lazycodex-ai 5.1.62 → 5.1.64

package/dist/cli/service-auth/closed-device-login.fixture.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/service-auth/credential-lock.d.ts

@@ -1,3 +1,4 @@
+import { type LockLease } from "@oh-my-opencode/team-core/team-state-store/locks";
 /**
  * The one per-origin lock and desktop generation record (account-transport-api v7 section 4.1). The CLI, desktop main
  * and the engine pin boundary all derive these paths here or with the same inputs; never pass a path around instead.
@@ -7,5 +8,10 @@ export declare function credentialLockPaths(api: string, home?: string): {
     readonly lock: string;
     readonly desktopRecord: string;
 };
-/** Writers and effect boundaries share one origin lock; nested session writes retain ownership. */
-export declare function withCredentialLock<T>(api: string, action: () => Promise<T>, home?: string, ownerTag?: string): Promise<T>;
+/** The lease of the origin lock this async context already holds, or undefined outside that lock. */
+export declare function heldCredentialLease(api: string, home?: string): LockLease | undefined;
+/**
+ * Writers and effect boundaries share one origin lock; nested session writes retain ownership and see the outer lease,
+ * which the keychain helper needs to take the lock over for a mutation (#11262 design 3.6).
+ */
+export declare function withCredentialLock<T>(api: string, action: (lease: LockLease) => Promise<T>, home?: string, ownerTag?: string): Promise<T>;

package/dist/cli/service-auth/keychain-helper/access.d.ts

@@ -0,0 +1,27 @@
+import { type HelperCall, type HelperLease, type HelperReply, type HelperSpawner } from "./client";
+import { type PinResult } from "./pin";
+import { type SignatureVerdict } from "./signature";
+export type HelperAccess = {
+    readonly kind: "ready";
+    readonly path: string;
+    readonly call: (call: HelperCall, lease?: HelperLease) => Promise<HelperReply>;
+} | {
+    readonly kind: "missing";
+} | {
+    readonly kind: "invalid";
+    readonly rejected: readonly string[];
+} | {
+    readonly kind: "unavailable";
+    readonly reason: string;
+};
+/**
+ * The only way the store reaches a helper process. The located copy is pinned (copied into this process's private
+ * directory and verified there), and the pinned copy is checked again before EVERY spawn through the process's one
+ * checker. So an unsigned, ad-hoc-signed or tampered file is never executed: not at resolution, not after a later
+ * swap at the original path (never spawned), and not after a change to the pinned copy (refused).
+ */
+export declare function resolveHelperAccess(candidates: readonly string[], options?: {
+    readonly verify?: (path: string) => Promise<SignatureVerdict>;
+    readonly spawn?: HelperSpawner;
+    readonly pin?: (source: string, verify: (path: string) => Promise<SignatureVerdict>) => Promise<PinResult>;
+}): Promise<HelperAccess>;

package/dist/cli/service-auth/keychain-helper/approval-cache.d.ts

@@ -0,0 +1,51 @@
+export type ItemAttributes = {
+    readonly cdat: number;
+    readonly mdat: number;
+};
+export type ApprovalEntry = ItemAttributes & {
+    readonly value: string;
+    readonly readStartedAt: number;
+};
+export type ApprovalAnswer = {
+    readonly kind: "approved";
+    readonly value: string;
+    readonly attributes: ItemAttributes;
+} | {
+    readonly kind: "denied";
+} | {
+    readonly kind: "missing";
+};
+export type ApprovalClock = {
+    readonly nowSeconds: () => number;
+    readonly sleepMs: (ms: number) => Promise<void>;
+};
+/**
+ * A cached `approve` answer serves a read only while `<A>` is exactly the item that answer read: equal `cdat` and `mdat`,
+ * and `floor(mdat) < floor(readStartedAt)` so any write after the approval read started (which lands in that second or
+ * later) invalidates it. A clock that went backwards since then drops the entry (design 3.5).
+ */
+export declare function isEntryValid(entry: ApprovalEntry, current: ItemAttributes, nowSeconds: number): boolean;
+export type ApprovalCache = ReturnType<typeof createApprovalCache>;
+/**
+ * One cache per process (design 3.2 step 3; addendum rows 12, 13, 22, 23): the validated answer, the one in-flight
+ * `approve` every caller attaches to, and a remembered "Deny" that only background paths honor.
+ */
+export declare function createApprovalCache(clock?: ApprovalClock): {
+    consume(current: ItemAttributes): string | null;
+    deniedForBackground: () => boolean;
+    /**
+     * Runs `approve` at most once at a time per process: later callers attach to the pending answer instead of opening a
+     * second dialog, and a late answer still fills the cache after a caller's bounded wait expired (3.2 step 4).
+     */
+    /** The `approve` already running in this process, which a new caller attaches to before taking any lock. */
+    inFlight: () => Promise<ApprovalAnswer> | null;
+    approve(run: () => Promise<ApprovalAnswer>): Promise<ApprovalAnswer>;
+    /**
+     * After this process wrote a non-owned item under the session lock, keep serving it: take the written value, hold
+     * the lock until the clock has left the write's second, then re-stamp from a fresh attribute read. Any later foreign
+     * write lands in a later second and fails validation (3.2 step 3, "This process's own writes keep it valid").
+     */
+    afterOwnWrite(value: string, readAttributes: () => Promise<ItemAttributes | null>): Promise<void>;
+    drop(): void;
+};
+export declare const processApprovalCache: () => ApprovalCache;

