oc-codex-multi-auth 6.0.0 → 6.1.0

package/dist/lib/storage/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../lib/storage/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAKF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAaT;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGhE;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,WAAW,GAAG,cAAc,CAAC,GAChF,MAAM,EAAE,CAkBV;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,WAAW,GAAG,cAAc,CAAC,GAChF,MAAM,GAAG,SAAS,CAEpB;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CASpF;AAED,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,WAAW,GAAG,cAAc,CAAC,EAAE,EACpF,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,CASR;AAgFD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EACtJ,QAAQ,EAAE,CAAC,EAAE,GACZ,CAAC,EAAE,CAEL;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EACvJ,QAAQ,EAAE,CAAC,EAAE,GACZ,CAAC,EAAE,CAiEL;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,CAAC,SAAS,WAAW,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAE5G"}

package/dist/lib/storage/identity.js

@@ -0,0 +1,230 @@
+/**
+ * Account identity + dedup helpers.
+ *
+ * Split out of `lib/storage.ts` in RC-2. This module is pure and synchronous:
+ * it owns the identity-key hierarchy (`organizationId` -> `accountId` ->
+ * `refreshToken`) and the dedup + merge rules used by `normalizeAccountStorage`
+ * and the import transaction.
+ *
+ * The two public exports that were already re-exported from `lib/storage.ts`
+ * (`deduplicateAccounts`, `deduplicateAccountsByEmail`) keep their original
+ * shape so external callers can import them via either the barrel or this
+ * submodule.
+ */
+const normalizeWorkspaceIdentityPart = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+export function getWorkspaceIdentityKey(account) {
+    const organizationId = normalizeWorkspaceIdentityPart(account.organizationId);
+    const accountId = normalizeWorkspaceIdentityPart(account.accountId);
+    const refreshToken = normalizeWorkspaceIdentityPart(account.refreshToken) ?? "";
+    if (organizationId) {
+        return accountId
+            ? `organizationId:${organizationId}|accountId:${accountId}`
+            : `organizationId:${organizationId}`;
+    }
+    if (accountId) {
+        return `accountId:${accountId}`;
+    }
+    return `refreshToken:${refreshToken}`;
+}
+export function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+export function clampIndex(index, length) {
+    if (length <= 0)
+        return 0;
+    return Math.max(0, Math.min(index, length - 1));
+}
+export function toAccountIdentityKeys(account) {
+    const keys = [];
+    const organizationId = typeof account.organizationId === "string" ? account.organizationId.trim() : "";
+    if (organizationId) {
+        keys.push(`organizationId:${organizationId}`);
+    }
+    const accountId = typeof account.accountId === "string" ? account.accountId.trim() : "";
+    if (accountId) {
+        keys.push(`accountId:${accountId}`);
+    }
+    const refreshToken = typeof account.refreshToken === "string" ? account.refreshToken.trim() : "";
+    if (refreshToken) {
+        keys.push(`refreshToken:${refreshToken}`);
+    }
+    return keys;
+}
+export function toAccountIdentityKey(account) {
+    return toAccountIdentityKeys(account)[0];
+}
+export function extractActiveKeys(accounts, activeIndex) {
+    const candidate = accounts[activeIndex];
+    if (!isRecord(candidate))
+        return [];
+    return toAccountIdentityKeys({
+        organizationId: typeof candidate.organizationId === "string" ? candidate.organizationId : undefined,
+        accountId: typeof candidate.accountId === "string" ? candidate.accountId : undefined,
+        refreshToken: typeof candidate.refreshToken === "string" ? candidate.refreshToken : "",
