dsh-plugin-subscription-oauth 0.0.0-stage → 0.2.0

package/lib/auth/registry.js

@@ -0,0 +1,149 @@
+/**
+ * The provider registry: one erased façade over every route's controller.
+ *
+ * The RPC layer talks to this object only, so it never has to know how many
+ * providers exist, what their routes are called, or which login shape each one
+ * uses. Each route's controller is generic over its own session type; this
+ * façade is the single place that erasure happens.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/registry
+ */
+import { BAD_REQUEST, ProviderError } from '../errors.js';
+/**
+ * Where a route sits in the page.
+ *
+ * `auto` is a way to reach every other route, so it leads the list; the routes it
+ * stands in for keep the order they were configured in. Registration order is
+ * therefore not the reading order, and this is the one place that says so.
+ *
+ * @param id - the route key.
+ * @returns the sort rank; lower reads first.
+ */
+function displayRank(id) {
+    return id === 'auto' ? 0 : 1;
+}
+/**
+ * Routes every Settings call to the provider it names.
+ *
+ * A provider key the plugin does not serve is a request error, not an internal
+ * failure: the message names the routes that do exist.
+ */
+export class SubscriptionRegistry {
+    byId;
+    constructor(routes) {
+        this.byId = new Map(routes.map((route) => [route.id, route]));
+    }
+    /** Route keys this registry serves, in display order. */
+    ids() {
+        return [...this.byId.keys()];
+    }
+    /** Every route, in registration order. */
+    all() {
+        return [...this.byId.values()];
+    }
+    /** One route by key, without the request-error path. */
+    get(id) {
+        return this.byId.get(id);
+    }
+    /**
+     * Add one route.
+     *
+     * `auto` is built last on purpose: it stands in for the others, so it is
+     * registered once their catalogs exist, without a circular construction order.
+     * That is a construction detail, not a display one — the page shows `auto`
+     * first, so the reading order is stated here rather than inherited from the
+     * order the routes happened to be built in.
+     *
+     * @param route - the route to serve from now on.
+     * @throws {ProviderError} when the key is already served.
+     */
+    register(route) {
+        if (this.byId.has(route.id)) {
+            throw new ProviderError(`provider ${route.id} is already registered`, BAD_REQUEST);
+        }
+        this.byId.set(route.id, route);
+        // Re-insert in display order: a leading route (Auto) is built last but read first.
+        const ordered = [...this.byId.entries()].sort(([left], [right]) => displayRank(left) - displayRank(right));
+        this.byId.clear();
+        for (const [id, entry] of ordered)
+            this.byId.set(id, entry);
+    }
+    /** One route, or a request error naming the known ones. */
+    route(provider) {
+        const found = this.byId.get(provider);
+        if (found === undefined) {
+            throw new ProviderError(`unknown provider ${JSON.stringify(provider)}; this plugin serves ${[...this.byId.keys()].join(', ')}`, BAD_REQUEST);
+        }
+        return found;
+    }
+    /** Every provider's state, in registration order. */
+    async status() {
+        return { providers: await Promise.all([...this.byId.values()].map((route) => route.status())) };
+    }
+    /** Start a login on one route. */
+    async login(provider, account) {
+        const started = await this.route(provider).login(account);
+        return { prompt: started.prompt, status: await this.status() };
+    }
+    /** Abandon one route's pending login. */
+    async cancel(provider) {
+        await this.route(provider).cancel();
+        return this.status();
+    }
+    /** Forget one account of one route. */
+    async logout(provider, account) {
+        await this.route(provider).logout(account);
+        return this.status();
+    }
+    /** Promote one account to default. */
+    async setDefault(provider, account) {
+        await this.route(provider).setDefault(account);
+        return this.status();
+    }
+    /** Refresh one account's token now. */
+    async refresh(provider, account) {
+        const result = await this.route(provider).refresh(account);
+        return { account: result.account, expiresAt: result.expiresAt, status: await this.status() };
+    }
+    /** Re-read one route's live model list. */
+    async discover(provider, force = false) {
+        await this.route(provider).discover(force);
+        return this.status();
+    }
+    /** Set one model's picker visibility. */
+    async setModelVisible(provider, id, visible) {
+        await this.route(provider).setModelVisible(id, visible);
+        return this.status();
+    }
+    /** Replace one route's model order with one dropped arrangement. */
+    async setModelOrder(provider, ids) {
+        await this.route(provider).setModelOrder(ids);
+        return this.status();
+    }
+    /** Add one model id by hand to one route. */
+    async addModel(provider, id) {
+        await this.route(provider).addModel(id);
+        return this.status();
+    }
+    /** Forget one hand-added model id. */
+    async removeModel(provider, id) {
+        await this.route(provider).removeModel(id);
+        return this.status();
+    }
+    /** Read one route's plan and metered allowances. */
+    async usage(provider, force = false) {
+        const route = this.route(provider);
+        const result = await route.usage(force);
+        return {
+            provider: route.id,
+            usage: result.usage,
+            ...result.error === undefined ? {} : { error: result.error },
+            status: await this.status(),
+        };
+    }
+    /** Re-read every credential file and the shared preferences. */
+    async reload() {
+        await Promise.all([...this.byId.values()].map((route) => route.reload()));
+        return this.status();
+    }
+}

package/lib/auth/rpc.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The host-side transport behind the Settings page.
