polyv-live-cli 1.1.4 → 1.1.7

package/dist/config/account-crypto.d.ts

@@ -0,0 +1,17 @@
+import { EncryptionMetadata } from '../types/account.types';
+export declare class AccountCrypto {
+    private masterKey;
+    constructor(masterKey?: string);
+    private deriveKey;
+    encrypt(plaintext: string): {
+        encrypted: string;
+        metadata: EncryptionMetadata;
+    };
+    decrypt(encrypted: string, metadata: EncryptionMetadata): string;
+    encryptSimple(plaintext: string): string;
+    decryptSimple(encryptedData: string): string;
+    validateEncryptedData(encryptedData: string): boolean;
+    static generateMasterKey(): string;
+    testEncryption(testData?: string): boolean;
+}
+//# sourceMappingURL=account-crypto.d.ts.map

package/dist/config/account-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-crypto.d.ts","sourceRoot":"","sources":["../../src/config/account-crypto.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAe5D,qBAAa,aAAa;IACxB,OAAO,CAAC,SAAS,CAAS;gBAMd,SAAS,CAAC,EAAE,MAAM;IAU9B,OAAO,CAAC,SAAS;IAUV,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE;IAiC/E,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,MAAM;IA0BhE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAcxC,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM;IAc5C,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO;WAa9C,iBAAiB,IAAI,MAAM;IASlC,cAAc,CAAC,QAAQ,GAAE,MAA2B,GAAG,OAAO;CAStE"}

package/dist/config/account-crypto.js

@@ -0,0 +1,129 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountCrypto = void 0;
+const crypto = __importStar(require("crypto"));
+const ENCRYPTION_CONFIG = {
+    algorithm: 'aes-256-cbc',
+    keyLength: 32,
+    ivLength: 16,
+    defaultMasterKey: 'polyv-cli-default-master-key-2024'
+};
+class AccountCrypto {
+    constructor(masterKey) {
+        const keySource = masterKey || process.env['POLYV_MASTER_KEY'] || ENCRYPTION_CONFIG.defaultMasterKey;
+        this.masterKey = this.deriveKey(keySource);
+    }
+    deriveKey(masterKey) {
+        const salt = Buffer.from('polyv-cli-salt-2024', 'utf8');
+        return crypto.pbkdf2Sync(masterKey, salt, 100000, ENCRYPTION_CONFIG.keyLength, 'sha256');
+    }
+    encrypt(plaintext) {
+        try {
+            const iv = crypto.randomBytes(ENCRYPTION_CONFIG.ivLength);
+            const cipher = crypto.createCipheriv(ENCRYPTION_CONFIG.algorithm, this.masterKey, iv);
+            let encrypted = cipher.update(plaintext, 'utf8', 'hex');
+            encrypted += cipher.final('hex');
+            const metadata = {
+                algorithm: ENCRYPTION_CONFIG.algorithm,
+                iv: iv.toString('hex'),
+                authTag: ''
+            };
+            return {
+                encrypted,
+                metadata
+            };
+        }
+        catch (error) {
+            throw new Error(`Failed to encrypt account secret: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    decrypt(encrypted, metadata) {
+        try {
+            if (metadata.algorithm !== ENCRYPTION_CONFIG.algorithm) {
+                throw new Error(`Unsupported encryption algorithm: ${metadata.algorithm}`);
+            }
+            const iv = Buffer.from(metadata.iv, 'hex');
+            const decipher = crypto.createDecipheriv(metadata.algorithm, this.masterKey, iv);
+            let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+            decrypted += decipher.final('utf8');
+            return decrypted;
+        }
+        catch (error) {
+            throw new Error(`Failed to decrypt account secret: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    encryptSimple(plaintext) {
+        const { encrypted, metadata } = this.encrypt(plaintext);
+        const combined = {
+            data: encrypted,
+            meta: metadata
+        };
+        return Buffer.from(JSON.stringify(combined)).toString('base64');
+    }
+    decryptSimple(encryptedData) {
+        try {
+            const combined = JSON.parse(Buffer.from(encryptedData, 'base64').toString('utf8'));
+            return this.decrypt(combined.data, combined.meta);
+        }
+        catch (error) {
+            throw new Error(`Failed to decrypt account secret: Invalid encrypted data format`);
+        }
+    }
+    validateEncryptedData(encryptedData) {
+        try {
+            this.decryptSimple(encryptedData);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    static generateMasterKey() {
+        return crypto.randomBytes(32).toString('hex');
+    }
+    testEncryption(testData = 'test-secret-data') {
+        try {
+            const encrypted = this.encryptSimple(testData);
+            const decrypted = this.decryptSimple(encrypted);
+            return decrypted === testData;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+exports.AccountCrypto = AccountCrypto;
+//# sourceMappingURL=account-crypto.js.map