+    });
+}
+export function findAccountIndexByIdentityKeys(accounts, identityKeys) {
+    if (identityKeys.length === 0)
+        return -1;
+    for (const identityKey of identityKeys) {
+        const idx = accounts.findIndex((account) => toAccountIdentityKeys(account).includes(identityKey));
+        if (idx >= 0) {
+            return idx;
+        }
+    }
+    return -1;
+}
+function selectNewestAccount(current, candidate) {
+    if (!current)
+        return candidate;
+    const currentLastUsed = current.lastUsed || 0;
+    const candidateLastUsed = candidate.lastUsed || 0;
+    if (candidateLastUsed > currentLastUsed)
+        return candidate;
+    if (candidateLastUsed < currentLastUsed)
+        return current;
+    const currentAddedAt = current.addedAt || 0;
+    const candidateAddedAt = candidate.addedAt || 0;
+    return candidateAddedAt >= currentAddedAt ? candidate : current;
+}
+function pickNewestAccountIndex(accounts, existingIndex, candidateIndex) {
+    const existing = accounts[existingIndex];
+    const candidate = accounts[candidateIndex];
+    if (!existing)
+        return candidateIndex;
+    if (!candidate)
+        return existingIndex;
+    const newest = selectNewestAccount(existing, candidate);
+    return newest === candidate ? candidateIndex : existingIndex;
+}
+function mergeAccountRecords(target, source) {
+    const newest = selectNewestAccount(target, source);
+    const older = newest === target ? source : target;
+    return {
+        ...older,
+        ...newest,
+        organizationId: target.organizationId ?? source.organizationId,
+        accountId: target.accountId ?? source.accountId,
+        accountIdSource: target.accountIdSource ?? source.accountIdSource,
+        accountLabel: target.accountLabel ?? source.accountLabel,
+        email: target.email ?? source.email,
+    };
+}
+function deduplicateAccountsByKey(accounts) {
+    const working = [...accounts];
+    const keyToIndex = new Map();
+    const indicesToRemove = new Set();
+    for (let i = 0; i < working.length; i += 1) {
+        const account = working[i];
+        if (!account)
+            continue;
+        const key = toAccountIdentityKey(account);
+        if (!key)
+            continue;
+        const existingIndex = keyToIndex.get(key);
+        if (existingIndex === undefined) {
+            keyToIndex.set(key, i);
+            continue;
+        }
+        const newestIndex = pickNewestAccountIndex(working, existingIndex, i);
+        const obsoleteIndex = newestIndex === existingIndex ? i : existingIndex;
+        const target = working[newestIndex];
+        const source = working[obsoleteIndex];
+        if (target && source) {
+            working[newestIndex] = mergeAccountRecords(target, source);
+        }
+        indicesToRemove.add(obsoleteIndex);
+        keyToIndex.set(key, newestIndex);
+    }
+    const result = [];
+    for (let i = 0; i < working.length; i += 1) {
+        if (indicesToRemove.has(i))
+            continue;
+        const account = working[i];
+        if (account)
+            result.push(account);
+    }
+    return result;
+}
+/**
+ * Removes duplicate accounts, keeping the most recently used entry for each unique key.
+ * Deduplication identity hierarchy: organizationId -> accountId -> refreshToken.
+ * @param accounts - Array of accounts to deduplicate
+ * @returns New array with duplicates removed
+ */
+export function deduplicateAccounts(accounts) {
+    return deduplicateAccountsByKey(accounts);
+}
+/**
+ * Removes duplicate legacy accounts by email, keeping the most recently used entry.
+ * Accounts with organizationId/accountId are never merged by email to avoid collapsing workspace variants.
+ * Accounts without email are always preserved.
