codex-multi-auth 0.1.7 → 0.1.8

package/dist/lib/context-overflow.js

@@ -32,16 +32,16 @@ export function isContextOverflowError(status, bodyText) {
 /**
  * The message shown to users when context overflow occurs
  */
-const CONTEXT_OVERFLOW_MESSAGE = `[Plugin Notice] Context is too long for this model.
-
-Please use one of these commands to reduce context size:
-
-• **/compact** - Compress conversation history (recommended)
-• **/clear** - Start fresh with empty context
-• **/undo** - Remove recent messages
-
-Then retry your request.
-
+const CONTEXT_OVERFLOW_MESSAGE = `[Plugin Notice] Context is too long for this model.
+
+Please use one of these commands to reduce context size:
+
+• **/compact** - Compress conversation history (recommended)
+• **/clear** - Start fresh with empty context
+• **/undo** - Remove recent messages
+
+Then retry your request.
+
 Alternatively, you can switch to a model with a larger context window.`;
 /**
  * Creates a synthetic SSE response for context overflow errors.

package/dist/lib/named-backup-export.d.ts

@@ -0,0 +1,69 @@
+export interface NamedBackupExportDependencies {
+    getStoragePath: () => string;
+    exportAccounts: (filePath: string, force?: boolean, beforeCommit?: (resolvedPath: string) => Promise<void> | void) => Promise<void>;
+}
+/**
+ * Validate and normalize a user-provided backup name into a safe `<name>.json` filename.
+ *
+ * Performs trimming, rejects path separators and traversal tokens, forbids rotation-style
+ * substrings and temporary suffixes, and enforces that the base name contains only
+ * letters, numbers, hyphens, and underscores. Checks that a resulting base name is non-empty
+ * and returns the base name with a `.json` extension appended.
+ *
+ * Notes:
+ * - Validation checks that are sensitive to case are performed using a lowercased form;
+ *   this mirrors Windows case-insensitive filesystem behavior for prohibited patterns.
+ * - The function is synchronous and safe for concurrent use (pure string validation/normalization).
+ * - Token redaction: traversal tokens (`..`), path separators, rotation-style substrings,
+ *   and temporary suffixes are rejected rather than sanitized.
+ *
+ * @param name - The user-provided filename or identifier (may include a `.json` extension)
+ * @returns The validated filename with a `.json` extension appended
+ * @throws Error if the name is empty, contains separators or traversal tokens, contains
+ *         prohibited substrings, ends with an invalid temporary suffix, contains disallowed
+ *         characters, or would result in an empty base name
+ */
+export declare function normalizeNamedBackupFileName(name: string): string;
+/**
+ * Compute the absolute path for the "backups" directory placed alongside the given storage path.
+ *
+ * This performs only path resolution and string manipulation; it does not access the filesystem and is insensitive to concurrent filesystem changes. It does not redact or sanitize tokens or sensitive substrings in `storagePath`. Note: other functions in this module handle Windows case-insensitive comparisons when validating paths.
+ *
+ * @param storagePath - Storage file or directory path (may be relative or absolute)
+ * @returns The resolved path to the backups directory adjacent to `storagePath` (i.e. dirname(storagePath)/backups)
+ */
+export declare function getNamedBackupRoot(storagePath: string): string;
+/**
+ * Resolve and validate a safe backup file path for a named backup inside the storage path's backups directory.
+ *
+ * @param name - User-provided backup name; will be normalized and validated (disallows path separators, `..`, prohibited substrings, and invalid suffixes such as `.tmp`/`.wal`) and the canonical filename (`*.json`) will be produced.
+ * @param storagePath - Base storage path used to locate the backups directory; path comparisons treat Windows paths case-insensitively.
+ * @returns The absolute, validated path to the backup file within the backups directory.
+ *
+ * Concurrency: this function only computes and validates the path and does not create files or directories; callers must handle concurrent filesystem operations (e.g., directory creation or file writes).
+ */
+export declare function resolveNamedBackupPath(name: string, storagePath: string): string;
+/**
+ * Create a named backup file inside the storage path's backups directory and return its resolved path.
+ *
+ * The provided `name` is validated and normalized (suffix, allowed characters, and prohibited substrings) and the
+ * backup root directory is created if missing. The export operation will be asked to write to the resolved path; a
+ * safety check ensures the final resolved path stays within the backups root.
+ * The delegated `beforeCommit` hook re-validates containment immediately before
+ * the storage layer commits the final rename, but callers should still serialize
+ * backup-root mutations rather than relying on path checks alone.
+ *
+ * Concurrency: callers should avoid concurrent exports that target the same `name` as behavior is unspecified.
+ * Windows behavior: file-name/path comparisons are case-insensitive and names are normalized to lowercase.
+ * Token rules: input `name` is checked to prevent path traversal, separators, rotation-style substrings, and certain
+ * invalid suffixes (e.g., `.tmp`, `.wal`); the final returned path always includes the `.json` extension.
+ *
+ * @param name - The desired backup file name (validated and normalized).
+ * @param dependencies - Object providing storage path resolution and the exportAccounts implementation.
+ * @param options.force - When true, request overwriting an existing backup.
+ * @returns The absolute path to the created backup file (including `.json`).
+ */
+export declare function exportNamedBackupFile(name: string, dependencies: NamedBackupExportDependencies, options?: {
+    force?: boolean;
+}): Promise<string>;
+//# sourceMappingURL=named-backup-export.d.ts.map