+ *
+ * Each endpoint is served as its own `POST /api/subscription-oauth.<endpoint>`
+ * Fetch route on the `connection` service. `connection` is deliberately not in
+ * the plugin's `inject` list: a headless composition has no connection service,
+ * and the provider routes must still work there. Nothing else is registered
+ * when it is absent, so the browser half simply finds no routes.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/rpc
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { RpcResult } from '../protocol.js';
+import type { SubscriptionRegistry } from './registry.js';
+/**
+ * Run one endpoint against the registry, converting any failure into the
+ * envelope's error branch — a route handler therefore never throws.
+ *
+ * @param registry - every registered provider route.
+ * @param endpoint - endpoint name, without the prefix.
+ * @param payload - the request's decoded payload.
+ * @returns the envelope result.
+ */
+export declare function dispatchRpc(registry: SubscriptionRegistry, endpoint: string, payload: unknown): Promise<RpcResult>;
+/**
+ * Register every endpoint route on the `connection` service, when one exists.
+ *
+ * @param ctx - the plugin's context.
+ * @param registry - the provider routes every route dispatches through.
+ */
+export declare function registerSubscriptionRpc(ctx: Context, registry: SubscriptionRegistry): void;

package/lib/auth/rpc.js

@@ -0,0 +1,200 @@
+/**
+ * The host-side transport behind the Settings page.
+ *
+ * Each endpoint is served as its own `POST /api/subscription-oauth.<endpoint>`
+ * Fetch route on the `connection` service. `connection` is deliberately not in
+ * the plugin's `inject` list: a headless composition has no connection service,
+ * and the provider routes must still work there. Nothing else is registered
+ * when it is absent, so the browser half simply finds no routes.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/rpc
+ */
+import { BAD_REQUEST, ProviderError } from '../errors.js';
+import { RPC_ENDPOINTS, RPC_PREFIX } from '../protocol.js';
+/** Wrap a value as a successful envelope result. */
+function success(value) {
+    return { ok: true, value };
+}
+/** Classify a thrown failure into the envelope's error shape. */
+function failure(error) {
+    if (error instanceof ProviderError) {
+        return { ok: false, error: { code: error.code, message: error.message, details: {} } };
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, error: { code: 'RPC_FAILED', message, details: {} } };
+}
+/** Build the JSON body of one response envelope. */
+function envelope(rpcId, result, status = 200) {
+    return Response.json({ type: 'server-response', rpcId, result }, { status });
+}
+/** Reject with an envelope the client can read, using the given HTTP status. */
+function rejection(rpcId, code, message, status) {
+    const error = { code, message, details: {} };
+    return envelope(rpcId, { ok: false, error }, status);
+}
+/** Read a non-empty trimmed string field from a payload. */
+function stringField(payload, field) {
+    if (typeof payload !== 'object' || payload === null)
+        return undefined;
+    const value = payload[field];
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+/** Read a boolean field from a payload, defaulting to false when absent. */
+function booleanField(payload, field) {
+    if (typeof payload !== 'object' || payload === null)
+        return false;
+    return payload[field] === true;
+}
+/**
+ * Read a boolean field that the endpoint cannot default.