package/dist/config/account-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-crypto.js","sourceRoot":"","sources":["../../src/config/account-crypto.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,+CAAiC;AAMjC,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,EAAE;IACZ,gBAAgB,EAAE,mCAAmC;CAC7C,CAAC;AAKX,MAAa,aAAa;IAOxB,YAAY,SAAkB;QAC5B,MAAM,SAAS,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,iBAAiB,CAAC,gBAAgB,CAAC;QACrG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAOO,SAAS,CAAC,SAAiB;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC3F,CAAC;IAOM,OAAO,CAAC,SAAiB;QAC9B,IAAI,CAAC;YAEH,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAG1D,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAGtF,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAEjC,MAAM,QAAQ,GAAuB;gBACnC,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACtB,OAAO,EAAE,EAAE;aACZ,CAAC;YAEF,OAAO;gBACL,SAAS;gBACT,QAAQ;aACT,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAQM,OAAO,CAAC,SAAiB,EAAE,QAA4B;QAC5D,IAAI,CAAC;YAEH,IAAI,QAAQ,CAAC,SAAS,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7E,CAAC;YAGD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAGjF,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAEpC,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAOM,aAAa,CAAC,SAAiB;QACpC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;IAOM,aAAa,CAAC,aAAqB;QACxC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAOM,qBAAqB,CAAC,aAAqB;QAChD,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAMM,MAAM,CAAC,iBAAiB;QAC7B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAOM,cAAc,CAAC,WAAmB,kBAAkB;QACzD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAChD,OAAO,SAAS,KAAK,QAAQ,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAjJD,sCAiJC"}

package/dist/config/account-encryption.d.ts

@@ -0,0 +1,35 @@
+export interface EncryptedData {
+    algorithm: 'aes-256-gcm';
+    iv: string;
+    authTag: string;
+    encrypted: string;
+}
+export interface AccountEncryption {
+    encrypt(plaintext: string): EncryptedData;
+    decrypt(encryptedData: EncryptedData): string;
+    generateKey(): string;
+    validateKey(key: string): boolean;
+}
+export declare class AccountEncryptionImpl implements AccountEncryption {
+    private encryptionKey;
+    private keySource;
+    constructor(masterKey?: string);
+    private resolveEncryptionKey;
+    private generateDefaultKey;
+    private deriveEncryptionKey;
+    encrypt(plaintext: string): EncryptedData;
+    decrypt(encryptedData: EncryptedData): string;
+    generateKey(): string;
+    validateKey(key: string): boolean;
+    testEncryption(testData?: string): boolean;
+    getKeySource(): 'environment' | 'generated';
+    validateEncryptedData(encryptedData: unknown): encryptedData is EncryptedData;
+    getEncryptionMetadata(): {
+        algorithm: string;
+        keySource: 'environment' | 'generated';
+        version: string;
+    };
+}
+export declare function createAccountEncryption(masterKey?: string): AccountEncryption;
+export declare const defaultAccountEncryption: AccountEncryption;
+//# sourceMappingURL=account-encryption.d.ts.map

package/dist/config/account-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-encryption.d.ts","sourceRoot":"","sources":["../../src/config/account-encryption.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,aAAa;IAE5B,SAAS,EAAE,aAAa,CAAC;IAEzB,EAAE,EAAE,MAAM,CAAC;IAEX,OAAO,EAAE,MAAM,CAAC;IAEhB,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,MAAM,WAAW,iBAAiB;IAMhC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAAC;IAO1C,OAAO,CAAC,aAAa,EAAE,aAAa,GAAG,MAAM,CAAC;IAM9C,WAAW,IAAI,MAAM,CAAC;IAOtB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAiBD,qBAAa,qBAAsB,YAAW,iBAAiB;IAC7D,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,SAAS,CAA8B;gBAMnC,SAAS,CAAC,EAAE,MAAM;IAW9B,OAAO,CAAC,oBAAoB;IAkC5B,OAAO,CAAC,kBAAkB;IA+B1B,OAAO,CAAC,mBAAmB;IAiBpB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa;IAmCzC,OAAO,CAAC,aAAa,EAAE,aAAa,GAAG,MAAM;IAiD7C,WAAW,IAAI,MAAM;IAWrB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAsBjC,cAAc,CAAC,QAAQ,GAAE,MAAgC,GAAG,OAAO;IAcnE,YAAY,IAAI,aAAa,GAAG,WAAW;IAS3C,qBAAqB,CAAC,aAAa,EAAE,OAAO,GAAG,aAAa,IAAI,aAAa;IAsB7E,qBAAqB,IAAI;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,aAAa,GAAG,WAAW,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;KACjB;CAOF;AAOD,wBAAgB,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAE7E;AAKD,eAAO,MAAM,wBAAwB,mBAA4B,CAAC"}

