccountAdapter, poolAdapterFor } from "../sources/account-adapters.js";
-import { rolesFromLiveDiscovery } from "./model-policy.js";
-import { snapshotMatchesLiveByFiles } from "./auth-fingerprint.js";
-import { clearKiroSecrets, kiroSecretIdentity, readKiroSecrets, writeKiroSecrets } from "./kiro-secret-store.js";
-import { readExternalProxyLogs, startExternalProxy, statusExternalProxy, stopExternalProxy } from "./proxy-process.js";
-import { join } from "node:path";
-import { homedir } from "node:os";
-import { createHash } from "node:crypto";
-//#region src/providers/kiro.ts
-/**
-* AWS Kiro (CLI + IDE social/Builder ID session tokens)
-*
-* A Kiro login has two possible homes and a machine can hold both:
-*   - kiro-cli 2.x keeps it in a secret store (see `kiro-secret-store.ts`)
-*   - the Kiro IDE and older kiro-cli write ~/.aws/sso/cache/*.json
-*
-* The IDE's filenames are SHA-1 hashes of the SSO session, not the two names
-* kiro-cli used, so files are recognised by *shape* rather than by name — that
-* also skips the client-registration files sitting in the same directory, which
-* carry a clientId but no token.
-*
-* Compatibility proxy: `kirolink` (Anthropic + OpenAI → Kiro API).
-*/
-/** Snapshot member holding the secret store; never a token file itself. */
-var SECRETS_FILE = "kiro-secret-store.json";
-/**
-* Snapshot member holding a user-supplied Kiro API key. Its presence is what
-* makes the account `proxy-only`: nothing on this machine reads it, only the
-* proxy this account starts.
-*/
-var API_KEY_FILE = "kiro-api-key.json";
-/** Mirrors kirolink's own floor for `KIROLINK_KIRO_API_KEY`. */
-var MIN_API_KEY_BYTES = 16;
-/**
-* Kiro runtime regions kirolink knows about, mirroring its own setup wizard.
-* The region selects the data-plane host (`runtime.<region>.kiro.dev`), so a
-* wrong one starts fine and then fails every request — offer the list rather
-* than a text box.
-*/
-var API_REGIONS = [
-	"us-east-1",
-	"eu-central-1",
-	"ap-southeast-1",
-	"ap-northeast-1"
-];
-var DEFAULT_PORT = 4119;
-/**
-* True for an SSO cache entry that carries a credential.
-*
-* Deliberately just "has an access token": that is already enough to exclude
-* the client-registration files sharing the directory, which hold a clientId
-* and an expiry but never a token. Demanding more — a profileArn, a parseable
-* expiry — would risk rejecting a real Kiro IDE token whose shape differs, and
-* failing to see a login is the bug this scan exists to fix.
-*/
-function looksLikeToken(data) {
-	const accessToken = data.accessToken ?? data.access_token;
-	return typeof accessToken === "string" && accessToken.length > 0;
-}
-var KiroProvider = class {
-	home;
-	id = "kiro";
-	name = "AWS Kiro";
-	shortName = "Kiro";
-	description = "Manages the kiro-cli secret store and ~/.aws/sso/cache (+ optional kirolink proxy)";
-	defaultProxyPort = DEFAULT_PORT;
-	proxyCompatibility = "Anthropic + OpenAI API";
-	roleDefaults() {
-		return rolesFromLiveDiscovery();
-	}
-	roleFriendlyModels() {
-		return [
-			"claude-sonnet-5",
-			"claude-opus-5",
-			"claude-haiku-4-5",
-			"claude-sonnet",
-			"claude-opus",
-			"claude-haiku"
-		];
-	}
-	constructor(home = homedir()) {
-		this.home = home;
-	}
-	sourceAdapter(account) {
-		return kiroAccountAdapter(account);
-	}
-	poolSourceAdapter() {
-		return poolAdapterFor(this.id, this, { proxyTransport: "managed_external_proxy" });
