openplanr 1.25.2 → 2.0.0

package/dist/services/credential-backends.d.ts

@@ -18,6 +18,8 @@ export declare class KeychainBackend implements CredentialBackend {
     readonly name: "keychain";
     isAvailable(): Promise<boolean>;
     get(provider: string): Promise<string | undefined>;
+    getStrict(provider: string): Promise<string | undefined>;
+    deleteStrict(provider: string): Promise<boolean>;
     set(provider: string, value: string): Promise<void>;
     delete(provider: string): Promise<boolean>;
 }
@@ -26,10 +28,18 @@ export declare class EncryptedFileBackend implements CredentialBackend {
     private readonly planrDir;
     private readonly encryptedFile;
     private readonly saltFile;
-    constructor(planrDir?: string);
+    private readonly configuredPassphrase;
+    constructor(planrDir?: string, options?: {
+        passphrase?: string;
+    });
+    private passphrase;
     isAvailable(): Promise<boolean>;
+    private requirePassphrase;
     private loadAll;
     private saveAll;
+    getStrict(provider: string): Promise<string | undefined>;
+    setStrict(provider: string, value: string): Promise<void>;
+    deleteStrict(provider: string): Promise<boolean>;
     get(provider: string): Promise<string | undefined>;
     set(provider: string, value: string): Promise<void>;
     delete(provider: string): Promise<boolean>;

package/dist/services/credential-backends.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-backends.d.ts","sourceRoot":"","sources":["../../src/services/credential-backends.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAErE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AA0BD,qBAAa,eAAgB,YAAW,iBAAiB;IACvD,QAAQ,CAAC,IAAI,EAAG,UAAU,CAAU;IAE9B,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAkB/B,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAWlD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUjD;AAsDD,qBAAa,oBAAqB,YAAW,iBAAiB;IAC5D,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,QAAQ,SAAY;IAM1B,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;YAIvB,OAAO;YA0BP,OAAO;IAWf,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAKlD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAOjD;AAQD,qBAAa,sBAAsB;IAC3B,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1B,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAY1C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ9B;AAMD,eAAO,MAAM,eAAe,iBAAwB,CAAC;AACrD,eAAO,MAAM,oBAAoB,sBAA6B,CAAC;AAC/D,eAAO,MAAM,aAAa,wBAA+B,CAAC"}
+{"version":3,"file":"credential-backends.d.ts","sourceRoot":"","sources":["../../src/services/credential-backends.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAErE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AA0BD,qBAAa,eAAgB,YAAW,iBAAiB;IACvD,QAAQ,CAAC,IAAI,EAAG,UAAU,CAAU;IAE9B,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAkB/B,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAWlD,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAKxD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOhD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUjD;AAkED,qBAAa,oBAAqB,YAAW,iBAAiB;IAC5D,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;gBAE9C,QAAQ,SAAY,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO;IAOvE,OAAO,CAAC,UAAU;IAOZ,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAIrC,OAAO,CAAC,iBAAiB;YAUX,OAAO;YAkCP,OAAO;IA4Bf,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIxD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUhD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAKlD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CASjD;AAQD,qBAAa,sBAAsB;IAC3B,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1B,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAY1C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ9B;AAMD,eAAO,MAAM,eAAe,iBAAwB,CAAC;AACrD,eAAO,MAAM,oBAAoB,sBAA6B,CAAC;AAC/D,eAAO,MAAM,aAAa,wBAA+B,CAAC"}

