anypick 1.0.0

package/dist/providers/auth-fingerprint.js

@@ -0,0 +1,163 @@
+import { pathExists, readJsonFile } from "../utils/fs.js";
+import { listAuthEntries } from "./opencode-auth.js";
+import { join } from "node:path";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { createHash } from "node:crypto";
+//#region src/providers/auth-fingerprint.ts
+/**
+* Stable fingerprints for "is this saved login currently live?"
+*
+* Email/display identity is not reliable:
+* - Codex: two saved logins can share an email; account_id is the truth.
+* - OpenCode: multi-provider API bags — identity strings drift; key material must match.
+*/
+/** Live auth.json path for a known provider (mirrors each Provider class). */
+function liveAuthPath(providerId, home = homedir()) {
+	switch (providerId) {
+		case "codex": return process.env.CODEX_AUTH_PATH ?? join(home, ".codex", "auth.json");
+		case "opencode":
+			if (process.env.OPENCODE_AUTH_PATH) return process.env.OPENCODE_AUTH_PATH;
+			if (process.env.OPENCODE_DATA_DIR) return join(process.env.OPENCODE_DATA_DIR, "auth.json");
+			return join(process.env.XDG_DATA_HOME ?? join(home, ".local", "share"), "opencode", "auth.json");
+		case "grok": return process.env.GROK_AUTH_PATH ?? join(home, ".grok", "auth.json");
+		default: return null;
+	}
+}
+async function fingerprintLiveAuth(providerId, home = homedir()) {
+	const path = liveAuthPath(providerId, home);
+	if (!path) return null;
+	return fingerprintAuthFile(providerId, path);
+}
+function sha8(s) {
+	return createHash("sha256").update(s).digest("hex").slice(0, 12);
+}
+/**
+* Codex ~/.codex/auth.json → fingerprint of the *current session material*.
+*
+* Prefer refresh_token (unique per login session) over account_id.
+* Matching only on account_id marks every saved copy of the same ChatGPT
+* account as ● live (e.g. "live" + "vicen" with the same email).
+*/
+function fingerprintCodexAuth(data) {
+	const tokens = data.tokens;
+	if (tokens && typeof tokens === "object") {
+		const t = tokens;
+		if (typeof t.refresh_token === "string" && t.refresh_token.trim()) {
+			const acct = typeof t.account_id === "string" && t.account_id.trim() ? t.account_id.trim() : "";
+			return acct ? `codex:rt:${sha8(t.refresh_token.trim())}:acct:${acct}` : `codex:rt:${sha8(t.refresh_token.trim())}`;
+		}
+		if (typeof t.access_token === "string" && t.access_token.trim()) return `codex:at:${sha8(t.access_token.trim())}`;
+		if (typeof t.account_id === "string" && t.account_id.trim()) return `codex:acct:${t.account_id.trim()}`;
+	}
+	if (typeof data.OPENAI_API_KEY === "string" && data.OPENAI_API_KEY.trim()) return `codex:key:${sha8(data.OPENAI_API_KEY.trim())}`;
+	if (typeof data.token === "string" && data.token.trim()) return `codex:tok:${sha8(data.token.trim())}`;
+	if (typeof data.email === "string" && data.email.trim()) return `codex:email:${data.email.trim().toLowerCase()}`;
+	return null;
+}
+/**
+* Grok rotates its access key and expiry during normal refreshes. The refresh
+* token identifies the durable login, so comparing the whole session JSON
+* would turn a healthy active account into false drift.
+*/
+function fingerprintGrokAuth(data) {
+	const parts = Object.values(data).filter((entry) => Boolean(entry) && typeof entry === "object").flatMap((session) => {
+		if (typeof session.refresh_token === "string" && session.refresh_token.trim()) return `rt:${sha8(session.refresh_token.trim())}`;
+		if (typeof session.key === "string" && session.key.trim()) return `key:${sha8(session.key.trim())}`;
+		return [];
+	}).toSorted();
+	return parts.length > 0 ? `grok:${parts.join("|")}` : null;
+}
+/** OpenCode auth.json → stable bag fingerprint (sorted provider:type:material). */
+function fingerprintOpenCodeAuth(data) {
+	const entries = listAuthEntries(data);
+	if (entries.length === 0) return null;
+	const parts = [];
+	for (const { provider, entry } of entries) if (entry.type === "api" && entry.key) parts.push(`${provider}:api:${sha8(entry.key)}`);
+	else if (entry.type === "oauth") if (entry.accountId) parts.push(`${provider}:oauth:acct:${entry.accountId}`);
+	else if (entry.refresh) parts.push(`${provider}:oauth:rt:${sha8(entry.refresh)}`);
+	else if (entry.access) parts.push(`${provider}:oauth:at:${sha8(entry.access)}`);
+	else parts.push(`${provider}:oauth`);
+	else if (entry.type === "wellknown" && entry.token) parts.push(`${provider}:wk:${sha8(entry.token)}`);
+	else parts.push(`${provider}:${entry.type}`);
+	parts.sort();
+	return `opencode:${parts.join("|")}`;
+}
+/**
+* Generic JSON auth fingerprint for unknown providers: hash of stable JSON.
+* Prefer provider-specific fingerprints when available.
+*/
+function fingerprintJsonAuth(data) {
+	if (data == null || typeof data !== "object") return null;
+	try {
+		return `json:${sha8(JSON.stringify(data))}`;
+	} catch {
+		return null;
+	}
+}
+function fingerprintAuthData(providerId, data) {
+	if (providerId === "codex") return fingerprintCodexAuth(data);
+	if (providerId === "opencode") return fingerprintOpenCodeAuth(data);
+	if (providerId === "grok") return fingerprintGrokAuth(data) ?? fingerprintJsonAuth(data);
+	if (typeof data.token === "string" && data.token.trim()) return `${providerId}:tok:${sha8(data.token.trim())}`;
+	if (typeof data.email === "string" && data.email.trim()) return `${providerId}:email:${data.email.trim().toLowerCase()}`;
+	return fingerprintJsonAuth(data);
+}
+async function fingerprintAuthFile(providerId, authPath) {
+	if (!await pathExists(authPath)) return null;
+	try {
+		return fingerprintAuthData(providerId, await readJsonFile(authPath));
+	} catch {
+		return null;
+	}
+}
+/** Snapshot dir → fingerprint (auth.json). */
+async function fingerprintSnapshot(providerId, snapshotDir) {
+	return fingerprintAuthFile(providerId, join(snapshotDir, "auth.json"));
+}
+/**
+* Default "is this snapshot the live login?" using stable material fingerprints.
+* Providers that need richer file layouts implement their own
+* `snapshotMatchesLive`; everyone else delegates here.
+*/
+async function snapshotMatchesLiveDefault(providerId, snapshotDir) {
+	if (providerId === "codex") {
+		const live = await fingerprintLiveAuth("codex");
+		if (!live) return false;
+		const snap = await fingerprintSnapshot("codex", snapshotDir);
+		return snap != null && snap === live;
+	}
+	const live = await fingerprintLiveAuth(providerId);
+	if (!live) return false;
+	const snap = await fingerprintSnapshot(providerId, snapshotDir);
+	return snap != null && snap === live;
+}
+/**
+* Compare a set of named auth files between a live location and a snapshot dir.
+* Used by providers (e.g. Kiro) whose live auth lives outside the standard
+* auth.json convention. Returns true only if every present live file has an
+* identical counterpart in the snapshot (and vice-versa for present files).
+*/
+async function snapshotMatchesLiveByFiles(liveFiles) {
+	let any = false;
+	for (const { livePath, snapshotPath } of liveFiles) {
+		const [live, snap] = await Promise.all([fileFingerprint(livePath), fileFingerprint(snapshotPath)]);
+		if (live == null && snap == null) continue;
+		if (live == null || snap == null || live !== snap) return false;
+		any = true;
+	}
+	return any;
+}
+async function fileFingerprint(p) {
+	if (!await pathExists(p)) return null;
+	try {
+		const buf = await readFile(p);
+		return createHash("sha256").update(buf).digest("hex").slice(0, 16);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { fingerprintAuthData, fingerprintAuthFile, fingerprintCodexAuth, fingerprintGrokAuth, fingerprintJsonAuth, fingerprintLiveAuth, fingerprintOpenCodeAuth, fingerprintSnapshot, liveAuthPath, snapshotMatchesLiveByFiles, snapshotMatchesLiveDefault };
+
+//# sourceMappingURL=auth-fingerprint.js.map

