lazycodex-ai 5.1.62 → 5.1.63

package/dist/cli/service-auth/keychain-helper/store-binding.d.ts

@@ -0,0 +1,46 @@
+import type { SecretApi } from "../keystore";
+import type { HelperLease } from "./client";
+import { type DarwinBackend, type KeychainHelperOptions } from "./darwin-backend";
+import type { WriteIntent } from "./darwin-store";
+/** The session-lock view of a store (#11262 design 3.3, 3.4, 3.6): every keychain change inside one locked section. */
+export type LockedStore<T> = {
+    readonly read: () => Promise<T | null>;
+    readonly write: (value: T, intent?: WriteIntent, beforeRetire?: () => Promise<void>) => Promise<void>;
+    readonly clear: () => Promise<void>;
+    readonly recover: () => Promise<void>;
+    readonly settle: () => Promise<void>;
+};
+export type HelperBinding = {
+    /** The secrets every non-helper path of this store uses: gated when the store is helper-eligible, else as given. */
+    readonly secrets: SecretApi;
+    readonly eligible: boolean;
+    readonly backend: () => Promise<DarwinBackend | null>;
+    readonly reader: (backend: DarwinBackend) => SecretApi;
+    readonly isHelperReader: (api: SecretApi) => boolean;
+    readonly guardHelperless: () => Promise<void>;
+};
+/**
+ * Only the real macOS store of the sign-in item gets the signed helper (or a store a test hands helper options to);
+ * Windows, Linux, the other namespaces and injected stores keep exactly today's path.
+ */
+export declare function bindKeychainHelper(input: {
+    readonly platform: NodeJS.Platform;
+    readonly namespace: string;
+    readonly secrets: SecretApi;
+    readonly key: {
+        readonly service: string;
+        readonly name: string;
+    };
+    readonly background: boolean;
+    readonly origin: string;
+    readonly notice: (message: string) => void;
+    readonly pending: (message: string) => Error;
+    readonly options?: KeychainHelperOptions;
+}): HelperBinding;
+/** Adapts the helper's locked view to the store's value type; every error is mapped once and the shared read reset. */
+export declare function lockedStoreView<T>(helper: DarwinBackend, lease: HelperLease, codec: {
+    readonly parse: (text: string) => T;
+    readonly serialize: (value: T) => string;
+    /** Assigns derived fields (the credential generation) from the item as a read started now finds it. */
+    readonly amend?: (previous: string | null, next: T) => T;
+}, mapError: (error: unknown) => unknown, done: () => void): LockedStore<T>;

package/dist/cli/service-auth/keystore.d.ts

@@ -1,5 +1,9 @@
 import type { z } from "zod";
 import { type Credentials, SignInError } from "./protocol";
+import type { HelperLease } from "./keychain-helper/client";
+import { type KeychainHelperOptions } from "./keychain-helper/darwin-backend";
+import { type WriteIntent } from "./keychain-helper/darwin-store";
+import { type LockedStore } from "./keychain-helper/store-binding";
 import { type SecretServiceLockProbe } from "./secret-service-lock";
 type SecretKey = {
     readonly service: string;
@@ -12,12 +16,23 @@ export type SecretApi = {
     }) => Promise<void>;
     readonly delete: (key: SecretKey) => Promise<boolean>;
 };
+export type { LockedStore };
 export type SealedStore<T> = {
     readonly read: () => Promise<T | null>;
     /** A read started now that never joins a coalesced read begun earlier; credential transactions use it under the lock. */
     readonly readAuthoritative: () => Promise<T | null>;
-    readonly write: (value: T) => Promise<void>;
+    /**
+     * `intent` matters only to the keychain helper: row 8b retires an unreadable item only on a fresh sign-in, and runs
+     * `beforeRetire` first so the caller can report that discard.
+     */
+    readonly write: (value: T, intent?: WriteIntent, beforeRetire?: () => Promise<void>) => Promise<void>;
     readonly clear: () => Promise<void>;
+    /** Before the session lock: settles any approval, so no access dialog is ever open while the lock is held. */
+    readonly prepare?: () => Promise<void>;
+    /** The helper's view for this locked section (recovered first), or null when this store has no helper. */
+    readonly underLock?: (lease: HelperLease) => Promise<LockedStore<T> | null>;
+    /** True while the last read came from an item the helper does not own yet: the token path then takes the lock once. */
+    readonly migrationPending?: () => Promise<boolean>;
 };
 export type CredentialStore = SealedStore<Credentials>;
 export declare class CredentialStoreError extends SignInError {
@@ -59,6 +74,6 @@ export declare function createCredentialStore(api: string, options?: {
     readonly notice?: (message: string) => void;
     readonly wait?: CredentialReadWait;
     readonly home?: string;
+    readonly keychainHelper?: KeychainHelperOptions;
 }): CredentialStore;
-export declare function createSealedStore<T>(api: string, namespace: "omo-cli" | "omo-cli-v2" | "omo-cli-revocations-v2", schema: z.ZodType<T>, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void, wait?: CredentialReadWait, amendWrite?: (previous: T | null, next: T) => T): SealedStore<T>;
-export {};
+export declare function createSealedStore<T>(api: string, namespace: "omo-cli" | "omo-cli-v2" | "omo-cli-revocations-v2", schema: z.ZodType<T>, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void, wait?: CredentialReadWait, amendWrite?: (previous: T | null, next: T) => T, keychainHelper?: KeychainHelperOptions): SealedStore<T>;

package/dist/cli/service-auth/session.d.ts

@@ -1,5 +1,5 @@
 import type { CredentialOwner } from "./credential-owner";
-import { type CredentialStore } from "./keystore";
+import { type CredentialStore, type LockedStore } from "./keystore";
 import { type ChooseDevice, type Credentials, SignInError } from "./protocol";
 export declare class SessionEnded extends SignInError {
     readonly deviceRevoked: boolean;
@@ -36,7 +36,7 @@ export declare function createSession(options: {
 }): {
     request: (path: string, init: RequestInit) => Promise<unknown>;
     signal: AbortSignal | undefined;
-    transaction: <T>(action: () => Promise<T>) => Promise<T>;
+    transaction: <T>(action: (view: LockedStore<Credentials> | null) => Promise<T>) => Promise<T>;
     ready(): Promise<void>;
     save(value: Credentials): Promise<void>;
     /** The marker an explicit `omo logout` left, or null; only an empty store makes it meaningful. */