oc-codex-multi-auth 6.0.0 → 6.1.1

package/dist/lib/storage/keychain.js

@@ -0,0 +1,278 @@
+/**
+ * Opt-in OS-keychain credential backend.
+ *
+ * Phase 4 F1. Addresses the audit finding (docs/audits/09-security-trust.md)
+ * that per-project accounts are stored as plaintext V3 JSON on disk. This
+ * module introduces an alternate storage backend that persists the SAME
+ * V3 JSON blob as a secret value in the OS keychain:
+ *
+ *   - macOS: Keychain
+ *   - Windows: Credential Manager
+ *   - Linux: Secret Service / libsecret
+ *
+ * **Default behavior is unchanged.** The backend only activates when
+ * `CODEX_KEYCHAIN=1` is set in the environment. Any other value (unset,
+ * `"0"`, `"false"`, `""`, `"yes"`, ...) leaves the existing JSON path in
+ * full control. This is deliberate: credential storage is the highest-trust
+ * surface in the plugin and every new failure mode is a login regression.
+ *
+ * Data model:
+ *   - Service name: `oc-codex-multi-auth` (fixed)
+ *   - Account key: `accounts:<project-storage-key>` where the project key
+ *     is the `projectName-sha256hash12` string already produced by
+ *     `lib/storage/paths.ts#getProjectStorageKey`. For the global file we
+ *     use the literal key `accounts:global`.
+ *   - Secret payload: the exact JSON string that would otherwise be written
+ *     to disk (UTF-8, pretty-printed to match the file contents; the OS
+ *     keychain APIs used here store arbitrary UTF-8 so no base64 encoding
+ *     is required — documented here for reviewers).
+ *
+ * Fallback contract:
+ *   - Every entry point returns a soft failure (`null` on read,
+ *     `{ok: false}` on write) instead of throwing when the native module
+ *     cannot load or a keychain call fails. Callers MUST fall back to the
+ *     JSON backend on failure; they must never silently lose credentials.
+ *   - All errors are logged with `log.warn` / `log.error`. Secret values
+ *     never appear in log text — only the service name, account key, and
+ *     the native error message.
+ *
+ * Testing:
+ *   - The native module is loaded lazily so unit tests can substitute
+ *     `_setBackendForTests` to avoid hitting the real OS keychain.
+ *     Integration tests that DO want to hit the real keychain can set
+ *     `CODEX_KEYCHAIN=1` and let `loadBackend` resolve the module.
+ */
+import { createLogger } from "../logger.js";
+const log = createLogger("storage.keychain");
+/**
+ * The keychain service identifier this plugin owns. Chosen to match the npm
+ * package name so a human inspecting Keychain Access / Credential Manager
+ * can easily identify which program owns a stored credential.
+ */
+export const KEYCHAIN_SERVICE_NAME = "oc-codex-multi-auth";
+/**
+ * Account key used when the plugin is operating without a per-project
+ * storage path (i.e. the global accounts file). Kept distinct from any
+ * per-project key so the two storage scopes never collide in the OS
+ * keychain's (service, account) index.
+ */
+export const GLOBAL_KEYCHAIN_ACCOUNT_KEY = "accounts:global";
+/**
+ * Reserved account key used exclusively by the availability probe. Kept
+ * double-underscored and service-suffixed so a future refactor that drops
+ * the `accounts:` prefix on real entries (or adds a different prefix) still
+ * cannot collide with this probe (F1 post-merge LOW finding).
+ */
+export const KEYCHAIN_PROBE_ACCOUNT_KEY = `__probe__@${KEYCHAIN_SERVICE_NAME}`;
+let cachedBackend = null;
+let cacheResolved = false;
+async function loadNativeBackend() {
+    try {
+        // Dynamic import keeps the module resolution inside the try/catch so
+        // a missing prebuilt binary (e.g. unsupported platform, partial npm
+        // install) degrades to JSON fallback instead of crashing at require
+        // time. The cast narrows the type without using `any`.
+        const mod = (await import("@napi-rs/keyring"));
+        if (!mod || typeof mod.Entry !== "function") {
+            log.warn("keychain: @napi-rs/keyring module shape unexpected; disabling keychain backend");
+            return null;
+        }
+        // @napi-rs/keyring's `Entry` methods are synchronous by design (they
+        // delegate to native OS keychain calls). The backend interface is
+        // Promise-typed so it can be mocked with in-memory Promise-returning
+        // stubs in tests, so each method returns `Promise.resolve(...)` of
+        // the native sync result. Using non-async methods keeps
+        // `@typescript-eslint/require-await` satisfied without per-method
+        // suppressions while the Promise-returning interface stays intact.