+ * @param accounts - Array of accounts to deduplicate
+ * @returns New array with email duplicates removed
+ */
+export function deduplicateAccountsByEmail(accounts) {
+    const emailToNewestIndex = new Map();
+    const indicesToKeep = new Set();
+    for (let i = 0; i < accounts.length; i += 1) {
+        const account = accounts[i];
+        if (!account)
+            continue;
+        const organizationId = account.organizationId?.trim();
+        if (organizationId) {
+            indicesToKeep.add(i);
+            continue;
+        }
+        const accountId = account.accountId?.trim();
+        if (accountId) {
+            indicesToKeep.add(i);
+            continue;
+        }
+        const email = account.email?.trim();
+        if (!email) {
+            indicesToKeep.add(i);
+            continue;
+        }
+        const existingIndex = emailToNewestIndex.get(email);
+        if (existingIndex === undefined) {
+            emailToNewestIndex.set(email, i);
+            continue;
+        }
+        const existing = accounts[existingIndex];
+        // istanbul ignore next -- defensive code: existingIndex always refers to valid account
+        if (!existing) {
+            emailToNewestIndex.set(email, i);
+            continue;
+        }
+        const existingLastUsed = existing.lastUsed || 0;
+        const candidateLastUsed = account.lastUsed || 0;
+        const existingAddedAt = existing.addedAt || 0;
+        const candidateAddedAt = account.addedAt || 0;
+        const isNewer = candidateLastUsed > existingLastUsed ||
+            (candidateLastUsed === existingLastUsed && candidateAddedAt > existingAddedAt);
+        if (isNewer) {
+            emailToNewestIndex.set(email, i);
+        }
+    }
+    for (const idx of emailToNewestIndex.values()) {
+        indicesToKeep.add(idx);
+    }
+    const result = [];
+    for (let i = 0; i < accounts.length; i += 1) {
+        if (indicesToKeep.has(i)) {
+            const account = accounts[i];
+            if (account)
+                result.push(account);
+        }
+    }
+    return result;
+}
+/**
+ * Applies storage deduplication semantics used by normalize/import paths.
+ * 1) Dedupe only exact identity duplicates (organizationId -> accountId -> refreshToken),
+ *    preserving distinct workspace variants that share a refresh token.
+ * 2) Then apply legacy email dedupe only for entries that still do not have organizationId/accountId.
+ */
+export function deduplicateAccountsForStorage(accounts) {
+    return deduplicateAccountsByEmail(deduplicateAccountsByKey(accounts));
+}
+//# sourceMappingURL=identity.js.map

package/dist/lib/storage/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../lib/storage/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAeH,MAAM,8BAA8B,GAAG,CAAC,KAAc,EAAsB,EAAE,CAC5E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAElF,MAAM,UAAU,uBAAuB,CAAC,OAIvC;IACC,MAAM,cAAc,GAAG,8BAA8B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,8BAA8B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,8BAA8B,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAChF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,SAAS;YACd,CAAC,CAAC,kBAAkB,cAAc,cAAc,SAAS,EAAE;YAC3D,CAAC,CAAC,kBAAkB,cAAc,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,aAAa,SAAS,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,gBAAgB,YAAY,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,MAAc;IACtD,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAiF;IAEjF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,kBAAkB,cAAc,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAiF;IAEjF,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAmB,EAAE,WAAmB;IACxE,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,OAAO,qBAAqB,CAAC;QAC3B,cAAc,EAAE,OAAO,SAAS,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACnG,SAAS,EAAE,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACpF,YAAY,EAAE,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;KACvF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,QAAoF,EACpF,YAAsB;IAEtB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IACzC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAClG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,SAAY;IAEZ,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC;IAClD,IAAI,iBAAiB,GAAG,eAAe;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,iBAAiB,GAAG,eAAe;QAAE,OAAO,OAAO,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC;IAChD,OAAO,gBAAgB,IAAI,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAa,EACb,aAAqB,EACrB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ;QAAE,OAAO,cAAc,CAAC;IACrC,IAAI,CAAC,SAAS;QAAE,OAAO,aAAa,CAAC;IACrC,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC;AAC/D,CAAC;AAED,SAAS,mBAAmB,CAAwB,MAAS,EAAE,MAAS;IACtE,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO;QACL,GAAG,KAAK;QACR,GAAG,MAAM;QACT,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc;QAC9D,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;QAC/C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe;QACjE,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY;QACxD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAwB,QAAa;IACpE,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,WAAW,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACtC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,OAAO,CAAC,WAAW,CAAC,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACnC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAa;IAEb,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAa;IAEb,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;QACtD,IAAI,cAAc,EAAE,CAAC;YACnB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,IAAI,SAAS,EAAE,CAAC;YACd,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzC,uFAAuF;QACvF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;QAE9C,MAAM,OAAO,GACX,iBAAiB,GAAG,gBAAgB;YACpC,CAAC,iBAAiB,KAAK,gBAAgB,IAAI,gBAAgB,GAAG,eAAe,CAAC,CAAC;QAEjF,IAAI,OAAO,EAAE,CAAC;YACZ,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAA6C,QAAa;IACrG,OAAO,0BAA0B,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/lib/storage/keychain.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Opt-in OS-keychain credential backend.
