oc-codex-multi-auth 6.0.0

package/dist/lib/auth/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../../lib/auth/browser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC;IAC1D,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC;IACxD,OAAO,gBAAgB,CAAC,KAAK,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,6EAA6E;IAC7E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,oBAAoB;IAEpB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,6EAA6E;IAC7E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;gBACvD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC3C,CAAC;QACF,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,oBAAoB;IAEpB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,IAAI,CAAC;QACJ,kGAAkG;QAClG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,mGAAmG;YACnG,MAAM,KAAK,GAAG,GAAG;iBACf,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;iBACnB,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;iBACpB,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,KAAK,CAClB,gBAAgB,EAChB,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,KAAK,GAAG,CAAC,EACjE,EAAE,KAAK,EAAE,QAAQ,EAAE,CACnB,CAAC;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACb,CAAC;QAGD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE;YAClC,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,mEAAmE;QACnE,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC"}

package/dist/lib/auth/device-code.d.ts

@@ -0,0 +1,28 @@
+import type { TokenResult } from "../types.js";
+export interface DeviceCodeSession {
+    verificationUrl: string;
+    userCode: string;
+    deviceAuthId: string;
+    intervalSeconds: number;
+}
+type DeviceCodeReadyResult = {
+    type: "ready";
+    session: DeviceCodeSession;
+};
+type DeviceCodeFailureResult = {
+    type: "failed";
+    failure: Extract<TokenResult, {
+        type: "failed";
+    }>;
+};
+export declare function buildDeviceCodeInstructions(session: DeviceCodeSession): string;
+export declare function createDeviceCodeSession(options?: {
+    authBaseUrl?: string;
+    clientId?: string;
+}): Promise<DeviceCodeReadyResult | DeviceCodeFailureResult>;
+export declare function completeDeviceCodeSession(session: DeviceCodeSession, options?: {
+    authBaseUrl?: string;
+    maxWaitMs?: number;
+}): Promise<TokenResult>;
+export {};
+//# sourceMappingURL=device-code.d.ts.map

package/dist/lib/auth/device-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code.d.ts","sourceRoot":"","sources":["../../../lib/auth/device-code.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO/C,MAAM,WAAW,iBAAiB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;CACxB;AAED,KAAK,qBAAqB,GAAG;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAClD,CAAC;AAoHF,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAM9E;AAED,wBAAsB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,qBAAqB,GAAG,uBAAuB,CAAC,CAsE3D;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE;IACT,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,GACC,OAAO,CAAC,WAAW,CAAC,CAuEtB"}