+        const backend = {
+            get(service, account) {
+                try {
+                    const entry = new mod.Entry(service, account);
+                    const value = entry.getPassword();
+                    return Promise.resolve(value ?? null);
+                }
+                catch (err) {
+                    log.warn("keychain: read failed", {
+                        service,
+                        account,
+                        error: err.message,
+                    });
+                    return Promise.resolve(null);
+                }
+            },
+            set(service, account, secret) {
+                const entry = new mod.Entry(service, account);
+                entry.setPassword(secret);
+                return Promise.resolve();
+            },
+            delete(service, account) {
+                try {
+                    const entry = new mod.Entry(service, account);
+                    return Promise.resolve(entry.deletePassword());
+                }
+                catch (err) {
+                    log.warn("keychain: delete failed", {
+                        service,
+                        account,
+                        error: err.message,
+                    });
+                    return Promise.resolve(false);
+                }
+            },
+            isAvailable() {
+                // Round-trip a throwaway entry under a reserved, namespaced
+                // account key so we actually exercise the OS keychain rather
+                // than trusting that import succeeded. The key is prefixed
+                // with the service name so a future refactor that drops the
+                // `accounts:` prefix on real entries cannot collide with
+                // this probe (F1 post-merge LOW finding).
+                try {
+                    const entry = new mod.Entry(KEYCHAIN_SERVICE_NAME, KEYCHAIN_PROBE_ACCOUNT_KEY);
+                    entry.setPassword("probe");
+                    entry.deletePassword();
+                    return Promise.resolve(true);
+                }
+                catch (err) {
+                    log.warn("keychain: availability probe failed", {
+                        error: err.message,
+                    });
+                    return Promise.resolve(false);
+                }
+            },
+        };
+        return backend;
+    }
+    catch (err) {
+        log.warn("keychain: native module unavailable", {
+            error: err.message,
+        });
+        return null;
+    }
+}
+/**
+ * Resolve and memoize the backend. Returns `null` when the native module
+ * cannot be loaded; callers fall back to JSON in that case.
+ */
+async function getBackend() {
+    if (cacheResolved)
+        return cachedBackend;
+    cachedBackend = await loadNativeBackend();
+    cacheResolved = true;
+    return cachedBackend;
+}
+/**
+ * Build the keychain account key for a given project storage key. When the
+ * plugin is running against the global accounts file, pass `null` to use
+ * the reserved global account key.
+ */
+export function buildKeychainAccountKey(projectStorageKey) {
+    if (!projectStorageKey)
+        return GLOBAL_KEYCHAIN_ACCOUNT_KEY;
+    return `accounts:${projectStorageKey}`;
+}
+/**
+ * Reads the V3 JSON blob from the OS keychain for the given project storage
+ * key. Returns `null` when:
+ *   - the native module is unavailable (not installed, missing prebuilt)
+ *   - no entry exists yet
+ *   - any keychain error occurs
+ *
+ * The caller MUST treat `null` as "fall back to JSON". Callers must never
+ * interpret `null` as "no credentials" unconditionally — it may mean
+ * "keychain locked / permission denied" and the JSON file still holds the
+ * authoritative copy.
+ */
+export async function readFromKeychain(projectStorageKey) {
+    const backend = await getBackend();
+    if (!backend)
+        return null;
+    const account = buildKeychainAccountKey(projectStorageKey);
+    return backend.get(KEYCHAIN_SERVICE_NAME, account);
+}
+/**
+ * Persist the V3 JSON blob to the OS keychain. Returns `{ok:false}` on
+ * failure so callers can fall back to JSON. Never throws.
+ */
+export async function writeToKeychain(projectStorageKey, jsonBlob) {
+    const backend = await getBackend();
+    if (!backend) {
+        return { ok: false, error: "backend unavailable" };
+    }
+    const account = buildKeychainAccountKey(projectStorageKey);
+    try {
+        await backend.set(KEYCHAIN_SERVICE_NAME, account, jsonBlob);
+        return { ok: true };
+    }
+    catch (err) {
+        const message = err.message;
+        log.error("keychain: write failed", {
+            service: KEYCHAIN_SERVICE_NAME,
+            account,
+            error: message,
+        });
+        return { ok: false, error: message };
+    }
+}
+/**
+ * Remove the plugin's keychain entry for the given project key. Returns
+ * true when the entry existed and was deleted, false otherwise (including
+ * "not present"). Never throws.