package/dist/services/credential-backends.js

@@ -7,10 +7,11 @@
  * 3. Legacy plaintext file (~/.planr/credentials.json) — read-only, for migration
  */
 import crypto from 'node:crypto';
-import { access, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
+import { access, mkdir, open, readFile, rename, unlink, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { logger } from '../utils/logger.js';
+import { withCredentialWriteLock } from './credential-write-lock.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -59,6 +60,16 @@ export class KeychainBackend {
             return undefined;
         }
     }
+    async getStrict(provider) {
+        const mod = await import('@napi-rs/keyring');
+        return new mod.Entry(KEYCHAIN_SERVICE, provider).getPassword() ?? undefined;
+    }
+    async deleteStrict(provider) {
+        const mod = await import('@napi-rs/keyring');
+        // The native method returns false for an absent entry and throws on failure.
+        new mod.Entry(KEYCHAIN_SERVICE, provider).deleteCredential();
+        return true;
+    }
     async set(provider, value) {
         const mod = await import('@napi-rs/keyring');
         const entry = new mod.Entry(KEYCHAIN_SERVICE, provider);
@@ -79,8 +90,14 @@ export class KeychainBackend {
 // ---------------------------------------------------------------------------
 // 2. Encrypted File Backend
 // ---------------------------------------------------------------------------
-/** Derive a 256-bit key from machine identity + per-installation salt. */
-function deriveKey(salt) {
+const CREDENTIAL_PASSPHRASE_ENV = 'PLANR_CREDENTIAL_FILE_PASSPHRASE';
+const MINIMUM_PASSPHRASE_LENGTH = 20;
+/** Derive a 256-bit key only from an explicit operator secret and installation salt. */
+function deriveKey(passphrase, salt) {
+    return crypto.scryptSync(passphrase, salt, 32, { N: 16384, r: 8, p: 1 });
+}
+/** Read legacy ciphertext without continuing to use machine identity for new writes. */
+function deriveLegacyKey(salt) {
     const machineId = `${os.hostname()}:${os.userInfo().username}`;
     return crypto.scryptSync(machineId, salt, 32, { N: 16384, r: 8, p: 1 });
 }
@@ -101,6 +118,8 @@ function encrypt(plaintext, key) {
     const encrypted = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
     const tag = cipher.getAuthTag();
     return {
+        version: 2,
+        kdf: 'scrypt',
         iv: iv.toString('hex'),
         tag: tag.toString('hex'),
         data: encrypted.toString('hex'),
@@ -120,26 +139,46 @@ export class EncryptedFileBackend {
     planrDir;
     encryptedFile;
     saltFile;
-    constructor(planrDir = PLANR_DIR) {
+    configuredPassphrase;
+    constructor(planrDir = PLANR_DIR, options = {}) {
         this.planrDir = planrDir;
         this.encryptedFile = path.join(planrDir, 'credentials.enc');
         this.saltFile = path.join(planrDir, '.credential-salt');
+        this.configuredPassphrase = options.passphrase;
+    }
+    passphrase() {
+        const value = this.configuredPassphrase ?? process.env[CREDENTIAL_PASSPHRASE_ENV];
+        return typeof value === 'string' && value.length >= MINIMUM_PASSPHRASE_LENGTH
+            ? value
+            : undefined;
     }
     async isAvailable() {
-        return true; // Always available as the universal fallback
+        return this.passphrase() !== undefined;
     }
-    async loadAll() {
+    requirePassphrase() {
+        const value = this.passphrase();
+        if (!value) {
+            throw new Error(`${CREDENTIAL_PASSPHRASE_ENV} must contain at least ${MINIMUM_PASSPHRASE_LENGTH} characters when the OS keychain is unavailable.`);
+        }
+        return value;
+    }
+    async loadAll(strict = false) {
         if (!(await pathExists(this.encryptedFile)))
             return {};
         try {
             const raw = await readFile(this.encryptedFile, 'utf-8');
             const envelope = JSON.parse(raw);
             const salt = await getSalt(this.planrDir, this.saltFile);