+ *
+ * A missing value must not silently mean `false` — for a visibility toggle that
+ * would hide the model the caller meant to show.
+ *
+ * @param payload - the request payload.
+ * @param field - required field name.
+ * @returns the supplied boolean.
+ * @throws {ProviderError} when the field is absent or not a boolean.
+ */
+function requiredBooleanField(payload, field) {
+    const value = typeof payload === 'object' && payload !== null
+        ? payload[field]
+        : undefined;
+    if (typeof value !== 'boolean') {
+        throw new ProviderError(`payload.${field} must be a boolean`, BAD_REQUEST);
+    }
+    return value;
+}
+/** Read the provider route a payload names. */
+function requiredProvider(payload, endpoint) {
+    const provider = stringField(payload, 'provider');
+    if (provider === undefined) {
+        throw new ProviderError(`${endpoint} requires a provider`, BAD_REQUEST);
+    }
+    return provider;
+}
+/**
+ * Run one endpoint against the registry, converting any failure into the
+ * envelope's error branch — a route handler therefore never throws.
+ *
+ * @param registry - every registered provider route.
+ * @param endpoint - endpoint name, without the prefix.
+ * @param payload - the request's decoded payload.
+ * @returns the envelope result.
+ */
+export async function dispatchRpc(registry, endpoint, payload) {
+    try {
+        return success(await runEndpoint(registry, endpoint, payload));
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+/**
+ * The endpoint table.
+ * @throws {ProviderError} for a request the registry refuses.
+ */
+async function runEndpoint(registry, endpoint, payload) {
+    switch (endpoint) {
+        case 'status':
+            return registry.status();
+        case 'login':
+            return registry.login(requiredProvider(payload, endpoint), stringField(payload, 'account'));
+        case 'cancel':
+            return registry.cancel(requiredProvider(payload, endpoint));
+        case 'logout':
+            return registry.logout(requiredProvider(payload, endpoint), stringField(payload, 'account'));
+        case 'setDefault': {
+            const account = stringField(payload, 'account');
+            if (account === undefined)
+                throw new ProviderError('setDefault requires an account', BAD_REQUEST);
+            return registry.setDefault(requiredProvider(payload, endpoint), account);
+        }
+        case 'refresh':
+            return registry.refresh(requiredProvider(payload, endpoint), stringField(payload, 'account'));
+        case 'discover':
+            return registry.discover(requiredProvider(payload, endpoint), booleanField(payload, 'force'));
+        case 'setModelVisible': {
+            const id = stringField(payload, 'id');
+            if (id === undefined)
+                throw new ProviderError('setModelVisible requires a model id', BAD_REQUEST);
+            return registry.setModelVisible(requiredProvider(payload, endpoint), id, requiredBooleanField(payload, 'visible'));
+        }
+        case 'addModel':
+        case 'removeModel': {
+            const id = stringField(payload, 'id');
+            if (id === undefined)
+                throw new ProviderError(`${endpoint} requires a model id`, BAD_REQUEST);
+            const provider = requiredProvider(payload, endpoint);
+            return endpoint === 'addModel'
+                ? registry.addModel(provider, id)
+                : registry.removeModel(provider, id);
+        }
+        case 'setModelOrder': {
+            const payloadRecord = typeof payload === 'object' && payload !== null
+                ? payload
+                : {};
+            const ids = payloadRecord.ids;
+            if (!Array.isArray(ids) || ids.some((id) => typeof id !== 'string')) {
+                throw new ProviderError('setModelOrder requires an array of model ids', BAD_REQUEST);
+            }
+            return registry.setModelOrder(requiredProvider(payload, endpoint), ids);
+        }
+        case 'usage':
+            return registry.usage(requiredProvider(payload, endpoint), booleanField(payload, 'force'));
+        case 'reload':
+            return registry.reload();
+        default:
+            throw new ProviderError(`unknown endpoint: ${endpoint}`, BAD_REQUEST);
+    }
+}
+/** Build the Fetch route for one endpoint. */
+function rpcRoute(endpoint, registry) {
+    const method = `${RPC_PREFIX}${endpoint}`;
+    return {
+        path: `/api/${method}`,
+        methods: ['POST'],
+        requestBody: 'buffered',
+        fetch: async (request) => {
+            const contentType = request.headers.get('content-type') ?? '';
+            if (!contentType.toLowerCase().includes('application/json')) {
+                return rejection('', 'gateway/unsupported-media-type', `${method} requires an application/json body`, 415);
+            }
+            const body = await request.text();
+            let parsed;
+            try {
+                parsed = body.length === 0 ? {} : JSON.parse(body);
+            }
+            catch {
+                return rejection('', 'gateway/bad-request', `${method} received an unparseable JSON body`, 400);
+            }
+            const envelopeRequest = parsed;
+            const rpcId = typeof envelopeRequest.rpcId === 'string' ? envelopeRequest.rpcId : '';
+            if (envelopeRequest.type !== 'client-request' || envelopeRequest.method !== method) {
+                return rejection(rpcId, 'gateway/bad-request', `${method} received an envelope for another method`, 400);
+            }
+            return envelope(rpcId, await dispatchRpc(registry, endpoint, envelopeRequest.payload));
+        },
+    };
+}
+/**
+ * Register every endpoint route on the `connection` service, when one exists.