+ *
+ * Phase 4 F1. Addresses the audit finding (docs/audits/09-security-trust.md)
+ * that per-project accounts are stored as plaintext V3 JSON on disk. This
+ * module introduces an alternate storage backend that persists the SAME
+ * V3 JSON blob as a secret value in the OS keychain:
+ *
+ *   - macOS: Keychain
+ *   - Windows: Credential Manager
+ *   - Linux: Secret Service / libsecret
+ *
+ * **Default behavior is unchanged.** The backend only activates when
+ * `CODEX_KEYCHAIN=1` is set in the environment. Any other value (unset,
+ * `"0"`, `"false"`, `""`, `"yes"`, ...) leaves the existing JSON path in
+ * full control. This is deliberate: credential storage is the highest-trust
+ * surface in the plugin and every new failure mode is a login regression.
+ *
+ * Data model:
+ *   - Service name: `oc-codex-multi-auth` (fixed)
+ *   - Account key: `accounts:<project-storage-key>` where the project key
+ *     is the `projectName-sha256hash12` string already produced by
+ *     `lib/storage/paths.ts#getProjectStorageKey`. For the global file we
+ *     use the literal key `accounts:global`.
+ *   - Secret payload: the exact JSON string that would otherwise be written
+ *     to disk (UTF-8, pretty-printed to match the file contents; the OS
+ *     keychain APIs used here store arbitrary UTF-8 so no base64 encoding
+ *     is required — documented here for reviewers).
+ *
+ * Fallback contract:
+ *   - Every entry point returns a soft failure (`null` on read,
+ *     `{ok: false}` on write) instead of throwing when the native module
+ *     cannot load or a keychain call fails. Callers MUST fall back to the
+ *     JSON backend on failure; they must never silently lose credentials.
+ *   - All errors are logged with `log.warn` / `log.error`. Secret values
+ *     never appear in log text — only the service name, account key, and
+ *     the native error message.
+ *
+ * Testing:
+ *   - The native module is loaded lazily so unit tests can substitute
+ *     `_setBackendForTests` to avoid hitting the real OS keychain.
+ *     Integration tests that DO want to hit the real keychain can set
+ *     `CODEX_KEYCHAIN=1` and let `loadBackend` resolve the module.
+ */
+/**
+ * The keychain service identifier this plugin owns. Chosen to match the npm
+ * package name so a human inspecting Keychain Access / Credential Manager
+ * can easily identify which program owns a stored credential.
+ */
+export declare const KEYCHAIN_SERVICE_NAME = "oc-codex-multi-auth";
+/**
+ * Account key used when the plugin is operating without a per-project
+ * storage path (i.e. the global accounts file). Kept distinct from any
+ * per-project key so the two storage scopes never collide in the OS
+ * keychain's (service, account) index.
+ */
+export declare const GLOBAL_KEYCHAIN_ACCOUNT_KEY = "accounts:global";
+/**
+ * Reserved account key used exclusively by the availability probe. Kept
+ * double-underscored and service-suffixed so a future refactor that drops
+ * the `accounts:` prefix on real entries (or adds a different prefix) still
+ * cannot collide with this probe (F1 post-merge LOW finding).
+ */
+export declare const KEYCHAIN_PROBE_ACCOUNT_KEY = "__probe__@oc-codex-multi-auth";
+/**
+ * Minimal abstraction over the native `@napi-rs/keyring` `Entry` API.
+ * Declared as an interface so tests can inject a deterministic in-memory
+ * backend without touching the real OS keychain.
