codex-multi-auth 0.1.0

package/dist/lib/auth/token-utils.js

@@ -0,0 +1,331 @@
+/**
+ * Token utility functions for JWT parsing and account ID extraction.
+ * Extracted from accounts.ts to reduce module size and improve cohesion.
+ */
+import { decodeJWT } from "./auth.js";
+import { JWT_CLAIM_PATH } from "../constants.js";
+import { isRecord } from "../utils.js";
+/**
+ * Converts a value to a trimmed string if it's a non-empty string.
+ * Local helper - returns undefined for non-strings (different from lib/utils.toStringValue).
+ */
+function toStringValue(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed : undefined;
+}
+/**
+ * Converts a value to boolean if possible.
+ */
+function toBoolean(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === "boolean")
+        return value;
+    if (typeof value === "string") {
+        const normalized = value.trim().toLowerCase();
+        if (normalized === "true")
+            return true;
+        if (normalized === "false")
+            return false;
+    }
+    return undefined;
+}
+/**
+ * Formats account ID to last 6 characters for display.
+ */
+function formatAccountIdSuffix(accountId) {
+    return accountId.length > 6 ? accountId.slice(-6) : accountId;
+}
+/**
+ * Formats a label for token-derived account candidates.
+ */
+function formatTokenCandidateLabel(prefix, accountId) {
+    const suffix = formatAccountIdSuffix(accountId);
+    return `${prefix} [id:${suffix}]`;
+}
+/**
+ * Extracts account ID from a JWT payload.
+ */
+function extractAccountIdFromPayload(payload) {
+    if (!payload)
+        return undefined;
+    const auth = payload[JWT_CLAIM_PATH];
+    if (isRecord(auth)) {
+        const id = toStringValue(auth.chatgpt_account_id);
+        if (id)
+            return id;
+    }
+    const direct = toStringValue(payload.chatgpt_account_id) ??
+        toStringValue(payload.account_id) ??
+        toStringValue(payload.accountId);
+    return direct;
+}
+/**
+ * Normalizes candidate arrays from various response formats.
+ */
+function normalizeCandidateArray(value) {
+    if (Array.isArray(value))
+        return value;
+    if (isRecord(value)) {
+        const nested = value.data ??
+            value.items ??
+            value.accounts ??
+            value.organizations ??
+            value.workspaces ??
+            value.teams;
+        if (Array.isArray(nested))
+            return nested;
+    }
+    return [];
+}
+/**
+ * Extracts a single account candidate from a record.
+ */
+function extractCandidateFromRecord(record, source) {
+    const accountId = toStringValue(record.account_id) ??
+        toStringValue(record.accountId) ??
+        toStringValue(record.chatgpt_account_id) ??
+        toStringValue(record.organization_id) ??
+        toStringValue(record.org_id) ??
+        toStringValue(record.workspace_id) ??
+        toStringValue(record.team_id) ??
+        toStringValue(record.id);
+    if (!accountId)
+        return null;
+    const name = toStringValue(record.name) ??
+        toStringValue(record.display_name) ??
+        toStringValue(record.title) ??
+        toStringValue(record.organization_name) ??
+        toStringValue(record.workspace_name) ??
+        toStringValue(record.team_name) ??
+        toStringValue(record.slug);
+    const type = toStringValue(record.type) ??
+        toStringValue(record.plan_type) ??
+        toStringValue(record.kind) ??
+        toStringValue(record.account_type);
+    const role = toStringValue(record.role) ??
+        toStringValue(record.membership_role) ??
+        toStringValue(record.user_role);
+    const isDefault = toBoolean(record.is_default ?? record.isDefault ?? record.default ?? record.primary ?? record.is_active ?? record.isActive ?? record.current);
+    const isPersonal = toBoolean(record.is_personal ?? record.isPersonal ?? record.personal);
+    const suffix = formatAccountIdSuffix(accountId);
+    const labelParts = [];
+    let labelBase = name ?? "Workspace";
+    if (!name && type) {
+        labelBase = type;
+    }
+    if (type && (!name || name.toLowerCase() !== type.toLowerCase())) {
+        labelParts.push(type);
+    }
+    if (role) {
+        labelParts.push(`role:${role}`);
+    }
+    if (isPersonal) {
+        labelParts.push("personal");
+    }
+    const meta = labelParts.length > 0 ? ` (${labelParts.join(", ")})` : "";
+    const label = `${labelBase}${meta} [id:${suffix}]`;
+    return {
+        accountId,
+        label,
+        source,
+        isDefault,
+        isPersonal,
+    };
+}
+/**
+ * Collects candidates from a list of records.
+ */
+function collectCandidatesFromList(value, source) {
+    const result = [];
+    const list = normalizeCandidateArray(value);
+    if (list.length === 0)
+        return result;
+    for (const item of list) {
+        if (!isRecord(item))
+            continue;
+        const candidate = extractCandidateFromRecord(item, source);
+        if (candidate) {
+            result.push(candidate);
+        }
+    }
+    return result;
+}
+/**
+ * Collects candidates from a JWT payload.
+ */
+function collectCandidatesFromPayload(payload, source) {
+    if (!payload || !isRecord(payload))
+        return [];
+    const candidates = [];
+    const keys = ["organizations", "orgs", "accounts", "workspaces", "teams"];
+    for (const key of keys) {
+        if (key in payload) {
+            candidates.push(...collectCandidatesFromList(payload[key], source));
+        }
+    }
+    const auth = payload[JWT_CLAIM_PATH];
+    if (isRecord(auth)) {
+        for (const key of keys) {
+            if (key in auth) {
+                candidates.push(...collectCandidatesFromList(auth[key], source));
