even-keel 0.0.2 → 0.2.0-rc.2

package/dist/src/account/homes.js

@@ -0,0 +1,332 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { CLAUDE } from '../claude/name.js';
+import { CODEX } from '../codex/name.js';
+import { tokenOf, writeToken } from '../copilot/home.js';
+import { COPILOT } from '../copilot/name.js';
+import { fail } from '../notice/notice.js';
+import { keyOf, keyVendor, replaceKey, writeKey } from '../opencode/home.js';
+import { OPENCODE } from '../opencode/name.js';
+import { samePath } from '../paths.js';
+import { KeychainCredentials, keychainService } from './keychain.js';
+import { CODEX_ACCOUNT, folderName, GLOBAL_ACCOUNT, parseCredentialTimes } from './model.js';
+import { API_KEY_VARIABLE, shareConfig } from './share.js';
+const PENDING_PREFIX = '.pending-';
+const LOCK_SUFFIX = '.lock';
+const APPROVED_SUFFIX = 20;
+const API_KEY_PATTERN = new RegExp(`^\\S{${APPROVED_SUFFIX + 1},}$`);
+const RESERVED = [GLOBAL_ACCOUNT, CODEX_ACCOUNT];
+const CODEX_AUTH = 'auth.json';
+const CODEX_KEY_FIELD = 'OPENAI_API_KEY';
+/**
+ * The account folders: explicitly registered global folders and one `CLAUDE_CONFIG_DIR` per account under the
+ * root; Codex's own folder (`CODEX_HOME` or `~/.codex`) when registered, and one
+ * `CODEX_HOME` per account under the Codex root (BTN-176). A folder's name is its key across both roots: a Codex folder
+ * named like a Claude one is left out, and a new one is named apart from both.
+ */
+export class AccountHomes {
+    env;
+    registration;
+    keychain;
+    global;
+    codex;
+    roots = {};
+    constructor(env, root, codexRoot = codexAccountsRoot(env), openCodeRoot = openCodeAccountsRoot(env), copilotRoot = copilotAccountsRoot(env), registration = { keys: new Set(), save: async (_key, _added) => { } }, 
+    /** Where a Claude sign-in is when the folder has no `.credentials.json`: the Keychain on macOS, nowhere elsewhere. */
+    keychain = process.platform === 'darwin' ? new KeychainCredentials() : null) {
+        this.env = env;
+        this.registration = registration;
+        this.keychain = keychain;
+        this.global = { key: GLOBAL_ACCOUNT, dir: env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude'), global: true, agent: CLAUDE };
+        this.codex = { key: CODEX_ACCOUNT, dir: env.CODEX_HOME ?? join(homedir(), '.codex'), global: true, agent: CODEX };
+        this.setRoots(root, codexRoot, openCodeRoot, copilotRoot);
+    }
+    /** The folders under the new roots count from the next `list`: `EVEN_KEEL_ACCOUNTS_DIR` changes on the fly. */
+    setRoots(root, codexRoot, openCodeRoot = openCodeAccountsRoot(this.env), copilotRoot = copilotAccountsRoot(this.env)) {
+        this.roots = { [CLAUDE]: root, [CODEX]: codexRoot, [OPENCODE]: openCodeRoot, [COPILOT]: copilotRoot };
+        this.forget();
+    }
+    /**
+     * What `list` and `times` read, kept until the current synchronous run ends (BTN-680): one state broadcast or limits
+     * publish asks for it per account and per project, and each read is four `readdirSync` on the event loop. A change
+     * made through this class forgets it at once; one made by another process shows from the next run.