-            const key = deriveKey(salt);
+            const key = envelope.version === 2 ? deriveKey(this.requirePassphrase(), salt) : deriveLegacyKey(salt);
             const json = decrypt(envelope, key);
-            return JSON.parse(json);
+            const value = JSON.parse(json);
+            if (!value || typeof value !== 'object' || Array.isArray(value))
+                throw new Error('invalid credential payload');
+            return value;
         }
         catch (err) {
+            if (strict)
+                throw new Error('The encrypted credential store cannot be read. Existing contents were preserved.');
             logger.debug('Failed to decrypt credentials file', err);
             // Backup corrupted/unreadable file before it gets overwritten by a
             // subsequent set() call — avoids silent credential loss.
@@ -158,11 +197,51 @@ export class EncryptedFileBackend {
     async saveAll(credentials) {
         await mkdir(this.planrDir, { recursive: true });
         const salt = await getSalt(this.planrDir, this.saltFile);
-        const key = deriveKey(salt);
+        const key = deriveKey(this.requirePassphrase(), salt);
         const envelope = encrypt(JSON.stringify(credentials), key);
-        await writeFile(this.encryptedFile, JSON.stringify(envelope, null, 2), {
-            encoding: 'utf-8',
-            mode: 0o600,
+        const temporary = `${this.encryptedFile}.${crypto.randomUUID()}.tmp`;
+        try {
+            const handle = await open(temporary, 'wx', 0o600);
+            try {
+                await handle.writeFile(JSON.stringify(envelope, null, 2), 'utf8');
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await rename(temporary, this.encryptedFile);
+            if (process.platform !== 'win32') {
+                const directory = await open(this.planrDir, 'r');
+                try {
+                    await directory.sync();
+                }
+                finally {
+                    await directory.close();
+                }
+            }
+        }
+        finally {
+            await unlink(temporary).catch(() => { });
+        }
+    }
+    async getStrict(provider) {
+        return (await this.loadAll(true))[provider];
+    }
+    async setStrict(provider, value) {
+        return withCredentialWriteLock(this.planrDir, async () => {
+            const all = await this.loadAll(true);
+            all[provider] = value;
+            await this.saveAll(all);
+        });
+    }
+    async deleteStrict(provider) {
+        return withCredentialWriteLock(this.planrDir, async () => {
+            const all = await this.loadAll(true);
+            if (!Object.hasOwn(all, provider))
+                return true;
+            delete all[provider];
+            await this.saveAll(all);
+            return true;
         });
     }
     async get(provider) {
@@ -170,17 +249,21 @@ export class EncryptedFileBackend {
         return all[provider];
     }
     async set(provider, value) {
-        const all = await this.loadAll();
-        all[provider] = value;
-        await this.saveAll(all);
+        return withCredentialWriteLock(this.planrDir, async () => {
+            const all = await this.loadAll(true);
+            all[provider] = value;
+            await this.saveAll(all);
+        });
     }
     async delete(provider) {
-        const all = await this.loadAll();
-        if (!(provider in all))
-            return false;
-        delete all[provider];
-        await this.saveAll(all);
-        return true;
+        return withCredentialWriteLock(this.planrDir, async () => {
+            const all = await this.loadAll(true);
+            if (!Object.hasOwn(all, provider))
+                return false;
+            delete all[provider];
+            await this.saveAll(all);
+            return true;
+        });
     }
 }
 // ---------------------------------------------------------------------------

