latchkey 2.21.0 → 3.0.1

package/README.md

@@ -162,6 +162,33 @@ code, stdout and stderr are passed back from curl to the caller
 of `latchkey`.
 
 
+### Multiple accounts
+
+Credentials for a service can be stored under several accounts.
+An account is a string that uniquely identifies the account
+behind the credentials - typically an e-mail, but for some
+services it may be an id. Use the global `--account` option to
+select one:
+
+```bash
+# Store credentials for a specific account.
+latchkey --account bob@example.com auth set slack -H "Authorization: Bearer xoxb-..."
+
+# Use them in a request.
+latchkey --account bob@example.com curl https://slack.com/api/auth.test
+```
+
+When `--account` is omitted, the single stored account is used
+automatically. If a service has more than one stored account,
+`--account` becomes required. Credentials stored without an
+account live under a "default" account (empty string, `""`).
+
+Browser logins (`latchkey auth browser`) determine the account
+automatically. The `--account` option here merely allows users
+to specify which existing OAuth client configuration to use for
+the login (selecting one associated with an existing account) if
+needed.
+
 ### Self-hosted services
 
 For services that can be self-hosted, like GitLab, first make Latchkey aware of your service instance:
@@ -226,15 +253,18 @@ calls.
 
 ### Inspecting the status of stored credentials
 
-Calling `latchkey services info <service_name>` will show information
-about the service, including the credentials status. The
-credentials status line will show one of:
+Calling `latchkey services info <service_name>` will show
+information about the service, including a `credentials` object
+keyed by account (the default account uses the empty string).
+Each entry reports a credentials status of:
 
-- `missing`
 - `invalid`
 - `valid`
 - `unknown` (for user-registered services)
 
+A service with no stored credentials shows an empty `credentials`
+object.
+
 ### Clearing credentials
 
 Remembered API credentials can expire. The caller of `latchkey
@@ -384,6 +414,7 @@ defaults:
 - `LATCHKEY_KEYRING_SERVICE_NAME`, `LATCHKEY_KEYRING_ACCOUNT_NAME`: identifiers that are used to store the encryption password in your keyring
 - `LATCHKEY_ENCRYPTION_KEY`: override the encryption key, e.g. when a keyring is not available. Example: `export LATCHKEY_ENCRYPTION_KEY="$(openssl rand -base64 32)"`
 - `LATCHKEY_DISABLE_BROWSER`: when set to a non-empty value, disables the browser login flow; commands that would trigger a browser login (`auth browser`, `auth browser-prepare`) will fail with an error instead
+- `LATCHKEY_EPHEMERAL_BROWSER`: when set to a non-empty value, browser flows operate similarly to the browser incognito mode. Useful when logging into multiple accounts.
 - `LATCHKEY_DISABLE_COUNTING`: when set to a non-empty value, disables daily usage counting.
 - `LATCHKEY_DISABLE_CREDENTIALS_REFRESH`: when set to a non-empty value, expired credentials are never refreshed. (Useful when the credentials are shared and refreshing in one place would risk exhausting the refresh token for the other one.)
 - `LATCHKEY_PERMISSIONS_CONFIG`: override the `permissions.json` location.
@@ -411,6 +442,7 @@ override `config.json` values.
     "keyringServiceName": "latchkey",
     "keyringAccountName": "encryption-key",
     "browserDisabled": false,
+    "browserEphemeral": false,
     "countingDisabled": true,
     "permissionsConfig": "/etc/latchkey/permissions.json",
     "permissionsDoNotUseBuiltinSchemas": false,

package/dist/skills/generic/latchkey/SKILL.md

@@ -95,6 +95,27 @@ credentials yet. `latchkey service info <service_name>` can be
 used to see how to provide credentials for a specific service.
 
