codex-multi-auth 2.17.0 → 2.17.3

package/dist/lib/storage/record-identity.js

@@ -0,0 +1,16 @@
+import { createHash } from "node:crypto";
+/** Derive a legacy record identity before its first persisted token rotation. */
+export function deriveAccountRecordId(account) {
+    const seed = [
+        account.addedAt,
+        account.accountId?.trim() ?? "",
+        account.email?.trim().toLowerCase() ?? "",
+        account.refreshToken.trim(),
+    ].join("\u0000");
+    return `record:${createHash("sha256").update(seed).digest("hex")}`;
+}
+/** Resolve the persisted identity, or derive it for a legacy row. */
+export function resolveAccountRecordId(account) {
+    const stored = account.recordId?.trim();
+    return stored || deriveAccountRecordId(account);
+}

package/dist/lib/storage/record-utils.d.ts

@@ -1,3 +1,2 @@
 export declare function isRecord(value: unknown): value is Record<string, unknown>;
 export declare function clampIndex(index: number, length: number): number;
-//# sourceMappingURL=record-utils.d.ts.map

package/dist/lib/storage/restore-assessment.d.ts

@@ -4,4 +4,3 @@ export declare function buildRestoreAssessment(params: {
     backupMetadata: BackupMetadata;
     hasResetMarker: boolean;
 }): RestoreAssessment;
-//# sourceMappingURL=restore-assessment.d.ts.map

package/dist/lib/storage/restore-backup-entry.d.ts

@@ -21,4 +21,3 @@ export declare function restoreAccountsFromBackupEntry(params: {
     }>;
     saveAccounts: (storage: AccountStorageV3) => Promise<void>;
 }): Promise<AccountStorageV3>;
-//# sourceMappingURL=restore-backup-entry.d.ts.map

package/dist/lib/storage/restore-metadata.d.ts

@@ -7,4 +7,3 @@ type AccountStorageWithMetadata = AccountStorageV3 & {
 export declare function createEmptyStorageWithRestoreMetadata(restoreEligible: boolean, restoreReason: RestoreReason): AccountStorageWithMetadata;
 export declare function withRestoreMetadata(storage: AccountStorageV3, restoreEligible: boolean, restoreReason: RestoreReason): AccountStorageWithMetadata;
 export {};
-//# sourceMappingURL=restore-metadata.d.ts.map

package/dist/lib/storage/save-retry.d.ts

@@ -7,4 +7,3 @@
 import type { AccountStorageV3 } from "./public-types.js";
 export declare function isRetryableStorageWriteError(error: unknown): boolean;
 export declare function saveAccountsWithRetry(storage: AccountStorageV3, saveAccounts: (storage: AccountStorageV3) => Promise<void>): Promise<void>;
-//# sourceMappingURL=save-retry.d.ts.map

package/dist/lib/storage/snapshot-inspectors.d.ts

@@ -19,4 +19,3 @@ export declare function describeFlaggedSnapshot(path: string, kind: BackupSnapsh
     loadFlaggedAccountsFromPath: (path: string) => Promise<FlaggedAccountStorageV1>;
     logWarn?: (message: string, meta: Record<string, unknown>) => void;
 }): Promise<BackupSnapshotMetadata>;
-//# sourceMappingURL=snapshot-inspectors.d.ts.map

package/dist/lib/storage/snapshot-merge.d.ts

@@ -13,4 +13,3 @@ export declare function mergeAccountSnapshot(base: AccountStorageV3 | null, curr
 /** Save observations independently of unresolved user-edit conflicts. Inventory stays disk-owned. */
 export declare function mergeAccountRuntimeObservations(base: AccountStorageV3, current: AccountStorageV3, local: AccountStorageV3): AccountStorageV3;
 export {};
-//# sourceMappingURL=snapshot-merge.d.ts.map

package/dist/lib/storage/storage-parser.d.ts

@@ -28,5 +28,6 @@ export declare function loadAccountsFromPath(path: string, deps: {
     normalized: AccountStorageV3 | null;
     storedVersion: unknown;
     schemaErrors: string[];
+    /** sha256 of the exact bytes read, for cheap unchanged-content checks. */
+    contentSha256: string;
 }>;
-//# sourceMappingURL=storage-parser.d.ts.map