package/dist/cli/service-auth/keychain-helper/client.d.ts

@@ -0,0 +1,68 @@
+import { z } from "zod";
+export type HelperVerb = "read" | "approve" | "write" | "stage" | "retire" | "promote" | "remove";
+export type HelperCall = {
+    readonly verb: HelperVerb;
+    readonly account: string;
+    readonly value?: string;
+};
+declare const helperReplySchema: z.ZodObject<{
+    owned: z.ZodOptional<z.ZodBoolean>;
+    value: z.ZodOptional<z.ZodString>;
+    marker: z.ZodOptional<z.ZodBoolean>;
+    cdat: z.ZodOptional<z.ZodNumber>;
+    mdat: z.ZodOptional<z.ZodNumber>;
+    partition: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        other: "other";
+        ours: "ours";
+        unknown: "unknown";
+    }>>;
+    present: z.ZodOptional<z.ZodObject<{
+        staging: z.ZodBoolean;
+        old: z.ZodBoolean;
+        oldSlots: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    }, z.core.$strict>>;
+    missing: z.ZodOptional<z.ZodBoolean>;
+    recover: z.ZodOptional<z.ZodBoolean>;
+    ok: z.ZodOptional<z.ZodBoolean>;
+    created: z.ZodOptional<z.ZodBoolean>;
+    skipped: z.ZodOptional<z.ZodBoolean>;
+    slot: z.ZodOptional<z.ZodNumber>;
+    error: z.ZodOptional<z.ZodEnum<{
+        denied: "denied";
+        exists: "exists";
+        locked: "locked";
+        missing: "missing";
+        "not-owned": "not-owned";
+        refused: "refused";
+        store: "store";
+    }>>;
+    reason: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type HelperReply = z.infer<typeof helperReplySchema>;
+/** The session-lock lease of team-core (`withLock`'s callback argument), narrowed to what a helper call needs. */
+export type HelperLease = {
+    readonly handOver: (pid: number) => Promise<void>;
+    readonly restore: () => Promise<void>;
+};
+export type SpawnedHelper = {
+    readonly pid: number;
+    readonly send: (line: string) => void;
+    readonly reply: Promise<string | null>;
+    readonly close: () => void;
+};
+export type HelperSpawner = (path: string) => SpawnedHelper;
+export declare class HelperProtocolError extends Error {
+}
+export declare const spawnDetachedHelper: HelperSpawner;
+/**
+ * One helper process per call. A mutating call runs only under the session lock: the lock is handed to the helper
+ * before the request and restored before its stdin closes, so no other writer can enter until the native call has
+ * landed (design 3.6, R2). `restore` throws when the lock was lost, and the caller's section must stop.
+ */
+export declare function callHelper(path: string, call: HelperCall, options?: {
+    readonly lease?: HelperLease;
+    readonly spawn?: HelperSpawner;
+}): Promise<HelperReply>;
+export {};