package/dist/config/account-encryption.js

@@ -0,0 +1,207 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultAccountEncryption = exports.AccountEncryptionImpl = void 0;
+exports.createAccountEncryption = createAccountEncryption;
+const crypto = __importStar(require("crypto"));
+const os = __importStar(require("os"));
+const ENCRYPTION_CONFIG = {
+    algorithm: 'aes-256-gcm',
+    keyLength: 32,
+    ivLength: 16,
+    authTagLength: 16,
+    keyDerivationIterations: 100000,
+    saltString: 'polyv-cli-security-salt-v1.0'
+};
+class AccountEncryptionImpl {
+    constructor(masterKey) {
+        const keyInfo = this.resolveEncryptionKey(masterKey);
+        this.encryptionKey = keyInfo.key;
+        this.keySource = keyInfo.source;
+    }
+    resolveEncryptionKey(providedKey) {
+        let keyString;
+        let source;
+        if (providedKey) {
+            keyString = providedKey;
+            source = 'environment';
+        }
+        else if (process.env['POLYV_MASTER_KEY']) {
+            keyString = process.env['POLYV_MASTER_KEY'];
+            source = 'environment';
+        }
+        else {
+            keyString = this.generateDefaultKey();
+            source = 'generated';
+        }
+        if (!this.validateKey(keyString)) {
+            throw new Error('Invalid encryption key. Key must be at least 16 characters long and contain mixed case letters and numbers.');
+        }
+        return {
+            key: this.deriveEncryptionKey(keyString),
+            source
+        };
+    }
+    generateDefaultKey() {
+        let username = 'unknown';
+        try {
+            const userInfo = os.userInfo();
+            username = userInfo && userInfo.username ? userInfo.username : 'unknown';
+        }
+        catch {
+            username = 'unknown';
+        }
+        const machineInfo = {
+            hostname: os.hostname(),
+            platform: os.platform(),
+            arch: os.arch(),
+            homedir: os.homedir(),
+            username
+        };
+        const hash = crypto.createHash('sha256');
+        hash.update(JSON.stringify(machineInfo));
+        hash.update('polyv-cli-default-key-v1.0');
+        return hash.digest('hex');
+    }
+    deriveEncryptionKey(masterKey) {
+        const salt = Buffer.from(ENCRYPTION_CONFIG.saltString, 'utf8');
+        return crypto.pbkdf2Sync(masterKey, salt, ENCRYPTION_CONFIG.keyDerivationIterations, ENCRYPTION_CONFIG.keyLength, 'sha256');
+    }
+    encrypt(plaintext) {
+        try {
+            const iv = crypto.randomBytes(ENCRYPTION_CONFIG.ivLength);
+            const cipher = crypto.createCipheriv(ENCRYPTION_CONFIG.algorithm, this.encryptionKey, iv);
+            let encrypted = cipher.update(plaintext, 'utf8');
+            encrypted = Buffer.concat([encrypted, cipher.final()]);
+            const authTag = cipher.getAuthTag();
+            return {
+                algorithm: ENCRYPTION_CONFIG.algorithm,
+                iv: iv.toString('base64'),
+                authTag: authTag.toString('base64'),
+                encrypted: encrypted.toString('base64')
+            };
+        }
+        catch (error) {
+            throw new Error(`Failed to encrypt account secret. Please check your encryption key and try again. ` +
+                `Error: ${error instanceof Error ? error.message : 'Unknown encryption error'}`);
+        }
+    }
+    decrypt(encryptedData) {
+        try {
+            if (encryptedData.algorithm !== ENCRYPTION_CONFIG.algorithm) {