package/dist/lib/auth/device-code.js

@@ -0,0 +1,215 @@
+import { setTimeout as sleep } from "node:timers/promises";
+import { logError } from "../logger.js";
+import { AUTHORIZE_URL, CLIENT_ID, exchangeAuthorizationCode } from "./auth.js";
+const DEFAULT_DEVICE_CODE_MAX_WAIT_MS = 15 * 60 * 1000;
+const DEFAULT_DEVICE_CODE_INTERVAL_SECONDS = 5;
+const DEVICE_CODE_LOG_BODY_LIMIT = 120;
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function getAuthOrigin(authBaseUrl = AUTHORIZE_URL) {
+    return new URL(authBaseUrl).origin;
+}
+function getDeviceAuthApiBase(authBaseUrl) {
+    return `${getAuthOrigin(authBaseUrl)}/api/accounts/deviceauth`;
+}
+function getDeviceVerificationUrl(authBaseUrl) {
+    return `${getAuthOrigin(authBaseUrl)}/codex/device`;
+}
+function getDeviceRedirectUri(authBaseUrl) {
+    return `${getAuthOrigin(authBaseUrl)}/deviceauth/callback`;
+}
+function getErrorMessage(status, bodyText, fallback) {
+    const trimmed = bodyText.trim();
+    if (!trimmed) {
+        return fallback;
+    }
+    return `${fallback} (${status}): ${trimmed}`;
+}
+// Auth-server error bodies can echo identifiers like device_auth_id, so logs keep
+// only a short prefix while the user-facing message still gets the full response.
+function getRedactedErrorBody(bodyText) {
+    const trimmed = bodyText.trim();
+    if (!trimmed) {
+        return "<empty>";
+    }
+    if (trimmed.length <= DEVICE_CODE_LOG_BODY_LIMIT) {
+        return trimmed;
+    }
+    return `${trimmed.slice(0, DEVICE_CODE_LOG_BODY_LIMIT)}...`;
+}
+function parseIntervalSeconds(value) {
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+        return Math.max(1, Math.floor(value));
+    }
+    if (typeof value === "string") {
+        const parsed = Number.parseInt(value.trim(), 10);
+        if (Number.isFinite(parsed) && parsed > 0) {
+            return Math.max(1, parsed);
+        }
+    }
+    return DEFAULT_DEVICE_CODE_INTERVAL_SECONDS;
+}
+function parseDeviceCodeRequestResponse(raw) {
+    if (!isRecord(raw))
+        return null;
+    const deviceAuthId = typeof raw.device_auth_id === "string" && raw.device_auth_id.trim()
+        ? raw.device_auth_id.trim()
+        : undefined;
+    const userCode = typeof raw.user_code === "string" && raw.user_code.trim()
+        ? raw.user_code.trim()
+        : typeof raw.usercode === "string" && raw.usercode.trim()
+            ? raw.usercode.trim()
+            : undefined;
+    if (!deviceAuthId || !userCode) {
+        return null;
+    }
+    return {
+        deviceAuthId,
+        userCode,
+        intervalSeconds: parseIntervalSeconds(raw.interval),
+    };
+}
+function parseDeviceCodePollResponse(raw) {
+    if (!isRecord(raw))
+        return null;
+    const authorizationCode = typeof raw.authorization_code === "string" && raw.authorization_code.trim()
+        ? raw.authorization_code.trim()
+        : undefined;
+    const codeVerifier = typeof raw.code_verifier === "string" && raw.code_verifier.trim()
+        ? raw.code_verifier.trim()
+        : undefined;
+    if (!authorizationCode || !codeVerifier) {
+        return null;
+    }
+    return {
+        authorizationCode,
+        codeVerifier,
+    };
+}
+export function buildDeviceCodeInstructions(session) {
+    return [
+        `Open this link and sign in: ${session.verificationUrl}`,
+        `Enter this one-time code: ${session.userCode}`,
+        "This code expires in about 15 minutes.",
+    ].join("\n");
+}
+export async function createDeviceCodeSession(options) {
+    const authBaseUrl = options?.authBaseUrl ?? AUTHORIZE_URL;
+    const clientId = options?.clientId ?? CLIENT_ID;
+    try {
+        const response = await fetch(`${getDeviceAuthApiBase(authBaseUrl)}/usercode`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ client_id: clientId }),
+        });
+        if (!response.ok) {
+            const bodyText = await response.text().catch(() => "");
+            const message = response.status === 404
+                ? "Device code login is not enabled for this auth server. Retry with browser login or manual URL paste."
+                : getErrorMessage(response.status, bodyText, "Device code login could not be started");
+            logError(`device-code usercode request failed: ${response.status} ${getRedactedErrorBody(bodyText)}`);
+            return {
+                type: "failed",
+                failure: {
+                    type: "failed",
+                    reason: "http_error",
+                    statusCode: response.status,
+                    message,
+                },
+            };
+        }
+        const rawJson = (await response.json());
+        const parsed = parseDeviceCodeRequestResponse(rawJson);
+        if (!parsed) {
+            logError("device-code usercode response validation failed", rawJson);
+            return {
+                type: "failed",
+                failure: {
+                    type: "failed",
+                    reason: "invalid_response",
+                    message: "Device code login returned an invalid response",
+                },
+            };
+        }
+        return {
+            type: "ready",
+            session: {
+                verificationUrl: getDeviceVerificationUrl(authBaseUrl),
+                userCode: parsed.userCode,
+                deviceAuthId: parsed.deviceAuthId,
+                intervalSeconds: parsed.intervalSeconds,
+            },
+        };
+    }
+    catch (error) {
+        const err = error;
+        logError("device-code usercode request error", err);
+        return {
+            type: "failed",
+            failure: {
+                type: "failed",
+                reason: "network_error",
+                message: err?.message,
+            },
+        };
+    }
+}
+export async function completeDeviceCodeSession(session, options) {
+    const authBaseUrl = options?.authBaseUrl ?? AUTHORIZE_URL;
+    const maxWaitMs = options?.maxWaitMs ?? DEFAULT_DEVICE_CODE_MAX_WAIT_MS;
+    const pollUrl = `${getDeviceAuthApiBase(authBaseUrl)}/token`;
+    const startedAt = Date.now();
+    try {
+        while (Date.now() - startedAt < maxWaitMs) {
+            const response = await fetch(pollUrl, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    device_auth_id: session.deviceAuthId,
+                    user_code: session.userCode,
+                }),
+            });
+            if (response.ok) {
+                const rawJson = (await response.json());
+                const parsed = parseDeviceCodePollResponse(rawJson);
+                if (!parsed) {
+                    logError("device-code token poll response validation failed", rawJson);
+                    return {
+                        type: "failed",
+                        reason: "invalid_response",
+                        message: "Device code login returned an invalid authorization payload",
+                    };
+                }
+                return await exchangeAuthorizationCode(parsed.authorizationCode, parsed.codeVerifier, getDeviceRedirectUri(authBaseUrl));
+            }
+            if (response.status === 403 || response.status === 404) {
+                await sleep(session.intervalSeconds * 1000);
+                continue;
+            }
+            const bodyText = await response.text().catch(() => "");
+            logError(`device-code token poll failed: ${response.status} ${getRedactedErrorBody(bodyText)}`);
+            return {
+                type: "failed",
+                reason: "http_error",
+                statusCode: response.status,
+                message: getErrorMessage(response.status, bodyText, "Device code authorization failed"),
+            };
+        }
+        return {
+            type: "failed",
+            reason: "unknown",
+            message: "Device code authorization timed out after 15 minutes",
+        };
+    }
+    catch (error) {
+        const err = error;
+        logError("device-code token poll error", err);
+        return {
+            type: "failed",
+            reason: "network_error",
+            message: err?.message,
+        };
+    }
+}
+//# sourceMappingURL=device-code.js.map