+ */
+export async function deleteFromKeychain(projectStorageKey) {
+    const backend = await getBackend();
+    if (!backend)
+        return false;
+    const account = buildKeychainAccountKey(projectStorageKey);
+    return backend.delete(KEYCHAIN_SERVICE_NAME, account);
+}
+/**
+ * Probe the backend end-to-end (write + read + delete a throwaway entry)
+ * to confirm the OS keychain is reachable and unlocked. Used by the
+ * `codex-keychain status` tool to give the operator a clear yes/no signal
+ * instead of waiting until the next real save.
+ *
+ * Gated on the opt-in flag (F1 post-merge LOW finding): with
+ * `CODEX_KEYCHAIN` unset the probe is a no-op that returns `false` without
+ * touching the OS keychain. This preserves the "unset -> zero keychain code
+ * path" invariant the feature advertises and avoids the first-run macOS
+ * "allow/always allow" prompt that `entry.setPassword` can otherwise
+ * trigger for users who run `codex-keychain status` without opting in.
+ *
+ * Pass `env` to override the opt-in lookup in tests.
+ */
+export async function keychainIsAvailable(env = process.env) {
+    if (!isKeychainOptInEnabled(env))
+        return false;
+    const backend = await getBackend();
+    if (!backend)
+        return false;
+    return backend.isAvailable();
+}
+/**
+ * Parse the `CODEX_KEYCHAIN` environment variable. Only the literal string
+ * `"1"` enables the opt-in. Anything else (unset, `"0"`, `"false"`, `""`,
+ * `"yes"`, ...) leaves the JSON backend in full control. This mirrors
+ * `EnvBooleanSchema`'s contract and is documented in README.md.
+ */
+export function isKeychainOptInEnabled(env = process.env) {
+    return env.CODEX_KEYCHAIN === "1";
+}
+/**
+ * Test-only hook: inject a deterministic backend (typically an in-memory
+ * Map-backed stub) and mark the cache as resolved so `getBackend` returns
+ * the injected backend without attempting to load the native module.
+ *
+ * Passing `null` clears the cache so a subsequent call re-runs the lazy
+ * loader — useful when a test needs to verify the unavailable-backend
+ * branch.
+ */
+export function _setBackendForTests(backend) {
+    cachedBackend = backend;
+    cacheResolved = backend !== null;
+}
+/** Test-only reset to the initial "not yet loaded" state. */
+export function _resetBackendForTests() {
+    cachedBackend = null;
+    cacheResolved = false;
+}
+//# sourceMappingURL=keychain.js.map

package/dist/lib/storage/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../lib/storage/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,aAAa,qBAAqB,EAAE,CAAC;AAc/E,IAAI,aAAa,GAA2B,IAAI,CAAC;AACjD,IAAI,aAAa,GAAG,KAAK,CAAC;AAc1B,KAAK,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACJ,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,uDAAuD;QACvD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAmC,CAAC;QACjF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CACP,gFAAgF,CAChF,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,wDAAwD;QACxD,kEAAkE;QAClE,mEAAmE;QACnE,MAAM,OAAO,GAAoB;YAChC,GAAG,CAAC,OAAO,EAAE,OAAO;gBACnB,IAAI,CAAC;oBACJ,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBAClC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;gBACvC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE;wBACjC,OAAO;wBACP,OAAO;wBACP,KAAK,EAAG,GAAa,CAAC,OAAO;qBAC7B,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;YACF,CAAC;YACD,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM;gBAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC1B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,OAAO;gBACtB,IAAI,CAAC;oBACJ,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;gBAChD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;wBACnC,OAAO;wBACP,OAAO;wBACP,KAAK,EAAG,GAAa,CAAC,OAAO;qBAC7B,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;YACF,CAAC;YACD,WAAW;gBACV,4DAA4D;gBAC5D,6DAA6D;gBAC7D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,yDAAyD;gBACzD,0CAA0C;gBAC1C,IAAI,CAAC;oBACJ,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAC1B,qBAAqB,EACrB,0BAA0B,CAC1B,CAAC;oBACF,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;oBAC3B,KAAK,CAAC,cAAc,EAAE,CAAC;oBACvB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE;wBAC/C,KAAK,EAAG,GAAa,CAAC,OAAO;qBAC7B,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;YACF,CAAC;SACD,CAAC;QACF,OAAO,OAAO,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE;YAC/C,KAAK,EAAG,GAAa,CAAC,OAAO;SAC7B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU;IACxB,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,aAAa,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC1C,aAAa,GAAG,IAAI,CAAC;IACrB,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,iBAAgC;IACvE,IAAI,CAAC,iBAAiB;QAAE,OAAO,2BAA2B,CAAC;IAC3D,OAAO,YAAY,iBAAiB,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,iBAAgC;IAEhC,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,iBAAgC,EAChC,QAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC3D,IAAI,CAAC;QACJ,MAAM,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE;YACnC,OAAO,EAAE,qBAAqB;YAC9B,OAAO;YACP,KAAK,EAAE,OAAO;SACd,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,iBAAgC;IAEhC,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA+B;IAClE,aAAa,GAAG,OAAO,CAAC;IACxB,aAAa,GAAG,OAAO,KAAK,IAAI,CAAC;AAClC,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACpC,aAAa,GAAG,IAAI,CAAC;IACrB,aAAa,GAAG,KAAK,CAAC;AACvB,CAAC"}

package/dist/lib/storage/load-save.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Account storage load/save pipeline.
