latchkey 3.9.0 → 3.10.1

package/dist/src/services/core/loginFlows/tokenCapture.js

@@ -0,0 +1,201 @@
+/**
+ * A generic browser login for services whose credential is a token the web app
+ * mints for itself: open a URL, watch the responses that arrive while the user
+ * signs in, and lift a token out of the JSON body of a named endpoint.
+ *
+ * This is the counterpart to `cookie-capture`, for the other common shape. In a
+ * cookie-authenticated service the cookie *is* the API credential, so capturing
+ * it is enough. In a token-minting one the cookie authenticates the *page*,
+ * which then calls an endpoint of its own to obtain a short-lived token, and it
+ * is that token the API wants — capturing the cookie would store something the
+ * API refuses. Single-page apps built on NextAuth are the common case, where
+ * the mint endpoint is conventionally `/api/auth/session`.
+ *
+ * Nothing here is service-specific: which endpoint to watch, which field holds
+ * the token, and which header carries it all come from whoever registered the
+ * service, as the parameters of the `token-capture` login flow.
+ *
+ * Two consequences of capturing a minted token are worth knowing, and are the
+ * registrant's to accept rather than this flow's to solve:
+ *
+ * - **The token expires, and there is no refresh path.** The refresh material
+ *   is the browser session, which stays in the browser profile and never
+ *   reaches us. A credential going invalid is routine; signing in again mints
+ *   a fresh one.
+ * - **The token is only as scoped as the service says.** A minted token is
+ *   usually broader than an API key a user would issue deliberately.
+ */
+import { z } from 'zod';
+import { RawCurlCredentials } from '../../../apiCredentials/base.js';
+import { SimpleServiceSession } from '../base.js';
+import { parseLoginFlowParams } from './base.js';
+/** The placeholder a header template puts the captured token in. */
+const TOKEN_PLACEHOLDER = '{token}';
+/**
+ * The header a captured token goes into when the registration does not say.
+ * Bearer is what the great majority of token-minting web APIs expect.
+ */
+const DEFAULT_HEADER_TEMPLATE = `Authorization: Bearer ${TOKEN_PLACEHOLDER}`;
+/**
+ * Identity of an endpoint for matching purposes: origin and path, with the
+ * query string and fragment dropped.
+ *
+ * Matching this way rather than on the URL verbatim is deliberate. A mint
+ * endpoint is commonly called with a cache-busting or callback parameter the
+ * registrant cannot predict — NextAuth appends one to `/api/auth/session` — and
+ * requiring the whole URL to match would silently never fire. The alternative,
+ * letting registrations carry a regular expression, puts an injection and
+ * catastrophic-backtracking surface into stored configuration to buy a
+ * generality nothing has asked for.
+ */
+function endpointIdentity(url) {
+    return `${url.origin}${url.pathname}`;
+}
+/**
+ * Read a dotted path out of parsed JSON — `accessToken`, or `data.token` when
+ * the endpoint nests it.
+ *
+ * Returns null for anything that is not a non-empty string, which is what makes
+ * the token's *presence* the completion signal: a signed-out visitor commonly
+ * gets the same endpoint answering `{}` or `{"accessToken": null}`, and the
+ * request having happened must not be mistaken for a finished login.
+ */
+function readTokenAtPath(body, path) {
+    let current = body;
+    for (const segment of path) {
+        if (typeof current !== 'object' || current === null || Array.isArray(current)) {
+            return null;
+        }
+        current = current[segment];
+    }
+    return typeof current === 'string' && current !== '' ? current : null;
+}
+const TokenCaptureParamsSchema = z
+    .object({
+    /**
+     * The endpoint whose response carries the token. Compared by origin and
+     * path, so a query string does not have to be predicted.
+     */
+    tokenUrl: z.string().url(),
+    /**
+     * Where the token sits in the JSON body. Dotted for a nested field; each
+     * segment is a literal key, so a key containing a dot cannot be addressed —
+     * no such endpoint has come up, and leaving it out keeps the syntax
+     * obvious.
+     */
+    tokenField: z.string().min(1),
+    /**
+     * The header the token is stored as. Must contain `{token}`, and must look
+     * like a header, so that a mistake here is caught at registration rather
+     * than as a puzzling 401 after a successful-looking login.
+     */
+    header: z
+        .string()
+        .min(1)
+        .refine((value) => value.includes(TOKEN_PLACEHOLDER), {
+        message: `must contain the ${TOKEN_PLACEHOLDER} placeholder`,
+    })
+        .refine((value) => /^[^:\s]+:/.test(value), {
+        message: "must be a header, as in 'Authorization: Bearer {token}'",
+    })
+        .optional(),