+            }
+        }
+    }
+    return candidates;
+}
+/**
+ * Removes duplicate candidates by accountId.
+ */
+function uniqueCandidates(candidates) {
+    const seen = new Set();
+    const result = [];
+    for (const candidate of candidates) {
+        if (seen.has(candidate.accountId))
+            continue;
+        seen.add(candidate.accountId);
+        result.push(candidate);
+    }
+    return result;
+}
+/**
+ * Select the best workspace candidate for OAuth account binding.
+ * Preference order:
+ * 1) org default that is not personal
+ * 2) org default (any)
+ * 3) id_token candidate
+ * 4) non-personal org candidate
+ * 5) token candidate
+ * 6) first candidate
+ */
+export function selectBestAccountCandidate(candidates) {
+    if (candidates.length === 0)
+        return undefined;
+    const orgDefaultNonPersonal = candidates.find((candidate) => candidate.source === "org" && candidate.isDefault === true && candidate.isPersonal !== true);
+    if (orgDefaultNonPersonal)
+        return orgDefaultNonPersonal;
+    const orgDefault = candidates.find((candidate) => candidate.source === "org" && candidate.isDefault === true);
+    if (orgDefault)
+        return orgDefault;
+    const idTokenCandidate = candidates.find((candidate) => candidate.source === "id_token");
+    if (idTokenCandidate)
+        return idTokenCandidate;
+    const nonPersonalOrg = candidates.find((candidate) => candidate.source === "org" && candidate.isPersonal !== true);
+    if (nonPersonalOrg)
+        return nonPersonalOrg;
+    const tokenCandidate = candidates.find((candidate) => candidate.source === "token");
+    if (tokenCandidate)
+        return tokenCandidate;
+    return candidates[0];
+}
+/**
+ * Extracts the ChatGPT account ID from a JWT access token.
+ * @param accessToken - JWT access token from OAuth flow
+ * @returns Account ID string or undefined if not found
+ */
+export function extractAccountId(accessToken) {
+    if (!accessToken)
+        return undefined;
+    const decoded = decodeJWT(accessToken);
+    const accountId = decoded?.[JWT_CLAIM_PATH]?.chatgpt_account_id;
+    return typeof accountId === "string" && accountId.trim() ? accountId : undefined;
+}
+/**
+ * Extracts the email address from OAuth tokens.
+ * Checks id_token first (where OpenAI puts email), then falls back to access_token.
+ */
+export function extractAccountEmail(accessToken, idToken) {
+    // Try id_token first - OpenAI puts email here
+    if (idToken) {
+        const idDecoded = decodeJWT(idToken);
+        const idEmail = idDecoded?.email;
+        if (typeof idEmail === "string" && idEmail.includes("@") && idEmail.trim()) {
+            return idEmail;
+        }
+    }
+    // Fall back to access_token
+    if (!accessToken)
+        return undefined;
+    const decoded = decodeJWT(accessToken);
+    const nested = decoded?.[JWT_CLAIM_PATH];
+    const candidate = nested?.email ??
+        nested?.chatgpt_user_email ??
+        decoded?.email ??
+        decoded?.preferred_username;
+    if (typeof candidate === "string" && candidate.includes("@") && candidate.trim()) {
+        return candidate;
+    }
+    return undefined;
+}
+/**
+ * Extracts all accountId candidates from access/id tokens.
+ * Used to support business workspaces/organizations that are not the token default.
+ */
+export function getAccountIdCandidates(accessToken, idToken) {
+    const candidates = [];
+    const accessId = extractAccountId(accessToken);
+    if (accessId) {
+        candidates.push({
+            accountId: accessId,
+            label: formatTokenCandidateLabel("Token account", accessId),
+            source: "token",
+            isDefault: true,
+        });
+    }
+    if (accessToken) {
+        const accessDecoded = decodeJWT(accessToken);
+        candidates.push(...collectCandidatesFromPayload(accessDecoded, "org"));
+    }
+    if (idToken) {
+        const decoded = decodeJWT(idToken);
+        const idAccountId = extractAccountIdFromPayload(decoded);
+        if (idAccountId && idAccountId !== accessId) {
+            candidates.push({
+                accountId: idAccountId,
+                label: formatTokenCandidateLabel("ID token account", idAccountId),
+                source: "id_token",
+            });
+        }
+        candidates.push(...collectCandidatesFromPayload(decoded, "org"));
+    }
+    return uniqueCandidates(candidates);
+}
+/**
+ * Determines if accountId should be updated from a token-derived value.
+ * We keep org/manual selections stable across refreshes.
+ */
+export function shouldUpdateAccountIdFromToken(source, currentAccountId) {
+    if (!currentAccountId)
+        return true;
+    if (!source)
+        return true;
+    return source === "token" || source === "id_token";
+}
+/**
+ * Resolve which accountId to use for runtime API calls.
+ * Preserves explicit org/manual selections; only token/id_token sources auto-follow token changes.
+ */
+export function resolveRequestAccountId(storedAccountId, source, tokenAccountId) {
+    if (!storedAccountId)
+        return tokenAccountId;
+    if (!shouldUpdateAccountIdFromToken(source, storedAccountId)) {
+        return storedAccountId;
+    }
+    return tokenAccountId ?? storedAccountId;
+}
+/**
+ * Sanitizes an email address by trimming whitespace and lowercasing.
+ * @param email - Email string to sanitize
+ * @returns Sanitized email or undefined if invalid
+ */
+export function sanitizeEmail(email) {
+    if (!email)
+        return undefined;
+    const trimmed = email.trim();
+    if (!trimmed || !trimmed.includes("@"))
+        return undefined;
+    return trimmed.toLowerCase();
+}
+//# sourceMappingURL=token-utils.js.map