 
+## Using multiple accounts
+
+It is possible to associate credentials with a specific account:
+
+```bash
+latchkey --account alice@example.com auth set ...
+```
+
+And then reference it in curl calls:
+
+```bash
+latchkey --account alice@example.com curl ...
+```
+
+The `--account` option must go right after `latchkey`.
+
+You can see the existing accounts as keys in the credential
+dictionary produced by `latchkey services info`. An empty string
+in the key means "unknown account".
+
+
 ## Notes
 
 - All curl arguments are passed through unchanged

package/dist/skills/openclaw/latchkey/SKILL.md

@@ -87,6 +87,27 @@ credentials yet. `latchkey service info <service_name>` can be
 used to see how to provide credentials for a specific service.
 
 
+## Using multiple accounts
+
+It is possible to associate credentials with a specific account:
+
+```bash
+latchkey --account alice@example.com auth set ...
+```
+
+And then reference it in curl calls:
+
+```bash
+latchkey --account alice@example.com curl ...
+```
+
+The `--account` option must go right after `latchkey`.
+
+You can see the existing accounts as keys in the credential
+dictionary produced by `latchkey services info`. An empty string
+in the key means "unknown account".
+
+
 ## Notes
 
 - All curl arguments are passed through unchanged

package/dist/src/apiCredentials/account.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Account identifiers for stored credentials, and helpers for determining the
+ * account behind a set of credentials.
+ *
+ * An account is a string that uniquely identifies the account behind a set of
+ * credentials (typically an e-mail, sometimes an opaque id). The empty string
+ * denotes the "default" account.
+ *
+ * This module must not import the credential store or any service module, so
+ * that service implementations can use it without creating an import cycle
+ * (store -> serialization -> service -> core/base -> store).
+ */
+import { type ApiCredentials } from './base.js';
+export declare const DEFAULT_ACCOUNT = "";
+/**
+ * Parse a JSON response body, returning null instead of throwing on malformed
+ * input. Response bodies come from arbitrary servers, so account parsing must
+ * never crash on unexpected content.
+ */
+export declare function tryParseJson(body: string): unknown;
+/**
+ * Fetch the account behind the given credentials from an identity-revealing
+ * endpoint, best-effort: returns null when the credentials cannot be injected
+ * or when the parser finds no identity in the response body. The shared
+ * implementation behind the services' `getAccount()`.
+ */
+export declare function fetchAccountFromEndpoint(apiCredentials: ApiCredentials, accountCurlArguments: readonly string[], parseAccount: (responseBody: string) => string | null): Promise<string | null>;
+//# sourceMappingURL=account.d.ts.map

package/dist/src/apiCredentials/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/apiCredentials/account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,cAAc,EAA4B,MAAM,WAAW,CAAC;AAG1E,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMlD;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,cAAc,EAAE,cAAc,EAC9B,oBAAoB,EAAE,SAAS,MAAM,EAAE,EACvC,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GACpD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYxB"}

package/dist/src/apiCredentials/account.js

@@ -0,0 +1,49 @@
+/**
+ * Account identifiers for stored credentials, and helpers for determining the
+ * account behind a set of credentials.
+ *
+ * An account is a string that uniquely identifies the account behind a set of
+ * credentials (typically an e-mail, sometimes an opaque id). The empty string
+ * denotes the "default" account.
+ *
+ * This module must not import the credential store or any service module, so
+ * that service implementations can use it without creating an import cycle
+ * (store -> serialization -> service -> core/base -> store).
+ */
+import { ApiCredentialsUsageError } from './base.js';
+import { runCapturedAsync } from '../curl.js';
+export const DEFAULT_ACCOUNT = '';
+/**
+ * Parse a JSON response body, returning null instead of throwing on malformed
+ * input. Response bodies come from arbitrary servers, so account parsing must
+ * never crash on unexpected content.
+ */
+export function tryParseJson(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Fetch the account behind the given credentials from an identity-revealing
+ * endpoint, best-effort: returns null when the credentials cannot be injected
+ * or when the parser finds no identity in the response body. The shared
+ * implementation behind the services' `getAccount()`.
+ */
+export async function fetchAccountFromEndpoint(apiCredentials, accountCurlArguments, parseAccount) {
+    let curlArguments;
+    try {
+        curlArguments = await apiCredentials.injectIntoCurlCall(['-s', ...accountCurlArguments]);
+    }
+    catch (error) {
+        if (error instanceof ApiCredentialsUsageError) {
+            return null;
+        }
+        throw error;
+    }
+    const result = await runCapturedAsync(curlArguments, 10);
+    return parseAccount(result.stdout);
+}
+//# sourceMappingURL=account.js.map