package/dist/providers/auth-fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fingerprint.js","names":[],"sources":["../../src/providers/auth-fingerprint.ts"],"sourcesContent":["/**\n * Stable fingerprints for \"is this saved login currently live?\"\n *\n * Email/display identity is not reliable:\n * - Codex: two saved logins can share an email; account_id is the truth.\n * - OpenCode: multi-provider API bags — identity strings drift; key material must match.\n */\n\nimport { createHash } from 'node:crypto';\nimport { readFile } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { pathExists, readJsonFile } from '../utils/fs';\nimport { listAuthEntries } from './opencode-auth';\n\n/** Live auth.json path for a known provider (mirrors each Provider class). */\nexport function liveAuthPath(providerId: string, home = homedir()): string | null {\n  switch (providerId) {\n    case 'codex':\n      return process.env.CODEX_AUTH_PATH ?? join(home, '.codex', 'auth.json');\n    case 'opencode': {\n      if (process.env.OPENCODE_AUTH_PATH) {\n        return process.env.OPENCODE_AUTH_PATH;\n      }\n      if (process.env.OPENCODE_DATA_DIR) {\n        return join(process.env.OPENCODE_DATA_DIR, 'auth.json');\n      }\n      const xdg = process.env.XDG_DATA_HOME ?? join(home, '.local', 'share');\n      return join(xdg, 'opencode', 'auth.json');\n    }\n    case 'grok':\n      return process.env.GROK_AUTH_PATH ?? join(home, '.grok', 'auth.json');\n    default:\n      return null;\n  }\n}\n\nexport async function fingerprintLiveAuth(\n  providerId: string,\n  home = homedir(),\n): Promise<string | null> {\n  const path = liveAuthPath(providerId, home);\n  if (!path) {\n    return null;\n  }\n  return fingerprintAuthFile(providerId, path);\n}\n\nfunction sha8(s: string): string {\n  return createHash('sha256').update(s).digest('hex').slice(0, 12);\n}\n\n/**\n * Codex ~/.codex/auth.json → fingerprint of the *current session material*.\n *\n * Prefer refresh_token (unique per login session) over account_id.\n * Matching only on account_id marks every saved copy of the same ChatGPT\n * account as ● live (e.g. \"live\" + \"vicen\" with the same email).\n */\nexport function fingerprintCodexAuth(data: Record<string, unknown>): string | null {\n  const tokens = data.tokens;\n  if (tokens && typeof tokens === 'object') {\n    const t = tokens as Record<string, unknown>;\n    // Session material first — exact live match\n    if (typeof t.refresh_token === 'string' && t.refresh_token.trim()) {\n      const acct =\n        typeof t.account_id === 'string' && t.account_id.trim() ? t.account_id.trim() : '';\n      return acct\n        ? `codex:rt:${sha8(t.refresh_token.trim())}:acct:${acct}`\n        : `codex:rt:${sha8(t.refresh_token.trim())}`;\n    }\n    if (typeof t.access_token === 'string' && t.access_token.trim()) {\n      return `codex:at:${sha8(t.access_token.trim())}`;\n    }\n    // Last resort: account only (cannot distinguish two snapshots of same user)\n    if (typeof t.account_id === 'string' && t.account_id.trim()) {\n      return `codex:acct:${t.account_id.trim()}`;\n    }\n  }\n  if (typeof data.OPENAI_API_KEY === 'string' && data.OPENAI_API_KEY.trim()) {\n    return `codex:key:${sha8(data.OPENAI_API_KEY.trim())}`;\n  }\n  // Test / FakeProvider shapes: { email, token }\n  if (typeof data.token === 'string' && data.token.trim()) {\n    return `codex:tok:${sha8(data.token.trim())}`;\n  }\n  if (typeof data.email === 'string' && data.email.trim()) {\n    return `codex:email:${data.email.trim().toLowerCase()}`;\n  }\n  return null;\n}\n\n/**\n * Grok rotates its access key and expiry during normal refreshes. The refresh\n * token identifies the durable login, so comparing the whole session JSON\n * would turn a healthy active account into false drift.\n */\nexport function fingerprintGrokAuth(data: Record<string, unknown>): string | null {\n  const parts = Object.values(data)\n    .filter(\n      (entry): entry is Record<string, unknown> => Boolean(entry) && typeof entry === 'object',\n    )\n    .flatMap((session) => {\n      if (typeof session.refresh_token === 'string' && session.refresh_token.trim()) {\n        return `rt:${sha8(session.refresh_token.trim())}`;\n      }\n      if (typeof session.key === 'string' && session.key.trim()) {\n        return `key:${sha8(session.key.trim())}`;\n      }\n      return [];\n    })\n    .toSorted();\n  return parts.length > 0 ? `grok:${parts.join('|')}` : null;\n}\n\n/** OpenCode auth.json → stable bag fingerprint (sorted provider:type:material). */\nexport function fingerprintOpenCodeAuth(data: Record<string, unknown>): string | null {\n  const entries = listAuthEntries(data);\n  if (entries.length === 0) {\n    return null;\n  }\n  const parts: string[] = [];\n  for (const { provider, entry } of entries) {\n    if (entry.type === 'api' && entry.key) {\n      parts.push(`${provider}:api:${sha8(entry.key)}`);\n    } else if (entry.type === 'oauth') {\n      if (entry.accountId) {\n        parts.push(`${provider}:oauth:acct:${entry.accountId}`);\n      } else if (entry.refresh) {\n        parts.push(`${provider}:oauth:rt:${sha8(entry.refresh)}`);\n      } else if (entry.access) {\n        parts.push(`${provider}:oauth:at:${sha8(entry.access)}`);\n      } else {\n        parts.push(`${provider}:oauth`);\n      }\n    } else if (entry.type === 'wellknown' && entry.token) {\n      parts.push(`${provider}:wk:${sha8(entry.token)}`);\n    } else {\n      parts.push(`${provider}:${entry.type}`);\n    }\n  }\n  parts.sort();\n  return `opencode:${parts.join('|')}`;\n}\n\n/**\n * Generic JSON auth fingerprint for unknown providers: hash of stable JSON.\n * Prefer provider-specific fingerprints when available.\n */\nexport function fingerprintJsonAuth(data: unknown): string | null {\n  if (data == null || typeof data !== 'object') {\n    return null;\n  }\n  try {\n    return `json:${sha8(JSON.stringify(data))}`;\n  } catch {\n    return null;\n  }\n}\n\nexport function fingerprintAuthData(\n  providerId: string,\n  data: Record<string, unknown>,\n): string | null {\n  if (providerId === 'codex') {\n    return fingerprintCodexAuth(data);\n  }\n  if (providerId === 'opencode') {\n    return fingerprintOpenCodeAuth(data);\n  }\n  if (providerId === 'grok') {\n    return fingerprintGrokAuth(data) ?? fingerprintJsonAuth(data);\n  }\n  // Grok / fakes / others: prefer known fields then full JSON\n  if (typeof data.token === 'string' && data.token.trim()) {\n    return `${providerId}:tok:${sha8(data.token.trim())}`;\n  }\n  if (typeof data.email === 'string' && data.email.trim()) {\n    return `${providerId}:email:${data.email.trim().toLowerCase()}`;\n  }\n  return fingerprintJsonAuth(data);\n}\n\nexport async function fingerprintAuthFile(\n  providerId: string,\n  authPath: string,\n): Promise<string | null> {\n  if (!(await pathExists(authPath))) {\n    return null;\n  }\n  try {\n    const data = await readJsonFile<Record<string, unknown>>(authPath);\n    return fingerprintAuthData(providerId, data);\n  } catch {\n    return null;\n  }\n}\n\n/** Snapshot dir → fingerprint (auth.json). */\nexport async function fingerprintSnapshot(\n  providerId: string,\n  snapshotDir: string,\n): Promise<string | null> {\n  return fingerprintAuthFile(providerId, join(snapshotDir, 'auth.json'));\n}\n\n/** Extract ChatGPT account_id from a codex auth.json object or snapshot. */\nexport function codexAccountIdFromAuth(data: Record<string, unknown>): string | null {\n  const tokens = data.tokens;\n  if (tokens && typeof tokens === 'object') {\n    const id = (tokens as Record<string, unknown>).account_id;\n    if (typeof id === 'string' && id.trim()) {\n      return id.trim();\n    }\n  }\n  return null;\n}\n\nexport async function codexAccountIdFromSnapshot(snapshotDir: string): Promise<string | null> {\n  const path = join(snapshotDir, 'auth.json');\n  if (!(await pathExists(path))) {\n    return null;\n  }\n  try {\n    const data = await readJsonFile<Record<string, unknown>>(path);\n    return codexAccountIdFromAuth(data);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Default \"is this snapshot the live login?\" using stable material fingerprints.\n * Providers that need richer file layouts implement their own\n * `snapshotMatchesLive`; everyone else delegates here.\n */\nexport async function snapshotMatchesLiveDefault(\n  providerId: string,\n  snapshotDir: string,\n): Promise<boolean> {\n  if (providerId === 'codex') {\n    const live = await fingerprintLiveAuth('codex');\n    if (!live) {\n      return false;\n    }\n    const snap = await fingerprintSnapshot('codex', snapshotDir);\n    return snap != null && snap === live;\n  }\n  const live = await fingerprintLiveAuth(providerId);\n  if (!live) {\n    return false;\n  }\n  const snap = await fingerprintSnapshot(providerId, snapshotDir);\n  return snap != null && snap === live;\n}\n\n/**\n * Compare a set of named auth files between a live location and a snapshot dir.\n * Used by providers (e.g. Kiro) whose live auth lives outside the standard\n * auth.json convention. Returns true only if every present live file has an\n * identical counterpart in the snapshot (and vice-versa for present files).\n */\nexport async function snapshotMatchesLiveByFiles(\n  liveFiles: { name: string; livePath: string; snapshotPath: string }[],\n): Promise<boolean> {\n  let any = false;\n  for (const { livePath, snapshotPath } of liveFiles) {\n    const [live, snap] = await Promise.all([\n      fileFingerprint(livePath),\n      fileFingerprint(snapshotPath),\n    ]);\n    if (live == null && snap == null) {\n      continue;\n    }\n    if (live == null || snap == null || live !== snap) {\n      return false;\n    }\n    any = true;\n  }\n  return any;\n}\n\nasync function fileFingerprint(p: string): Promise<string | null> {\n  if (!(await pathExists(p))) {\n    return null;\n  }\n  try {\n    const buf = await readFile(p);\n    return createHash('sha256').update(buf).digest('hex').slice(0, 16);\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,SAAgB,aAAa,YAAoB,OAAO,QAAQ,GAAkB;CAChF,QAAQ,YAAR;EACE,KAAK,SACH,OAAO,QAAQ,IAAI,mBAAmB,KAAK,MAAM,UAAU,WAAW;EACxE,KAAK;GACH,IAAI,QAAQ,IAAI,oBACd,OAAO,QAAQ,IAAI;GAErB,IAAI,QAAQ,IAAI,mBACd,OAAO,KAAK,QAAQ,IAAI,mBAAmB,WAAW;GAGxD,OAAO,KADK,QAAQ,IAAI,iBAAiB,KAAK,MAAM,UAAU,OAAO,GACpD,YAAY,WAAW;EAE1C,KAAK,QACH,OAAO,QAAQ,IAAI,kBAAkB,KAAK,MAAM,SAAS,WAAW;EACtE,SACE,OAAO;CACX;AACF;AAEA,eAAsB,oBACpB,YACA,OAAO,QAAQ,GACS;CACxB,MAAM,OAAO,aAAa,YAAY,IAAI;CAC1C,IAAI,CAAC,MACH,OAAO;CAET,OAAO,oBAAoB,YAAY,IAAI;AAC7C;AAEA,SAAS,KAAK,GAAmB;CAC/B,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;AACjE;;;;;;;;AASA,SAAgB,qBAAqB,MAA8C;CACjF,MAAM,SAAS,KAAK;CACpB,IAAI,UAAU,OAAO,WAAW,UAAU;EACxC,MAAM,IAAI;EAEV,IAAI,OAAO,EAAE,kBAAkB,YAAY,EAAE,cAAc,KAAK,GAAG;GACjE,MAAM,OACJ,OAAO,EAAE,eAAe,YAAY,EAAE,WAAW,KAAK,IAAI,EAAE,WAAW,KAAK,IAAI;GAClF,OAAO,OACH,YAAY,KAAK,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ,SACjD,YAAY,KAAK,EAAE,cAAc,KAAK,CAAC;EAC7C;EACA,IAAI,OAAO,EAAE,iBAAiB,YAAY,EAAE,aAAa,KAAK,GAC5D,OAAO,YAAY,KAAK,EAAE,aAAa,KAAK,CAAC;EAG/C,IAAI,OAAO,EAAE,eAAe,YAAY,EAAE,WAAW,KAAK,GACxD,OAAO,cAAc,EAAE,WAAW,KAAK;CAE3C;CACA,IAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,GACtE,OAAO,aAAa,KAAK,KAAK,eAAe,KAAK,CAAC;CAGrD,IAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,GACpD,OAAO,aAAa,KAAK,KAAK,MAAM,KAAK,CAAC;CAE5C,IAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,GACpD,OAAO,eAAe,KAAK,MAAM,KAAK,CAAC,CAAC,YAAY;CAEtD,OAAO;AACT;;;;;;AAOA,SAAgB,oBAAoB,MAA8C;CAChF,MAAM,QAAQ,OAAO,OAAO,IAAI,CAAC,CAC9B,QACE,UAA4C,QAAQ,KAAK,KAAK,OAAO,UAAU,QAClF,CAAC,CACA,SAAS,YAAY;EACpB,IAAI,OAAO,QAAQ,kBAAkB,YAAY,QAAQ,cAAc,KAAK,GAC1E,OAAO,MAAM,KAAK,QAAQ,cAAc,KAAK,CAAC;EAEhD,IAAI,OAAO,QAAQ,QAAQ,YAAY,QAAQ,IAAI,KAAK,GACtD,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC;EAEvC,OAAO,CAAC;CACV,CAAC,CAAC,CACD,SAAS;CACZ,OAAO,MAAM,SAAS,IAAI,QAAQ,MAAM,KAAK,GAAG,MAAM;AACxD;;AAGA,SAAgB,wBAAwB,MAA8C;CACpF,MAAM,UAAU,gBAAgB,IAAI;CACpC,IAAI,QAAQ,WAAW,GACrB,OAAO;CAET,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,EAAE,UAAU,WAAW,SAChC,IAAI,MAAM,SAAS,SAAS,MAAM,KAChC,MAAM,KAAK,GAAG,SAAS,OAAO,KAAK,MAAM,GAAG,GAAG;MAC1C,IAAI,MAAM,SAAS,SACxB,IAAI,MAAM,WACR,MAAM,KAAK,GAAG,SAAS,cAAc,MAAM,WAAW;MACjD,IAAI,MAAM,SACf,MAAM,KAAK,GAAG,SAAS,YAAY,KAAK,MAAM,OAAO,GAAG;MACnD,IAAI,MAAM,QACf,MAAM,KAAK,GAAG,SAAS,YAAY,KAAK,MAAM,MAAM,GAAG;MAEvD,MAAM,KAAK,GAAG,SAAS,OAAO;MAE3B,IAAI,MAAM,SAAS,eAAe,MAAM,OAC7C,MAAM,KAAK,GAAG,SAAS,MAAM,KAAK,MAAM,KAAK,GAAG;MAEhD,MAAM,KAAK,GAAG,SAAS,GAAG,MAAM,MAAM;CAG1C,MAAM,KAAK;CACX,OAAO,YAAY,MAAM,KAAK,GAAG;AACnC;;;;;AAMA,SAAgB,oBAAoB,MAA8B;CAChE,IAAI,QAAQ,QAAQ,OAAO,SAAS,UAClC,OAAO;CAET,IAAI;EACF,OAAO,QAAQ,KAAK,KAAK,UAAU,IAAI,CAAC;CAC1C,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAgB,oBACd,YACA,MACe;CACf,IAAI,eAAe,SACjB,OAAO,qBAAqB,IAAI;CAElC,IAAI,eAAe,YACjB,OAAO,wBAAwB,IAAI;CAErC,IAAI,eAAe,QACjB,OAAO,oBAAoB,IAAI,KAAK,oBAAoB,IAAI;CAG9D,IAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,GACpD,OAAO,GAAG,WAAW,OAAO,KAAK,KAAK,MAAM,KAAK,CAAC;CAEpD,IAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,GACpD,OAAO,GAAG,WAAW,SAAS,KAAK,MAAM,KAAK,CAAC,CAAC,YAAY;CAE9D,OAAO,oBAAoB,IAAI;AACjC;AAEA,eAAsB,oBACpB,YACA,UACwB;CACxB,IAAI,CAAE,MAAM,WAAW,QAAQ,GAC7B,OAAO;CAET,IAAI;EAEF,OAAO,oBAAoB,YAAY,MADpB,aAAsC,QAAQ,CACtB;CAC7C,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAsB,oBACpB,YACA,aACwB;CACxB,OAAO,oBAAoB,YAAY,KAAK,aAAa,WAAW,CAAC;AACvE;;;;;;AAgCA,eAAsB,2BACpB,YACA,aACkB;CAClB,IAAI,eAAe,SAAS;EAC1B,MAAM,OAAO,MAAM,oBAAoB,OAAO;EAC9C,IAAI,CAAC,MACH,OAAO;EAET,MAAM,OAAO,MAAM,oBAAoB,SAAS,WAAW;EAC3D,OAAO,QAAQ,QAAQ,SAAS;CAClC;CACA,MAAM,OAAO,MAAM,oBAAoB,UAAU;CACjD,IAAI,CAAC,MACH,OAAO;CAET,MAAM,OAAO,MAAM,oBAAoB,YAAY,WAAW;CAC9D,OAAO,QAAQ,QAAQ,SAAS;AAClC;;;;;;;AAQA,eAAsB,2BACpB,WACkB;CAClB,IAAI,MAAM;CACV,KAAK,MAAM,EAAE,UAAU,kBAAkB,WAAW;EAClD,MAAM,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAAI,CACrC,gBAAgB,QAAQ,GACxB,gBAAgB,YAAY,CAC9B,CAAC;EACD,IAAI,QAAQ,QAAQ,QAAQ,MAC1B;EAEF,IAAI,QAAQ,QAAQ,QAAQ,QAAQ,SAAS,MAC3C,OAAO;EAET,MAAM;CACR;CACA,OAAO;AACT;AAEA,eAAe,gBAAgB,GAAmC;CAChE,IAAI,CAAE,MAAM,WAAW,CAAC,GACtB,OAAO;CAET,IAAI;EACF,MAAM,MAAM,MAAM,SAAS,CAAC;EAC5B,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;CACnE,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/providers/claude.d.ts