package/dist/lib/auth/device-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code.js","sourceRoot":"","sources":["../../../lib/auth/device-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAEhF,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvD,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAC/C,MAAM,0BAA0B,GAAG,GAAG,CAAC;AA8BvC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,cAAsB,aAAa;IACzD,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAoB;IACjD,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,0BAA0B,CAAC;AAChE,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAoB;IACrD,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,eAAe,CAAC;AACrD,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAoB;IACjD,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,sBAAsB,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,QAAgB,EAAE,QAAgB;IAC1E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,QAAQ,KAAK,MAAM,MAAM,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,SAAS,oBAAoB,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,oCAAoC,CAAC;AAC7C,CAAC;AAED,SAAS,8BAA8B,CAAC,GAAY;IACnD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,YAAY,GACjB,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAClE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAC3B,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GACb,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;QACxD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;YACxD,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;YACrB,CAAC,CAAC,SAAS,CAAC;IAEf,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO;QACN,YAAY;QACZ,QAAQ;QACR,eAAe,EAAE,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC;KACnD,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAY;IAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,iBAAiB,GACtB,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,IAAI,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAC1E,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAC/B,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GACjB,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE;QAChE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,CAAC,iBAAiB,IAAI,CAAC,YAAY,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO;QACN,iBAAiB;QACjB,YAAY;KACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAA0B;IACrE,OAAO;QACN,+BAA+B,OAAO,CAAC,eAAe,EAAE;QACxD,6BAA6B,OAAO,CAAC,QAAQ,EAAE;QAC/C,wCAAwC;KACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAG7C;IACA,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,aAAa,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,SAAS,CAAC;IAEhD,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,WAAW,EAAE;YAC7E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;SAC7C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACvD,MAAM,OAAO,GACZ,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACtB,CAAC,CAAC,sGAAsG;gBACxG,CAAC,CAAC,eAAe,CAChB,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,wCAAwC,CACxC,CAAC;YACJ,QAAQ,CACP,wCAAwC,QAAQ,CAAC,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAC3F,CAAC;YACF,OAAO;gBACN,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,YAAY;oBACpB,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,OAAO;iBACP;aACD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;QACnD,MAAM,MAAM,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,QAAQ,CAAC,iDAAiD,EAAE,OAAO,CAAC,CAAC;YACrE,OAAO;gBACN,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,gDAAgD;iBACzD;aACD,CAAC;QACH,CAAC;QAED,OAAO;YACN,IAAI,EAAE,OAAO;YACb,OAAO,EAAE;gBACR,eAAe,EAAE,wBAAwB,CAAC,WAAW,CAAC;gBACtD,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,eAAe,EAAE,MAAM,CAAC,eAAe;aACvC;SACD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,KAAc,CAAC;QAC3B,QAAQ,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,GAAG,EAAE,OAAO;aACrB;SACD,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAA0B,EAC1B,OAGC;IAED,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,aAAa,CAAC;IAC1D,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,+BAA+B,CAAC;IACxE,MAAM,OAAO,GAAG,GAAG,oBAAoB,CAAC,WAAW,CAAC,QAAQ,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACpB,cAAc,EAAE,OAAO,CAAC,YAAY;oBACpC,SAAS,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC;aACF,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;gBACnD,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;gBACpD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,QAAQ,CAAC,mDAAmD,EAAE,OAAO,CAAC,CAAC;oBACvE,OAAO;wBACN,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE,kBAAkB;wBAC1B,OAAO,EAAE,6DAA6D;qBACtE,CAAC;gBACH,CAAC;gBAED,OAAO,MAAM,yBAAyB,CACrC,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,YAAY,EACnB,oBAAoB,CAAC,WAAW,CAAC,CACjC,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,KAAK,CAAC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;gBAC5C,SAAS;YACV,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACvD,QAAQ,CACP,kCAAkC,QAAQ,CAAC,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CACrF,CAAC;YACF,OAAO;gBACN,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,YAAY;gBACpB,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,OAAO,EAAE,eAAe,CACvB,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,kCAAkC,CAClC;aACD,CAAC;QACH,CAAC;QAED,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,sDAAsD;SAC/D,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,KAAc,CAAC;QAC3B,QAAQ,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QAC9C,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,GAAG,EAAE,OAAO;SACrB,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/lib/auth/login-runner.d.ts