+})
+    .strict();
+/** Store the captured token the way `latchkey auth set -H` would. */
+function buildTokenCredentials(headerTemplate, token) {
+    return new RawCurlCredentials(['-H', headerTemplate.replaceAll(TOKEN_PLACEHOLDER, token)]);
+}
+/**
+ * One run of the flow: responses go by, and the first one from the mint
+ * endpoint that carries a token ends the login.
+ */
+class TokenCaptureSession extends SimpleServiceSession {
+    tokenEndpointIdentity;
+    tokenPath;
+    headerTemplate;
+    constructor(service, appNamePrefix, tokenUrl, tokenPath, headerTemplate) {
+        super(service, appNamePrefix);
+        this.tokenEndpointIdentity = endpointIdentity(tokenUrl);
+        this.tokenPath = tokenPath;
+        this.headerTemplate = headerTemplate;
+    }
+    async getApiCredentialsFromResponse(response) {
+        let responseUrl;
+        try {
+            responseUrl = new URL(response.url());
+        }
+        catch {
+            // Not a URL we can compare — a data: or blob: response, say.
+            return null;
+        }
+        if (endpointIdentity(responseUrl) !== this.tokenEndpointIdentity) {
+            return null;
+        }
+        let token;
+        try {
+            token = readTokenAtPath(JSON.parse(await response.text()), this.tokenPath);
+        }
+        catch {
+            // Unreadable or not JSON: the endpoint answered with something this
+            // registration does not describe. Keep waiting rather than fail the
+            // login — the response that carries the token may still be coming.
+            return null;
+        }
+        return token === null ? null : buildTokenCredentials(this.headerTemplate, token);
+    }
+}
+/**
+ * The flow. Its statics are the kind of automation — what `--login-flow`
+ * selects — and an instance is that kind configured with one service's
+ * parameters, ready to create a session per login.
+ */
+export class TokenCaptureLoginFlow {
+    /** Value of `--login-flow`. Not `name`, which every class already has. */
+    static flowName = 'token-capture';
+    static summary = 'Open the login URL and capture a token the web app mints for itself, from the JSON ' +
+        'body of a named endpoint.';
+    static details = [
+        'Parameters:',
+        '  tokenUrl    Full URL, including the scheme, of the endpoint whose response',
+        '              carries the token. Required. Matched on origin and path, so a',
+        '              query string the app appends does not have to be predicted.',
+        '  tokenField  Where the token sits in the JSON body. Required. Dotted for a',
+        '              nested field, as in "data.accessToken".',
+        '  header      Header to store the token as. Optional; defaults to',
+        `              "${DEFAULT_HEADER_TEMPLATE}". Must contain ${TOKEN_PLACEHOLDER}.`,
+        '',
+        'For services where the cookie authenticates the page rather than the API,',
+        'and the page calls an endpoint of its own to mint a short-lived token. Use',
+        'cookie-capture instead when the cookie is itself the API credential.',
+        '',
+        'The login finishes when that endpoint answers with a non-empty token, not',
+        'when it is merely requested: a signed-out visitor commonly gets the same',
+        'endpoint answering `{}`. A token minted this way expires and cannot be',
+        'refreshed — the refresh material stays in the browser — so expect to sign',
+        'in again periodically.',
+        '',
+        'Example:',
+        '  $ latchkey services register my-app \\',
+        '      --base-api-url="https://app.example.com/backend-api/" \\',
+        '      --login-url="https://app.example.com/auth/login" \\',
+        '      --login-flow=token-capture \\',
+        '      --login-flow-params=\'{"tokenUrl": "https://app.example.com/api/auth/session",',
+        '                            "tokenField": "accessToken"}\'',
+    ].join('\n');
+    static paramsSchema = TokenCaptureParamsSchema;
+    params;
+    constructor(rawParams) {
+        this.params = parseLoginFlowParams(TokenCaptureLoginFlow, rawParams);
+    }
+    describe(loginUrl) {
+        return (`\`latchkey auth browser\` opens ${loginUrl} and stores the '${this.params.tokenField}' ` +
+            `field of ${this.params.tokenUrl} as the credentials once it carries a token.`);
+    }
+    createSession(service, appNamePrefix) {
+        return new TokenCaptureSession(service, appNamePrefix, new URL(this.params.tokenUrl), this.params.tokenField.split('.'), this.params.header ?? DEFAULT_HEADER_TEMPLATE);
+    }
+}
+// TypeScript has no `static implements`, so this is where the class side of the
+// flow is checked. The registry checks it again, but the error lands here.
+TokenCaptureLoginFlow;
+//# sourceMappingURL=tokenCapture.js.map