package/dist/src/apiCredentials/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/apiCredentials/account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAuB,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,cAA8B,EAC9B,oBAAuC,EACvC,YAAqD;IAErD,IAAI,aAAgC,CAAC;IACrC,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC"}

package/dist/src/apiCredentials/store.d.ts

@@ -1,20 +1,86 @@
 /**
  * API credential store for persisting and loading API credentials.
+ *
+ * The store has two top-level sections:
+ *
+ * - "credentials": complete credentials, stored per service and, within each
+ *   service, per account. An account is a string that uniquely identifies the
+ *   account behind the credentials (typically an e-mail, sometimes an opaque
+ *   id). The empty string denotes the "default" account (when we don't know
+ *   anything more).
+ * - "preparations": prepared / incomplete credentials (e.g. an OAuth client
+ *   id and secret created by `auth prepare` or `auth browser-prepare`),
+ *   stored per service only. A service has at most one preparation; storing a
+ *   new one overwrites the previous one.
+ *
+ * All credential read/write methods accept an optional account. When it is
+ * omitted the account is resolved from the data itself: the single stored
+ * account is used, or an {@link AmbiguousAccountError} is raised when several
+ * accounts exist and the caller must disambiguate.
  */
 import type { ApiCredentials } from './base.js';
 import { EncryptedStorage } from '../encryptedStorage.js';
 export declare class ApiCredentialStoreError extends Error {
     constructor(message: string);
 }
+/**
+ * Thrown when a service has more than one account stored and no account was
+ * specified to disambiguate between them.
+ */
+export declare class AmbiguousAccountError extends Error {
+    readonly serviceName: string;
+    readonly accounts: readonly string[];
+    constructor(serviceName: string, accounts: readonly string[]);
+}
 export declare class ApiCredentialStore {
     readonly path: string;
     private readonly encryptedStorage;
     constructor(path: string, encryptedStorage: EncryptedStorage);
     private loadStoreData;
     private saveStoreData;
-    get(serviceName: string): ApiCredentials | null;
-    save(serviceName: string, apiCredentials: ApiCredentials): void;
-    getAll(): ReadonlyMap<string, ApiCredentials>;
-    delete(serviceName: string): boolean;
+    private parseCredentials;
+    /**
+     * Resolve which stored account to operate on when the caller did not name
+     * one. Returns null when the service has no stored accounts. Throws
+     * {@link AmbiguousAccountError} when several accounts exist.
+     */
+    private resolveImplicitAccount;
+    get(serviceName: string, account?: string): ApiCredentials | null;
+    save(serviceName: string, apiCredentials: ApiCredentials, account?: string): void;
+    /**
+     * Return the prepared (incomplete) credentials stored for a service, or null
+     * when the service has no preparation.
+     */
+    getPreparation(serviceName: string): ApiCredentials | null;
+    /**
+     * Store prepared (incomplete) credentials for a service, overwriting any
+     * previous preparation for that service.
+     */
+    savePreparation(serviceName: string, apiCredentials: ApiCredentials): void;
+    /**
+     * List the accounts that have credentials stored for a service, in the order
+     * they appear in the store. Returns an empty array when the service has no
+     * stored credentials.
+     */
+    listAccounts(serviceName: string): readonly string[];
+    /**
+     * Return all stored credentials as a map of service name to a map of account
+     * to credentials.
+     */
+    getAll(): ReadonlyMap<string, ReadonlyMap<string, ApiCredentials>>;
+    /**
+     * Delete stored credentials for the given account (resolving an unspecified
+     * account the same way reads do). If that leaves the service with no
+     * accounts, the service entry is removed entirely. Preparations are never
+     * touched; use {@link deleteAll} for that. Returns whether anything was
+     * deleted.
+     */
+    delete(serviceName: string, account?: string): boolean;
+    /**
+     * Delete everything stored for a service: the credentials of all its
+     * accounts as well as its preparation (if any). Returns whether anything
+     * was deleted.
+     */
+    deleteAll(serviceName: string): boolean;
 }
 //# sourceMappingURL=store.d.ts.map