@@ -0,0 +1,43 @@
+import type { Account, LiveAuthStatus, Provider, SnapshotMeta, SourceAdapter } from '../types.js';
+export interface ClaudeCredentialStore {
+    read(): Promise<{
+        account: string;
+        credential: string;
+    } | null>;
+    write(account: string, credential: string): Promise<void>;
+    clear(account: string): Promise<void>;
+}
+interface ClaudeProviderOptions {
+    credentialStore?: ClaudeCredentialStore;
+    isOwnerRunning?: () => Promise<boolean>;
+}
+/**
+ * Claude Code keeps OAuth/API credentials in macOS Keychain and falls back to
+ * ~/.claude/.credentials.json on file-backed platforms. This store mirrors
+ * those two authorities without ever putting the secret in process argv.
+ */
+export declare function createClaudeCredentialStore(home?: string): ClaudeCredentialStore;
+export declare class ClaudeProvider implements Provider {
+    readonly id = "claude";
+    readonly name = "Anthropic Claude Code";
+    readonly shortName = "Claude";
+    readonly description = "Manages Claude Code native login credentials";
+    private readonly credentials;
+    private readonly isOwnerRunning;
+    constructor(home?: string, opts?: ClaudeProviderOptions);
+    sourceAdapter(account: Account): SourceAdapter;
+    detectLive(): Promise<LiveAuthStatus>;
+    backup(destDir: string): Promise<SnapshotMeta>;
+    preflightRestore(_srcDir: string): Promise<void>;
+    restoreOwnerStatus(_srcDir: string): Promise<{
+        name: string;
+        running: boolean;
+    }>;
+    restore(srcDir: string): Promise<void>;
+    clearLive(): Promise<void>;
+    describeSnapshot(srcDir: string): Promise<SnapshotMeta>;
+    snapshotMatchesLive(srcDir: string): Promise<boolean>;
+}
+export declare const claudeProvider: ClaudeProvider;
+export {};
+//# sourceMappingURL=claude.d.ts.map