package/dist/services/credential-backends.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-backends.js","sourceRoot":"","sources":["../../src/services/credential-backends.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAgB5C,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,OAAO,MAAM,CAAC,CAAC,CAAC;SACb,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SAChB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,4DAA4D;AAC5D,IAAI,iBAAiB,GAAmB,IAAI,CAAC;AAE7C,MAAM,OAAO,eAAe;IACjB,IAAI,GAAG,UAAmB,CAAC;IAEpC,KAAK,CAAC,WAAW;QACf,IAAI,iBAAiB,KAAK,IAAI;YAAE,OAAO,iBAAiB,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC7C,mDAAmD;YACnD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;YACrE,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC/B,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAC7B,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACxD,iBAAiB,GAAG,KAAK,CAAC;QAC5B,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,KAAa;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACxD,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,0EAA0E;AAC1E,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/D,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,+CAA+C;AAC/C,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,QAAgB;IACvD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,IAAI,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,SAAS,OAAO,CAAC,SAAiB,EAAE,GAAW;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxB,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,QAA2B,EAAE,GAAW;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9F,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,OAAO,oBAAoB;IACtB,IAAI,GAAG,gBAAyB,CAAC;IACzB,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,QAAQ,CAAS;IAElC,YAAY,QAAQ,GAAG,SAAS;QAC9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAC5D,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAsB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACxD,mEAAmE;YACnE,yDAAyD;YACzD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,aAAa,MAAM,CAAC;gBAC/C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC/C,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;gBACjE,6CAA6C;YAC/C,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,WAAmC;QACvD,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACrE,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,KAAa;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QACtB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAE7D,MAAM,OAAO,sBAAsB;IACjC,KAAK,CAAC,MAAM;QACV,OAAO,UAAU,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;YAC9D,yBAAyB;QAC3B,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"credential-backends.js","sourceRoot":"","sources":["../../src/services/credential-backends.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAgBrE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,OAAO,MAAM,CAAC,CAAC,CAAC;SACb,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SAChB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,4DAA4D;AAC5D,IAAI,iBAAiB,GAAmB,IAAI,CAAC;AAE7C,MAAM,OAAO,eAAe;IACjB,IAAI,GAAG,UAAmB,CAAC;IAEpC,KAAK,CAAC,WAAW;QACf,IAAI,iBAAiB,KAAK,IAAI;YAAE,OAAO,iBAAiB,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC7C,mDAAmD;YACnD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;YACrE,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC/B,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAC7B,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACxD,iBAAiB,GAAG,KAAK,CAAC;QAC5B,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,6EAA6E;QAC7E,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,KAAa;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACxD,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,yBAAyB,GAAG,kCAAkC,CAAC;AACrE,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,wFAAwF;AACxF,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY;IACjD,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,wFAAwF;AACxF,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/D,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,+CAA+C;AAC/C,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,QAAgB;IACvD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,IAAI,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAUD,SAAS,OAAO,CAAC,SAAiB,EAAE,GAAW;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,GAAG,EAAE,QAAQ;QACb,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxB,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,QAA2B,EAAE,GAAW;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9F,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,OAAO,oBAAoB;IACtB,IAAI,GAAG,gBAAyB,CAAC;IACzB,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,QAAQ,CAAS;IACjB,oBAAoB,CAAqB;IAE1D,YAAY,QAAQ,GAAG,SAAS,EAAE,UAAmC,EAAE;QACrE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC;IACjD,CAAC;IAEO,UAAU;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAClF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,yBAAyB;YAC3E,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,SAAS,CAAC;IACzC,CAAC;IAEO,iBAAiB;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,GAAG,yBAAyB,0BAA0B,yBAAyB,kDAAkD,CAClI,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK;QAClC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAsB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzD,MAAM,GAAG,GACP,QAAQ,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;YACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM;gBACR,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;YACJ,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACxD,mEAAmE;YACnE,yDAAyD;YACzD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,aAAa,MAAM,CAAC;gBAC/C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC/C,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;gBACjE,6CAA6C;YAC/C,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,WAAmC;QACvD,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;gBAClE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YACD,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACjD,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;gBACzB,CAAC;wBAAS,CAAC;oBACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,KAAa;QAC7C,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;YACtB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,KAAa;QACvC,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;YACtB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAE7D,MAAM,OAAO,sBAAsB;IACjC,KAAK,CAAC,MAAM;QACV,OAAO,UAAU,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;YAC9D,yBAAyB;QAC3B,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,sBAAsB,EAAE,CAAC"}