package/dist/lib/auth/token-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-utils.js","sourceRoot":"","sources":["../../../lib/auth/token-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAcvC;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,UAAU,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,SAAiB;IAC/C,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,MAAc,EAAE,SAAiB;IACnE,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,GAAG,MAAM,QAAQ,MAAM,GAAG,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAAC,OAAoD;IACxF,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClD,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GACX,aAAa,CAAE,OAAmC,CAAC,kBAAkB,CAAC;QACtE,aAAa,CAAE,OAAmC,CAAC,UAAU,CAAC;QAC9D,aAAa,CAAE,OAAmC,CAAC,SAAS,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,GACX,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,CAAC;QACb,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CAClC,MAA+B,EAC/B,MAAuB;IAEvB,MAAM,SAAS,GACd,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC;QAChC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QAC/B,aAAa,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACxC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;QACrC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5B,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QAClC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QAC7B,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE1B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,IAAI,GACT,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QAClC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,aAAa,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACvC,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC;QACpC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QAC/B,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GACT,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QAC/B,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,IAAI,GACT,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;QACrC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,SAAS,CAC1B,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAClI,CAAC;IACF,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzF,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,IAAI,IAAI,WAAW,CAAC;IAEpC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACnB,SAAS,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACV,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QAChB,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,GAAG,SAAS,GAAG,IAAI,QAAQ,MAAM,GAAG,CAAC;IAEnD,OAAO;QACN,SAAS;QACT,KAAK;QACL,MAAM;QACN,SAAS;QACT,UAAU;KACV,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CACjC,KAAc,EACd,MAAuB;IAEvB,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC9B,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,4BAA4B,CACpC,OAAoD,EACpD,MAAuB;IAEvB,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9C,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC1E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;YACpB,UAAU,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBACjB,UAAU,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAClE,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,UAAU,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,UAAgC;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;YAAE,SAAS;QAC5C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACzC,UAAgC;IAEhC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAC5C,CAAC,SAAS,EAAE,EAAE,CACb,SAAS,CAAC,MAAM,KAAK,KAAK,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,CAC5F,CAAC;IACF,IAAI,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IAExD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CACjC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,CACzE,CAAC;IACF,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,UAAU,CAC9C,CAAC;IACF,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CACrC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,CAC1E,CAAC;IACF,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CACrC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,OAAO,CAC3C,CAAC;IACF,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAoB;IACpD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAChE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAoB,EAAE,OAAgB;IACzE,8CAA8C;IAC9C,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,SAAS,EAAE,KAA2B,CAAC;QACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5E,OAAO,OAAO,CAAC;QAChB,CAAC;IACF,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,cAAc,CAAwC,CAAC;IAChF,MAAM,SAAS,GACb,MAAM,EAAE,KAA4B;QACpC,MAAM,EAAE,kBAAyC;QACjD,OAAO,EAAE,KAA4B;QACrC,OAAO,EAAE,kBAAyC,CAAC;IACrD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAClF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACrC,WAAoB,EACpB,OAAgB;IAEhB,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACd,UAAU,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,yBAAyB,CAAC,eAAe,EAAE,QAAQ,CAAC;YAC3D,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,IAAI;SACf,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,aAAa,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,WAAW,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC;gBACf,SAAS,EAAE,WAAW;gBACtB,KAAK,EAAE,yBAAyB,CAAC,kBAAkB,EAAE,WAAW,CAAC;gBACjE,MAAM,EAAE,UAAU;aAClB,CAAC,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC7C,MAAmC,EACnC,gBAAyB;IAEzB,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,UAAU,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACtC,eAAmC,EACnC,MAAmC,EACnC,cAAkC;IAElC,IAAI,CAAC,eAAe;QAAE,OAAO,cAAc,CAAC;IAC5C,IAAI,CAAC,8BAA8B,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;QAC9D,OAAO,eAAe,CAAC;IACxB,CAAC;IACD,OAAO,cAAc,IAAI,eAAe,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;AAC9B,CAAC"}