package/dist/lib/named-backup-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-backup-export.d.ts","sourceRoot":"","sources":["../../lib/named-backup-export.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,6BAA6B;IAC7C,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,cAAc,EAAE,CACf,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,OAAO,EACf,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,KACzD,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AA6ED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwCjE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACrC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GACjB,MAAM,CAMR;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,qBAAqB,CAC1C,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,6BAA6B,EAC3C,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAuBjB"}

package/dist/lib/named-backup-export.js

@@ -0,0 +1,207 @@
+import { existsSync, promises as fs, lstatSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, } from "node:path";
+import { resolvePath } from "./storage/paths.js";
+const BACKUP_EXPORT_DIR_NAME = "backups";
+const BACKUP_FILE_EXTENSION = ".json";
+const BACKUP_SAFE_NAME_REGEX = /^[a-zA-Z0-9_-]+$/;
+const BACKUP_WINDOWS_RESERVED_NAME_REGEX = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
+const BACKUP_INVALID_SUFFIXES = [".tmp", ".wal"];
+const BACKUP_PROHIBITED_SUBSTRINGS = [".rotate."];
+const inFlightNamedBackupExports = new Set();
+/**
+ * Compute a canonical, comparison-ready filesystem path for the given input.
+ *
+ * Resolves the input to an absolute path, resolves symlinks (realpath) if the path exists, and on Windows converts the resulting canonical path to lowercase for case-insensitive comparisons. The function does not mask or redact any sensitive tokens contained in the path. Note: the returned value may become stale if the filesystem changes after this call (race conditions are possible).
+ *
+ * @param pathValue - The input filesystem path to normalize.
+ * @returns The canonicalized path suitable for equality or containment comparisons; on Windows the result is returned in lowercase.
+ */
+function normalizePathForComparison(pathValue) {
+    const resolvedPath = resolve(pathValue);
+    const canonicalPath = existsSync(resolvedPath)
+        ? realpathSync(resolvedPath)
+        : resolvedPath;
+    return process.platform === "win32"
+        ? canonicalPath.toLowerCase()
+        : canonicalPath;
+}
+/**
+ * Ensures the resolved target path is located inside the resolved base directory.
+ *
+ * Validates that `baseDir` is not a symbolic link and that the canonical/resolved
+ * forms of `baseDir` and `targetPath` keep `targetPath` rooted under `baseDir`.
+ * On Windows, comparisons are performed in a case-insensitive manner via the
+ * normalization helper. Errors do not include the original path values.
+ *
+ * Concurrency: callers must avoid concurrently mutating the filesystem (for example
+ * creating/removing/moving symlinks or directories) between calling this function
+ * and any subsequent operations that rely on its result. `exportNamedBackupFile`
+ * performs a second containment check through the `beforeCommit` hook, but that
+ * revalidation narrows rather than eliminates time-of-check/time-of-use windows.
+ *
+ * @param baseDir - The directory to treat as the backup root; must remain stable during validation.
+ * @param targetPath - The candidate target file path that must reside within `baseDir`.
+ * @throws Error with message "Named backup path escapes the backup root" if `baseDir` is a symlink,
+ *         if the canonical and resolved base paths differ, or if `targetPath` is not contained
+ *         within `baseDir`.
+ */
+function assertWithinDirectory(baseDir, targetPath) {
+    const resolvedBase = resolve(baseDir);
+    let baseStat = null;
+    try {
+        baseStat = lstatSync(resolvedBase);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== "ENOENT") {
+            throw error;
+        }
+    }
+    if (baseStat) {
+        if (baseStat.isSymbolicLink()) {
+            throw new Error("Named backup path escapes the backup root");