+                throw new Error(`Unsupported encryption algorithm: ${encryptedData.algorithm}. Expected: ${ENCRYPTION_CONFIG.algorithm}`);
+            }
+            const iv = Buffer.from(encryptedData.iv, 'base64');
+            const authTag = Buffer.from(encryptedData.authTag, 'base64');
+            const encrypted = Buffer.from(encryptedData.encrypted, 'base64');
+            const decipher = crypto.createDecipheriv(ENCRYPTION_CONFIG.algorithm, this.encryptionKey, iv);
+            decipher.setAuthTag(authTag);
+            let decrypted = decipher.update(encrypted);
+            decrypted = Buffer.concat([decrypted, decipher.final()]);
+            return decrypted.toString('utf8');
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                const errorMessage = error.message.toLowerCase();
+                if (errorMessage.includes('bad decrypt') ||
+                    errorMessage.includes('unsupported state or unable to authenticate data') ||
+                    errorMessage.includes('invalid authentication tag') ||
+                    errorMessage.includes('authentication failed')) {
+                    throw new Error('Failed to decrypt account secret. This may be due to:\n' +
+                        '1. Incorrect encryption key (check POLYV_MASTER_KEY environment variable)\n' +
+                        '2. Corrupted configuration file\n' +
+                        '3. Configuration file created with different key\n\n' +
+                        'Try: polyv-cli config recover');
+                }
+            }
+            throw new Error(`Failed to decrypt account secret: ${error instanceof Error ? error.message : 'Unknown decryption error'}\n\n` +
+                'Try: polyv-cli config recover');
+        }
+    }
+    generateKey() {
+        const randomBytes = crypto.randomBytes(32);
+        return randomBytes.toString('hex');
+    }
+    validateKey(key) {
+        if (!key || typeof key !== 'string') {
+            return false;
+        }
+        if (key.length < 16) {
+            return false;
+        }
+        const hasLowerCase = /[a-z]/.test(key);
+        const hasUpperOrNumber = /[A-Z0-9]/.test(key);
+        return hasLowerCase && hasUpperOrNumber;
+    }
+    testEncryption(testData = 'test-secret-data-2024') {
+        try {
+            const encrypted = this.encrypt(testData);
+            const decrypted = this.decrypt(encrypted);
+            return decrypted === testData;
+        }
+        catch {
+            return false;
+        }
+    }
+    getKeySource() {
+        return this.keySource;
+    }
+    validateEncryptedData(encryptedData) {
+        if (!encryptedData || typeof encryptedData !== 'object') {
+            return false;
+        }
+        const data = encryptedData;
+        return (data['algorithm'] === ENCRYPTION_CONFIG.algorithm &&
+            typeof data['iv'] === 'string' &&
+            typeof data['authTag'] === 'string' &&
+            typeof data['encrypted'] === 'string' &&
+            data['iv'].length > 0 &&
+            data['authTag'].length > 0 &&
+            data['encrypted'].length > 0);
+    }
+    getEncryptionMetadata() {
+        return {
+            algorithm: ENCRYPTION_CONFIG.algorithm,
+            keySource: this.keySource,
+            version: '1.0'
+        };
+    }
+}
+exports.AccountEncryptionImpl = AccountEncryptionImpl;
+function createAccountEncryption(masterKey) {
+    return new AccountEncryptionImpl(masterKey);
+}
+exports.defaultAccountEncryption = createAccountEncryption();
+//# sourceMappingURL=account-encryption.js.map