package/dist/lib/auth-rate-limit.d.ts

@@ -0,0 +1,20 @@
+export interface AuthRateLimitConfig {
+    maxAttempts: number;
+    windowMs: number;
+}
+export declare function configureAuthRateLimit(newConfig: Partial<AuthRateLimitConfig>): void;
+export declare function getAuthRateLimitConfig(): AuthRateLimitConfig;
+export declare function canAttemptAuth(accountId: string): boolean;
+export declare function recordAuthAttempt(accountId: string): void;
+export declare function getAttemptsRemaining(accountId: string): number;
+export declare function getTimeUntilReset(accountId: string): number;
+export declare function resetAuthRateLimit(accountId: string): void;
+export declare function resetAllAuthRateLimits(): void;
+export declare class AuthRateLimitError extends Error {
+    readonly accountId: string;
+    readonly attemptsRemaining: number;
+    readonly resetAfterMs: number;
+    constructor(accountId: string, attemptsRemaining: number, resetAfterMs: number);
+}
+export declare function checkAuthRateLimit(accountId: string): void;
+//# sourceMappingURL=auth-rate-limit.d.ts.map

package/dist/lib/auth-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-rate-limit.d.ts","sourceRoot":"","sources":["../../lib/auth-rate-limit.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAcD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAEpF;AAED,wBAAgB,sBAAsB,IAAI,mBAAmB,CAE5D;AAWD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAYzD;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAYzD;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAY9D;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAmB3D;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAG1D;AAED,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,qBAAa,kBAAmB,SAAQ,KAAK;aAE3B,SAAS,EAAE,MAAM;aACjB,iBAAiB,EAAE,MAAM;aACzB,YAAY,EAAE,MAAM;gBAFpB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,MAAM;CAMrC;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAQ1D"}