package/dist/cli/service-auth/keychain-helper/creator-handoff.d.ts

@@ -0,0 +1,31 @@
+import type { RequirementCheck } from "./signature";
+export declare const DESKTOP_RUNTIME_REQUIREMENT = "identifier \"com.mengmota.omo-desktop-runtime\" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = \"523JNR86LZ\"";
+/** The app bundle as a whole: any Developer ID signature of our team, with every nested piece sealed (--deep --strict). */
+export declare const DESKTOP_APP_REQUIREMENT = "anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = \"523JNR86LZ\"";
+/** Set in the creator's environment: that process never hands off in turn and never shows a keychain dialog. */
+export declare const HANDOFF_ENV = "OMO_KEYCHAIN_HANDOFF";
+export type DesktopRuntime = {
+    readonly app: string;
+    readonly runtime: string;
+};
+/** The desktop app's macOS install locations, joined with POSIX separators on every host. */
+export declare function desktopRuntimeCandidates(home: string, arch?: string): readonly DesktopRuntime[];
+export type BundleCheck = (app: string, requirement: string) => Promise<boolean>;
+export type HandOffRunner = (path: string, args: readonly string[], env: Record<string, string>, deadlineMs: number) => Promise<number | null>;
+/**
+ * Addendum change 1 (rows 7, 8): before the one dialog, ask the side that created the item to move it to the helper.
+ * The runtime is run from inside its app bundle, never from a copy: it finds its own keychain helper next to itself,
+ * which is what lets it migrate. So the whole bundle is verified (`codesign --deep --strict` against our team) and the
+ * runtime against its designated requirement immediately before the spawn. True only when a verified creator exited
+ * cleanly; a missing app, a failed check, a failed spawn or a non-zero exit is false, and the caller shows its dialog.
+ */
+export declare function createCreatorHandOff(options: {
+    readonly candidates: readonly DesktopRuntime[];
+    readonly origin?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly checkRuntime?: RequirementCheck;
+    readonly checkBundle?: BundleCheck;
+    readonly declaresHandOff?: (runtime: string) => Promise<boolean>;
+    readonly run?: HandOffRunner;
+    readonly selfPath?: string;
+}): () => Promise<boolean>;

package/dist/cli/service-auth/keychain-helper/darwin-backend.d.ts

@@ -0,0 +1,75 @@
+import { type HelperAccess } from "./access";
+import { type ApprovalCache } from "./approval-cache";
+import { type Row8bChoice } from "./darwin-read";
+import { type LockedDarwinStore } from "./darwin-store";
+import type { HelperLease } from "./client";
+import { type MarkerProbe } from "./owner-marker";
+type SecretKey = {
+    readonly service: string;
+    readonly name: string;
+};
+type Secrets = {
+    readonly get: (key: SecretKey) => Promise<string | null>;
+    readonly set: (key: SecretKey & {
+        readonly value: string;
+    }) => Promise<void>;
+    readonly delete: (key: SecretKey) => Promise<boolean>;
+};
+/**
+ * Row 9b (addendum, ruled 2026-10-28): the item is helper-owned but no verified helper exists on this machine.
+ * "reinstall-notice" (default) fails with a one-line notice and no dialog; "dialog" takes today's read, which prompts.
+ */
+export type Row9bChoice = "reinstall-notice" | "dialog";
+/** Entry points with their own layout (the compiled binary's `execDir`, the desktop runtime) register their copy first. */
+export declare function registerHelperCandidates(paths: readonly string[]): void;
+/**
+ * One resolution per process, shared by every bundled copy. An `unavailable` result (a transient pin or copy failure)
+ * is not kept: the next resolve tries again, so a long-lived process does not stay on the helper-less path.
+ */
+export declare const helperAccess: () => Promise<HelperAccess>;
+export declare function sharedHelperAccess(resolve: () => Promise<HelperAccess>): Promise<HelperAccess>;
+export declare class HelperMissingForOwnedItem extends Error {
+}
+/** The error shapes keystore.ts already maps: a locked keychain carries -25308; a pending approval is its own kind. */
+export declare function asKeystoreError(error: unknown, pending: (message: string) => Error): unknown;
+/** What a test (or an entry point) may substitute; production uses the defaults. */
+export type KeychainHelperOptions = {
+    readonly access?: () => Promise<HelperAccess>;
+    readonly ownerMarker?: MarkerProbe;
+    readonly silently?: <T>(run: () => Promise<T>) => Promise<T>;
+    readonly home?: string;
+    readonly row8b?: Row8bChoice;
+    readonly row9b?: Row9bChoice;
+    readonly cache?: ApprovalCache;
+    readonly handOff?: () => Promise<boolean>;
+    readonly noDialog?: boolean;
+};
+export type DarwinBackend = {
+    /** The read every caller outside the session lock shares (it may show the one plain approval dialog). */
+    readonly read: () => Promise<string | null>;
+    readonly underLock: (lease: HelperLease) => LockedDarwinStore;
+    /** The last read outside the lock found a value the helper does not own yet; only a locked section migrates it. */
+    readonly migrationPending: () => boolean;
+};
+export declare function createDarwinBackend(options: {
+    readonly access: Extract<HelperAccess, {
+        kind: "ready";
+    }>;
+    readonly secrets: Secrets;
+    readonly service: string;
+    readonly account: string;
+    readonly background: boolean;
+    readonly notice: (message: string) => void;
+    readonly home?: string;
+    readonly row8b?: Row8bChoice;
+    readonly silently?: <T>(run: () => Promise<T>) => Promise<T>;
+    readonly cache?: ApprovalCache;
+    readonly handOff?: () => Promise<boolean>;
+    readonly noDialog?: boolean;
+}): DarwinBackend;
+/**
+ * Without a verified helper, the read is today's, except for an item the helper owns (row 9b): today's read could
+ * only reach it through a dialog, so by default this answers with the reinstall notice instead.
+ */
+export declare function guardHelperlessRead(service: string, account: string, choice?: Row9bChoice, probe?: MarkerProbe): Promise<void>;
+export {};