package/dist/services/credential-write-lock.d.ts

@@ -0,0 +1,8 @@
+/**
+ * A filesystem bakery lock: each writer owns a unique record, announces selection
+ * with ticket zero, then waits for earlier (ticket, name) pairs. Unlike replacing
+ * one shared lock, reclaiming a dead writer cannot unlink a new owner's lock.
+ * This serializes the complete encrypted-file read/modify/write across processes.
+ */
+export declare function withCredentialWriteLock<T>(planrDirectory: string, action: () => Promise<T>, timeoutMs?: number): Promise<T>;
+//# sourceMappingURL=credential-write-lock.d.ts.map

package/dist/services/credential-write-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-write-lock.d.ts","sourceRoot":"","sources":["../../src/services/credential-write-lock.ts"],"names":[],"mappings":"AAWA;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,EAC7C,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACxB,SAAS,SAAQ,GAChB,OAAO,CAAC,CAAC,CAAC,CA+FZ"}

package/dist/services/credential-write-lock.js

@@ -0,0 +1,104 @@
+import { randomUUID } from 'node:crypto';
+import { lstat, mkdir, open, readdir, readFile, rename, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+/**
+ * A filesystem bakery lock: each writer owns a unique record, announces selection
+ * with ticket zero, then waits for earlier (ticket, name) pairs. Unlike replacing
+ * one shared lock, reclaiming a dead writer cannot unlink a new owner's lock.
+ * This serializes the complete encrypted-file read/modify/write across processes.
+ */
+export async function withCredentialWriteLock(planrDirectory, action, timeoutMs = 15000) {
+    const directory = path.join(planrDirectory, '.credential-writers');
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const info = await lstat(directory);
+    if (!info.isDirectory() || info.isSymbolicLink())
+        throw new Error('The credential writer directory is unsafe. Existing credentials were preserved.');
+    const name = `${process.pid}-${randomUUID()}.json`;
+    const file = path.join(directory, name);
+    const deadline = Date.now() + timeoutMs;
+    async function announce(ticket) {
+        const temporary = `${file}.tmp`;
+        try {
+            const handle = await open(temporary, 'wx', 0o600);
+            try {
+                await handle.writeFile(JSON.stringify({ pid: process.pid, ticket }));
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await rename(temporary, file);
+        }
+        finally {
+            await unlink(temporary).catch(() => { });
+        }
+    }
+    async function writers() {
+        const result = [];
+        for (const entry of await readdir(directory)) {
+            if (!entry.endsWith('.json'))
+                continue;
+            const match = /^([1-9]\d*)-([a-f0-9-]{36})\.json$/.exec(entry);
+            if (!match)
+                throw new Error('Credential writer state is invalid. Existing credentials were preserved.');
+            const entryPath = path.join(directory, entry);
+            try {
+                const info = await lstat(entryPath);
+                if (!info.isFile() || info.isSymbolicLink() || info.size > 1024)
+                    throw new Error('Credential writer state is unsafe. Existing credentials were preserved.');
+                const value = JSON.parse(await readFile(entryPath, 'utf8'));
+                if (value.pid !== Number(match[1]) ||
+                    !Number.isSafeInteger(value.pid) ||
+                    !Number.isSafeInteger(value.ticket) ||
+                    value.ticket < 0)
+                    throw new Error('Credential writer state is invalid. Existing credentials were preserved.');
+                let dead = false;
+                try {
+                    process.kill(value.pid, 0);
+                }
+                catch (error) {
+                    dead = error.code === 'ESRCH';
+                }
+                if (dead) {
+                    // Names are never reused, so overlapping reclaimers cannot remove a new owner.
+                    await unlink(entryPath).catch((error) => {
+                        if (error.code !== 'ENOENT')
+                            throw error;
+                    });
+                    continue;
+                }
+                result.push({ ...value, name: entry });
+            }
+            catch (error) {
+                // A writer can finish between directory enumeration and opening its record.
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        return result;
+    }
+    try {
+        await announce(0);
+        const ticket = Math.max(0, ...(await writers()).map((writer) => writer.ticket)) + 1;
+        if (!Number.isSafeInteger(ticket))
+            throw new Error('Credential writer ticket limit reached.');
+        await announce(ticket);
+        for (;;) {
+            const blocked = (await writers()).some((writer) => writer.name !== name &&
+                (writer.ticket === 0 ||
+                    writer.ticket < ticket ||
+                    (writer.ticket === ticket && writer.name < name)));
+            if (!blocked)
+                break;
+            if (Date.now() >= deadline)
+                throw new Error('Another credential update is still running. Retry after it finishes; existing credentials were preserved.');
+            await delay(20);
+        }
+        return await action();
+    }
+    finally {
+        await unlink(file).catch(() => { });
+    }
+}
+//# sourceMappingURL=credential-write-lock.js.map

package/dist/services/credential-write-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-write-lock.js","sourceRoot":"","sources":["../../src/services/credential-write-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAQ3D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,cAAsB,EACtB,MAAwB,EACxB,SAAS,GAAG,KAAK;IAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;QAC9C,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,OAAO,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,KAAK,UAAU,QAAQ,CAAC,MAAc;QACpC,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACrE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YACD,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,KAAK,UAAU,OAAO;QACpB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACvC,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;YAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI;oBAC7D,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;gBACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAW,CAAC;gBACtE,IACE,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC9B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;oBAChC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;oBACnC,KAAK,CAAC,MAAM,GAAG,CAAC;oBAEhB,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;gBACJ,IAAI,IAAI,GAAG,KAAK,CAAC;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC7B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,GAAI,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;gBAC3D,CAAC;gBACD,IAAI,IAAI,EAAE,CAAC;oBACT,+EAA+E;oBAC/E,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;wBAC7D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;4BAAE,MAAM,KAAK,CAAC;oBAC3C,CAAC,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4EAA4E;gBAC5E,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YACtE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC9F,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvB,SAAS,CAAC;YACR,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,IAAI,CACpC,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,IAAI,KAAK,IAAI;gBACpB,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;oBAClB,MAAM,CAAC,MAAM,GAAG,MAAM;oBACtB,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CACtD,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,MAAM;YACpB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBACxB,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;YACJ,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/services/credentials-service.d.ts