+     */
+    memo;
+    remembered() {
+        if (this.memo === undefined) {
+            const memo = { times: new Map() };
+            this.memo = memo;
+            queueMicrotask(() => {
+                if (this.memo === memo)
+                    this.memo = undefined;
+            });
+        }
+        return this.memo;
+    }
+    forget() {
+        this.memo = undefined;
+        this.keychain?.forget();
+    }
+    list() {
+        const memo = this.remembered();
+        memo.list ??= this.read();
+        return [...memo.list];
+    }
+    read() {
+        const claude = this.folders(CLAUDE);
+        const codex = this.folders(CODEX).filter((name) => !claude.includes(name));
+        const openCode = this.folders(OPENCODE).filter((name) => !claude.includes(name) && !codex.includes(name));
+        const copilot = this.folders(COPILOT).filter((name) => !claude.includes(name) && !codex.includes(name) && !openCode.includes(name));
+        return [
+            ...(this.registered(this.global) ? [this.global] : []),
+            ...claude.map((name) => this.home(CLAUDE, name)),
+            ...(this.registered(this.codex) ? [this.codex] : []),
+            ...codex.map((name) => this.home(CODEX, name)),
+            ...openCode.map((name) => this.home(OPENCODE, name)),
+            ...copilot.map((name) => this.home(COPILOT, name)),
+        ];
+    }
+    find(key) {
+        return this.list().find((home) => home.key === key);
+    }
+    /** Existing history folders, including global folders not registered for running sessions. */
+    all() {
+        return [...this.list(), ...this.availableGlobals()];
+    }
+    availableGlobals() {
+        return [this.global, this.codex].filter((home) => existsSync(home.dir) && !this.registration.keys.has(home.key));
+    }
+    async register(home) {
+        if (!this.availableGlobals().some((each) => each.key === home.key))
+            throw fail('account.unknown', { key: home.key });
+        await this.registration.save(home.key, true);
+        this.registration.keys.add(home.key);
+        this.forget();
+    }
+    registered(home) {
+        return this.registration.keys.has(home.key) && existsSync(home.dir);
+    }
+    ownerOf(configDir) {
+        if (configDir === null)
+            return this.find(GLOBAL_ACCOUNT)?.key;
+        return this.list().find((home) => samePath(home.dir, configDir))?.key;
+    }
+    times(home) {
+        const { times } = this.remembered();
+        const known = times.get(home.dir);
+        if (known !== undefined)
+            return known;
+        let text;
+        try {
+            text = readFileSync(join(home.dir, '.credentials.json'), 'utf8');
+        }
+        catch {
+            text = this.keychainText(home);
+        }
+        const parsed = parseCredentialTimes(text);
+        times.set(home.dir, parsed);
+        return parsed;
+    }
+    /** The CLI names the item after the `CLAUDE_CONFIG_DIR` it ran with, the one `claudeEnv` gives the folder. */
+    keychainText(home) {
+        if (this.keychain === null || home.agent !== CLAUDE)
+            return undefined;
+        const configDir = home.global ? this.env.CLAUDE_CONFIG_DIR : home.dir;
+        return this.keychain.read(keychainService(configDir));
+    }
+    /** A folder to sign a new account of the agent in; Codex does not create its folder, so it is made here for both. */
+    pending(now, agent) {
+        const home = this.home(agent, `${PENDING_PREFIX}${now.getTime().toString(36)}`);
+        mkdirSync(home.dir, { recursive: true });
+        this.forget();
+        return home;
+    }
+    place(pending, email) {
+        const name = folderName(email, this.taken());
+        const home = this.home(pending.agent, name);
+        renameSync(pending.dir, home.dir);
+        if (pending.agent === CLAUDE)
+            this.keychain?.move(keychainService(pending.dir), keychainService(home.dir));
+        this.forget();
+        return home;
+    }
+    /**
+     * An API account. Claude's: a folder whose `settings.json` carries the key (`mergeSettings` keeps it there) and whose
+     * `.claude.json` has it approved, or the CLI asks whether to use it (BTN-136). Codex's: an `auth.json` the way
+     * `codex login --with-api-key` writes it (BTN-177). OpenCode's: an `auth.json` under the provider the key is of (BTN-214).
+     * Copilot's: the GitHub token in `even-keel.json` (BTN-215).
+     */
+    addApiKey(name, key, agent = CLAUDE) {
+        const value = assertApiKey(key, agent);
+        const home = this.home(agent, folderName(name.trim() === '' ? (agent === COPILOT ? 'github' : 'api') : name, this.taken()));
+        mkdirSync(home.dir, { recursive: true });
+        this.forget();
+        if (agent === COPILOT) {
+            writeToken(home.dir, value);
+            return home;
+        }
+        if (agent === OPENCODE) {
+            writeKey(home.dir, value);
+            return home;
+        }
+        if (agent === CODEX) {
+            writeFileSync(join(home.dir, CODEX_AUTH), JSON.stringify({ auth_mode: 'apikey', [CODEX_KEY_FIELD]: value }, null, 2));
+            return home;
+        }
+        writeFileSync(join(home.dir, 'settings.json'), JSON.stringify({ env: { [API_KEY_VARIABLE]: value } }, null, 2));
+        const approved = { customApiKeyResponses: { approved: [value.slice(-APPROVED_SUFFIX)], rejected: [] } };
+        writeFileSync(join(home.dir, '.claude.json'), JSON.stringify(approved, null, 2));
+        return home;
+    }
+    /**
+     * The trimmed key that may take the place of the folder's own (BTN-418): of the right form, into a folder that holds its
+     * key itself — not the agent's own folder, not one with `apiKeyHelper` — and of the provider of the key it holds.