+ *
+ * @param ctx - the plugin's context.
+ * @param registry - the provider routes every route dispatches through.
+ */
+export function registerSubscriptionRpc(ctx, registry) {
+    ctx.inject(['connection'], (connectionCtx) => {
+        const connection = connectionCtx.get('connection');
+        if (connection === undefined)
+            return;
+        const register = (route) => connection.fetch.register(route);
+        for (const endpoint of RPC_ENDPOINTS) {
+            const method = `${RPC_PREFIX}${endpoint}`;
+            connectionCtx.effect(() => register(rpcRoute(endpoint, registry)), `dsh-plugin-subscription-oauth: /api/${method} route`);
+        }
+    });
+}

package/lib/auth/store.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Durable credentials, keyed by provider.
+ *
+ * The file mirrors the subscriptions plugin's layout so both plugins' token
+ * files stay recognisable to a user browsing `~/.dsh/plugins`: a JSON object
+ * keyed by provider, each entry holding a `default` account key and an
+ * `accounts` record. Writes are atomic (temp file plus rename) with owner-only
+ * permissions, so a crash mid-write cannot leave a truncated credential file.
+ *
+ * The store is generic over the session shape: each provider declares its own
+ * session fields plus the parser that validates them, while account keying,
+ * defaults, and the file lifecycle stay shared.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/store
+ */
+/** Fields every provider's stored session carries. */
+export interface SessionBase {
+    accessToken: string;
+    /** Refresh token; absent for a token set the service issued without one. */
+    refreshToken?: string;
+    /** Epoch milliseconds after which `accessToken` must not be sent. */
+    expiresAt: number;
+    /** Service-disclosed account identity, when the tokens carry one. */
+    accountId?: string;
+    email?: string;
+}
+/** True for a plain object usable as a JSON record. */
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/** Read a non-empty trimmed string, or undefined. */
+export declare function nonEmpty(value: unknown): string | undefined;
+/** Read a finite epoch-millisecond value, or undefined. */
+export declare function finiteInstant(value: unknown): number | undefined;
+/**
+ * Derive the account key for one session: the identity the service disclosed,
+ * falling back to a digest of the refresh token so distinct logins stay
+ * distinct even when both tokens are opaque.
+ * @param session - the session to key.
+ * @returns a stable account key.
+ */
+export declare function accountKeyOf(session: SessionBase): string;
+/** Label shown for one account in the Settings page. */
+export declare function accountLabelOf(session: SessionBase): string;
+/**
+ * Owns the on-disk credential file for one provider.
+ *
+ * In-memory state is authoritative between writes: a failed read leaves the
+ * store empty rather than throwing, so a corrupt file degrades to "logged out"
+ * instead of breaking plugin startup.
+ */
+export declare class TokenStore<S extends SessionBase> {
+    private readonly file;
+    private readonly provider;
+    private readonly parse;
+    private entries;
+    private loaded;
+    /**
+     * The in-flight load, shared by every caller.