package/dist/lib/storage/storage-parser.js

@@ -1,6 +1,7 @@
 import { promises as fs } from "node:fs";
 import { AnyAccountStorageSchema, getValidationErrors, safeParseJson, } from "../schemas.js";
 import { withFileOperationRetry } from "../fs-retry.js";
+import { computeSha256 } from "./hash.js";
 export function parseAndNormalizeStorage(data, normalizeAccountStorage, isRecord) {
     const schemaErrors = getValidationErrors(AnyAccountStorageSchema, data);
     const normalized = normalizeAccountStorage(data);
@@ -33,18 +34,25 @@ export async function loadAccountsFromPath(path, deps) {
     // unchanged; JSON.parse runs outside the retry, so the SyntaxError → recovery
     // contract documented above is also preserved.
     const content = await withFileOperationRetry(() => fs.readFile(path, "utf-8"));
+    const contentSha256 = computeSha256(content);
     // Run the Zod-guarded JSON boundary first. Returns null on either a
     // `SyntaxError` or a schema mismatch; we disambiguate below so the
     // `SyntaxError` contract keeps propagating to callers that rely on it
     // for WAL / backup recovery.
     const validated = safeParseJson(content, AnyAccountStorageSchema, "storage-parser.loadAccountsFromPath");
     if (validated !== null) {
-        return parseAndNormalizeStorage(validated, deps.normalizeAccountStorage, deps.isRecord);
+        return {
+            ...parseAndNormalizeStorage(validated, deps.normalizeAccountStorage, deps.isRecord),
+            contentSha256,
+        };
     }
     // `validated === null`: either SyntaxError or schema mismatch.
     // A raw JSON.parse distinguishes them: SyntaxError propagates to preserve
     // existing recovery semantics; otherwise fall through to the TS normalizer
     // (legacy unknown-shape path, surfaced via `schemaErrors`).
     const data = JSON.parse(content);
-    return parseAndNormalizeStorage(data, deps.normalizeAccountStorage, deps.isRecord);
+    return {
+        ...parseAndNormalizeStorage(data, deps.normalizeAccountStorage, deps.isRecord),
+        contentSha256,
+    };
 }

package/dist/lib/storage/transactions.d.ts

@@ -29,4 +29,3 @@ export declare function withAccountAndFlaggedStorageTransaction<T>(handler: (cur
     cloneAccountStorageForPersistence: (storage: AccountStorageV3 | null | undefined) => AccountStorageV3;
     logRollbackError: (error: unknown, rollbackError: unknown) => void;
 }): Promise<T>;
-//# sourceMappingURL=transactions.d.ts.map

package/dist/lib/storage.d.ts

@@ -156,7 +156,21 @@ export declare function withFlaggedStorageTransaction<T>(handler: (current: Flag
  * @param storage - Account storage data to save
  * @throws StorageError with platform-aware hints on failure
  */
-/** Clone a loaded working snapshot without losing its optimistic-concurrency baseline. */
+/**
+ * Clone a loaded working snapshot without losing its optimistic-concurrency baseline.
+ *
+ * Baseline contract: `saveAccounts` only runs the three-way merge
+ * (`mergeAccountSnapshot` against a fresh `loadPrimaryAccountsForMerge` read)
+ * when the saved object is registered in `loadedAccountSnapshots` — and that
+ * WeakMap is keyed by OBJECT IDENTITY, so registration does not survive
+ * `structuredClone`, `JSON.parse(JSON.stringify(...))`, spread copies, or
+ * manual reconstruction. A baseline-less save writes the object as-is
+ * (last-writer-wins): concurrent changes are neither merged nor flagged with
+ * ESTALE, and when the primary on disk differs from the state this process
+ * last read or wrote the save additionally emits a one-time baseline-less
+ * overwrite warning. Use this helper — or mutate the loaded object in place —
+ * to keep the merge armed.
+ */
 export declare function cloneTrackedAccountStorage(storage: AccountStorageV3): AccountStorageV3;
 export declare function saveAccounts(storage: AccountStorageV3): Promise<void>;
 /**
@@ -185,4 +199,3 @@ export declare function importAccounts(filePath: string): Promise<{
     total: number;
     skipped: number;
 }>;
-//# sourceMappingURL=storage.d.ts.map