-	}
-	get cacheDir() {
-		return process.env.KIRO_SSO_CACHE_DIR ?? join(this.home, ".aws", "sso", "cache");
-	}
-	livePath(file) {
-		return join(this.cacheDir, file);
-	}
-	/** Cache entries that carry a credential, freshest first. */
-	async liveTokenFiles() {
-		const { readdir } = await import("node:fs/promises");
-		let entries;
-		try {
-			entries = await readdir(this.cacheDir);
-		} catch {
-			return [];
-		}
-		const found = [];
-		for (const name of entries) {
-			if (!name.endsWith(".json")) continue;
-			const path = this.livePath(name);
-			try {
-				const data = await readJsonFile(path);
-				if (!looksLikeToken(data)) continue;
-				const raw = data.expiresAt ?? data.expires_at;
-				const at = typeof raw === "string" ? new Date(raw).getTime() : NaN;
-				found.push({
-					name,
-					path,
-					expiresAt: Number.isFinite(at) ? at : 0
-				});
-			} catch {}
-		}
-		return found.sort((a, b) => b.expiresAt - a.expiresAt);
-	}
-	/** Token files a snapshot carries, by their original cache-dir names. */
-	async snapshotTokenFiles(srcDir) {
-		const { readdir } = await import("node:fs/promises");
-		try {
-			return (await readdir(srcDir)).filter((name) => name !== SECRETS_FILE && name !== API_KEY_FILE);
-		} catch {
-			return [];
-		}
-	}
-	async detectLive() {
-		const [secrets, files] = await Promise.all([readKiroSecrets(this.home), this.liveTokenFiles()]);
-		const where = [];
-		if (Object.keys(secrets).length > 0) where.push("kiro-cli secret store");
-		where.push(...files.map((file) => file.name));
-		if (where.length === 0) return { present: false };
-		return {
-			present: true,
-			identity: kiroSecretIdentity(secrets) ?? await identityFrom(files.map((file) => file.path)),
-			details: where.join(", ")
-		};
-	}
-	async snapshotMatchesLive(snapshotDir) {
-		if (await readApiKeyFile(join(snapshotDir, API_KEY_FILE))) return false;
-		const snapshotSecrets = await readSecretsFile(join(snapshotDir, SECRETS_FILE));
-		if (snapshotSecrets) return sameSecrets(snapshotSecrets, await readKiroSecrets(this.home));
-		return snapshotMatchesLiveByFiles((await this.snapshotTokenFiles(snapshotDir)).map((name) => ({
-			name,
-			livePath: this.livePath(name),
-			snapshotPath: join(snapshotDir, name)
-		})));
-	}
-	credentialInputs = ["api-key"];
-	credentialInputFields(kind) {
-		if (kind !== "api-key") return [];
-		return [{
-			name: "region",
-			label: "API region",
-			choices: API_REGIONS,
-			default: API_REGIONS[0]
-		}];
-	}
-	/**
-	* Save a Kiro API key (`ksk_…`) as an account. There is no live login to read
-	* and nothing to restore later: the key only ever reaches the Kiro runtime
-	* through `kirolink`, which this account's proxy starts in `api-key` mode.
-	*/
-	async backupInput(input, destDir) {
-		if (input.kind !== "api-key") throw new AnyPickError(`AWS Kiro does not accept a ${input.kind} credential.`, "UNSUPPORTED_CREDENTIAL_INPUT");
-		const kiroApiKey = input.secret.trim();
-		if (!kiroApiKey) throw new AnyPickError("The Kiro API key is empty.", "INVALID_CREDENTIAL");
-		if (Buffer.byteLength(kiroApiKey) < MIN_API_KEY_BYTES) throw new AnyPickError(`That Kiro API key is too short to be valid (needs at least ${MIN_API_KEY_BYTES} characters).`, {
-			code: "INVALID_CREDENTIAL",
-			suggestions: ["Copy the whole key, including its ksk_ prefix."]