+     */
+    replacement(home, key) {
+        const value = assertApiKey(key, home.agent);
+        const held = home.global ? null : this.apiKeyOf(home);
+        if (held === null)
+            throw fail('account.keyNotHeld', { agent: home.agent });
+        const provider = keyProvider(home.agent, held);
+        if (keyProvider(home.agent, value) !== provider)
+            throw fail('account.keyOtherProvider', { provider });
+        return value;
+    }
+    /**
+     * A new key in the place of the folder's own, the rest of its files as they are: Claude's `settings.json` and the
+     * approval in `.claude.json` (the old key's suffix goes), Codex's `auth.json`, OpenCode's provider entry, Copilot's token.
+     */
+    replaceApiKey(home, key) {
+        const held = this.apiKeyOf(home);
+        const value = this.replacement(home, key);
+        if (home.agent === COPILOT)
+            return writeToken(home.dir, value);
+        if (home.agent === OPENCODE)
+            return replaceKey(home.dir, value);
+        if (home.agent === CODEX) {
+            const file = join(home.dir, CODEX_AUTH);
+            writeFileSync(file, JSON.stringify({ ...readObject(file), [CODEX_KEY_FIELD]: value }, null, 2));
+            return;
+        }
+        const settingsFile = join(home.dir, 'settings.json');
+        const settings = readObject(settingsFile);
+        writeFileSync(settingsFile, JSON.stringify({ ...settings, env: { ...objectOf(settings.env), [API_KEY_VARIABLE]: value } }, null, 2));
+        const configFile = this.configFile(home);
+        const config = readObject(configFile);
+        const responses = objectOf(config.customApiKeyResponses);
+        const approved = (Array.isArray(responses.approved) ? responses.approved : []).filter((suffix) => suffix !== held?.slice(-APPROVED_SUFFIX));
+        const rejected = Array.isArray(responses.rejected) ? responses.rejected : [];
+        const customApiKeyResponses = { ...responses, approved: [...approved, value.slice(-APPROVED_SUFFIX)], rejected };
+        writeFileSync(configFile, JSON.stringify({ ...config, customApiKeyResponses }, null, 2));
+    }
+    /** The key in Claude's `settings.json`, Codex's or OpenCode's `auth.json`; a folder with `apiKeyHelper` has none to read. */
+    apiKeyOf(home) {
+        if (home.agent === OPENCODE)
+            return keyOf(home.dir);
+        if (home.agent === COPILOT)
+            return tokenOf(home.dir);
+        try {
+            const key = home.agent === CODEX
+                ? JSON.parse(readFileSync(join(home.dir, CODEX_AUTH), 'utf8'))?.[CODEX_KEY_FIELD]
+                : JSON.parse(readFileSync(join(home.dir, 'settings.json'), 'utf8'))?.env?.[API_KEY_VARIABLE];
+            return typeof key === 'string' && key !== '' ? key : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Claude's shared configuration into an account folder; Codex reads its own `config.toml`. */
+    share(home) {
+        if (home.global || home.agent !== CLAUDE)
+            return false;
+        return shareConfig({ dir: this.global.dir, config: this.configFile(this.global) }, home.dir);
+    }
+    /** The `.claude.json` the CLI reads with this folder. */
+    configFile(home) {
+        if (!home.global)
+            return join(home.dir, '.claude.json');
+        return this.env.CLAUDE_CONFIG_DIR === undefined ? join(homedir(), '.claude.json') : join(this.global.dir, '.claude.json');
+    }
+    async remove(home) {
+        if (home.global) {
+            await this.registration.save(home.key, false);
+            this.registration.keys.delete(home.key);
+            this.forget();
+            return;
+        }
+        rmSync(home.dir, { recursive: true, force: true, maxRetries: 3 });
+        this.forget();
+    }
+    home(agent, name) {
+        const root = this.roots[agent];
+        if (root === undefined)
+            throw fail('request.required', { field: 'agent' });
+        return { key: name, dir: join(root, name), global: false, agent };
+    }
+    taken() {