package/dist/cli/service-auth/keychain-helper/darwin-read.d.ts

@@ -0,0 +1,46 @@
+import type { HelperAccess } from "./access";
+import type { ApprovalCache } from "./approval-cache";
+import type { HelperReply } from "./client";
+export type ReadSource = "owned" | "owned-unmarked" | "own-identity" | "approved";
+export type ReadResult = {
+    readonly kind: "value";
+    readonly value: string;
+    readonly source: ReadSource;
+    readonly reply: HelperReply;
+} | {
+    readonly kind: "missing";
+    readonly reply: HelperReply;
+};
+/**
+ * Row 8b (addendum, PRODUCT CALL, recommended default): the item's creator is gone and the only dialog left would be
+ * the login-password kind. "re-login" reads as signed out so the user signs in again (save then retires the old item);
+ * "password-dialog" asks anyway. Only the default may ship until the owner decides.
+ */
+export type Row8bChoice = "re-login" | "password-dialog";
+export type ReadFailure = "locked" | "store" | "pending" | "denied";
+export declare class HelperReadError extends Error {
+    readonly failure: ReadFailure;
+    constructor(failure: ReadFailure, message: string);
+}
+export type DarwinReadDeps = {
+    readonly account: string;
+    readonly access: Extract<HelperAccess, {
+        kind: "ready";
+    }>;
+    /** This process's own identity, interaction off: the value, null when missing, or throws when refused. */
+    readonly ownSilentGet: () => Promise<string | null>;
+    readonly cache: ApprovalCache;
+    /** R4: the machine-wide prompt lock, taken with zero wait; null when another process holds it. */
+    readonly takePromptLock: () => Promise<(() => Promise<void>) | null>;
+    /** Asks the side that created the item to migrate it before any prompt; true when that ran. */
+    readonly handOff?: () => Promise<boolean>;
+    readonly noDialog?: boolean;
+    readonly background: boolean;
+    readonly row8b?: Row8bChoice;
+};
+/**
+ * Design 3.2 for one read: the helper's read; for an item another identity owns, this process's own silent read, then
+ * the process's validated approval, then (outside the session lock only) the creator hand-off and at most one plain
+ * `approve` dialog. A login-password dialog is never shown (addendum Q2): such an item reads per row 8b.
+ */
+export declare function readThroughHelper(deps: DarwinReadDeps, allowPrompt: boolean): Promise<ReadResult>;