package/dist/providers/claude.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../src/providers/claude.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAiB/F,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAChE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,UAAU,qBAAqB;IAC7B,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,SAAY,GAAG,qBAAqB,CA2DnF;AAED,qBAAa,cAAe,YAAW,QAAQ;IAC7C,QAAQ,CAAC,EAAE,YAAY;IACvB,QAAQ,CAAC,IAAI,2BAA2B;IACxC,QAAQ,CAAC,SAAS,YAAY;IAC9B,QAAQ,CAAC,WAAW,kDAAkD;IAEtE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyB;IAExD,YAAY,IAAI,SAAY,EAAE,IAAI,GAAE,qBAA0B,EAG7D;IAED,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAE7C;IAEK,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC,CAU1C;IAEK,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAenD;IAEK,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrD;IAEK,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAErF;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG3C;IAEK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAK/B;IAEK,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAG5D;IAEK,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAY1D;CACF;AAkFD,eAAO,MAAM,cAAc,gBAAuB,CAAC"}

package/dist/providers/claude.js

@@ -0,0 +1,191 @@
+import { AnyPickError } from "../utils/errors.js";
+import { pathExists, readJsonFile, writeJsonFile, writeTextFile } from "../utils/fs.js";
+import { claudeAccountAdapter } from "../sources/account-adapters.js";
+import { join } from "node:path";
+import { readFile, rm } from "node:fs/promises";
+import { homedir, userInfo } from "node:os";
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+//#region src/providers/claude.ts
+var execFileAsync = promisify(execFile);
+var SECURITY_BIN = "/usr/bin/security";
+var SECURITY_TIMEOUT_MS = 5e3;
+var CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+var SNAPSHOT_FILE = "credentials.json";
+/**
+* Claude Code keeps OAuth/API credentials in macOS Keychain and falls back to
+* ~/.claude/.credentials.json on file-backed platforms. This store mirrors
+* those two authorities without ever putting the secret in process argv.
+*/
+function createClaudeCredentialStore(home = homedir()) {
+	const account = userInfo().username;
+	const file = process.env.ANYPICK_CLAUDE_CREDENTIALS_PATH ?? join(home, ".claude", ".credentials.json");
+	if (!(process.platform === "darwin" && process.env.ANYPICK_CLAUDE_NO_KEYCHAIN !== "1")) return {
+		async read() {
+			if (!await pathExists(file)) return null;
+			const credential = await readFile(file, "utf8");
+			return credential.trim() ? {
+				account,
+				credential
+			} : null;
+		},
+		async write(_account, credential) {
+			await writeTextFile(file, credential.endsWith("\n") ? credential : `${credential}\n`, 384);
+		},
+		async clear() {
+			await rm(file, { force: true });
+		}
+	};
+	return {
+		async read() {
+			try {
+				const { stdout } = await execFileAsync(SECURITY_BIN, [
+					"find-generic-password",
+					"-s",
+					CLAUDE_KEYCHAIN_SERVICE,
+					"-a",
+					account,
+					"-w"
+				], {
+					encoding: "utf8",
+					timeout: SECURITY_TIMEOUT_MS,
+					maxBuffer: 1024 * 1024
+				});
+				const credential = stdout.trim();
+				return credential ? {
+					account,
+					credential
+				} : null;
+			} catch {
+				return null;
+			}
+		},
+		async write(keychainAccount, credential) {
+			const hex = Buffer.from(credential, "utf8").toString("hex");
+			await securityStdin(`add-generic-password -U -s ${quoteSecurityArgument(CLAUDE_KEYCHAIN_SERVICE)} -a ${quoteSecurityArgument(keychainAccount)} -X ${hex}\n`);
+		},
+		async clear(keychainAccount) {
+			await securityStdin(`delete-generic-password -s ${quoteSecurityArgument(CLAUDE_KEYCHAIN_SERVICE)} -a ${quoteSecurityArgument(keychainAccount)}\n`);
+		}
+	};
+}
+var ClaudeProvider = class {
+	id = "claude";
+	name = "Anthropic Claude Code";
+	shortName = "Claude";
+	description = "Manages Claude Code native login credentials";
+	credentials;
+	isOwnerRunning;
+	constructor(home = homedir(), opts = {}) {
+		this.credentials = opts.credentialStore ?? createClaudeCredentialStore(home);
+		this.isOwnerRunning = opts.isOwnerRunning ?? claudeCodeApplicationRunning;
+	}
+	sourceAdapter(account) {
+		return claudeAccountAdapter(account);
+	}
+	async detectLive() {
+		const current = await this.credentials.read();
+		if (!current) return { present: false };
+		return {
+			present: true,
+			identity: claudeCredentialIdentity(current.credential),
+			details: "Claude Code secure credential store"
+		};
+	}
+	async backup(destDir) {
+		const current = await this.credentials.read();
+		if (!current) throw new AnyPickError("No signed-in Claude Code account was found.", "NO_LIVE_AUTH");
+		await writeJsonFile(join(destDir, SNAPSHOT_FILE), {
+			version: 1,
+			account: current.account,
+			credential: current.credential
+		}, 384);
+		return { identity: claudeCredentialIdentity(current.credential) };
+	}
+	async preflightRestore(_srcDir) {
+		if (await this.isOwnerRunning()) throw new AnyPickError("Claude Code is still running.", {
+			code: "RESTORE_OWNER_RUNNING",
+			suggestions: ["Quit Claude Code completely, then retry the account switch."]
+		});
+	}
+	async restoreOwnerStatus(_srcDir) {
+		return {
+			name: "Claude Code",
+			running: await this.isOwnerRunning()
+		};
+	}
+	async restore(srcDir) {
+		const snapshot = await readClaudeSnapshot(srcDir);
+		await this.credentials.write(snapshot.account, snapshot.credential);
+	}
+	async clearLive() {
+		const current = await this.credentials.read();
+		if (current) await this.credentials.clear(current.account);
+	}
+	async describeSnapshot(srcDir) {
+		const snapshot = await readClaudeSnapshot(srcDir).catch(() => null);
+		return snapshot ? { identity: claudeCredentialIdentity(snapshot.credential) } : {};
+	}
+	async snapshotMatchesLive(srcDir) {
+		const [current, snapshot] = await Promise.all([this.credentials.read().catch(() => null), readClaudeSnapshot(srcDir).catch(() => null)]);
+		if (!current || !snapshot) return false;
+		return claudeCredentialFingerprint(current.credential) === claudeCredentialFingerprint(snapshot.credential);
+	}
+};
+async function readClaudeSnapshot(srcDir) {
+	const snapshot = await readJsonFile(join(srcDir, SNAPSHOT_FILE));
+	if (snapshot.version !== 1 || typeof snapshot.account !== "string" || !snapshot.account || typeof snapshot.credential !== "string" || !snapshot.credential) throw new Error("Claude Code credential snapshot is invalid.");
+	return snapshot;
+}
+function claudeCredentialIdentity(raw) {
+	try {
+		const root = JSON.parse(raw);
+		const oauth = root.claudeAiOauth;
+		for (const candidate of [root.email, oauth?.email]) if (typeof candidate === "string" && candidate.trim()) return candidate.trim();
+		const plan = oauth?.subscriptionType;
+		return typeof plan === "string" && plan.trim() ? `Claude ${plan.trim()}` : void 0;
+	} catch {
+		return;
+	}
+}
+function claudeCredentialFingerprint(raw) {
+	let stable = raw;
+	try {
+		const oauth = JSON.parse(raw).claudeAiOauth;
+		const refresh = oauth?.refreshToken ?? oauth?.refresh_token;
+		if (typeof refresh === "string" && refresh.trim()) stable = refresh.trim();
+	} catch {}
+	return createHash("sha256").update(stable).digest("hex");
+}
+async function claudeCodeApplicationRunning() {
+	if (process.platform !== "darwin") return false;
+	try {
+		const { stdout } = await execFileAsync("/bin/ps", ["-axo", "comm="], {
+			encoding: "utf8",
+			maxBuffer: 8 * 1024 * 1024
+		});
+		return stdout.split(/\r?\n/gu).some((line) => {
+			const executable = line.trim();
+			return executable === "claude" || executable.endsWith("/Claude.app/Contents/MacOS/Claude");
+		});
+	} catch {
+		return false;
+	}
+}
+function quoteSecurityArgument(value) {
+	return `'${value.replaceAll("\\", "\\\\").replaceAll("'", "'\\\\''")}'`;
+}
+function securityStdin(command) {
+	return new Promise((resolve, reject) => {
+		execFile(SECURITY_BIN, ["-i"], { timeout: SECURITY_TIMEOUT_MS }, (err) => {
+			if (err) reject(/* @__PURE__ */ new Error("macOS Keychain rejected the Claude Code credential update."));
+			else resolve();
+		}).stdin?.end(command);
+	});
+}
+var claudeProvider = new ClaudeProvider();
+//#endregion
+export { ClaudeProvider, claudeProvider, createClaudeCredentialStore };
+
+//# sourceMappingURL=claude.js.map