+        }
+        const canonicalBase = realpathSync(resolvedBase);
+        const comparableCanonicalBase = process.platform === "win32"
+            ? canonicalBase.toLowerCase()
+            : canonicalBase;
+        const comparableResolvedBase = process.platform === "win32" ? resolvedBase.toLowerCase() : resolvedBase;
+        if (comparableCanonicalBase !== comparableResolvedBase) {
+            throw new Error("Named backup path escapes the backup root");
+        }
+    }
+    const normalizedBase = normalizePathForComparison(baseDir);
+    const targetParent = dirname(targetPath);
+    const normalizedTargetParent = normalizePathForComparison(targetParent);
+    const normalizedTarget = join(normalizedTargetParent, basename(targetPath));
+    const rel = relative(normalizedBase, normalizedTarget);
+    if (rel === "" || (!rel.startsWith("..") && !isAbsolute(rel))) {
+        return;
+    }
+    throw new Error("Named backup path escapes the backup root");
+}
+/**
+ * Validate and normalize a user-provided backup name into a safe `<name>.json` filename.
+ *
+ * Performs trimming, rejects path separators and traversal tokens, forbids rotation-style
+ * substrings and temporary suffixes, and enforces that the base name contains only
+ * letters, numbers, hyphens, and underscores. Checks that a resulting base name is non-empty
+ * and returns the base name with a `.json` extension appended.
+ *
+ * Notes:
+ * - Validation checks that are sensitive to case are performed using a lowercased form;
+ *   this mirrors Windows case-insensitive filesystem behavior for prohibited patterns.
+ * - The function is synchronous and safe for concurrent use (pure string validation/normalization).
+ * - Token redaction: traversal tokens (`..`), path separators, rotation-style substrings,
+ *   and temporary suffixes are rejected rather than sanitized.
+ *
+ * @param name - The user-provided filename or identifier (may include a `.json` extension)
+ * @returns The validated filename with a `.json` extension appended
+ * @throws Error if the name is empty, contains separators or traversal tokens, contains
+ *         prohibited substrings, ends with an invalid temporary suffix, contains disallowed
+ *         characters, or would result in an empty base name
+ */
+export function normalizeNamedBackupFileName(name) {
+    const trimmed = (name ?? "").trim();
+    if (trimmed.length === 0) {
+        throw new Error("Named backup requires a non-empty filename");
+    }
+    if (/[\\/]/.test(trimmed)) {
+        throw new Error("Backup filename must not contain path separators");
+    }
+    if (trimmed.includes("..")) {
+        throw new Error("Backup filename must not contain traversal tokens");
+    }
+    const lower = trimmed.toLowerCase();
+    if (BACKUP_PROHIBITED_SUBSTRINGS.some((value) => lower.includes(value))) {
+        throw new Error("Backup filename may not contain rotation-style sequences");
+    }
+    const hasJsonExtension = lower.endsWith(BACKUP_FILE_EXTENSION);
+    const baseName = hasJsonExtension
+        ? trimmed.slice(0, trimmed.length - BACKUP_FILE_EXTENSION.length)
+        : trimmed;
+    if (baseName.length === 0) {
+        throw new Error("Backup filename cannot be just an extension");
+    }
+    const baseLower = baseName.toLowerCase();
+    if (BACKUP_INVALID_SUFFIXES.some((value) => baseLower.endsWith(value))) {
+        throw new Error("Backup filename may not end with temporary suffixes");
+    }
+    if (BACKUP_WINDOWS_RESERVED_NAME_REGEX.test(baseName)) {
+        throw new Error("Backup filename may not use a reserved Windows device name");
+    }
+    if (!BACKUP_SAFE_NAME_REGEX.test(baseName)) {
+        throw new Error("Backup filename may only contain letters, numbers, hyphens, and underscores; dots (.) are not allowed");
+    }
+    return `${baseName}${BACKUP_FILE_EXTENSION}`;
+}
+/**
+ * Compute the absolute path for the "backups" directory placed alongside the given storage path.
+ *