+        return Object.keys(this.roots).flatMap((agent) => this.folders(agent));
+    }
+    folders(agent) {
+        try {
+            return readdirSync(this.roots[agent], { withFileTypes: true })
+                .filter((entry) => entry.isDirectory() && !entry.name.startsWith('.') && !entry.name.endsWith(LOCK_SUFFIX) && !RESERVED.includes(entry.name))
+                .map((entry) => entry.name)
+                .sort();
+        }
+        catch {
+            return [];
+        }
+    }
+}
+/** A JSON object file; an empty object for one missing, broken or holding something else. */
+function readObject(file) {
+    try {
+        return objectOf(JSON.parse(readFileSync(file, 'utf8')));
+    }
+    catch {
+        return {};
+    }
+}
+function objectOf(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : {};
+}
+/** The trimmed key, or a refusal of one that is not a single word long enough to approve. */
+export function assertApiKey(key, agent = CLAUDE) {
+    const value = key.trim();
+    if (agent === COPILOT) {
+        if (!API_KEY_PATTERN.test(value) || !COPILOT_TOKEN.test(value))
+            throw fail('account.copilotTokenInvalid', {});
+        return value;
+    }
+    if (!API_KEY_PATTERN.test(value))
+        throw fail(agent === CODEX ? 'account.codexKeyInvalid' : 'account.apiKeyInvalid', {});
+    return value;
+}
+/**
+ * The tokens Copilot CLI takes: a fine-grained personal one (`github_pat_`) or an OAuth one of an app (`gho_`, `ghu_`);
+ * a classic `ghp_` is refused by the CLI.
+ */
+const COPILOT_TOKEN = /^(github_pat_|gho_|ghu_)/;
+/** Whose key an API account of the agent holds: Codex's is OpenAI's, OpenCode's either, by its prefix, Copilot's GitHub's. */
+export function keyProvider(agent, key) {
+    if (agent === COPILOT)
+        return 'github';
+    if (agent === OPENCODE)
+        return keyVendor(key);
+    return agent === CODEX ? 'openai' : 'anthropic';
+}
+export function accountsRoot(env) {
+    return env.EVEN_KEEL_ACCOUNTS_DIR ?? join(homedir(), '.claude-accounts');
+}
+export function codexAccountsRoot(env) {
+    return env.EVEN_KEEL_CODEX_ACCOUNTS_DIR ?? join(homedir(), '.codex-accounts');
+}
+/** OpenCode has no folder of its own to stand for an account: every one of them is under this root. */
+export function openCodeAccountsRoot(env) {
+    return env.EVEN_KEEL_OPENCODE_ACCOUNTS_DIR ?? join(homedir(), '.opencode-accounts');
+}
+/** Copilot's own `~/.copilot` is not an account here: its sign-in is the OS's, shared by every folder (BTN-215). */
+export function copilotAccountsRoot(env) {
+    return env.EVEN_KEEL_COPILOT_ACCOUNTS_DIR ?? join(homedir(), '.copilot-accounts');
+}

package/dist/src/account/keychain.js

@@ -0,0 +1,134 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+const SERVICE = 'Claude Code-credentials';
+const NOT_FOUND = 44;
+const TTL_MS = 60_000;
+const TIMEOUT_MS = 3_000;
+const HEX = /^(?:[0-9a-f]{2})+$/i;
+/**
+ * The macOS Keychain item Claude Code keeps a folder's sign-in in, named as the CLI names it: no `CLAUDE_CONFIG_DIR`
+ * gives the bare name, a folder adds `-` and the first 8 hex of the sha256 of its path in NFC (`docs/accounts.md`).
+ */
+export function keychainService(configDir) {
+    if (!configDir)
+        return SERVICE;
+    return `${SERVICE}-${createHash('sha256').update(configDir.normalize('NFC')).digest('hex').slice(0, 8)}`;
+}
+function runSecurity(args, input) {
+    const result = spawnSync('security', args, { encoding: 'utf8', input, timeout: TIMEOUT_MS, windowsHide: true });
+    const timedOut = result.error?.code === 'ETIMEDOUT' || result.signal !== null;
+    return { status: result.status, stdout: result.stdout ?? '', timedOut };
+}
+/**
+ * Reads the secret of a Keychain item through `security find-generic-password -w`. An answer is kept for a minute, as
+ * the state broadcast asks for it per account. A read that timed out may be held by an access dialog: that item is
+ * never asked for again until the service restarts, so the dialog does not come back every minute.