package/dist/src/services/core/loginFlows/tokenCapture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenCapture.js","sourceRoot":"","sources":["../../../../../src/services/core/loginFlows/tokenCapture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAuB,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1F,OAAO,EAAW,oBAAoB,EAAuB,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAuC,MAAM,WAAW,CAAC;AAEtF,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC;;;GAGG;AACH,MAAM,uBAAuB,GAAG,yBAAyB,iBAAiB,EAAE,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CAAC,GAAQ;IAChC,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,IAAa,EAAE,IAAuB;IAC7D,IAAI,OAAO,GAAY,IAAI,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B;;;;OAIG;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE;QACpD,OAAO,EAAE,oBAAoB,iBAAiB,cAAc;KAC7D,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC1C,OAAO,EAAE,yDAAyD;KACnE,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,qEAAqE;AACrE,SAAS,qBAAqB,CAAC,cAAsB,EAAE,KAAa;IAClE,OAAO,IAAI,kBAAkB,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,mBAAoB,SAAQ,oBAAoB;IACnC,qBAAqB,CAAS;IAC9B,SAAS,CAAoB;IAC7B,cAAc,CAAS;IAExC,YACE,OAAgB,EAChB,aAAqB,EACrB,QAAa,EACb,SAA4B,EAC5B,cAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC9B,IAAI,CAAC,qBAAqB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,QAAkB;QAElB,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,gBAAgB,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IAChC,0EAA0E;IAC1E,MAAM,CAAU,QAAQ,GAAG,eAAe,CAAC;IAE3C,MAAM,CAAU,OAAO,GACrB,qFAAqF;QACrF,2BAA2B,CAAC;IAE9B,MAAM,CAAU,OAAO,GAAG;QACxB,aAAa;QACb,8EAA8E;QAC9E,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,uDAAuD;QACvD,mEAAmE;QACnE,kBAAkB,uBAAuB,mBAAmB,iBAAiB,GAAG;QAChF,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,wBAAwB;QACxB,EAAE;QACF,UAAU;QACV,0CAA0C;QAC1C,gEAAgE;QAChE,2DAA2D;QAC3D,qCAAqC;QACrC,sFAAsF;QACtF,4DAA4D;KAC7D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,CAAU,YAAY,GAAG,wBAAwB,CAAC;IAEvC,MAAM,CAAqB;IAE5C,YAAY,SAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,QAAQ,CAAC,QAAgB;QACvB,OAAO,CACL,mCAAmC,QAAQ,oBAAoB,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI;YACzF,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,8CAA8C,CAC/E,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,OAAgB,EAAE,aAAqB;QACnD,OAAO,IAAI,mBAAmB,CAC5B,OAAO,EACP,aAAa,EACb,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC7B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EACjC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,uBAAuB,CAC9C,CAAC;IACJ,CAAC;;AAGH,gFAAgF;AAChF,2EAA2E;AAC3E,qBAA8C,CAAC"}