+ * This performs only path resolution and string manipulation; it does not access the filesystem and is insensitive to concurrent filesystem changes. It does not redact or sanitize tokens or sensitive substrings in `storagePath`. Note: other functions in this module handle Windows case-insensitive comparisons when validating paths.
+ *
+ * @param storagePath - Storage file or directory path (may be relative or absolute)
+ * @returns The resolved path to the backups directory adjacent to `storagePath` (i.e. dirname(storagePath)/backups)
+ */
+export function getNamedBackupRoot(storagePath) {
+    const resolvedStoragePath = resolvePath(storagePath);
+    return resolvePath(join(dirname(resolvedStoragePath), BACKUP_EXPORT_DIR_NAME));
+}
+/**
+ * Resolve and validate a safe backup file path for a named backup inside the storage path's backups directory.
+ *
+ * @param name - User-provided backup name; will be normalized and validated (disallows path separators, `..`, prohibited substrings, and invalid suffixes such as `.tmp`/`.wal`) and the canonical filename (`*.json`) will be produced.
+ * @param storagePath - Base storage path used to locate the backups directory; path comparisons treat Windows paths case-insensitively.
+ * @returns The absolute, validated path to the backup file within the backups directory.
+ *
+ * Concurrency: this function only computes and validates the path and does not create files or directories; callers must handle concurrent filesystem operations (e.g., directory creation or file writes).
+ */
+export function resolveNamedBackupPath(name, storagePath) {
+    const fileName = normalizeNamedBackupFileName(name);
+    const backupRoot = getNamedBackupRoot(storagePath);
+    const candidate = resolvePath(join(backupRoot, fileName));
+    assertWithinDirectory(backupRoot, candidate);
+    return candidate;
+}
+/**
+ * Create a named backup file inside the storage path's backups directory and return its resolved path.
+ *
+ * The provided `name` is validated and normalized (suffix, allowed characters, and prohibited substrings) and the
+ * backup root directory is created if missing. The export operation will be asked to write to the resolved path; a
+ * safety check ensures the final resolved path stays within the backups root.
+ * The delegated `beforeCommit` hook re-validates containment immediately before
+ * the storage layer commits the final rename, but callers should still serialize
+ * backup-root mutations rather than relying on path checks alone.
+ *
+ * Concurrency: callers should avoid concurrent exports that target the same `name` as behavior is unspecified.
+ * Windows behavior: file-name/path comparisons are case-insensitive and names are normalized to lowercase.
+ * Token rules: input `name` is checked to prevent path traversal, separators, rotation-style substrings, and certain
+ * invalid suffixes (e.g., `.tmp`, `.wal`); the final returned path always includes the `.json` extension.
+ *
+ * @param name - The desired backup file name (validated and normalized).
+ * @param dependencies - Object providing storage path resolution and the exportAccounts implementation.
+ * @param options.force - When true, request overwriting an existing backup.
+ * @returns The absolute path to the created backup file (including `.json`).
+ */
+export async function exportNamedBackupFile(name, dependencies, options) {
+    const storagePath = dependencies.getStoragePath();
+    const destination = resolveNamedBackupPath(name, storagePath);
+    const backupRoot = getNamedBackupRoot(storagePath);
+    const exportKey = normalizePathForComparison(destination);
+    if (!options?.force && inFlightNamedBackupExports.has(exportKey)) {
+        throw new Error(`File already exists: ${destination}`);
+    }
+    assertWithinDirectory(dirname(backupRoot), backupRoot);
+    await fs.mkdir(backupRoot, { recursive: true });
+    inFlightNamedBackupExports.add(exportKey);
+    try {
+        await dependencies.exportAccounts(destination, options?.force === true, (resolvedPath) => {
+            assertWithinDirectory(backupRoot, resolvedPath);
+        });
+        return destination;
+    }
+    finally {
+        inFlightNamedBackupExports.delete(exportKey);
+    }
+}
+//# sourceMappingURL=named-backup-export.js.map