@@ -0,0 +1,55 @@
+import type { AccountIdSource, TokenResult } from "../types.js";
+type TokenSuccess = Extract<TokenResult, {
+    type: "success";
+}>;
+export type TokenSuccessWithAccount = TokenSuccess & {
+    accountIdOverride?: string;
+    organizationIdOverride?: string;
+    accountIdSource?: AccountIdSource;
+    accountLabel?: string;
+};
+export type AccountSelectionResult = {
+    primary: TokenSuccessWithAccount;
+    variantsForPersistence: TokenSuccessWithAccount[];
+};
+export type PersistAccountSelections = (results: TokenSuccessWithAccount[], replaceAll: boolean) => Promise<void>;
+export type AccountSelectionFallbacks = Pick<TokenSuccessWithAccount, "accountIdOverride" | "accountIdSource" | "organizationIdOverride" | "accountLabel">;
+export declare function resolveAccountSelection(tokens: TokenSuccess): AccountSelectionResult;
+export declare function applyAccountSelectionFallbacks(selection: AccountSelectionResult, fallbacks: AccountSelectionFallbacks): AccountSelectionResult;
+/**
+ * Persists the already-resolved selection through the caller's
+ * `persistSelections` callback. Windows filesystem safety remains delegated to
+ * that callback, so callers should use `persistAccountPool` or
+ * `withAccountStorageTransaction` to keep the rename retry and serialized
+ * read-modify-write behavior covered by `test/login-runner.test.ts`.
+ * Callback failures are rethrown with a redacted message so callers can log the
+ * wrapper safely without leaking token-file paths or account identifiers.
+ */
+export declare function persistResolvedAccountSelection(selection: AccountSelectionResult, options?: {
+    persistSelections?: PersistAccountSelections;
+    replaceAll?: boolean;
+}): Promise<AccountSelectionResult>;
+/**
+ * Finalizes a resolved selection by delegating persistence to the caller's
+ * `persistSelections` callback. Windows lock-retry and read-modify-write
+ * serialization remain the callback's responsibility, so callers should route
+ * through `persistAccountPool` or `withAccountStorageTransaction` to preserve
+ * the guarantees covered by `test/login-runner.test.ts`.
+ * Persistence callback failures are redacted inside
+ * `persistResolvedAccountSelection()` before they propagate back to callers.
+ */
+export declare function resolveAndPersistAccountSelection(tokens: TokenSuccess, options?: {
+    fallbacks?: AccountSelectionFallbacks;
+    persistSelections?: PersistAccountSelections;
+    replaceAll?: boolean;
+}): Promise<AccountSelectionResult>;
+/**
+ * Persists login results through the shared storage transaction so overlapping
+ * login retries serialize their read-modify-write cycle instead of racing stale
+ * snapshots. `withAccountStorageTransaction` also routes the final rename
+ * through the Windows lock retry path in `lib/storage.ts`; see
+ * `test/login-runner.test.ts` for the concurrent persist regression coverage.
+ */
+export declare function persistAccountPool(results: TokenSuccessWithAccount[], replaceAll?: boolean): Promise<void>;
+export {};
+//# sourceMappingURL=login-runner.d.ts.map

package/dist/lib/auth/login-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-runner.d.ts","sourceRoot":"","sources":["../../../lib/auth/login-runner.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,KAAK,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AAE9D,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACpC,OAAO,EAAE,uBAAuB,CAAC;IACjC,sBAAsB,EAAE,uBAAuB,EAAE,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,CACtC,OAAO,EAAE,uBAAuB,EAAE,EAClC,UAAU,EAAE,OAAO,KACf,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAC3C,uBAAuB,EACvB,mBAAmB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,cAAc,CACnF,CAAC;AAqBF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,GAAG,sBAAsB,CA8DpF;AAED,wBAAgB,8BAA8B,CAC7C,SAAS,EAAE,sBAAsB,EACjC,SAAS,EAAE,yBAAyB,GAClC,sBAAsB,CAsCxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,+BAA+B,CACpD,SAAS,EAAE,sBAAsB,EACjC,OAAO,CAAC,EAAE;IACT,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB,GACC,OAAO,CAAC,sBAAsB,CAAC,CAgBjC;AAED;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CACtD,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE;IACT,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB,GACC,OAAO,CAAC,sBAAsB,CAAC,CAMjC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,uBAAuB,EAAE,EAClC,UAAU,GAAE,OAAe,GACzB,OAAO,CAAC,IAAI,CAAC,CAskBf"}