package/dist/cli/service-auth/keychain-helper/darwin-store.d.ts

@@ -0,0 +1,28 @@
+import type { HelperLease } from "./client";
+import { type DarwinReadDeps } from "./darwin-read";
+export type WriteIntent = "fresh-sign-in" | "update";
+export type DarwinStoreDeps = DarwinReadDeps & {
+    /** Today's overwrite of an item another identity owns (silent, m5): keeps that item's access list. */
+    readonly ownOverwrite: (value: string) => Promise<void>;
+    /** Today's delete of `<A>` by this process's identity (may prompt, v9 3.1); `<A>.old` silently. */
+    readonly ownDelete: (name: string) => Promise<boolean>;
+    /** One notice per process for a failed migration (v9 3.3: it never fails the section). */
+    readonly notice: (message: string) => void;
+};
+export type LockedDarwinStore = {
+    readonly recover: () => Promise<void>;
+    readonly read: () => Promise<string | null>;
+    readonly settle: () => Promise<void>;
+    /** `beforeRetire` runs once, just before row 8b moves an unreadable item aside (the session reports that discard). */
+    readonly write: (value: string, intent: WriteIntent, beforeRetire?: () => Promise<void>) => Promise<void>;
+    readonly clear: () => Promise<void>;
+};
+/** RULING-73: every retired slot holds a copy nothing here can remove; the user must delete them once. */
+export declare class HelperOldSlotsFull extends Error {
+}
+/**
+ * The session-lock view (design 3.3, 3.4, 3.6): every helper mutation is handed the lease; reads never prompt (an
+ * approval comes from `prepare()` before the lock); recovery runs at the start of every section, migration only from
+ * `accessToken()`'s section via `settle()`.
+ */
+export declare function lockedDarwinStore(deps: DarwinStoreDeps, lease: HelperLease): LockedDarwinStore;

package/dist/cli/service-auth/keychain-helper/fake-keychain.test-support.d.ts

@@ -0,0 +1,85 @@
+import { type SecretApi } from "../keystore";
+import type { Credentials } from "../protocol";
+import { type BeforeKeysDiscarded } from "../session";
+import type { HelperCall, HelperLease, HelperReply } from "./client";
+export type Owner = "helper" | "bun" | "runtime" | "other-app";
+type Item = {
+    value: string;
+    owner: Owner;
+    partition: "ours" | "other" | "none";
+    marker: boolean;
+    cdat: number;
+    mdat: number;
+};
+export declare const credentials: Credentials;
+export declare const API = "https://api.example.test";
+export declare const A: string;
+/**
+ * An in-memory keychain with the measured semantics of #11262 design 8: data reads by a non-owner are refused, an
+ * overwrite keeps the item's owner (m5), a rename works for anyone (m10), a delete by a non-owner is refused (m6).
+ * `secrets` is this process's own identity (`bun`); `access` is the signed helper, which counts every approve dialog.
+ */
+export declare function fakeKeychain(options?: {
+    readonly approve?: "allow" | "deny" | "locked";
+    readonly approveGate?: Promise<void>;
+    readonly onApprove?: () => void;
+    readonly failReadWhenMissing?: boolean;
+    readonly singleOldSlot?: boolean;
+}): {
+    items: Map<string, Item>;
+    events: string[];
+    stats: {
+        approves: number;
+        unleasedMutations: number;
+    };
+    secrets: SecretApi;
+    secretsAs: (identity: Owner) => SecretApi;
+    access: {
+        readonly kind: "ready";
+        readonly path: string;
+        readonly call: (call: HelperCall, lease?: HelperLease) => Promise<HelperReply>;
+    };
+    put: (name: string, value: string, owner: Owner, partition?: Item["partition"]) => Map<string, Item>;
+    cache: {
+        consume(current: import("./approval-cache").ItemAttributes): string | null;
+        deniedForBackground: () => boolean;
+        inFlight: () => Promise<import("./approval-cache").ApprovalAnswer> | null;
+        approve(run: () => Promise<import("./approval-cache").ApprovalAnswer>): Promise<import("./approval-cache").ApprovalAnswer>;
+        afterOwnWrite(value: string, readAttributes: () => Promise<import("./approval-cache").ItemAttributes | null>): Promise<void>;
+        drop(): void;
+    };
+};
+export type SessionProcess = {
+    readonly identity?: Owner;
+    readonly noDialog?: boolean;
+    readonly handOff?: () => Promise<boolean>;
+    readonly home?: string;
+    readonly api?: string;
+    readonly beforeKeysDiscarded?: BeforeKeysDiscarded;
+};
+/** One omo process on the fake machine; a process other than the default has its own approval cache, as a real one does. */
+export declare function helperSession(keychain: ReturnType<typeof fakeKeychain>, background?: boolean, proc?: SessionProcess): Promise<{
+    store: import("..").CredentialStore;
+    session: {
+        request: (path: string, init: RequestInit) => Promise<unknown>;
+        signal: AbortSignal | undefined;
+        transaction: <T>(action: (view: import("./store-binding").LockedStore<Credentials> | null) => Promise<T>) => Promise<T>;
+        ready(): Promise<void>;
+        save(value: Credentials): Promise<void>;
+        signedOutMarker: () => Promise<{
+            device: string | null;
+            at: string;
+        } | null>;
+        clearSignedOutMarker: () => Promise<void>;
+        update<T>(action: (current: Credentials | null) => Promise<T>, options?: {
+            readonly replaceInvalid?: boolean;
+        }): Promise<T>;
+        forget(): Promise<void>;
+        accessSnapshot: () => Promise<Credentials | null>;
+        logout(): Promise<boolean>;
+        accessToken(expect?: (current: Credentials) => boolean): Promise<string>;
+        removeForLimit(error: unknown, choose: import("../protocol").ChooseDevice): Promise<boolean>;
+    };
+    home: string;
+}>;
+export {};