+ *
+ * Split out of `lib/storage.ts` in RC-2. This module owns:
+ *   - the `.gitignore` side-effect when writing into a project repo,
+ *   - the legacy project + global storage migrations triggered on ENOENT,
+ *   - the project-global fallback seed flow,
+ *   - the atomic write (temp file + rename + EEMPTY guard),
+ *   - and the `withAccountStorageTransaction` read-modify-write primitive
+ *     that every mutating caller above the storage layer uses.
+ *
+ * The error-handling contract is subtle and load-bearing: forward-compat
+ * (`UNSUPPORTED_SCHEMA_VERSION`) and unknown-V2 failures MUST reach the
+ * caller. Swallowing either would overwrite future-schema credentials or
+ * silently discard a user's V2 file, which is exactly the class of bug the
+ * audit flagged.
+ */
+import { type AccountStorageV3 } from "./migrations.js";
+/**
+ * Loads OAuth accounts from disk storage.
+ * Automatically migrates v1 storage to v3 format if needed.
+ * @returns AccountStorageV3 if file exists and is valid, null otherwise
+ * @throws StorageError (code `UNSUPPORTED_SCHEMA_VERSION`) when the on-disk
+ *   `version` field is greater than the newest format this plugin understands.
+ *   Surfacing the error stops a downgraded plugin from overwriting the user's
+ *   future-schema credentials with a stale or empty payload.
+ */
+export declare function loadAccounts(): Promise<AccountStorageV3 | null>;
+/**
+ * Executes a read-modify-write transaction under the storage lock and exposes
+ * an unlocked persist callback so nested save operations do not deadlock.
+ */
+export declare function withAccountStorageTransaction<T>(handler: (current: AccountStorageV3 | null, persist: (storage: AccountStorageV3) => Promise<void>) => Promise<T>): Promise<T>;
+/**
+ * Persists account storage to disk using atomic write (temp file + rename).
+ * Creates the .opencode directory if it doesn't exist.
+ * Verifies file was written correctly and provides detailed error messages.
+ * @param storage - Account storage data to save
+ * @throws StorageError with platform-aware hints on failure
+ */
+export declare function saveAccounts(storage: AccountStorageV3): Promise<void>;
+/**
+ * Deletes the account storage file from disk.
+ * Silently ignores if file doesn't exist.
+ *
+ * Ordering (F1 post-merge MEDIUM finding): unlink the on-disk JSON FIRST,
+ * then delete the keychain entry. If we cleared the keychain first and the
+ * unlink failed for a non-ENOENT reason (EACCES, EBUSY, filesystem drift),
+ * a subsequent load with opt-in still on would take the "no keychain entry,
+ * fall back to JSON" branch (see `loadAccountsInternal`) and resurrect the
+ * credentials from the still-present JSON file. Callers typically run
+ * `clearAccounts` to recover from a compromised token, so a silent
+ * resurrection is a meaningful failure mode.
+ *
+ * Fail-safe invariant: if the JSON unlink fails (non-ENOENT), we skip the
+ * keychain delete and log at `error`. Both copies remain in sync so the
+ * caller can retry safely. The operation is still best-effort (never
+ * throws) to preserve the existing contract above the storage layer.
+ */
+export declare function clearAccounts(): Promise<void>;
+//# sourceMappingURL=load-save.d.ts.map

package/dist/lib/storage/load-save.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-save.d.ts","sourceRoot":"","sources":["../../../lib/storage/load-save.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmBH,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAkjBzB;;;;;;;;GAQG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,CAAC,EACnD,OAAO,EAAE,CACP,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KAClD,OAAO,CAAC,CAAC,CAAC,GACd,OAAO,CAAC,CAAC,CAAC,CAKZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAgCnD"}