+     *
+     * Without this, a second caller saw `loaded` already true, skipped the read and
+     * wrote its own state — while the first read was still on its way back and then
+     * replaced that state with the file it had read a moment earlier. A sign-in that
+     * settled quickly enough to overlap the first load was therefore wiped: the
+     * account was saved in memory, the pending read overwrote it, and the next write
+     * persisted the empty document. A flow whose session arrives in milliseconds,
+     * like GLM's polled one, hits that window every time.
+     */
+    private loading;
+    /**
+     * @param file - absolute path of the credential file.
+     * @param provider - section key this store owns.
+     * @param parse - validates and coerces one stored account into a session.
+     */
+    constructor(file: string, provider: string, parse: (value: unknown) => S | undefined);
+    /** Load the file once; later calls share the same in-flight read. */
+    private ensureLoaded;
+    /** Read the document from disk into memory. */
+    private read;
+    /** Re-read the file from disk, discarding in-memory changes. */
+    reload(): Promise<void>;
+    private providerEntry;
+    /** Every stored session, keyed by account. */
+    list(): Promise<Record<string, S>>;
+    /** The default account key, falling back to the only stored account. */
+    defaultAccount(): Promise<string | undefined>;
+    /** Read one account's session. */
+    get(account?: string): Promise<S | undefined>;
+    /** Whether any account is stored. */
+    hasAny(): Promise<boolean>;
+    /** Insert or replace one account, making it the default when none is set. */
+    save(key: string, session: S, options?: {
+        makeDefault?: boolean;
+    }): Promise<void>;
+    /** Promote one account to default. */
+    setDefault(key: string): Promise<void>;
+    /** Remove one account; the default moves to a remaining account when any. */
+    remove(key: string): Promise<void>;
+    /** Write the file atomically with owner-only permissions. */
+    private persist;
+}

package/lib/auth/store.js

@@ -0,0 +1,213 @@
+/**
+ * Durable credentials, keyed by provider.
+ *
+ * The file mirrors the subscriptions plugin's layout so both plugins' token
+ * files stay recognisable to a user browsing `~/.dsh/plugins`: a JSON object
+ * keyed by provider, each entry holding a `default` account key and an
+ * `accounts` record. Writes are atomic (temp file plus rename) with owner-only
+ * permissions, so a crash mid-write cannot leave a truncated credential file.
+ *
+ * The store is generic over the session shape: each provider declares its own
+ * session fields plus the parser that validates them, while account keying,
+ * defaults, and the file lifecycle stay shared.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/store
+ */
+import { createHash } from 'node:crypto';
+import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+/** True for a plain object usable as a JSON record. */
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Read a non-empty trimmed string, or undefined. */
+export function nonEmpty(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+/** Read a finite epoch-millisecond value, or undefined. */
+export function finiteInstant(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+/**
+ * Derive the account key for one session: the identity the service disclosed,
+ * falling back to a digest of the refresh token so distinct logins stay
+ * distinct even when both tokens are opaque.
+ * @param session - the session to key.
+ * @returns a stable account key.
+ */
+export function accountKeyOf(session) {
+    if (session.accountId !== undefined)
+        return session.accountId;
+    if (session.email !== undefined)
+        return session.email;
+    const secret = session.refreshToken ?? session.accessToken;
+    return createHash('sha256').update(secret).digest('hex').slice(0, 16);
+}
+/** Label shown for one account in the Settings page. */
+export function accountLabelOf(session) {
+    return session.email ?? session.accountId ?? accountKeyOf(session);
+}
+/**
+ * Owns the on-disk credential file for one provider.
+ *
+ * In-memory state is authoritative between writes: a failed read leaves the
+ * store empty rather than throwing, so a corrupt file degrades to "logged out"
+ * instead of breaking plugin startup.
+ */
+export class TokenStore {
+    file;
+    provider;
+    parse;
+    entries = {};
+    loaded = false;
+    /**
+     * The in-flight load, shared by every caller.
+     *
+     * Without this, a second caller saw `loaded` already true, skipped the read and
+     * wrote its own state — while the first read was still on its way back and then
+     * replaced that state with the file it had read a moment earlier. A sign-in that
+     * settled quickly enough to overlap the first load was therefore wiped: the
+     * account was saved in memory, the pending read overwrote it, and the next write
+     * persisted the empty document. A flow whose session arrives in milliseconds,
+     * like GLM's polled one, hits that window every time.