+ */
+export class KeychainCredentials {
+    security;
+    warn;
+    answers = new Map();
+    blocked = new Set();
+    constructor(security = runSecurity, warn = console.warn) {
+        this.security = security;
+        this.warn = warn;
+    }
+    read(service, now = Date.now()) {
+        if (this.blocked.has(service))
+            return undefined;
+        const known = this.answers.get(service);
+        if (known !== undefined && now - known.at < TTL_MS)
+            return known.text;
+        const answer = this.security(['find-generic-password', '-s', service, '-w']);
+        if (answer.timedOut) {
+            this.blocked.add(service);
+            this.warn(`Keychain: reading "${service}" took over ${TIMEOUT_MS} ms, likely an access dialog; not asked again until a restart`);
+            return undefined;
+        }
+        const text = answer.status === 0 ? decode(answer.stdout.trim()) : undefined;
+        this.answers.set(service, { text, at: now });
+        return text;
+    }
+    /**
+     * Carries a folder's sign-in item to the name of the folder's new path (BTN-745): the `.pending-*` folder of "Add
+     * account" is renamed after the sign-in, and its item would stay behind matching no folder. The old item is found by
+     * its name alone and keeps its own account (`acct`): the CLI writes the macOS user name there (BTN-748). An item
+     * already under the new name, whatever its account, wins and the old one is only deleted; a failed write keeps the old
+     * one. The secret goes to `security -i` on stdin as hex, as the CLI writes it, never in the arguments.
+     */
+    move(from, to) {
+        this.forget();
+        const found = this.ask(['find-generic-password', '-s', from]);
+        if (found === undefined)
+            return;
+        if (found.status !== 0) {
+            this.warn(found.status === NOT_FOUND
+                ? `Keychain: no item "${from}" to carry to "${to}"; the sign-in may be in .credentials.json`
+                : `Keychain: could not look up "${from}" (security exit ${found.status}); nothing carried to "${to}"`);
+            return;
+        }
+        const account = accountOf(found.stdout);
+        if (account !== null && !QUOTABLE.test(account)) {
+            this.warn(`Keychain: the account of "${from}" cannot be passed to security -i; the sign-in stays there`);
+            return;
+        }
+        const by = account === null ? [] : ['-a', account];
+        const old = this.ask(['find-generic-password', ...by, '-s', from, '-w']);
+        if (old === undefined)
+            return;
+        const text = old.status === 0 ? decode(old.stdout.trim()) : undefined;
+        if (text === undefined) {
+            this.warn(`Keychain: could not read "${from}"; nothing carried to "${to}"`);
+            return;
+        }
+        const present = this.ask(['find-generic-password', '-s', to]);
+        if (present === undefined)
+            return;
+        if (present.status === NOT_FOUND) {
+            const hex = Buffer.from(text, 'utf8').toString('hex');
+            const as = account === null ? '' : ` -a "${account}"`;
+            const written = this.ask(['-i'], `add-generic-password -U${as} -s "${to}" -X "${hex}"\n`);
+            if (written?.status !== 0) {
+                this.warn(`Keychain: could not write "${to}"; the sign-in stays under "${from}"`);
+                return;
+            }
+        }
+        else if (present.status !== 0) {
+            this.warn(`Keychain: could not look up "${to}" (security exit ${present.status}); the sign-in stays under "${from}"`);
+            return;
+        }
+        if (this.ask(['delete-generic-password', ...by, '-s', from])?.status !== 0)
+            this.warn(`Keychain: could not delete "${from}"`);
+    }
+    /** One `security` call; `undefined` when it timed out, likely on an access dialog. */
+    ask(args, input) {
+        const answer = this.security(args, input);
+        if (!answer.timedOut)
+            return answer;
+        this.warn(`Keychain: "security ${args[0]}" took over ${TIMEOUT_MS} ms, likely an access dialog`);
+        return undefined;
+    }
+    forget() {
+        this.answers.clear();
+    }
+}
+/**
+ * The `acct` attribute from the dump of `find-generic-password` without `-w`: `"acct"<blob>="m1"`, or `0x<hex>` and an
+ * escaped copy when a byte is outside printable ASCII; `null` for `<NULL>` or no such line.