package/dist/providers/claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.js","names":[],"sources":["../../src/providers/claude.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { execFile } from 'node:child_process';\nimport { homedir, userInfo } from 'node:os';\nimport { join } from 'node:path';\nimport { promisify } from 'node:util';\nimport { readFile, rm } from 'node:fs/promises';\nimport type { Account, LiveAuthStatus, Provider, SnapshotMeta, SourceAdapter } from '../types';\nimport { claudeAccountAdapter } from '../sources/account-adapters';\nimport { AnyPickError } from '../utils/errors';\nimport { pathExists, readJsonFile, writeJsonFile, writeTextFile } from '../utils/fs';\n\nconst execFileAsync = promisify(execFile);\nconst SECURITY_BIN = '/usr/bin/security';\nconst SECURITY_TIMEOUT_MS = 5_000;\nconst CLAUDE_KEYCHAIN_SERVICE = 'Claude Code-credentials';\nconst SNAPSHOT_FILE = 'credentials.json';\n\ninterface ClaudeCredentialSnapshot {\n  version: 1;\n  account: string;\n  credential: string;\n}\n\nexport interface ClaudeCredentialStore {\n  read(): Promise<{ account: string; credential: string } | null>;\n  write(account: string, credential: string): Promise<void>;\n  clear(account: string): Promise<void>;\n}\n\ninterface ClaudeProviderOptions {\n  credentialStore?: ClaudeCredentialStore;\n  isOwnerRunning?: () => Promise<boolean>;\n}\n\n/**\n * Claude Code keeps OAuth/API credentials in macOS Keychain and falls back to\n * ~/.claude/.credentials.json on file-backed platforms. This store mirrors\n * those two authorities without ever putting the secret in process argv.\n */\nexport function createClaudeCredentialStore(home = homedir()): ClaudeCredentialStore {\n  const account = userInfo().username;\n  const file =\n    process.env.ANYPICK_CLAUDE_CREDENTIALS_PATH ?? join(home, '.claude', '.credentials.json');\n  const useKeychain =\n    process.platform === 'darwin' && process.env.ANYPICK_CLAUDE_NO_KEYCHAIN !== '1';\n\n  if (!useKeychain) {\n    return {\n      async read() {\n        if (!(await pathExists(file))) {\n          return null;\n        }\n        const credential = await readFile(file, 'utf8');\n        return credential.trim() ? { account, credential } : null;\n      },\n      async write(_account, credential) {\n        await writeTextFile(\n          file,\n          credential.endsWith('\\n') ? credential : `${credential}\\n`,\n          0o600,\n        );\n      },\n      async clear() {\n        await rm(file, { force: true });\n      },\n    };\n  }\n\n  return {\n    async read() {\n      try {\n        const { stdout } = await execFileAsync(\n          SECURITY_BIN,\n          ['find-generic-password', '-s', CLAUDE_KEYCHAIN_SERVICE, '-a', account, '-w'],\n          { encoding: 'utf8', timeout: SECURITY_TIMEOUT_MS, maxBuffer: 1024 * 1024 },\n        );\n        const credential = stdout.trim();\n        return credential ? { account, credential } : null;\n      } catch {\n        return null;\n      }\n    },\n    async write(keychainAccount, credential) {\n      const hex = Buffer.from(credential, 'utf8').toString('hex');\n      await securityStdin(\n        `add-generic-password -U -s ${quoteSecurityArgument(CLAUDE_KEYCHAIN_SERVICE)} -a ${quoteSecurityArgument(\n          keychainAccount,\n        )} -X ${hex}\\n`,\n      );\n    },\n    async clear(keychainAccount) {\n      await securityStdin(\n        `delete-generic-password -s ${quoteSecurityArgument(CLAUDE_KEYCHAIN_SERVICE)} -a ${quoteSecurityArgument(\n          keychainAccount,\n        )}\\n`,\n      );\n    },\n  };\n}\n\nexport class ClaudeProvider implements Provider {\n  readonly id = 'claude';\n  readonly name = 'Anthropic Claude Code';\n  readonly shortName = 'Claude';\n  readonly description = 'Manages Claude Code native login credentials';\n\n  private readonly credentials: ClaudeCredentialStore;\n  private readonly isOwnerRunning: () => Promise<boolean>;\n\n  constructor(home = homedir(), opts: ClaudeProviderOptions = {}) {\n    this.credentials = opts.credentialStore ?? createClaudeCredentialStore(home);\n    this.isOwnerRunning = opts.isOwnerRunning ?? claudeCodeApplicationRunning;\n  }\n\n  sourceAdapter(account: Account): SourceAdapter {\n    return claudeAccountAdapter(account);\n  }\n\n  async detectLive(): Promise<LiveAuthStatus> {\n    const current = await this.credentials.read();\n    if (!current) {\n      return { present: false };\n    }\n    return {\n      present: true,\n      identity: claudeCredentialIdentity(current.credential),\n      details: 'Claude Code secure credential store',\n    };\n  }\n\n  async backup(destDir: string): Promise<SnapshotMeta> {\n    const current = await this.credentials.read();\n    if (!current) {\n      throw new AnyPickError('No signed-in Claude Code account was found.', 'NO_LIVE_AUTH');\n    }\n    await writeJsonFile(\n      join(destDir, SNAPSHOT_FILE),\n      {\n        version: 1,\n        account: current.account,\n        credential: current.credential,\n      } satisfies ClaudeCredentialSnapshot,\n      0o600,\n    );\n    return { identity: claudeCredentialIdentity(current.credential) };\n  }\n\n  async preflightRestore(_srcDir: string): Promise<void> {\n    if (await this.isOwnerRunning()) {\n      throw new AnyPickError('Claude Code is still running.', {\n        code: 'RESTORE_OWNER_RUNNING',\n        suggestions: ['Quit Claude Code completely, then retry the account switch.'],\n      });\n    }\n  }\n\n  async restoreOwnerStatus(_srcDir: string): Promise<{ name: string; running: boolean }> {\n    return { name: 'Claude Code', running: await this.isOwnerRunning() };\n  }\n\n  async restore(srcDir: string): Promise<void> {\n    const snapshot = await readClaudeSnapshot(srcDir);\n    await this.credentials.write(snapshot.account, snapshot.credential);\n  }\n\n  async clearLive(): Promise<void> {\n    const current = await this.credentials.read();\n    if (current) {\n      await this.credentials.clear(current.account);\n    }\n  }\n\n  async describeSnapshot(srcDir: string): Promise<SnapshotMeta> {\n    const snapshot = await readClaudeSnapshot(srcDir).catch(() => null);\n    return snapshot ? { identity: claudeCredentialIdentity(snapshot.credential) } : {};\n  }\n\n  async snapshotMatchesLive(srcDir: string): Promise<boolean> {\n    const [current, snapshot] = await Promise.all([\n      this.credentials.read().catch(() => null),\n      readClaudeSnapshot(srcDir).catch(() => null),\n    ]);\n    if (!current || !snapshot) {\n      return false;\n    }\n    return (\n      claudeCredentialFingerprint(current.credential) ===\n      claudeCredentialFingerprint(snapshot.credential)\n    );\n  }\n}\n\nasync function readClaudeSnapshot(srcDir: string): Promise<ClaudeCredentialSnapshot> {\n  const snapshot = await readJsonFile<ClaudeCredentialSnapshot>(join(srcDir, SNAPSHOT_FILE));\n  if (\n    snapshot.version !