package/dist/src/apiCredentials/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/apiCredentials/store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAID,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAExC,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB;IAK5D,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,aAAa;IAUrB,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAiB/C,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAM/D,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC;IAe7C,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;CASrC"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/apiCredentials/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;gBAEzB,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE;CAU7D;AASD,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAExC,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB;IAK5D,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,gBAAgB;IAUxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAU9B,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAejE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAgBjF;;;OAGG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAS1D;;;OAGG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAM1E;;;;OAIG;IACH,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE;IAMpD;;;OAGG;IACH,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAalE;;;;;;OAMG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO;IAyBtD;;;;OAIG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;CAUxC"}

package/dist/src/apiCredentials/store.js

@@ -1,6 +1,24 @@
 /**
  * API credential store for persisting and loading API credentials.
+ *
+ * The store has two top-level sections:
+ *
+ * - "credentials": complete credentials, stored per service and, within each
+ *   service, per account. An account is a string that uniquely identifies the
+ *   account behind the credentials (typically an e-mail, sometimes an opaque
+ *   id). The empty string denotes the "default" account (when we don't know
+ *   anything more).
+ * - "preparations": prepared / incomplete credentials (e.g. an OAuth client
+ *   id and secret created by `auth prepare` or `auth browser-prepare`),
+ *   stored per service only. A service has at most one preparation; storing a
+ *   new one overwrites the previous one.
+ *
+ * All credential read/write methods accept an optional account. When it is
+ * omitted the account is resolved from the data itself: the single stored
+ * account is used, or an {@link AmbiguousAccountError} is raised when several
+ * accounts exist and the caller must disambiguate.
  */
+import { DEFAULT_ACCOUNT } from './account.js';
 import { ApiCredentialsSchema, deserializeCredentials, serializeCredentials, } from './serialization.js';
 export class ApiCredentialStoreError extends Error {
     constructor(message) {
@@ -8,6 +26,22 @@ export class ApiCredentialStoreError extends Error {
         this.name = 'ApiCredentialStoreError';
     }
 }
+/**
+ * Thrown when a service has more than one account stored and no account was
+ * specified to disambiguate between them.
+ */
+export class AmbiguousAccountError extends Error {
+    serviceName;
+    accounts;
+    constructor(serviceName, accounts) {
+        super(`Multiple accounts are stored for service '${serviceName}': ` +
+            `${accounts.map((account) => `'${account}'`).join(', ')}. ` +
+            'Specify which one to use with --account.');
+        this.name = 'AmbiguousAccountError';
+        this.serviceName = serviceName;
+        this.accounts = accounts;
+    }
+}
 export class ApiCredentialStore {
     path;
     encryptedStorage;
@@ -19,9 +53,13 @@ export class ApiCredentialStore {
         try {
             const content = this.encryptedStorage.readFile(this.path);
             if (content === null) {
-                return {};
+                return { credentials: {}, preparations: {} };
             }
-            return JSON.parse(content);
+            const parsed = JSON.parse(content);
+            return {
+                credentials: parsed.credentials ?? {},
+                preparations: parsed.preparations ?? {},
+            };
         }
         catch (error) {
             throw new ApiCredentialStoreError(`Failed to read credential store: ${error instanceof Error ? error.message : String(error)}`);
@@ -35,42 +73,146 @@ export class ApiCredentialStore {
             throw new ApiCredentialStoreError(`Failed to write credential store: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
-    get(serviceName) {
-        const data = this.loadStoreData();
-        const credentialData = data[serviceName];
-        if (credentialData === undefined) {
-            return null;
-        }
+    parseCredentials(serviceName, credentialData) {
         const parseResult = ApiCredentialsSchema.safeParse(credentialData);
         if (!parseResult.success) {
             throw new ApiCredentialStoreError(`Invalid credential data for service ${serviceName}: ${parseResult.error.message}`);
         }
         return deserializeCredentials(parseResult.data);
     }
-    save(serviceName, apiCredentials) {
+    /**
+     * Resolve which stored account to operate on when the caller did not name
+     * one. Returns null when the service has no stored accounts. Throws
+     * {@link AmbiguousAccountError} when several accounts exist.
+     */
+    resolveImplicitAccount(serviceName, accounts) {
+        if (accounts.length === 0) {
+            return null;
+        }
+        if (accounts.length === 1) {
+            return accounts[0];
+        }
+        throw new AmbiguousAccountError(serviceName, accounts);
+    }
+    get(serviceName, account) {
+        const data = this.loadStoreData();
+        const serviceData = data.credentials[serviceName];