package/dist/lib/named-backup-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-backup-export.js","sourceRoot":"","sources":["../../lib/named-backup-export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EACN,QAAQ,EACR,OAAO,EACP,UAAU,EACV,IAAI,EACJ,QAAQ,EACR,OAAO,GACP,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,sBAAsB,GAAG,SAAS,CAAC;AACzC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AACtC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAClD,MAAM,kCAAkC,GACvC,wCAAwC,CAAC;AAC1C,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACjD,MAAM,4BAA4B,GAAG,CAAC,UAAU,CAAC,CAAC;AAClD,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;AAWrD;;;;;;;GAOG;AACH,SAAS,0BAA0B,CAAC,SAAiB;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC;QAC7C,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC;QAC5B,CAAC,CAAC,YAAY,CAAC;IAChB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QAClC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE;QAC7B,CAAC,CAAC,aAAa,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,qBAAqB,CAAC,OAAe,EAAE,UAAkB;IACjE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,QAAQ,GAAwC,IAAI,CAAC;IACzD,IAAI,CAAC;QACJ,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACd,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,aAAa,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,uBAAuB,GAC5B,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC3B,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE;YAC7B,CAAC,CAAC,aAAa,CAAC;QAClB,MAAM,sBAAsB,GAC3B,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;QAC1E,IAAI,uBAAuB,KAAK,sBAAsB,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC9D,CAAC;IACF,CAAC;IACD,MAAM,cAAc,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACvD,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO;IACR,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACxD,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,gBAAgB;QAChC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;QACjE,CAAC,CAAC,OAAO,CAAC;IACX,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACd,4DAA4D,CAC5D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACd,uGAAuG,CACvG,CAAC;IACH,CAAC;IAED,OAAO,GAAG,QAAQ,GAAG,qBAAqB,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACrD,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,WAAW,CACjB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,sBAAsB,CAAC,CAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACrC,IAAY,EACZ,WAAmB;IAEnB,MAAM,QAAQ,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1D,qBAAqB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,IAAY,EACZ,YAA2C,EAC3C,OAA6B;IAE7B,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;IAClD,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC;QACJ,MAAM,YAAY,CAAC,cAAc,CAChC,WAAW,EACX,OAAO,EAAE,KAAK,KAAK,IAAI,EACvB,CAAC,YAAY,EAAE,EAAE;YAChB,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACjD,CAAC,CACD,CAAC;QACF,OAAO,WAAW,CAAC;IACpB,CAAC;YAAS,CAAC;QACV,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;AACF,CAAC"}