package/dist/src/services/index.d.ts

@@ -7,6 +7,7 @@ export { RegisteredService } from './core/registered.js';
 export { LOGIN_FLOWS, UnknownLoginFlowError, formatLoginFlowsHelp, resolveLoginFlow, } from './core/loginFlows/registry.js';
 export { LoginFlowParamsInvalidError, parseLoginFlowParams, type LoginFlow, type LoginFlowClass, } from './core/loginFlows/base.js';
 export { CookieCaptureLoginFlow } from './core/loginFlows/cookieCapture.js';
+export { TokenCaptureLoginFlow } from './core/loginFlows/tokenCapture.js';
 export { Slack, SLACK } from './slack.js';
 export { Discord, DISCORD } from './discord.js';
 export { Github, GITHUB } from './github.js';

package/dist/src/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,YAAY,EACZ,2BAA2B,EAC3B,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,YAAY,EACZ,2BAA2B,EAC3B,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/src/services/index.js

@@ -7,6 +7,7 @@ export { RegisteredService } from './core/registered.js';
 export { LOGIN_FLOWS, UnknownLoginFlowError, formatLoginFlowsHelp, resolveLoginFlow, } from './core/loginFlows/registry.js';
 export { LoginFlowParamsInvalidError, parseLoginFlowParams, } from './core/loginFlows/base.js';
 export { CookieCaptureLoginFlow } from './core/loginFlows/cookieCapture.js';
+export { TokenCaptureLoginFlow } from './core/loginFlows/tokenCapture.js';
 export { Slack, SLACK } from './slack.js';
 export { Discord, DISCORD } from './discord.js';
 export { Github, GITHUB } from './github.js';

package/dist/src/services/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,GAGrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,YAAY,EACZ,2BAA2B,GAE5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kCAAkC,EAClC,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,GAGrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/src/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "3.9.0";
+export declare const VERSION = "3.10.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/src/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,UAAU,CAAC"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,WAAW,CAAC"}

package/dist/src/version.js

@@ -1,4 +1,4 @@
 // Auto-generated from package.json by scripts/generateVersion.js.
 // Do not edit by hand; run `node scripts/generateVersion.js` to refresh.
-export const VERSION = "3.9.0";
+export const VERSION = "3.10.1";
 //# sourceMappingURL=version.js.map

package/dist/src/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,yEAAyE;AACzE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,yEAAyE;AACzE,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC"}