@@ -2,7 +2,7 @@
  * Manages API key storage with a secure fallback chain.
  *
  * Resolution order:
- * 1. Environment variable (ANTHROPIC_API_KEY, OPENAI_API_KEY)
+ * 1. Environment variable (`PLANR_LINEAR_TOKEN`)
  * 2. OS Keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
  * 3. Encrypted file (~/.planr/credentials.enc) with AES-256-GCM
  * 4. undefined (caller decides how to handle)
@@ -18,7 +18,7 @@ import type { CredentialSource } from './credential-backends.js';
 export declare function migrateCredentials(): Promise<boolean>;
 /**
  * Resolve API key for a provider using the secure fallback chain:
- * 1. Environment variable (ANTHROPIC_API_KEY, OPENAI_API_KEY)
+ * 1. Environment variable (`PLANR_LINEAR_TOKEN`)
  * 2. OS Keychain
  * 3. Encrypted file (~/.planr/credentials.enc)
  * 4. undefined
@@ -34,6 +34,12 @@ export declare function resolveApiKeySource(provider: string): Promise<{
  * Prefers OS keychain; falls back to encrypted file.
  */
 export declare function saveCredential(provider: string, apiKey: string): Promise<CredentialSource>;
+/** Save a rotating credential without treating an unreadable fallback file as empty. */
+export declare function saveRecordedCredential(provider: string, value: string): Promise<'keychain' | 'encrypted-file'>;
+/** Read a credential from its recorded backend, avoiding stale fallback copies. */
+export declare function readStoredCredential(provider: string, source: 'keychain' | 'encrypted-file'): Promise<string | undefined>;
+/** Delete the recorded credential copy; false means removal was not confirmed. */
+export declare function removeStoredCredential(provider: string, source: 'keychain' | 'encrypted-file'): Promise<boolean>;
 /** Delete a stored credential from all backends. */
 export declare function clearCredential(provider: string): Promise<void>;
 /**

package/dist/services/credentials-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials-service.d.ts","sourceRoot":"","sources":["../../src/services/credentials-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA0BjE;;;GAGG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CA8B3D;AAMD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqBjF;AAED,sDAAsD;AACtD,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG,SAAS,CAAC,CAmBhE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAchG;AAED,oDAAoD;AACpD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrE;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAkBvE;AAED,iDAAiD;AACjD,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}
+{"version":3,"file":"credentials-service.d.ts","sourceRoot":"","sources":["../../src/services/credentials-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA6BjE;;;GAGG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CA8B3D;AAMD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqBjF;AAED,sDAAsD;AACtD,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG,SAAS,CAAC,CAqBhE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmBhG;AAED,wFAAwF;AACxF,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,GAAG,gBAAgB,CAAC,CAgBxC;AAED,mFAAmF;AACnF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,GAAG,gBAAgB,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED,kFAAkF;AAClF,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,GAAG,gBAAgB,GACpC,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED,oDAAoD;AACpD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrE;AAED;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoBvE;AAED,iDAAiD;AACjD,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/services/credentials-service.js