package/dist/lib/oc-chatgpt-import-adapter.d.ts

@@ -0,0 +1,64 @@
+import { type AccountStorageV3 } from "./storage.js";
+type MatchStrategy = "accountId" | "email" | "refreshToken";
+export type OcChatgptImportPayload = AccountStorageV3;
+export type OcChatgptPreviewPayload = {
+    version: 3;
+    activeIndex: number;
+    activeIndexByFamily?: AccountStorageV3["activeIndexByFamily"];
+    accounts: OcChatgptAccountRef[];
+};
+export type OcChatgptAccountRef = {
+    accountId?: string;
+    email?: string;
+    refreshTokenLast4: string;
+};
+export type OcChatgptMergePreview = {
+    payload: OcChatgptPreviewPayload;
+    merged: AccountStorageV3;
+    toAdd: OcChatgptAccountRef[];
+    toUpdate: Array<{
+        previous: OcChatgptAccountRef;
+        next: OcChatgptAccountRef;
+        matchedBy: MatchStrategy;
+    }>;
+    toSkip: Array<{
+        source: OcChatgptAccountRef;
+        reason: string;
+    }>;
+    unchangedDestinationOnly: OcChatgptAccountRef[];
+    activeSelectionBehavior: "preserve-destination";
+};
+/**
+ * Produce a normalized AccountStorageV3 payload suitable for OC ChatGPT import.
+ *
+ * Normalizes and sanitizes the provided source storage for the target importer.
+ *
+ * @param source - The source AccountStorageV3 to normalize, or `null` to normalize an empty input.
+ * @returns A normalized AccountStorageV3 ready for import. WARNING: this object may include raw `refreshToken` values; redact or mask tokens before logging, persisting to logs, or transmitting to external systems.
+ *
+ * Concurrency notes: the function does not perform synchronization; callers are responsible for coordinating concurrent access to the source data.
+ *
+ * Filesystem note: the function performs in-memory transformations only and has no special behavior for Windows filesystem semantics.
+ */
+export declare function buildOcChatgptImportPayload(source: AccountStorageV3 | null): OcChatgptImportPayload;
+/**
+ * Produces a detailed merge preview and merged storage that reconciles a source and destination AccountStorageV3.
+ *
+ * Normalizes source and destination inputs, identifies accounts to add, update, or skip (with reasons), preserves
+ * destination-only unchanged accounts, and returns a merged AccountStorageV3 plus a preview payload. Refresh tokens
+ * in preview entries are redacted (masked to last four characters). The function is synchronous, stateless, performs
+ * no filesystem I/O (no Windows-specific behavior), and is safe to call concurrently from multiple callers.
+ *
+ * @param options.source - Source storage to import from; may be `null`.
+ * @param options.destination - Destination storage to merge into; may be `null`.
+ * @returns An OcChatgptMergePreview describing the normalized source preview (`payload`), the resulting merged storage
+ *          (`merged`), lists of accounts to add (`toAdd`), accounts updated with previous/next summaries (`toUpdate`),
+ *          skipped accounts with reasons (`toSkip`), destination-only unchanged accounts (`unchangedDestinationOnly`),
+ *          and an `activeSelectionBehavior` hint.
+ */
+export declare function previewOcChatgptImportMerge(options: {
+    source: AccountStorageV3 | null;
+    destination: AccountStorageV3 | null;
+}): OcChatgptMergePreview;
+export {};
+//# sourceMappingURL=oc-chatgpt-import-adapter.d.ts.map

package/dist/lib/oc-chatgpt-import-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oc-chatgpt-import-adapter.d.ts","sourceRoot":"","sources":["../../lib/oc-chatgpt-import-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,KAAK,gBAAgB,EAErB,MAAM,cAAc,CAAC;AAEtB,KAAK,aAAa,GAAG,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC;AAE5D,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEtD,MAAM,MAAM,uBAAuB,GAAG;IACrC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IAC9D,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,uBAAuB,CAAC;IACjC,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,QAAQ,EAAE,KAAK,CAAC;QACf,QAAQ,EAAE,mBAAmB,CAAC;QAC9B,IAAI,EAAE,mBAAmB,CAAC;QAC1B,SAAS,EAAE,aAAa,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;IAChD,uBAAuB,EAAE,sBAAsB,CAAC;CAChD,CAAC;AA8dF;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,gBAAgB,GAAG,IAAI,GAC7B,sBAAsB,CAGxB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE;IACpD,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC,GAAG,qBAAqB,CA2ExB"}