-		});
-		const apiRegion = input.options?.region?.trim() || void 0;
-		if (apiRegion && !/^[a-z0-9-]+$/u.test(apiRegion)) throw new AnyPickError(`"${apiRegion}" is not a valid Kiro API region.`, {
-			code: "INVALID_CREDENTIAL",
-			suggestions: [`Known regions: ${API_REGIONS.join(", ")}.`]
-		});
-		await ensureDir(destDir);
-		const snapshot = {
-			kiroApiKey,
-			apiRegion
-		};
-		await writeJsonFile(join(destDir, API_KEY_FILE), snapshot);
-		return {
-			identity: apiKeyIdentity(kiroApiKey),
-			credentialKind: "proxy-only"
-		};
-	}
-	async backup(destDir) {
-		await ensureDir(destDir);
-		const [secrets, files] = await Promise.all([readKiroSecrets(this.home), this.liveTokenFiles()]);
-		let saved = 0;
-		if (Object.keys(secrets).length > 0) {
-			await writeJsonFile(join(destDir, SECRETS_FILE), secrets);
-			saved += 1;
-		}
-		const copied = [];
-		for (const file of files) if (await copyFileSafe(file.path, join(destDir, file.name))) {
-			saved += 1;
-			copied.push(join(destDir, file.name));
-		}
-		const identity = kiroSecretIdentity(secrets) ?? await identityFrom(copied);
-		if (saved === 0) throw new AnyPickError(`No Kiro login found in the kiro-cli secret store or ${this.cacheDir}. Run kiro-cli login first.`, "NO_LIVE_AUTH");
-		return { identity };
-	}
-	async restore(srcDir) {
-		if (await readApiKeyFile(join(srcDir, API_KEY_FILE))) return;
-		const secrets = await readSecretsFile(join(srcDir, SECRETS_FILE));
-		const names = await this.snapshotTokenFiles(srcDir);
-		if (!secrets && names.length === 0) throw new AnyPickError(`Kiro snapshot has no credentials in ${srcDir}`, "EMPTY_SNAPSHOT");
-		for (const file of await this.liveTokenFiles()) if (!names.includes(file.name)) await removePath(file.path);
-		await ensureDir(this.cacheDir);
-		for (const name of names) await restoreRequiredFile(join(srcDir, name), this.livePath(name), name);
-		await writeKiroSecrets(secrets ?? {}, this.home);
-	}
-	async describeSnapshot(srcDir) {
-		const apiKey = await readApiKeyFile(join(srcDir, API_KEY_FILE));
-		if (apiKey) return { identity: apiKeyIdentity(apiKey.kiroApiKey) };
-		const secrets = await readSecretsFile(join(srcDir, SECRETS_FILE));
-		const names = await this.snapshotTokenFiles(srcDir);
-		const identity = (secrets ? kiroSecretIdentity(secrets) : void 0) ?? await identityFrom(names.map((name) => join(srcDir, name)));
-		return identity ? { identity } : {};
-	}
-	/**
-	* Remove the local Kiro login only — does NOT call AWS/Kiro logout.
-	*/
-	async clearLive() {
-		for (const file of await this.liveTokenFiles()) await removePath(file.path);
-		await clearKiroSecrets(this.home);
-	}
-	async startProxy(ctx) {
-		const apiKey = await readApiKeyFile(join(ctx.snapshotDir, API_KEY_FILE));
-		const authMode = apiKey ? {
-			KIROLINK_AUTH: "api-key",
-			KIROLINK_KIRO_API_KEY: apiKey.kiroApiKey,
-			...apiKey.apiRegion ? { KIROLINK_API_REGION: apiKey.apiRegion } : {}
-		} : { KIROLINK_AUTH: "cli" };
-		const tokenPath = apiKey ? void 0 : await this.resolveTokenPath();
-		const env = () => ({
-			...process.env,
-			...authMode,
-			...tokenPath ? { KIRO_PROXY_TOKEN_PATH: tokenPath } : {}
-		});
-		const command = resolveKiroProxyCommand();
-		if (command?.kind === "node-entry") return startExternalProxy(ctx, {
-			label: "Kiro",
-			binaries: ["node"],
-			defaultPort: DEFAULT_PORT,
-			compatibility: this.proxyCompatibility,
-			buildArgs: (_c, port, host) => [
-				command.entry,
-				"-p",
-				String(port),
-				"--host",
-				host
-			],
-			env
-		});