package/dist/lib/auth-rate-limit.js

@@ -0,0 +1,91 @@
+const DEFAULT_CONFIG = {
+    maxAttempts: 5,
+    windowMs: 60_000,
+};
+const attemptsByAccount = new Map();
+let config = { ...DEFAULT_CONFIG };
+export function configureAuthRateLimit(newConfig) {
+    config = { ...config, ...newConfig };
+}
+export function getAuthRateLimitConfig() {
+    return { ...config };
+}
+function getAccountKey(accountId) {
+    return accountId.toLowerCase().trim();
+}
+function pruneOldAttempts(record, now) {
+    const cutoff = now - config.windowMs;
+    record.timestamps = record.timestamps.filter((ts) => ts > cutoff);
+}
+export function canAttemptAuth(accountId) {
+    const key = getAccountKey(accountId);
+    const record = attemptsByAccount.get(key);
+    if (!record) {
+        return true;
+    }
+    const now = Date.now();
+    pruneOldAttempts(record, now);
+    return record.timestamps.length < config.maxAttempts;
+}
+export function recordAuthAttempt(accountId) {
+    const key = getAccountKey(accountId);
+    const now = Date.now();
+    let record = attemptsByAccount.get(key);
+    if (!record) {
+        record = { timestamps: [] };
+        attemptsByAccount.set(key, record);
+    }
+    pruneOldAttempts(record, now);
+    record.timestamps.push(now);
+}
+export function getAttemptsRemaining(accountId) {
+    const key = getAccountKey(accountId);
+    const record = attemptsByAccount.get(key);
+    if (!record) {
+        return config.maxAttempts;
+    }
+    const now = Date.now();
+    pruneOldAttempts(record, now);
+    return Math.max(0, config.maxAttempts - record.timestamps.length);
+}
+export function getTimeUntilReset(accountId) {
+    const key = getAccountKey(accountId);
+    const record = attemptsByAccount.get(key);
+    if (!record || record.timestamps.length === 0) {
+        return 0;
+    }
+    const now = Date.now();
+    pruneOldAttempts(record, now);
+    if (record.timestamps.length === 0) {
+        return 0;
+    }
+    const oldestAttempt = Math.min(...record.timestamps);
+    const resetTime = oldestAttempt + config.windowMs;
+    return Math.max(0, resetTime - now);
+}
+export function resetAuthRateLimit(accountId) {
+    const key = getAccountKey(accountId);
+    attemptsByAccount.delete(key);
+}
+export function resetAllAuthRateLimits() {
+    attemptsByAccount.clear();
+}
+export class AuthRateLimitError extends Error {
+    accountId;
+    attemptsRemaining;
+    resetAfterMs;
+    constructor(accountId, attemptsRemaining, resetAfterMs) {
+        const resetSeconds = Math.ceil(resetAfterMs / 1000);
+        super(`Auth rate limit exceeded for account. Retry after ${resetSeconds}s`);
+        this.accountId = accountId;
+        this.attemptsRemaining = attemptsRemaining;
+        this.resetAfterMs = resetAfterMs;
+        this.name = "AuthRateLimitError";
+    }
+}
+export function checkAuthRateLimit(accountId) {
+    if (!canAttemptAuth(accountId)) {
+        throw new AuthRateLimitError(accountId, getAttemptsRemaining(accountId), getTimeUntilReset(accountId));
+    }
+}
+//# sourceMappingURL=auth-rate-limit.js.map

package/dist/lib/auth-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-rate-limit.js","sourceRoot":"","sources":["../../lib/auth-rate-limit.ts"],"names":[],"mappings":"AAKA,MAAM,cAAc,GAAwB;IAC3C,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,MAAM;CAChB,CAAC;AAMF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAC;AAC3D,IAAI,MAAM,GAAwB,EAAE,GAAG,cAAc,EAAE,CAAC;AAExD,MAAM,UAAU,sBAAsB,CAAC,SAAuC;IAC7E,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACvC,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAqB,EAAE,GAAW;IAC3D,MAAM,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;IACrC,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC/C,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9B,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAClD,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC5B,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACrD,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,WAAW,CAAC;IAC3B,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAClD,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,CAAC;IACV,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9B,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,CAAC;IACV,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IAElD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IACnD,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACrC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAE3B;IACA;IACA;IAHjB,YACiB,SAAiB,EACjB,iBAAyB,EACzB,YAAoB;QAEpC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QACpD,KAAK,CAAC,qDAAqD,YAAY,GAAG,CAAC,CAAC;QAL5D,cAAS,GAAT,SAAS,CAAQ;QACjB,sBAAiB,GAAjB,iBAAiB,CAAQ;QACzB,iBAAY,GAAZ,YAAY,CAAQ;QAIpC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAClC,CAAC;CACD;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IACnD,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,CAC3B,SAAS,EACT,oBAAoB,CAAC,SAAS,CAAC,EAC/B,iBAAiB,CAAC,SAAS,CAAC,CAC5B,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/lib/auto-update-checker.d.ts

@@ -0,0 +1,10 @@
+export interface UpdateCheckResult {
+    hasUpdate: boolean;
+    currentVersion: string;
+    latestVersion: string | null;
+    updateCommand: string;
+}
+export declare function checkForUpdates(force?: boolean): Promise<UpdateCheckResult>;
+export declare function checkAndNotify(showToast?: (message: string, variant: "info" | "warning") => Promise<void>): Promise<void>;
+export declare function clearUpdateCache(): void;
+//# sourceMappingURL=auto-update-checker.d.ts.map

package/dist/lib/auto-update-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-update-checker.d.ts","sourceRoot":"","sources":["../../lib/auto-update-checker.ts"],"names":[],"mappings":"AA6LA,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,eAAe,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+B/E;AAED,wBAAsB,cAAc,CAClC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GAC1E,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC"}