+        const accounts = serviceData === undefined ? [] : Object.keys(serviceData);
+        const resolvedAccount = account ?? this.resolveImplicitAccount(serviceName, accounts);
+        if (resolvedAccount === null) {
+            return null;
+        }
+        const credentialData = serviceData?.[resolvedAccount];
+        if (credentialData === undefined) {
+            return null;
+        }
+        return this.parseCredentials(serviceName, credentialData);
+    }
+    save(serviceName, apiCredentials, account) {
         const data = this.loadStoreData();
-        data[serviceName] = serializeCredentials(apiCredentials);
+        const serviceData = data.credentials[serviceName] ?? {};
+        const accounts = Object.keys(serviceData);
+        // A brand-new service with no account specified defaults to the default
+        // account; otherwise an unspecified account updates the single existing one
+        // (and raises for ambiguity), keeping writes consistent with reads.
+        const resolvedAccount = account ?? this.resolveImplicitAccount(serviceName, accounts) ?? DEFAULT_ACCOUNT;
+        data.credentials[serviceName] = {
+            ...serviceData,
+            [resolvedAccount]: serializeCredentials(apiCredentials),
+        };
         this.saveStoreData(data);
     }
+    /**
+     * Return the prepared (incomplete) credentials stored for a service, or null
+     * when the service has no preparation.
+     */
+    getPreparation(serviceName) {
+        const data = this.loadStoreData();
+        const preparationData = data.preparations[serviceName];
+        if (preparationData === undefined) {
+            return null;
+        }
+        return this.parseCredentials(serviceName, preparationData);
+    }
+    /**
+     * Store prepared (incomplete) credentials for a service, overwriting any
+     * previous preparation for that service.
+     */
+    savePreparation(serviceName, apiCredentials) {
+        const data = this.loadStoreData();
+        data.preparations[serviceName] = serializeCredentials(apiCredentials);
+        this.saveStoreData(data);
+    }
+    /**
+     * List the accounts that have credentials stored for a service, in the order
+     * they appear in the store. Returns an empty array when the service has no
+     * stored credentials.
+     */
+    listAccounts(serviceName) {
+        const data = this.loadStoreData();
+        const serviceData = data.credentials[serviceName];
+        return serviceData === undefined ? [] : Object.keys(serviceData);
+    }
+    /**
+     * Return all stored credentials as a map of service name to a map of account
+     * to credentials.
+     */
     getAll() {
         const data = this.loadStoreData();
         const result = new Map();
-        for (const [serviceName, credentialData] of Object.entries(data)) {
-            const parseResult = ApiCredentialsSchema.safeParse(credentialData);
-            if (!parseResult.success) {
-                throw new ApiCredentialStoreError(`Invalid credential data for service ${serviceName}: ${parseResult.error.message}`);
+        for (const [serviceName, serviceData] of Object.entries(data.credentials)) {
+            const accountMap = new Map();
+            for (const [account, credentialData] of Object.entries(serviceData)) {
+                accountMap.set(account, this.parseCredentials(serviceName, credentialData));
             }
-            result.set(serviceName, deserializeCredentials(parseResult.data));
+            result.set(serviceName, accountMap);
         }
         return result;
     }
-    delete(serviceName) {
+    /**
+     * Delete stored credentials for the given account (resolving an unspecified
+     * account the same way reads do). If that leaves the service with no
+     * accounts, the service entry is removed entirely. Preparations are never
+     * touched; use {@link deleteAll} for that. Returns whether anything was
+     * deleted.
+     */
+    delete(serviceName, account) {
+        const data = this.loadStoreData();
+        const serviceData = data.credentials[serviceName];
+        if (serviceData === undefined) {
+            return false;
+        }
+        const accounts = Object.keys(serviceData);
+        const resolvedAccount = account ?? this.resolveImplicitAccount(serviceName, accounts);
+        if (resolvedAccount === null || !(resolvedAccount in serviceData)) {
+            return false;
+        }
+        const { [resolvedAccount]: _, ...remainingAccounts } = serviceData;
+        if (Object.keys(remainingAccounts).length === 0) {
+            const { [serviceName]: __, ...remainingServices } = data.credentials;
+            this.saveStoreData({ ...data, credentials: remainingServices });
+        }
+        else {
+            this.saveStoreData({
+                ...data,
+                credentials: { ...data.credentials, [serviceName]: remainingAccounts },
+            });
+        }
+        return true;
+    }
+    /**
+     * Delete everything stored for a service: the credentials of all its
+     * accounts as well as its preparation (if any). Returns whether anything
+     * was deleted.
+     */
+    deleteAll(serviceName) {
         const data = this.loadStoreData();
-        if (!(serviceName in data)) {
+        if (!(serviceName in data.credentials) && !(serviceName in data.preparations)) {
             return false;
         }
-        const { [serviceName]: _, ...rest } = data;
-        this.saveStoreData(rest);
+        const { [serviceName]: _, ...remainingServices } = data.credentials;
+        const { [serviceName]: __, ...remainingPreparations } = data.preparations;
+        this.saveStoreData({ credentials: remainingServices, preparations: remainingPreparations });
         return true;
     }
 }