-		return startExternalProxy(ctx, {
-			label: "Kiro",
-			binaries: command ? [command.path] : [...KIRO_PROXY_BINARIES],
-			defaultPort: DEFAULT_PORT,
-			compatibility: this.proxyCompatibility,
-			buildArgs: (_c, port, host) => [
-				"-p",
-				String(port),
-				"--host",
-				host
-			],
-			env
-		});
-	}
-	async stopProxy(ctx) {
-		await stopExternalProxy(ctx);
-	}
-	async proxyStatus(ctx) {
-		const status = await statusExternalProxy(ctx, { compatibility: this.proxyCompatibility });
-		if (status.running && !status.endpoint) status.endpoint = `http://${ctx.config.host ?? "127.0.0.1"}:${ctx.config.port ?? DEFAULT_PORT}`;
-		return status;
-	}
-	async readProxyLogs(ctx, lines) {
-		return readExternalProxyLogs(ctx, lines);
-	}
-	/**
-	* Pin the proxy to a cache file only when the secret store is empty. A pin is
-	* an override that stops kirolink searching, so pinning while kiro-cli holds
-	* the real login would force the proxy onto a stale file.
-	*/
-	async resolveTokenPath() {
-		if (Object.keys(await readKiroSecrets(this.home)).length > 0) return;
-		const [freshest] = await this.liveTokenFiles();
-		return freshest?.path;
-	}
-};
-async function readApiKeyFile(path) {
-	if (!await pathExists(path)) return null;
-	try {
-		const data = await readJsonFile(path);
-		if (typeof data.kiroApiKey !== "string" || !data.kiroApiKey) return null;
-		return {
-			kiroApiKey: data.kiroApiKey,
-			apiRegion: typeof data.apiRegion === "string" ? data.apiRegion : void 0
-		};
-	} catch {
-		return null;
-	}
-}
-/**
-* A stable name for an API key that does not disclose it. A key carries no
-* email, and the raw value must not become an account identity — identities are
-* printed, exported, and stored in meta.
-*/
-function apiKeyIdentity(kiroApiKey) {
-	return `api-key:${createHash("sha256").update(kiroApiKey).digest("hex").slice(0, 12)}`;
-}
-async function readSecretsFile(path) {
-	if (!await pathExists(path)) return null;
-	try {
-		const data = await readJsonFile(path);
-		const secrets = {};
-		for (const [key, value] of Object.entries(data)) if (typeof value === "string") secrets[key] = value;
-		return secrets;
-	} catch {
-		return null;
-	}
-}
-function sameSecrets(a, b) {
-	const keys = Object.keys(a);
-	return keys.length === Object.keys(b).length && keys.every((key) => a[key] === b[key]);
-}
-/**
-* A name for the account a token file belongs to, or undefined when the file
-* carries nothing identifying.
-*
-* The placeholder for "a token with no identity in it" is applied by
-* `identityFrom` rather than here: cache filenames are content hashes, so the
-* scan order is arbitrary, and returning the placeholder early would let it win
-* over a real identity sitting in the next file.
-*/
-async function tryIdentity(path) {
-	try {
-		const data = await readJsonFile(path);
-		for (const key of [
-			"email",
-			"username",
-			"startUrl",
-			"clientId",
-			"provider"
-		]) if (typeof data[key] === "string" && data[key]) return data[key];
-		const arn = data.profileArn ?? data.profile_arn;
-		if (typeof arn === "string") return arn.split("/").pop() ?? void 0;
-	} catch {}
-}
-/** The best identity across some token files, falling back to a placeholder. */
-async function identityFrom(paths) {
-	for (const path of paths) {
-		const identity = await tryIdentity(path);
-		if (identity) return identity;
-	}
-	return paths.length > 0 ? "session-token" : void 0;
-}
-var kiroProvider = new KiroProvider();
-//#endregion
-export { KiroProvider, kiroProvider };
-
-//# sourceMappingURL=kiro.js.map