package/dist/cli/service-auth/keychain-helper/location.d.ts

@@ -0,0 +1,28 @@
+import type { SignatureVerdict } from "./signature";
+export type HelperLocation = {
+    readonly kind: "found";
+    readonly path: string;
+} | {
+    readonly kind: "missing";
+} | {
+    readonly kind: "invalid";
+    readonly rejected: readonly string[];
+};
+/**
+ * The two candidates every store-inlining bundle tries first, relative to its own file (design 1, shape A):
+ * `<two levels up>/bin/darwin/omo-keychain` (the omo-ai package, the compiled payload), then `<two levels up>/omo-keychain`
+ * (the desktop runtime directory).
+ */
+export declare function bundleCandidates(moduleUrl: string): readonly string[];
+/**
+ * Other signature-valid copies on this machine, tried after the bundle's own (addendum rows 9 and 10): the desktop
+ * app's copies and a bun-global omo-ai install. These are macOS paths, so they are joined with POSIX separators on
+ * every host.
+ */
+export declare function machineCandidates(home: string, arch?: string): readonly string[];
+/**
+ * The first candidate that exists AND passes the signature check. A missing candidate is skipped. A present candidate
+ * that fails the check is never used and is reported; the search continues only to other verified copies (addendum
+ * row 10 amends v9's "refuse, never fall through" to exactly this). Never PATH, never an environment variable.
+ */
+export declare function locateHelper(candidates: readonly string[], verify: (path: string) => Promise<SignatureVerdict>): Promise<HelperLocation>;

package/dist/cli/service-auth/keychain-helper/migration.d.ts

@@ -0,0 +1,20 @@
+import { type HelperCaller } from "./recovery";
+/** Where the value about to be migrated came from; anything else is never migrated (3.3 table, addendum row 22). */
+export type MigrationSource = "own-identity" | "owned-unmarked" | "approved";
+export type MigrationOutcome = {
+    readonly kind: "migrated";
+    readonly oldDeleted: boolean;
+} | {
+    readonly kind: "skipped";
+    readonly reason: "old-slots-full" | "not-migratable";
+} | {
+    readonly kind: "failed";
+    readonly step: "stage" | "retire" | "promote";
+};
+/**
+ * stage -> retire (`<A>` -> its first free `.old` slot) -> promote (staging -> `<A>`) -> delete that slot, all helper calls under the
+ * session lock (3.6 R2), so at every instant `<A>`, `<A>.staging` or `<A>.old` holds the current value. It never throws
+ * for a keychain refusal: the caller prints one notice and its section continues with the value it already read; 3.4
+ * recovery converges whatever is left.
+ */
+export declare function migrate(account: string, value: string, source: string, helper: HelperCaller, deleteOwnOld: (name: string) => Promise<boolean>): Promise<MigrationOutcome>;

package/dist/cli/service-auth/keychain-helper/owner-marker.d.ts

@@ -0,0 +1,7 @@
+export type MarkerProbe = (service: string, account: string, keychain?: string) => Promise<"helper-owned" | "other" | "absent" | "unknown">;
+/**
+ * Whether `<A>` carries the helper's `omo-owner/1` marker, read WITHOUT the helper (addendum row 9b): an attribute-only
+ * `security find-generic-password` lookup. It never passes `-w`/`-g`, so the secret is never read and no dialog can
+ * appear (attribute reads are silent for any identity, design 8 m2).
+ */
+export declare const probeOwnerMarker: MarkerProbe;