package/dist/src/apiCredentials/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/apiCredentials/store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAID,MAAM,OAAO,kBAAkB;IACpB,IAAI,CAAS;IACL,gBAAgB,CAAmB;IAEpD,YAAY,IAAY,EAAE,gBAAkC;QAC1D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,IAAe;QACnC,IAAI,CAAC;YACH,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,GAAG,CAAC,WAAmB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAC/B,uCAAuC,WAAW,KAAK,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CACnF,CAAC;QACJ,CAAC;QAED,OAAO,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,WAAmB,EAAE,cAA8B;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,WAAW,CAAC,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;QACjD,KAAK,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YACnE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAI,uBAAuB,CAC/B,uCAAuC,WAAW,KAAK,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CACnF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,WAAmB;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QAC3C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/apiCredentials/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,WAAW,CAAS;IACpB,QAAQ,CAAoB;IAErC,YAAY,WAAmB,EAAE,QAA2B;QAC1D,KAAK,CACH,6CAA6C,WAAW,KAAK;YAC3D,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC3D,0CAA0C,CAC7C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AASD,MAAM,OAAO,kBAAkB;IACpB,IAAI,CAAS;IACL,gBAAgB,CAAmB;IAEpD,YAAY,IAAY,EAAE,gBAAkC;QAC1D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;YAC/C,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAC;YACzD,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;gBACrC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;aACxC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,IAAe;QACnC,IAAI,CAAC;YACH,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,WAAmB,EAAE,cAAuB;QACnE,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,uBAAuB,CAC/B,uCAAuC,WAAW,KAAK,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAAC,WAAmB,EAAE,QAA2B;QAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,CAAC,CAAE,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,GAAG,CAAC,WAAmB,EAAE,OAAgB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,OAAO,IAAI,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACtF,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,cAAc,GAAG,WAAW,EAAE,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,WAAmB,EAAE,cAA8B,EAAE,OAAgB;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,wEAAwE;QACxE,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,eAAe,GACnB,OAAO,IAAI,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,eAAe,CAAC;QACnF,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG;YAC9B,GAAG,WAAW;YACd,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC,cAAc,CAAC;SACxD,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,WAAmB;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,WAAmB,EAAE,cAA8B;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,WAAmB;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+C,CAAC;QACtE,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;YACrD,KAAK,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,WAAmB,EAAE,OAAgB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,OAAO,IAAI,IAAI,CAAC,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACtF,IAAI,eAAe,KAAK,IAAI,IAAI,CAAC,CAAC,eAAe,IAAI,WAAW,CAAC,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,GAAG,iBAAiB,EAAE,GAAG,WAAW,CAAC;QACnE,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,iBAAiB,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,aAAa,CAAC;gBACjB,GAAG,IAAI;gBACP,WAAW,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,WAAmB;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,GAAG,iBAAiB,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;QACpE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,qBAAqB,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;QAC1E,IAAI,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/src/apiCredentials/utils.d.ts