@@ -2,7 +2,7 @@
  * Manages API key storage with a secure fallback chain.
  *
  * Resolution order:
- * 1. Environment variable (ANTHROPIC_API_KEY, OPENAI_API_KEY)
+ * 1. Environment variable (`PLANR_LINEAR_TOKEN`)
  * 2. OS Keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service)
  * 3. Encrypted file (~/.planr/credentials.enc) with AES-256-GCM
  * 4. undefined (caller decides how to handle)
@@ -10,13 +10,15 @@
  * Keys are automatically migrated from the legacy plaintext
  * ~/.planr/credentials.json on first access.
  */
-import { ENV_KEY_MAP } from '../ai/types.js';
 import { logger } from '../utils/logger.js';
 import { encryptedFileBackend, keychainBackend, legacyBackend } from './credential-backends.js';
 // ---------------------------------------------------------------------------
 // Env-var access (explicit allowlist — avoids dynamic process.env lookups)
 // ---------------------------------------------------------------------------
 /** Allowed environment variable names for API key resolution. */
+const ENV_KEY_MAP = Object.freeze({
+    linear: 'PLANR_LINEAR_TOKEN',
+});
 const ALLOWED_ENV_VARS = new Set(Object.values(ENV_KEY_MAP));
 /**
  * Read an API key from an environment variable.
@@ -70,15 +72,13 @@ export async function migrateCredentials() {
 // ---------------------------------------------------------------------------
 /**
  * Resolve API key for a provider using the secure fallback chain:
- * 1. Environment variable (ANTHROPIC_API_KEY, OPENAI_API_KEY)
+ * 1. Environment variable (`PLANR_LINEAR_TOKEN`)
  * 2. OS Keychain
  * 3. Encrypted file (~/.planr/credentials.enc)
  * 4. undefined
  */
 export async function resolveApiKey(provider) {
-    // Deprecated for Operating Board advisor dispatch; retained for CLI-side
-    // planning until the announced OpenPlanr 2.0.0 removal.
-    // Run one-time migration from legacy plaintext file
+    // Run one-time migration from the legacy plaintext file.
     await migrateCredentials();
     // 1. Environment variable (explicit allowlist)
     const envKey = readEnvKey(provider);
@@ -90,10 +90,12 @@ export async function resolveApiKey(provider) {
         if (key)
             return key;
     }
-    // 3. Encrypted file
-    const key = await encryptedFileBackend.get(provider);
-    if (key)
-        return key;
+    // 3. Encrypted file, only with an explicit operator passphrase.
+    if (await encryptedFileBackend.isAvailable()) {
+        const key = await encryptedFileBackend.get(provider);
+        if (key)
+            return key;
+    }
     return undefined;
 }
 /** Resolve the source where the API key is stored. */
@@ -110,10 +112,12 @@ export async function resolveApiKeySource(provider) {
         if (key)
             return { key, source: 'keychain' };
     }
-    // 3. Encrypted file
-    const key = await encryptedFileBackend.get(provider);
-    if (key)
-        return { key, source: 'encrypted-file' };
+    // 3. Encrypted file, only with an explicit operator passphrase.
+    if (await encryptedFileBackend.isAvailable()) {
+        const key = await encryptedFileBackend.get(provider);
+        if (key)
+            return { key, source: 'encrypted-file' };
+    }
     return undefined;
 }
 /**
@@ -132,13 +136,52 @@ export async function saveCredential(provider, apiKey) {
             // Fall through to encrypted file backend.
         }
     }
+    if (!(await encryptedFileBackend.isAvailable())) {
+        throw new Error('The OS keychain is unavailable. Set PLANR_CREDENTIAL_FILE_PASSPHRASE to a strong passphrase before using encrypted-file credential storage.');
+    }
     await encryptedFileBackend.set(provider, apiKey);
     return 'encrypted-file';
 }
+/** Save a rotating credential without treating an unreadable fallback file as empty. */
+export async function saveRecordedCredential(provider, value) {
+    if (await keychainBackend.isAvailable()) {
+        try {
+            await keychainBackend.set(provider, value);
+            return 'keychain';
+        }
+        catch {
+            /* Use strict fallback. */
+        }
+    }
+    if (!(await encryptedFileBackend.isAvailable())) {
+        throw new Error('The OS keychain is unavailable. Set PLANR_CREDENTIAL_FILE_PASSPHRASE to a strong passphrase before using encrypted-file credential storage.');
+    }
+    await encryptedFileBackend.setStrict(provider, value);
+    return 'encrypted-file';
+}
+/** Read a credential from its recorded backend, avoiding stale fallback copies. */
+export async function readStoredCredential(provider, source) {
+    try {
+        return await (source === 'keychain' ? keychainBackend : encryptedFileBackend).getStrict(provider);
+    }
+    catch {
+        throw new Error('The recorded credential backend is unavailable. Unlock or repair it before retrying.');
+    }
+}
+/** Delete the recorded credential copy; false means removal was not confirmed. */
+export async function removeStoredCredential(provider, source) {
+    try {
+        return await (source === 'keychain' ? keychainBackend : encryptedFileBackend).deleteStrict(provider);
+    }
+    catch {
+        return false;
+    }
+}
 /** Delete a stored credential from all backends. */
 export async function clearCredential(provider) {
     await keychainBackend.delete(provider);
-    await encryptedFileBackend.delete(provider);
+    if (await encryptedFileBackend.isAvailable())
+        await encryptedFileBackend.delete(provider);
 }
 /**
  * Load all stored credentials (for display/diagnostic purposes).
@@ -146,15 +189,17 @@ export async function clearCredential(provider) {
  */
 export async function loadCredentials() {
     const result = {};
-    // Load from encrypted file first
-    for (const provider of ['anthropic', 'openai', 'linear']) {
-        const key = await encryptedFileBackend.get(provider);
-        if (key)
-            result[provider] = key;
+    // Load from encrypted file first when its operator secret is available.
+    if (await encryptedFileBackend.isAvailable()) {
+        for (const provider of ['linear']) {
+            const key = await encryptedFileBackend.get(provider);
+            if (key)
+                result[provider] = key;
+        }
     }
     // Keychain entries override (they're the preferred backend)
     if (await keychainBackend.isAvailable()) {
-        for (const provider of ['anthropic', 'openai', 'linear']) {
+        for (const provider of ['linear']) {
             const key = await keychainBackend.get(provider);
             if (key)
                 result[provider] = key;