package/dist/cli/service-auth/keychain-helper/pin.d.ts

@@ -0,0 +1,20 @@
+import type { SignatureVerdict } from "./signature";
+/** Removes the pin directories of processes that are gone (a crash skips the exit cleanup). A live owner's is kept. */
+export declare function sweepDeadPinDirs(root?: string): readonly string[];
+export type PinResult = {
+    readonly kind: "pinned";
+    readonly path: string;
+} | {
+    readonly kind: "invalid";
+} | {
+    readonly kind: "unavailable";
+    readonly reason: string;
+};
+/**
+ * Copies a located helper into a directory only this process uses, makes the copy read-only, and verifies the COPY.
+ * The process then spawns only that copy, so a file written to the original path later (a dev build, a broken
+ * install) is never executed. The signature is inside the Mach-O, so the copy has the same designated requirement and
+ * the same keychain access as the original (#11262 design 1: every copy at any path matches one ACL entry).
+ * One copy is kept per source file identity; a source that changes gets a fresh copy.
+ */
+export declare function pinVerifiedCopy(source: string, verify: (path: string) => Promise<SignatureVerdict>, dir?: string): Promise<PinResult>;

package/dist/cli/service-auth/keychain-helper/process-copy.test-support.d.ts

@@ -0,0 +1,3 @@
+export { processApprovalCache } from "./approval-cache";
+export { promptLockAt } from "./prompt-lock";
+export { gatedSecrets } from "./secrets-gate";

package/dist/cli/service-auth/keychain-helper/process-state.d.ts

@@ -0,0 +1,19 @@
+import type { HelperAccess } from "./access";
+import type { ApprovalCache } from "./approval-cache";
+/**
+ * The state design 3.2 and 3.6 require once per PROCESS: the Bun.secrets queue and interaction switch, the approval
+ * cache, the helper candidates and their resolution, and the prompt locks this process holds. The store is bundled
+ * separately into more than one sidecar loaded in one process, so module state would give each copy its own; one
+ * record on globalThis under a registered symbol is shared by every copy. The ".v1" suffix keeps a future change of
+ * this record's shape from being read by an older copy.
+ */
+export type KeychainProcessState = {
+    secretsQueue: Promise<unknown>;
+    interactionSwitch: ((allowed: boolean) => void) | null | undefined;
+    approvalCache: ApprovalCache | undefined;
+    readonly entryCandidates: string[];
+    helperAccess: Promise<HelperAccess> | undefined;
+    readonly heldPromptLocks: Set<string>;
+    handOff: Promise<boolean> | undefined;
+};
+export declare function keychainProcessState(): KeychainProcessState;

package/dist/cli/service-auth/keychain-helper/prompt-lock.d.ts

@@ -0,0 +1,14 @@
+/**
+ * R4 (design 3.6): the machine-wide prompt lock around `approve`, taken with zero wait. Null means another process is
+ * already showing the one dialog, so this caller must not open a second. A pending `approve` keeps holding it; a holder
+ * that died leaves a record that is stale at once and is reaped by the next taker.
+ */
+/**
+ * Test seams: `beforePublish` runs between this caller's reservation and its publish (holding one copy there makes a race
+ * deterministic); `removeRecord` replaces the release's unlink, so a test can observe what holds while it runs.
+ */
+export type PromptLockHooks = {
+    readonly beforePublish?: () => Promise<void>;
+    readonly removeRecord?: (path: string, record: string) => Promise<unknown>;
+};
+export declare function promptLockAt(path: string, hooks?: PromptLockHooks): () => Promise<(() => Promise<void>) | null>;