@@ -12,6 +12,6 @@ import type { Service } from '../services/core/base.js';
  * used when the credentials are shared with another machine and refreshing here
  * would otherwise risk exhausting the refresh token.
  */
-export declare function maybeRefreshCredentials(service: Service, apiCredentials: ApiCredentials, apiCredentialStore: ApiCredentialStore, disableRefresh?: boolean): Promise<ApiCredentials>;
-export declare function getCredentialStatus(service: Service, credentials: ApiCredentials | null, apiCredentialStore: ApiCredentialStore, disableRefresh?: boolean, offline?: boolean): Promise<ApiCredentialStatus>;
+export declare function maybeRefreshCredentials(service: Service, apiCredentials: ApiCredentials, apiCredentialStore: ApiCredentialStore, disableRefresh?: boolean, account?: string): Promise<ApiCredentials>;
+export declare function getCredentialStatus(service: Service, credentials: ApiCredentials | null, apiCredentialStore: ApiCredentialStore, disableRefresh?: boolean, offline?: boolean, account?: string): Promise<ApiCredentialStatus>;
 //# sourceMappingURL=utils.d.ts.map

package/dist/src/apiCredentials/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/apiCredentials/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,cAAc,EAC9B,kBAAkB,EAAE,kBAAkB,EACtC,cAAc,UAAQ,GACrB,OAAO,CAAC,cAAc,CAAC,CAUzB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,cAAc,GAAG,IAAI,EAClC,kBAAkB,EAAE,kBAAkB,EACtC,cAAc,UAAQ,EACtB,OAAO,UAAQ,GACd,OAAO,CAAC,mBAAmB,CAAC,CAgB9B"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/apiCredentials/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,cAAc,EAC9B,kBAAkB,EAAE,kBAAkB,EACtC,cAAc,UAAQ,EACtB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,CAAC,CAUzB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,cAAc,GAAG,IAAI,EAClC,kBAAkB,EAAE,kBAAkB,EACtC,cAAc,UAAQ,EACtB,OAAO,UAAQ,EACf,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CAiB9B"}