+ */
+function accountOf(dump) {
+    const line = /^\s*"acct"<blob>=(?:"(.*)"|0x([0-9a-f]*))/im.exec(dump);
+    if (line === null)
+        return null;
+    return line[1] ?? Buffer.from(line[2], 'hex').toString('utf8');
+}
+/** `security -i` splits its line on quotes: an account with a quote, a backslash or a control character is not passed. */
+const QUOTABLE = /^[^"\\\x00-\x1f\x7f]*$/;
+/** `security -w` prints a secret that is not plain text as hex. */
+function decode(text) {
+    if (!text)
+        return undefined;
+    if (text.startsWith('{') || !HEX.test(text))
+        return text;
+    return Buffer.from(text, 'hex').toString('utf8');
+}

package/dist/src/account/keycheck.js

@@ -0,0 +1,67 @@
+const MODELS_URL = 'https://api.anthropic.com/v1/models?limit=1';
+const OPENAI_MODELS_URL = 'https://api.openai.com/v1/models';
+const OPENAI_ME_URL = 'https://api.openai.com/v1/me';
+const GITHUB_USER_URL = 'https://api.github.com/user';
+const API_VERSION = '2023-06-01';
+/** Asks Anthropic whether it takes the key: the models list costs no tokens. 401 and 403 are a refused key. */
+export function checkApiKey(key, timeoutMs, fetchImpl = fetch) {
+    return askModels(MODELS_URL, { 'x-api-key': key, 'anthropic-version': API_VERSION }, timeoutMs, fetchImpl, 'anthropic-organization-id');
+}
+/**
+ * The same question to OpenAI for a Codex key (BTN-177). OpenAI's models list carries no `openai-organization` (BTN-649),
+ * so a working key's organization is asked of `/v1/me`; a failure there leaves the key working, its organization unknown.
+ */
+export async function checkOpenAiKey(key, timeoutMs, fetchImpl = fetch) {
+    const headers = { authorization: `Bearer ${key}` };
+    const verdict = await askModels(OPENAI_MODELS_URL, headers, timeoutMs, fetchImpl, 'openai-organization');
+    if (verdict.state !== 'ok' || verdict.organization !== undefined)
+        return verdict;
+    const me = await askModels(OPENAI_ME_URL, headers, timeoutMs, fetchImpl, 'openai-organization');
+    return me.state === 'ok' && me.organization !== undefined ? me : verdict;
+}
+/**
+ * Whether GitHub takes a Copilot account's token (BTN-215): `/user` answers any valid token for free. Whether it may make
+ * Copilot requests is not asked — only a session shows that.
+ */
+export function checkGitHubToken(key, timeoutMs, fetchImpl = fetch) {
+    return askModels(GITHUB_USER_URL, { authorization: `Bearer ${key}`, accept: 'application/vnd.github+json', 'user-agent': 'even-keel' }, timeoutMs, fetchImpl);
+}
+async function askModels(url, headers, timeoutMs, fetchImpl, organizationHeader) {
+    let response;
+    try {
+        response = await fetchImpl(url, { headers, signal: AbortSignal.timeout(timeoutMs) });
+    }
+    catch (error) {
+        return { state: 'unknown', reason: error instanceof Error ? error.message : String(error) };
+    }
+    await response.body?.cancel();
+    if (response.ok) {
+        const organization = organizationHeader === undefined ? '' : (response.headers.get(organizationHeader)?.trim() ?? '');
+        return organization === '' ? { state: 'ok' } : { state: 'ok', organization };
+    }
+    if (response.status === 401 || response.status === 403)
+        return { state: 'rejected' };
+    return { state: 'unknown', reason: `HTTP ${response.status}` };
+}
+/** The last check of each API account's key: one per interval, and a check that learns nothing keeps the verdict. */
+export class KeyChecks {
+    intervalMs;
+    checked = new Map();
+    constructor(intervalMs) {
+        this.intervalMs = intervalMs;
+    }
+    due(key, now) {
+        const last = this.checked.get(key);
+        return last === undefined || now.getTime() - last.at >= this.intervalMs;
+    }
+    note(key, verdict, now) {
+        const rejected = verdict.state === 'unknown' ? (this.checked.get(key)?.rejected ?? false) : verdict.state === 'rejected';
+        this.checked.set(key, { at: now.getTime(), rejected });
+    }
+    rejected(key) {
+        return this.checked.get(key)?.rejected ?? false;
+    }
+    forget(key) {
+        this.checked.delete(key);
+    }
+}

package/dist/src/account/ledger.js

@@ -0,0 +1,92 @@
+import { readFileSync } from 'node:fs';
+import { writeAtomic } from '../storage/atomic.js';
+import { refuseNewer, SCHEMA_VERSION, versionOf } from '../storage/schema.js';
+import { GLOBAL_ACCOUNT, namedAfter } from './model.js';
+import { isTransport } from './transport.js';
+export function emptyLedger() {
+    return { accounts: {}, removing: [] };
+}
+/**
+ * `email` is `undefined` while the folder is signed out (nothing to note) and `null` when it is signed in with no
+ * identity, as an OpenCode folder: a key folder reused that way no longer holds the key it was noted with, and a stale
+ * record would make every limit of its sessions look like an account switch to the chain.