+     */
+    loading;
+    /**
+     * @param file - absolute path of the credential file.
+     * @param provider - section key this store owns.
+     * @param parse - validates and coerces one stored account into a session.
+     */
+    constructor(file, provider, parse) {
+        this.file = file;
+        this.provider = provider;
+        this.parse = parse;
+    }
+    /** Load the file once; later calls share the same in-flight read. */
+    async ensureLoaded(reload = false) {
+        if (this.loaded && !reload)
+            return;
+        if (reload) {
+            this.loaded = false;
+            this.loading = undefined;
+        }
+        this.loading ??= this.read().finally(() => {
+            this.loading = undefined;
+            this.loaded = true;
+        });
+        await this.loading;
+    }
+    /** Read the document from disk into memory. */
+    async read() {
+        let raw;
+        try {
+            raw = await readFile(this.file, 'utf8');
+        }
+        catch {
+            this.entries = {};
+            return;
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            this.entries = isRecord(parsed) ? parsed : {};
+        }
+        catch {
+            this.entries = {};
+        }
+    }
+    /** Re-read the file from disk, discarding in-memory changes. */
+    async reload() {
+        await this.ensureLoaded(true);
+    }
+    providerEntry() {
+        return this.entries[this.provider] ?? {};
+    }
+    /** Every stored session, keyed by account. */
+    async list() {
+        await this.ensureLoaded();
+        const accounts = this.providerEntry().accounts;
+        if (!isRecord(accounts))
+            return {};
+        const result = {};
+        for (const [key, value] of Object.entries(accounts)) {
+            const session = this.parse(value);
+            if (session !== undefined)
+                result[key] = session;
+        }
+        return result;
+    }
+    /** The default account key, falling back to the only stored account. */
+    async defaultAccount() {
+        await this.ensureLoaded();
+        const entry = this.providerEntry();
+        const accounts = await this.list();
+        const keys = Object.keys(accounts);
+        const preferred = nonEmpty(entry.default);
+        if (preferred !== undefined && keys.includes(preferred))
+            return preferred;
+        return keys[0];
+    }
+    /** Read one account's session. */
+    async get(account) {
+        const accounts = await this.list();
+        const key = account ?? await this.defaultAccount();
+        return key === undefined ? undefined : accounts[key];
+    }
+    /** Whether any account is stored. */
+    async hasAny() {
+        return Object.keys(await this.list()).length > 0;
+    }
+    /** Insert or replace one account, making it the default when none is set. */
+    async save(key, session, options = {}) {
+        await this.ensureLoaded();
+        const entry = this.providerEntry();
+        const accounts = { ...isRecord(entry.accounts) ? entry.accounts : {}, [key]: session };
+        const makeDefault = options.makeDefault ?? true;
+        const next = {
+            ...entry,
+            accounts,
+            ...makeDefault || entry.default === undefined ? { default: key } : {},
+        };
+        this.entries = { ...this.entries, [this.provider]: next };
+        await this.persist();
+    }
+    /** Promote one account to default. */
+    async setDefault(key) {
+        await this.ensureLoaded();
+        const entry = this.providerEntry();
+        this.entries = { ...this.entries, [this.provider]: { ...entry, default: key } };
+        await this.persist();
+    }
+    /** Remove one account; the default moves to a remaining account when any. */
+    async remove(key) {
+        await this.ensureLoaded();
+        const entry = this.providerEntry();
+        const accounts = { ...isRecord(entry.accounts) ? entry.accounts : {} };
+        delete accounts[key];
+        const remaining = Object.keys(accounts);
+        const fallback = entry.default === key ? remaining[0] : entry.default;
+        const next = { ...entry, accounts };
+        if (fallback === undefined)
+            delete next.default;
+        else
+            next.default = fallback;
+        this.entries = { ...this.entries, [this.provider]: next };
+        await this.persist();
+    }
+    /** Write the file atomically with owner-only permissions. */
+    async persist() {
+        await mkdir(path.dirname(this.file), { recursive: true });
+        const temporary = `${this.file}.${process.pid}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(this.entries, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+        try {
+            await rename(temporary, this.file);
+            await chmod(this.file, 0o600);
+        }
+        catch (error) {
+            await rm(temporary, { force: true });
+            throw error;
+        }
+    }
+}