package/dist/src/apiCredentials/utils.js

@@ -10,18 +10,18 @@ import { ApiCredentialStatus } from './base.js';
  * used when the credentials are shared with another machine and refreshing here
  * would otherwise risk exhausting the refresh token.
  */
-export async function maybeRefreshCredentials(service, apiCredentials, apiCredentialStore, disableRefresh = false) {
+export async function maybeRefreshCredentials(service, apiCredentials, apiCredentialStore, disableRefresh = false, account) {
     if (disableRefresh || apiCredentials.isExpired() !== true || !service.refreshCredentials) {
         return apiCredentials;
     }
     const refreshedCredentials = await service.refreshCredentials(apiCredentials);
     if (refreshedCredentials !== null) {
-        apiCredentialStore.save(service.name, refreshedCredentials);
+        apiCredentialStore.save(service.name, refreshedCredentials, account);
         return refreshedCredentials;
     }
     return apiCredentials;
 }
-export async function getCredentialStatus(service, credentials, apiCredentialStore, disableRefresh = false, offline = false) {
+export async function getCredentialStatus(service, credentials, apiCredentialStore, disableRefresh = false, offline = false, account) {
     if (credentials === null) {
         return ApiCredentialStatus.Missing;
     }
@@ -30,7 +30,7 @@ export async function getCredentialStatus(service, credentials, apiCredentialSto
     if (offline) {
         return ApiCredentialStatus.Unknown;
     }
-    const refreshed = await maybeRefreshCredentials(service, credentials, apiCredentialStore, disableRefresh);
-    return await service.checkApiCredentials(refreshed);
+    const refreshed = await maybeRefreshCredentials(service, credentials, apiCredentialStore, disableRefresh, account);
+    return service.checkApiCredentials(refreshed);
 }
 //# sourceMappingURL=utils.js.map

package/dist/src/apiCredentials/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/apiCredentials/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,WAAW,CAAC;AAIrE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,cAA8B,EAC9B,kBAAsC,EACtC,cAAc,GAAG,KAAK;IAEtB,IAAI,cAAc,IAAI,cAAc,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACzF,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAClC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC5D,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,WAAkC,EAClC,kBAAsC,EACtC,cAAc,GAAG,KAAK,EACtB,OAAO,GAAG,KAAK;IAEf,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,mBAAmB,CAAC,OAAO,CAAC;IACrC,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,mBAAmB,CAAC,OAAO,CAAC;IACrC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAC7C,OAAO,EACP,WAAW,EACX,kBAAkB,EAClB,cAAc,CACf,CAAC;IACF,OAAO,MAAM,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/apiCredentials/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,WAAW,CAAC;AAIrE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,cAA8B,EAC9B,kBAAsC,EACtC,cAAc,GAAG,KAAK,EACtB,OAAgB;IAEhB,IAAI,cAAc,IAAI,cAAc,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACzF,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAClC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,WAAkC,EAClC,kBAAsC,EACtC,cAAc,GAAG,KAAK,EACtB,OAAO,GAAG,KAAK,EACf,OAAgB;IAEhB,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,mBAAmB,CAAC,OAAO,CAAC;IACrC,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,mBAAmB,CAAC,OAAO,CAAC;IACrC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAC7C,OAAO,EACP,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,OAAO,CACR,CAAC;IACF,OAAO,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC"}

package/dist/src/cli.js

@@ -43,7 +43,7 @@ if (!gatewayMode) {
             accountName: deps.config.accountName,
             allowKeyGeneration: !hasEncryptedData,
         });
-        runMigrations(deps.config, new EncryptedStorage(encryptionKey));
+        await runMigrations(deps.config, new EncryptedStorage(encryptionKey));
     }
     catch (error) {
         if (error instanceof KeychainTimeoutError) {