package/dist/cli/service-auth/keychain-helper/recovery.d.ts

@@ -0,0 +1,34 @@
+import type { HelperCall, HelperReply } from "./client";
+export type MigrationNames = {
+    readonly original: boolean;
+    readonly staging: boolean;
+    readonly old: boolean;
+    readonly oldSlots: readonly number[];
+};
+/** `<A>.old` is slot 0; retired copies rotate through `<A>.old.1` ... `<A>.old.7` (RULING-73). */
+export declare const OLD_SLOT_COUNT = 8;
+export declare const oldSlotName: (account: string, slot: number) => string;
+export type RecoveryStep = "promote" | "remove-staging" | "delete-old";
+/**
+ * The 3.4 table: what one locked section does for each leftover of an interrupted migration. Renames only, never
+ * interactive, and `.old` is never renamed back: an `.old` with no original and no staging means signed out.
+ */
+export declare function recoveryPlan(names: MigrationNames): readonly RecoveryStep[];
+/** The occupied old slots; a helper that predates `oldSlots` has only slot 0 (`.old`). */
+export declare function oldSlotsOf(reply: HelperReply): readonly number[];
+/** The names present, from one `read` reply (its `present` field comes from silent attribute reads). */
+export declare function namesFromRead(reply: HelperReply): MigrationNames;
+export type HelperCaller = (call: HelperCall) => Promise<HelperReply>;
+/**
+ * Deletes one retired copy with whichever identity can: the helper when it can read it, otherwise this process's own
+ * identity (a decrypt-list member deletes silently, m9). A copy neither can delete is left; it holds a single-use token
+ * that the next refresh retires, and it occupies one rotation slot.
+ */
+export declare function deleteOld(name: string, helper: HelperCaller, deleteOwn: (name: string) => Promise<boolean>): Promise<boolean>;
+/** Clears every retired slot that is present and that some identity here can delete; true when none is left. */
+export declare function deleteOldSlots(account: string, slots: readonly number[], helper: HelperCaller, deleteOwn: (name: string) => Promise<boolean>): Promise<boolean>;
+export type RecoveryOutcome = {
+    readonly applied: readonly RecoveryStep[];
+    readonly failed: RecoveryStep | null;
+};
+export declare function runRecovery(account: string, names: MigrationNames, helper: HelperCaller, deleteOwnOld: (name: string) => Promise<boolean>): Promise<RecoveryOutcome>;

package/dist/cli/service-auth/keychain-helper/runtime-capabilities.d.ts

@@ -0,0 +1,13 @@
+/**
+ * What a built omo runtime declares about itself (RULING-74), in a file beside the runtime binary. The release build
+ * writes it next to every runtime it produces, and the desktop bundles it with the runtime and its keychain helper,
+ * inside the sealed app. A runtime from before this contract has no such file.
+ */
+export declare const RUNTIME_CAPABILITIES_FILE = "omo-runtime-capabilities.json";
+/** keychainHandoff 1: honours OMO_KEYCHAIN_HANDOFF (never shows a keychain dialog) and migrates through its helper. */
+export declare const RUNTIME_CAPABILITIES: {
+    readonly keychainHandoff: 1;
+};
+export declare function runtimeCapabilitiesText(): string;
+/** True only when the file beside `runtime` parses and declares keychain hand-off support at level 1 or above. */
+export declare function runtimeDeclaresKeychainHandoff(runtime: string): Promise<boolean>;

package/dist/cli/service-auth/keychain-helper/secrets-gate.d.ts

@@ -0,0 +1,4 @@
+/** Runs one Bun.secrets call after every earlier one has settled. */
+export declare function gatedSecrets<T>(run: () => Promise<T>): Promise<T>;
+/** As `gatedSecrets`, with keychain interaction off for exactly this call: it can never show a dialog. */
+export declare function silentSecrets<T>(run: () => Promise<T>): Promise<T>;

package/dist/cli/service-auth/keychain-helper/signature.d.ts

@@ -0,0 +1,17 @@
+export declare const KEYCHAIN_HELPER_REQUIREMENT: string;
+export type SignatureVerdict = "valid" | "invalid" | "missing";
+/** Checks one file against a designated requirement. Injected in tests; production uses `verifyWithSecurityFramework`. */
+export type RequirementCheck = (path: string, requirement: string) => Promise<boolean>;
+export declare function signatureBackend(): Promise<"ffi" | "codesign">;
+/** bun:ffi first, `/usr/bin/codesign --verify --strict -R=<DR>` when the framework cannot be loaded. */
+export declare const verifyWithSecurityFramework: RequirementCheck;
+/**
+ * One verdict per file identity (dev, inode, size, mtime, ctime) per process (design 1, "Checking the helper"): a
+ * replaced or rewritten file is checked again, an unchanged one is not. ctime moves on every write and cannot be set
+ * back with utimes. The file is stat'ed before AND after the check, and a verdict is stored only when both agree, so it
+ * is never recorded under the identity of a file that changed while it was being checked (that answers "invalid").
+ */
+export type SignatureChecker = (path: string) => Promise<SignatureVerdict>;
+export declare function createSignatureChecker(check?: RequirementCheck, requirement?: string): SignatureChecker;
+/** The one checker of this process: its verdict cache is shared by every resolution and every spawn. */
+export declare const processSignatureChecker: () => SignatureChecker;