== 1 ||\n    typeof snapshot.account !== 'string' ||\n    !snapshot.account ||\n    typeof snapshot.credential !== 'string' ||\n    !snapshot.credential\n  ) {\n    throw new Error('Claude Code credential snapshot is invalid.');\n  }\n  return snapshot;\n}\n\nfunction claudeCredentialIdentity(raw: string): string | undefined {\n  try {\n    const root = JSON.parse(raw) as Record<string, unknown>;\n    const oauth = root.claudeAiOauth as Record<string, unknown> | undefined;\n    for (const candidate of [root.email, oauth?.email]) {\n      if (typeof candidate === 'string' && candidate.trim()) {\n        return candidate.trim();\n      }\n    }\n    const plan = oauth?.subscriptionType;\n    return typeof plan === 'string' && plan.trim() ? `Claude ${plan.trim()}` : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction claudeCredentialFingerprint(raw: string): string {\n  let stable = raw;\n  try {\n    const root = JSON.parse(raw) as Record<string, unknown>;\n    const oauth = root.claudeAiOauth as Record<string, unknown> | undefined;\n    const refresh = oauth?.refreshToken ?? oauth?.refresh_token;\n    if (typeof refresh === 'string' && refresh.trim()) {\n      stable = refresh.trim();\n    }\n  } catch {\n    // A future credential envelope is still safely comparable as opaque text.\n  }\n  return createHash('sha256').update(stable).digest('hex');\n}\n\nasync function claudeCodeApplicationRunning(): Promise<boolean> {\n  if (process.platform !== 'darwin') {\n    return false;\n  }\n  try {\n    const { stdout } = await execFileAsync('/bin/ps', ['-axo', 'comm='], {\n      encoding: 'utf8',\n      maxBuffer: 8 * 1024 * 1024,\n    });\n    return stdout.split(/\\r?\\n/gu).some((line) => {\n      const executable = line.trim();\n      return executable === 'claude' || executable.endsWith('/Claude.app/Contents/MacOS/Claude');\n    });\n  } catch {\n    return false;\n  }\n}\n\nfunction quoteSecurityArgument(value: string): string {\n  return `'${value.replaceAll('\\\\', '\\\\\\\\').replaceAll(\"'\", \"'\\\\\\\\''\")}'`;\n}\n\nfunction securityStdin(command: string): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const child = execFile(SECURITY_BIN, ['-i'], { timeout: SECURITY_TIMEOUT_MS }, (err) => {\n      if (err) {\n        reject(new Error('macOS Keychain rejected the Claude Code credential update.'));\n      } else {\n        resolve();\n      }\n    });\n    child.stdin?.end(command);\n  });\n}\n\nexport const claudeProvider = new ClaudeProvider();\n"],"mappings":";;;;;;;;;;AAWA,IAAM,gBAAgB,UAAU,QAAQ;AACxC,IAAM,eAAe;AACrB,IAAM,sBAAsB;AAC5B,IAAM,0BAA0B;AAChC,IAAM,gBAAgB;;;;;;AAwBtB,SAAgB,4BAA4B,OAAO,QAAQ,GAA0B;CACnF,MAAM,UAAU,SAAS,CAAC,CAAC;CAC3B,MAAM,OACJ,QAAQ,IAAI,mCAAmC,KAAK,MAAM,WAAW,mBAAmB;CAI1F,IAAI,EAFF,QAAQ,aAAa,YAAY,QAAQ,IAAI,+BAA+B,MAG5E,OAAO;EACL,MAAM,OAAO;GACX,IAAI,CAAE,MAAM,WAAW,IAAI,GACzB,OAAO;GAET,MAAM,aAAa,MAAM,SAAS,MAAM,MAAM;GAC9C,OAAO,WAAW,KAAK,IAAI;IAAE;IAAS;GAAW,IAAI;EACvD;EACA,MAAM,MAAM,UAAU,YAAY;GAChC,MAAM,cACJ,MACA,WAAW,SAAS,IAAI,IAAI,aAAa,GAAG,WAAW,KACvD,GACF;EACF;EACA,MAAM,QAAQ;GACZ,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;EAChC;CACF;CAGF,OAAO;EACL,MAAM,OAAO;GACX,IAAI;IACF,MAAM,EAAE,WAAW,MAAM,cACvB,cACA;KAAC;KAAyB;KAAM;KAAyB;KAAM;KAAS;IAAI,GAC5E;KAAE,UAAU;KAAQ,SAAS;KAAqB,WAAW,OAAO;IAAK,CAC3E;IACA,MAAM,aAAa,OAAO,KAAK;IAC/B,OAAO,aAAa;KAAE;KAAS;IAAW,IAAI;GAChD,QAAQ;IACN,OAAO;GACT;EACF;EACA,MAAM,MAAM,iBAAiB,YAAY;GACvC,MAAM,MAAM,OAAO,KAAK,YAAY,MAAM,CAAC,CAAC,SAAS,KAAK;GAC1D,MAAM,cACJ,8BAA8B,sBAAsB,uBAAuB,EAAE,MAAM,sBACjF,eACF,EAAE,MAAM,IAAI,GACd;EACF;EACA,MAAM,MAAM,iBAAiB;GAC3B,MAAM,cACJ,8BAA8B,sBAAsB,uBAAuB,EAAE,MAAM,sBACjF,eACF,EAAE,GACJ;EACF;CACF;AACF;AAEA,IAAa,iBAAb,MAAgD;CAC9C,KAAc;CACd,OAAgB;CAChB,YAAqB;CACrB,cAAuB;CAEvB;CACA;CAEA,YAAY,OAAO,QAAQ,GAAG,OAA8B,CAAC,GAAG;EAC9D,KAAK,cAAc,KAAK,mBAAmB,4BAA4B,IAAI;EAC3E,KAAK,iBAAiB,KAAK,kBAAkB;CAC/C;CAEA,cAAc,SAAiC;EAC7C,OAAO,qBAAqB,OAAO;CACrC;CAEA,MAAM,aAAsC;EAC1C,MAAM,UAAU,MAAM,KAAK,YAAY,KAAK;EAC5C,IAAI,CAAC,SACH,OAAO,EAAE,SAAS,MAAM;EAE1B,OAAO;GACL,SAAS;GACT,UAAU,yBAAyB,QAAQ,UAAU;GACrD,SAAS;EACX;CACF;CAEA,MAAM,OAAO,SAAwC;EACnD,MAAM,UAAU,MAAM,KAAK,YAAY,KAAK;EAC5C,IAAI,CAAC,SACH,MAAM,IAAI,aAAa,+CAA+C,cAAc;EAEtF,MAAM,cACJ,KAAK,SAAS,aAAa,GAC3B;GACE,SAAS;GACT,SAAS,QAAQ;GACjB,YAAY,QAAQ;EACtB,GACA,GACF;EACA,OAAO,EAAE,UAAU,yBAAyB,QAAQ,UAAU,EAAE;CAClE;CAEA,MAAM,iBAAiB,SAAgC;EACrD,IAAI,MAAM,KAAK,eAAe,GAC5B,MAAM,IAAI,aAAa,iCAAiC;GACtD,MAAM;GACN,aAAa,CAAC,6DAA6D;EAC7E,CAAC;CAEL;CAEA,MAAM,mBAAmB,SAA8D;EACrF,OAAO;GAAE,MAAM;GAAe,SAAS,MAAM,KAAK,eAAe;EAAE;CACrE;CAEA,MAAM,QAAQ,QAA+B;EAC3C,MAAM,WAAW,MAAM,mBAAmB,MAAM;EAChD,MAAM,KAAK,YAAY,MAAM,SAAS,SAAS,SAAS,UAAU;CACpE;CAEA,MAAM,YAA2B;EAC/B,MAAM,UAAU,MAAM,KAAK,YAAY,KAAK;EAC5C,IAAI,SACF,MAAM,KAAK,YAAY,MAAM,QAAQ,OAAO;CAEhD;CAEA,MAAM,iBAAiB,QAAuC;EAC5D,MAAM,WAAW,MAAM,mBAAmB,MAAM,CAAC,CAAC,YAAY,IAAI;EAClE,OAAO,WAAW,EAAE,UAAU,yBAAyB,SAAS,UAAU,EAAE,IAAI,CAAC;CACnF;CAEA,MAAM,oBAAoB,QAAkC;EAC1D,MAAM,CAAC,SAAS,YAAY,MAAM,QAAQ,IAAI,CAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,YAAY,IAAI,GACxC,mBAAmB,MAAM,CAAC,CAAC,YAAY,IAAI,CAC7C,CAAC;EACD,IAAI,CAAC,WAAW,CAAC,UACf,OAAO;EAET,OACE,4BAA4B,QAAQ,UAAU,MAC9C,4BAA4B,SAAS,UAAU;CAEnD;AACF;AAEA,eAAe,mBAAmB,QAAmD;CACnF,MAAM,WAAW,MAAM,aAAuC,KAAK,QAAQ,aAAa,CAAC;CACzF,IACE,SAAS,YAAY,KACrB,OAAO,SAAS,YAAY,YAC5B,CAAC,SAAS,WACV,OAAO,SAAS,eAAe,YAC/B,CAAC,SAAS,YAEV,MAAM,IAAI,MAAM,6CAA6C;CAE/D,OAAO;AACT;AAEA,SAAS,yBAAyB,KAAiC;CACjE,IAAI;EACF,MAAM,OAAO,KAAK,MAAM,GAAG;EAC3B,MAAM,QAAQ,KAAK;EACnB,KAAK,MAAM,aAAa,CAAC,KAAK,OAAO,OAAO,KAAK,GAC/C,IAAI,OAAO,cAAc,YAAY,UAAU,KAAK,GAClD,OAAO,UAAU,KAAK;EAG1B,MAAM,OAAO,OAAO;EACpB,OAAO,OAAO,SAAS,YAAY,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,MAAM,KAAA;CAC7E,QAAQ;EACN;CACF;AACF;AAEA,SAAS,4BAA4B,KAAqB;CACxD,IAAI,SAAS;CACb,IAAI;EAEF,MAAM,QADO,KAAK,MAAM,GACV,CAAA,CAAK;EACnB,MAAM,UAAU,OAAO,gBAAgB,OAAO;EAC9C,IAAI,OAAO,YAAY,YAAY,QAAQ,KAAK,GAC9C,SAAS,QAAQ,KAAK;CAE1B,QAAQ,CAER;CACA,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;AACzD;AAEA,eAAe,+BAAiD;CAC9D,IAAI,QAAQ,aAAa,UACvB,OAAO;CAET,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,cAAc,WAAW,CAAC,QAAQ,OAAO,GAAG;GACnE,UAAU;GACV,WAAW,IAAI,OAAO;EACxB,CAAC;EACD,OAAO,OAAO,MAAM,SAAS,CAAC,CAAC,MAAM,SAAS;GAC5C,MAAM,aAAa,KAAK,KAAK;GAC7B,OAAO,eAAe,YAAY,WAAW,SAAS,mCAAmC;EAC3F,CAAC;CACH,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,sBAAsB,OAAuB;CACpD,OAAO,IAAI,MAAM,WAAW,MAAM,MAAM,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE;AACvE;AAEA,SAAS,cAAc,SAAgC;CACrD,OAAO,IAAI,SAAS,SAAS,WAAW;EAQtC,SAPuB,cAAc,CAAC,IAAI,GAAG,EAAE,SAAS,oBAAoB,IAAI,QAAQ;GACtF,IAAI,KACF,uBAAO,IAAI,MAAM,4DAA4D,CAAC;QAE9E,QAAQ;EAEZ,CACA,CAAA,CAAM,OAAO,IAAI,OAAO;CAC1B,CAAC;AACH;AAEA,IAAa,iBAAiB,IAAI,eAAe"}