+ */
+export interface KeychainBackend {
+    get(service: string, account: string): Promise<string | null>;
+    set(service: string, account: string, secret: string): Promise<void>;
+    delete(service: string, account: string): Promise<boolean>;
+    isAvailable(): Promise<boolean>;
+}
+/**
+ * Build the keychain account key for a given project storage key. When the
+ * plugin is running against the global accounts file, pass `null` to use
+ * the reserved global account key.
+ */
+export declare function buildKeychainAccountKey(projectStorageKey: string | null): string;
+/**
+ * Reads the V3 JSON blob from the OS keychain for the given project storage
+ * key. Returns `null` when:
+ *   - the native module is unavailable (not installed, missing prebuilt)
+ *   - no entry exists yet
+ *   - any keychain error occurs
+ *
+ * The caller MUST treat `null` as "fall back to JSON". Callers must never
+ * interpret `null` as "no credentials" unconditionally — it may mean
+ * "keychain locked / permission denied" and the JSON file still holds the
+ * authoritative copy.
+ */
+export declare function readFromKeychain(projectStorageKey: string | null): Promise<string | null>;
+export interface KeychainWriteResult {
+    ok: boolean;
+    /** Populated on failure. Never contains secret material. */
+    error?: string;
+}
+/**
+ * Persist the V3 JSON blob to the OS keychain. Returns `{ok:false}` on
+ * failure so callers can fall back to JSON. Never throws.
+ */
+export declare function writeToKeychain(projectStorageKey: string | null, jsonBlob: string): Promise<KeychainWriteResult>;
+/**
+ * Remove the plugin's keychain entry for the given project key. Returns
+ * true when the entry existed and was deleted, false otherwise (including
+ * "not present"). Never throws.
+ */
+export declare function deleteFromKeychain(projectStorageKey: string | null): Promise<boolean>;
+/**
+ * Probe the backend end-to-end (write + read + delete a throwaway entry)
+ * to confirm the OS keychain is reachable and unlocked. Used by the
+ * `codex-keychain status` tool to give the operator a clear yes/no signal
+ * instead of waiting until the next real save.
+ *
+ * Gated on the opt-in flag (F1 post-merge LOW finding): with
+ * `CODEX_KEYCHAIN` unset the probe is a no-op that returns `false` without
+ * touching the OS keychain. This preserves the "unset -> zero keychain code
+ * path" invariant the feature advertises and avoids the first-run macOS
+ * "allow/always allow" prompt that `entry.setPassword` can otherwise
+ * trigger for users who run `codex-keychain status` without opting in.
+ *
+ * Pass `env` to override the opt-in lookup in tests.
+ */
+export declare function keychainIsAvailable(env?: NodeJS.ProcessEnv): Promise<boolean>;
+/**
+ * Parse the `CODEX_KEYCHAIN` environment variable. Only the literal string
+ * `"1"` enables the opt-in. Anything else (unset, `"0"`, `"false"`, `""`,
+ * `"yes"`, ...) leaves the JSON backend in full control. This mirrors
+ * `EnvBooleanSchema`'s contract and is documented in README.md.
+ */
+export declare function isKeychainOptInEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Test-only hook: inject a deterministic backend (typically an in-memory
+ * Map-backed stub) and mark the cache as resolved so `getBackend` returns
+ * the injected backend without attempting to load the native module.
+ *
+ * Passing `null` clears the cache so a subsequent call re-runs the lazy
+ * loader — useful when a test needs to verify the unavailable-backend
+ * branch.
+ */
+export declare function _setBackendForTests(backend: KeychainBackend | null): void;
+/** Test-only reset to the initial "not yet loaded" state. */
+export declare function _resetBackendForTests(): void;
+//# sourceMappingURL=keychain.d.ts.map

package/dist/lib/storage/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../lib/storage/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAMH;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,kCAAuC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAChC;AAiHD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAGhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AAED,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACpC,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAChC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CAkB9B;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACvC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC9B,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,IAAI,CAGzE;AAED,6DAA6D;AAC7D,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C"}