package/dist/services/credentials-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials-service.js","sourceRoot":"","sources":["../../src/services/credentials-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEhG,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;AAE7D;;;GAGG;AACH,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,aAAa;QAAE,OAAO,KAAK,CAAC;IAEhC,0DAA0D;IAC1D,aAAa,GAAG,IAAI,CAAC;IAErB,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAElD,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iDAAiD;QACjD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,sEAAsE;QACtE,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACjD,wDAAwD;QACxD,aAAa,GAAG,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,yEAAyE;IACzE,wDAAwD;IACxD,oDAAoD;IACpD,MAAM,kBAAkB,EAAE,CAAC;IAE3B,+CAA+C;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,iBAAiB;IACjB,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IAED,oBAAoB;IACpB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB;IAEhB,oDAAoD;IACpD,MAAM,kBAAkB,EAAE,CAAC;IAE3B,+CAA+C;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAElD,iBAAiB;IACjB,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,oBAAoB;IACpB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,GAAG;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAElD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IACnE,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;YAC3E,uEAAuE;YACvE,0CAA0C;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,MAAM,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,iCAAiC;IACjC,KAAK,MAAM,QAAQ,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,GAAG;YAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;IAClC,CAAC;IAED,4DAA4D;IAC5D,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,KAAK,MAAM,QAAQ,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,eAAe;IAC7B,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC"}
+{"version":3,"file":"credentials-service.js","sourceRoot":"","sources":["../../src/services/credentials-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEhG,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,WAAW,GAAqC,MAAM,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,oBAAoB;CAC7B,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;AAE7D;;;GAGG;AACH,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,aAAa;QAAE,OAAO,KAAK,CAAC;IAEhC,0DAA0D;IAC1D,aAAa,GAAG,IAAI,CAAC;IAErB,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAElD,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iDAAiD;QACjD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,sEAAsE;QACtE,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACjD,wDAAwD;QACxD,aAAa,GAAG,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,yDAAyD;IACzD,MAAM,kBAAkB,EAAE,CAAC;IAE3B,+CAA+C;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,iBAAiB;IACjB,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IAED,gEAAgE;IAChE,IAAI,MAAM,oBAAoB,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB;IAEhB,oDAAoD;IACpD,MAAM,kBAAkB,EAAE,CAAC;IAE3B,+CAA+C;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAElD,iBAAiB;IACjB,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,gEAAgE;IAChE,IAAI,MAAM,oBAAoB,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,GAAG;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACpD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IACnE,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;YAC3E,uEAAuE;YACvE,0CAA0C;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,6IAA6I,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,KAAa;IAEb,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,6IAA6I,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAgB,EAChB,MAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,SAAS,CACrF,QAAQ,CACT,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,MAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,YAAY,CACxF,QAAQ,CACT,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,MAAM,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,oBAAoB,CAAC,WAAW,EAAE;QAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,wEAAwE;IACxE,IAAI,MAAM,oBAAoB,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7C,KAAK,MAAM,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QAClC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QACxC,KAAK,MAAM,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,eAAe;IAC7B,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC"}

package/dist/services/deprecation-notices.d.ts

@@ -1,5 +1,5 @@
 import { logger as defaultLogger } from '../utils/logger.js';
-export type DeprecatedSurface = 'operate-structured-provider' | 'ai-planning';
-export declare const HARNESS_FLOW_DEPRECATION_NOTICE = "Deprecated: CLI-managed AI planning and structured Operating Board providers remain available in this release, but agentic work now belongs in the native runtime harness through Protocol v1.3 mandates. See https://openplanr.dev/docs/operate/agent-harness. Scheduled for removal in OpenPlanr 2.0.0.";
+export type DeprecatedSurface = 'ai-planning';
+export declare const AI_PLANNING_DEPRECATION_NOTICE = "Deprecated: CLI-managed AI planning remains available in this release.";
 export declare function printDeprecationNotice(_surface: DeprecatedSurface, sink?: Pick<typeof defaultLogger, 'warn'>): void;
 //# sourceMappingURL=deprecation-notices.d.ts.map

package/dist/services/deprecation-notices.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deprecation-notices.d.ts","sourceRoot":"","sources":["../../src/services/deprecation-notices.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,6BAA6B,GAAG,aAAa,CAAC;AAE9E,eAAO,MAAM,+BAA+B,8SACiQ,CAAC;AAE9S,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,GAAE,IAAI,CAAC,OAAO,aAAa,EAAE,MAAM,CAAiB,GACvD,IAAI,CAEN"}
+{"version":3,"file":"deprecation-notices.d.ts","sourceRoot":"","sources":["../../src/services/deprecation-notices.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE9C,eAAO,MAAM,8BAA8B,2EAC+B,CAAC;AAE3E,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,GAAE,IAAI,CAAC,OAAO,aAAa,EAAE,MAAM,CAAiB,GACvD,IAAI,CAEN"}