package/dist/tests/cli.test.js

@@ -1001,6 +1001,14 @@ describe('CLI commands with dependency injection', () => {
         function writeStore(contents, preparations = {}) {
             writeSecureFile(join(tempDir, STORE_FILENAME), JSON.stringify({ ...nestAccounts(contents), preparations }));
         }
+        // Write an on-disk store with explicit account keys.
+        function writeAccountStore(credentials, preparations = {}) {
+            writeSecureFile(join(tempDir, STORE_FILENAME), JSON.stringify({ credentials, preparations }));
+        }
+        function readAccountsWithKey(path, key) {
+            const raw = JSON.parse(new EncryptedStorage(key).readFile(path) ?? '{}');
+            return raw.credentials ?? {};
+        }
         function readPreparationsWithKey(path, key) {
             const raw = JSON.parse(new EncryptedStorage(key).readFile(path) ?? '{}');
             return raw.preparations ?? {};
@@ -1125,6 +1133,116 @@ describe('CLI commands with dependency injection', () => {
                 gitlab: GITLAB_PREPARATION,
             });
         });
+        it('only includes the given account when using --account', async () => {
+            writeAccountStore({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'work-tok', dCookie: 'work-cookie' },
+                    'home@example.com': { objectType: 'slack', token: 'home-tok', dCookie: 'home-cookie' },
+                },
+                gitlab: {
+                    'work@example.com': { objectType: 'authorizationBearer', token: 'gitlab-token' },
+                },
+            }, { gitlab: GITLAB_PREPARATION });
+            const destinationDirectory = join(tempDir, 'export');
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['--account', 'work@example.com', 'auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBeNull();
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            expect(readAccountsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'work-tok', dCookie: 'work-cookie' },
+                },
+                gitlab: {
+                    'work@example.com': { objectType: 'authorizationBearer', token: 'gitlab-token' },
+                },
+            });
+            // Preparations are not account-specific and are carried over as usual.
+            expect(readPreparationsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                gitlab: GITLAB_PREPARATION,
+            });
+        });
+        it('keeps the other accounts of the destination when using --account', async () => {
+            writeAccountStore({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'new-tok', dCookie: 'new-cookie' },
+                },
+            });
+            const destinationDirectory = join(tempDir, 'export');
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            stampDataFormatVersion(destinationDirectory);
+            new EncryptedStorage(NEW_ENCRYPTION_KEY).writeFile(destination, JSON.stringify({
+                credentials: {
+                    slack: {
+                        'work@example.com': { objectType: 'slack', token: 'old-tok', dCookie: 'old-cookie' },
+                        'home@example.com': {
+                            objectType: 'slack',
+                            token: 'home-tok',
+                            dCookie: 'home-cookie',
+                        },
+                    },
+                },
+                preparations: {},
+            }));
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['--account', 'work@example.com', 'auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBeNull();
+            expect(readAccountsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'new-tok', dCookie: 'new-cookie' },
+                    'home@example.com': { objectType: 'slack', token: 'home-tok', dCookie: 'home-cookie' },
+                },
+            });
+        });
+        it('leaves the destination account alone when the source does not have it', async () => {
+            writeAccountStore({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'work-tok', dCookie: 'work-cookie' },
+                },
+            }, { gitlab: GITLAB_PREPARATION });
+            const destinationDirectory = join(tempDir, 'export');
+            const destination = join(destinationDirectory, STORE_FILENAME);
+            stampDataFormatVersion(destinationDirectory);
+            new EncryptedStorage(NEW_ENCRYPTION_KEY).writeFile(destination, JSON.stringify({
+                credentials: {
+                    // gitlab only has a preparation in the source, so its credentials
+                    // in the destination must survive.
+                    gitlab: {
+                        'work@example.com': {
+                            objectType: 'authorizationBearer',
+                            token: 'destination-token',
+                        },
+                    },
+                },
+                preparations: {},
+            }));
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['--account', 'work@example.com', 'auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBeNull();
+            expect(readAccountsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                gitlab: {
+                    'work@example.com': { objectType: 'authorizationBearer', token: 'destination-token' },
+                },
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'work-tok', dCookie: 'work-cookie' },
+                },
+            });
+            expect(readPreparationsWithKey(destination, NEW_ENCRYPTION_KEY)).toEqual({
+                gitlab: GITLAB_PREPARATION,
+            });
+        });
+        it('errors when no stored credentials belong to the given account', async () => {
+            writeAccountStore({
+                slack: {
+                    'work@example.com': { objectType: 'slack', token: 'work-tok', dCookie: 'work-cookie' },
+                },
+            });
+            const destinationDirectory = join(tempDir, 'export');
+            const deps = withStdinKey(NEW_ENCRYPTION_KEY);
+            await runCommand(['--account', 'missing@example.com', 'auth', 're-encrypt', destinationDirectory], deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs.join('\n')).toContain('missing@example.com');
+            expect(existsSync(join(destinationDirectory, STORE_FILENAME))).toBe(false);
+        });
         it('errors for an invalid encryption key read from stdin', async () => {
             writeStore({});
             const destinationDirectory = join(tempDir, 'export');