package/dist/providers/codex-identity.d.ts

@@ -0,0 +1,13 @@
+export declare function hasCodexAuth(data: Record<string, unknown>): boolean;
+export declare function codexAccountId(data: Record<string, unknown>): string | undefined;
+/**
+ * Best-effort identity for display.
+ *
+ * Codex CLI writes ~/.codex/auth.json with either:
+ * - ChatGPT OAuth: `tokens.{id_token,access_token,refresh_token,account_id}` + auth_mode
+ * - API key: `OPENAI_API_KEY` string
+ *
+ * Email lives on id_token.email or access_token["https://api.openai.com/profile"].email.
+ */
+export declare function extractCodexIdentity(data: Record<string, unknown>): string | undefined;
+//# sourceMappingURL=codex-identity.d.ts.map

package/dist/providers/codex-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-identity.d.ts","sourceRoot":"","sources":["../../src/providers/codex-identity.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUnE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAShF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CA8BtF"}

package/dist/providers/codex-identity.js

@@ -0,0 +1,69 @@
+//#region src/providers/codex-identity.ts
+function hasCodexAuth(data) {
+	if (typeof data.OPENAI_API_KEY === "string" && data.OPENAI_API_KEY.trim()) return true;
+	const tokens = data.tokens;
+	if (tokens && typeof tokens === "object") {
+		const t = tokens;
+		return Boolean(t.access_token || t.refresh_token || t.id_token);
+	}
+	return false;
+}
+function codexAccountId(data) {
+	const tokens = data.tokens;
+	if (tokens && typeof tokens === "object") {
+		const id = tokens.account_id;
+		if (typeof id === "string" && id.trim()) return id.trim();
+	}
+}
+/**
+* Best-effort identity for display.
+*
+* Codex CLI writes ~/.codex/auth.json with either:
+* - ChatGPT OAuth: `tokens.{id_token,access_token,refresh_token,account_id}` + auth_mode
+* - API key: `OPENAI_API_KEY` string
+*
+* Email lives on id_token.email or access_token["https://api.openai.com/profile"].email.
+*/
+function extractCodexIdentity(data) {
+	const tokens = data.tokens;
+	if (tokens && typeof tokens === "object") {
+		const t = tokens;
+		const fromId = claimsFromJwt(typeof t.id_token === "string" ? t.id_token : null);
+		const fromAccess = claimsFromJwt(typeof t.access_token === "string" ? t.access_token : null);
+		const email = stringClaim(fromId, "email") ?? stringClaim(fromAccess, "email") ?? nestedEmail(fromAccess, "https://api.openai.com/profile") ?? nestedEmail(fromId, "https://api.openai.com/profile");
+		if (email) return email;
+		const name = stringClaim(fromId, "name") ?? stringClaim(fromAccess, "name");
+		if (name) return name;
+		if (typeof t.account_id === "string" && t.account_id) return `chatgpt:${t.account_id.slice(0, 8)}`;
+	}
+	if (typeof data.OPENAI_API_KEY === "string" && data.OPENAI_API_KEY.trim()) return "API key";
+}
+function claimsFromJwt(token) {
+	if (!token) return null;
+	try {
+		const parts = token.split(".");
+		if (parts.length < 2 || !parts[1]) return null;
+		let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+		const pad = b64.length % 4;
+		if (pad) b64 += "=".repeat(4 - pad);
+		return JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
+	} catch {
+		return null;
+	}
+}
+function stringClaim(claims, key) {
+	if (!claims) return;
+	const v = claims[key];
+	return typeof v === "string" && v.trim() ? v.trim() : void 0;
+}
+function nestedEmail(claims, key) {
+	if (!claims) return;
+	const nest = claims[key];
+	if (!nest || typeof nest !== "object") return;
+	const email = nest.email;
+	return typeof email === "string" && email.trim() ? email.trim() : void 0;
+}
+//#endregion
+export { codexAccountId, extractCodexIdentity, hasCodexAuth };
+
+//# sourceMappingURL=codex-identity.js.map