+ */
+export function noteAccount(ledger, key, email, now) {
+    const record = ledger.accounts[key];
+    if (email === undefined || email === (record?.email ?? null))
+        return undefined;
+    const { name, ...kept } = record ?? { email: null, since: null, previous: null };
+    // The name the user gave belonged to the account that signed out of the folder, not to the one in it now (BTN-528).
+    const another = kept.email !== null && email !== null && kept.email.toLowerCase() !== email.toLowerCase();
+    const noted = { ...kept, ...(!another && name !== undefined && { name }), email, since: now.toISOString(), previous: kept.email };
+    return { ...ledger, accounts: { ...ledger.accounts, [key]: noted } };
+}
+/**
+ * The account the folder `key` is named after (`folderName`) when another one signed in to it since: the page shows the
+ * change instead of a silent rename. Null while it holds that account, or when its name came from no sign-in.
+ */
+export function formerOwner(ledger, key) {
+    const record = ledger.accounts[key];
+    if (record?.previous == null || record.email === null || key === GLOBAL_ACCOUNT)
+        return null;
+    return namedAfter(key, record.previous) && !namedAfter(key, record.email) ? record.previous : null;
+}
+export function nameAccount(ledger, key, name) {
+    const { name: _old, ...record } = ledger.accounts[key] ?? { email: null, since: null, previous: null };
+    const named = name.trim() === '' ? record : { ...record, name: name.trim() };
+    return { ...ledger, accounts: { ...ledger.accounts, [key]: named } };
+}
+export function accountAt(ledger, key, at) {
+    const record = ledger.accounts[key];
+    if (record === undefined || record.since === null)
+        return null;
+    return Date.parse(at) >= Date.parse(record.since) ? record.email : record.previous;
+}
+export function forgetAccount(ledger, key) {
+    const { [key]: _forgotten, ...accounts } = ledger.accounts;
+    return { ...ledger, accounts, removing: ledger.removing.filter((each) => each !== key) };
+}
+export function markRemoving(ledger, key, on) {
+    const removing = ledger.removing.filter((each) => each !== key);
+    return { ...ledger, removing: on ? [...removing, key] : removing };
+}
+export function parseLedger(raw) {
+    if (!isRecord(raw))
+        return emptyLedger();
+    if (isRecord(raw.accounts)) {
+        const accounts = {};
+        for (const [key, value] of Object.entries(raw.accounts))
+            if (isRecord(value))
+                accounts[key] = recordOf(value);
+        const removing = Array.isArray(raw.removing) ? raw.removing.filter((key) => typeof key === 'string') : [];
+        if (!isRecord(raw.transports))
+            return { accounts, removing };
+        const transports = Object.fromEntries(Object.entries(raw.transports).filter((entry) => isTransport(entry[1])));
+        return { accounts, removing, transports };
+    }
+    if ('email' in raw || 'since' in raw)
+        return { accounts: { [GLOBAL_ACCOUNT]: recordOf(raw) }, removing: [] };
+    return emptyLedger();
+}
+export function loadLedger(file) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return emptyLedger();
+    }
+    refuseNewer(file, versionOf(raw));
+    return parseLedger(raw);
+}
+export function saveLedger(file, ledger) {
+    writeAtomic(file, JSON.stringify({ version: SCHEMA_VERSION, ...ledger }, null, 2));
+}
+function recordOf(raw) {
+    const text = (value) => (typeof value === 'string' ? value : null);
+    const record = { email: text(raw.email), since: text(raw.since), previous: text(raw.previous) };
+    return { ...record, ...(typeof raw.name === 'string' && { name: raw.name }) };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}