package/dist/providers/codex-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-identity.js","names":[],"sources":["../../src/providers/codex-identity.ts"],"sourcesContent":["export function hasCodexAuth(data: Record<string, unknown>): boolean {\n  if (typeof data.OPENAI_API_KEY === 'string' && data.OPENAI_API_KEY.trim()) {\n    return true;\n  }\n  const tokens = data.tokens;\n  if (tokens && typeof tokens === 'object') {\n    const t = tokens as Record<string, unknown>;\n    return Boolean(t.access_token || t.refresh_token || t.id_token);\n  }\n  return false;\n}\n\nexport function codexAccountId(data: Record<string, unknown>): string | undefined {\n  const tokens = data.tokens;\n  if (tokens && typeof tokens === 'object') {\n    const id = (tokens as Record<string, unknown>).account_id;\n    if (typeof id === 'string' && id.trim()) {\n      return id.trim();\n    }\n  }\n  return undefined;\n}\n\n/**\n * Best-effort identity for display.\n *\n * Codex CLI writes ~/.codex/auth.json with either:\n * - ChatGPT OAuth: `tokens.{id_token,access_token,refresh_token,account_id}` + auth_mode\n * - API key: `OPENAI_API_KEY` string\n *\n * Email lives on id_token.email or access_token[\"https://api.openai.com/profile\"].email.\n */\nexport function extractCodexIdentity(data: Record<string, unknown>): string | undefined {\n  const tokens = data.tokens;\n  if (tokens && typeof tokens === 'object') {\n    const t = tokens as Record<string, unknown>;\n    const fromId = claimsFromJwt(typeof t.id_token === 'string' ? t.id_token : null);\n    const fromAccess = claimsFromJwt(typeof t.access_token === 'string' ? t.access_token : null);\n\n    const email =\n      stringClaim(fromId, 'email') ??\n      stringClaim(fromAccess, 'email') ??\n      nestedEmail(fromAccess, 'https://api.openai.com/profile') ??\n      nestedEmail(fromId, 'https://api.openai.com/profile');\n    if (email) {\n      return email;\n    }\n\n    const name = stringClaim(fromId, 'name') ?? stringClaim(fromAccess, 'name');\n    if (name) {\n      return name;\n    }\n\n    if (typeof t.account_id === 'string' && t.account_id) {\n      return `chatgpt:${t.account_id.slice(0, 8)}`;\n    }\n  }\n\n  if (typeof data.OPENAI_API_KEY === 'string' && data.OPENAI_API_KEY.trim()) {\n    return 'API key';\n  }\n  return undefined;\n}\n\nfunction claimsFromJwt(token: string | null): Record<string, unknown> | null {\n  if (!token) {\n    return null;\n  }\n  try {\n    const parts = token.split('.');\n    if (parts.length < 2 || !parts[1]) {\n      return null;\n    }\n    // Accept base64url or standard base64 (with/without padding).\n    let b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');\n    const pad = b64.length % 4;\n    if (pad) {\n      b64 += '='.repeat(4 - pad);\n    }\n    return JSON.parse(Buffer.from(b64, 'base64').toString('utf8')) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction stringClaim(claims: Record<string, unknown> | null, key: string): string | undefined {\n  if (!claims) {\n    return undefined;\n  }\n  const v = claims[key];\n  return typeof v === 'string' && v.trim() ? v.trim() : undefined;\n}\n\nfunction nestedEmail(claims: Record<string, unknown> | null, key: string): string | undefined {\n  if (!claims) {\n    return undefined;\n  }\n  const nest = claims[key];\n  if (!nest || typeof nest !== 'object') {\n    return undefined;\n  }\n  const email = (nest as Record<string, unknown>).email;\n  return typeof email === 'string' && email.trim() ? email.trim() : undefined;\n}\n"],"mappings":";AAAA,SAAgB,aAAa,MAAwC;CACnE,IAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,GACtE,OAAO;CAET,MAAM,SAAS,KAAK;CACpB,IAAI,UAAU,OAAO,WAAW,UAAU;EACxC,MAAM,IAAI;EACV,OAAO,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,QAAQ;CAChE;CACA,OAAO;AACT;AAEA,SAAgB,eAAe,MAAmD;CAChF,MAAM,SAAS,KAAK;CACpB,IAAI,UAAU,OAAO,WAAW,UAAU;EACxC,MAAM,KAAM,OAAmC;EAC/C,IAAI,OAAO,OAAO,YAAY,GAAG,KAAK,GACpC,OAAO,GAAG,KAAK;CAEnB;AAEF;;;;;;;;;;AAWA,SAAgB,qBAAqB,MAAmD;CACtF,MAAM,SAAS,KAAK;CACpB,IAAI,UAAU,OAAO,WAAW,UAAU;EACxC,MAAM,IAAI;EACV,MAAM,SAAS,cAAc,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW,IAAI;EAC/E,MAAM,aAAa,cAAc,OAAO,EAAE,iBAAiB,WAAW,EAAE,eAAe,IAAI;EAE3F,MAAM,QACJ,YAAY,QAAQ,OAAO,KAC3B,YAAY,YAAY,OAAO,KAC/B,YAAY,YAAY,gCAAgC,KACxD,YAAY,QAAQ,gCAAgC;EACtD,IAAI,OACF,OAAO;EAGT,MAAM,OAAO,YAAY,QAAQ,MAAM,KAAK,YAAY,YAAY,MAAM;EAC1E,IAAI,MACF,OAAO;EAGT,IAAI,OAAO,EAAE,eAAe,YAAY,EAAE,YACxC,OAAO,WAAW,EAAE,WAAW,MAAM,GAAG,CAAC;CAE7C;CAEA,IAAI,OAAO,KAAK,mBAAmB,YAAY,KAAK,eAAe,KAAK,GACtE,OAAO;AAGX;AAEA,SAAS,cAAc,OAAsD;CAC3E,IAAI,CAAC,OACH,OAAO;CAET,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,GAAG;EAC7B,IAAI,MAAM,SAAS,KAAK,CAAC,MAAM,IAC7B,OAAO;EAGT,IAAI,MAAM,MAAM,EAAE,CAAC,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EACvD,MAAM,MAAM,IAAI,SAAS;EACzB,IAAI,KACF,OAAO,IAAI,OAAO,IAAI,GAAG;EAE3B,OAAO,KAAK,MAAM,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC;CAC/D,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,QAAwC,KAAiC;CAC5F,IAAI,CAAC,QACH;CAEF,MAAM,IAAI,OAAO;CACjB,OAAO,OAAO,MAAM,YAAY,EAAE,KAAK,IAAI,EAAE,KAAK,IAAI,KAAA;AACxD;AAEA,SAAS,YAAY,QAAwC,KAAiC;CAC5F,IAAI,CAAC,QACH;CAEF,MAAM,OAAO,OAAO;CACpB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B;CAEF,MAAM,QAAS,KAAiC;CAChD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,IAAI,MAAM,KAAK,IAAI,KAAA;AACpE"}

package/dist/providers/codex-refresh.d.ts

@@ -0,0 +1,30 @@
+/**
+ * ChatGPT / Codex OAuth token refresh (no browser).
+ *
+ * Endpoint + client_id match the official Codex CLI binary
+ * (https://auth.openai.com/oauth/token, app_EMoamEEZ73f0CkXaXp7hrann).
+ */
+export declare const CODEX_OAUTH_TOKEN_URL: string;
+export declare const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export interface CodexAuthFile {
+    auth_mode?: string;
+    OPENAI_API_KEY?: string | null;
+    tokens?: {
+        id_token?: string;
+        access_token?: string;
+        refresh_token?: string;
+        account_id?: string;
+        [key: string]: unknown;
+    };
+    last_refresh?: string;
+    [key: string]: unknown;
+}
+export interface CodexRefreshResult {
+    auth: CodexAuthFile;
+    identity?: string;
+}
+/**
+ * Refresh Codex ChatGPT OAuth tokens in-memory from an auth.json object.
+ */
+export declare function refreshCodexAuth(auth: CodexAuthFile, fetchFn?: typeof fetch): Promise<CodexRefreshResult>;
+//# sourceMappingURL=codex-refresh.d.ts.map

package/dist/providers/codex-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-refresh.d.ts","sourceRoot":"","sources":["../../src/providers/codex-refresh.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,qBAAqB,QAC6D,CAAC;AAEhG,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,EACnB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAqD7B"}