package/dist/config/account-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-encryption.js","sourceRoot":"","sources":["../../src/config/account-encryption.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwWA,0DAEC;AA3VD,+CAAiC;AACjC,uCAAyB;AAmDzB,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,aAAsB;IACjC,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,EAAE;IACjB,uBAAuB,EAAE,MAAM;IAC/B,UAAU,EAAE,8BAA8B;CAClC,CAAC;AAKX,MAAa,qBAAqB;IAQhC,YAAY,SAAkB;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAClC,CAAC;IAOO,oBAAoB,CAAC,WAAoB;QAC/C,IAAI,SAAiB,CAAC;QACtB,IAAI,MAAmC,CAAC;QAExC,IAAI,WAAW,EAAE,CAAC;YAEhB,SAAS,GAAG,WAAW,CAAC;YACxB,MAAM,GAAG,aAAa,CAAC;QACzB,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAE3C,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC5C,MAAM,GAAG,aAAa,CAAC;QACzB,CAAC;aAAM,CAAC;YAEN,SAAS,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACtC,MAAM,GAAG,WAAW,CAAC;QACvB,CAAC;QAGD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;QACjI,CAAC;QAGD,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC;YACxC,MAAM;SACP,CAAC;IACJ,CAAC;IAMO,kBAAkB;QAExB,IAAI,QAAQ,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC/B,QAAQ,GAAG,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QAED,MAAM,WAAW,GAAG;YAClB,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;YACvB,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;YACvB,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;YACf,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE;YACrB,QAAQ;SACT,CAAC;QAGF,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAE1C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAOO,mBAAmB,CAAC,SAAiB;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,UAAU,CACtB,SAAS,EACT,IAAI,EACJ,iBAAiB,CAAC,uBAAuB,EACzC,iBAAiB,CAAC,SAAS,EAC3B,QAAQ,CACT,CAAC;IACJ,CAAC;IAQM,OAAO,CAAC,SAAiB;QAC9B,IAAI,CAAC;YAEH,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAG1D,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAG1F,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACjD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAGvD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAEpC,OAAO;gBACL,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACzB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACnC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACxC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oFAAoF;gBACpF,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAQM,OAAO,CAAC,aAA4B;QACzC,IAAI,CAAC;YAEH,IAAI,aAAa,CAAC,SAAS,KAAK,iBAAiB,CAAC,SAAS,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,qCAAqC,aAAa,CAAC,SAAS,eAAe,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;YAC5H,CAAC;YAGD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAGjE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC9F,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAG7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3C,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAEzD,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACjD,IAAI,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;oBACpC,YAAY,CAAC,QAAQ,CAAC,kDAAkD,CAAC;oBACzE,YAAY,CAAC,QAAQ,CAAC,4BAA4B,CAAC;oBACnD,YAAY,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CACb,yDAAyD;wBACzD,6EAA6E;wBAC7E,mCAAmC;wBACnC,sDAAsD;wBACtD,+BAA+B,CAChC,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,MAAM;gBAC9G,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAMM,WAAW;QAEhB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3C,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAOM,WAAW,CAAC,GAAW;QAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE9C,OAAO,YAAY,IAAI,gBAAgB,CAAC;IAC1C,CAAC;IAOM,cAAc,CAAC,WAAmB,uBAAuB;QAC9D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,SAAS,KAAK,QAAQ,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAMM,YAAY;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAOM,qBAAqB,CAAC,aAAsB;QACjD,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,aAAwC,CAAC;QAEtD,OAAO,CACL,IAAI,CAAC,WAAW,CAAC,KAAK,iBAAiB,CAAC,SAAS;YACjD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ;YAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ;YACnC,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ;YACrC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YACrB,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;YAC1B,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAC7B,CAAC;IACJ,CAAC;IAMM,qBAAqB;QAK1B,OAAO;YACL,SAAS,EAAE,iBAAiB,CAAC,SAAS;YACtC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;CACF;AAlRD,sDAkRC;AAOD,SAAgB,uBAAuB,CAAC,SAAkB;IACxD,OAAO,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;AAC9C,CAAC;AAKY,QAAA,wBAAwB,GAAG,uBAAuB,EAAE,CAAC"}

package/dist/config/auth-adapter.d.ts

@@ -0,0 +1,23 @@
+import { AuthConfig } from '../types/auth';
+import { AuthenticationProvider } from '../types/auth-source.types';
+export declare class AuthenticationAdapter {
+    private authProvider;
+    constructor(authProvider?: AuthenticationProvider);
+    getAuthConfig(options?: Record<string, unknown>): AuthConfig;
+    tryGetAuthConfig(options?: Record<string, unknown>): {
+        config: AuthConfig;
+        source: string;
+        accountName?: string;
+    } | null;
+    isAuthenticationAvailable(options?: Record<string, unknown>): boolean;
+    getStatusMessage(options?: Record<string, unknown>): string;
+    getDiagnostics(options?: Record<string, unknown>): {
+        availableSources: import("../types/auth-source.types").AuthenticationSource[];
+        selectedSource?: import("../types/auth-source.types").AuthenticationSource;
+        errors: string[];
+        warnings: string[];
+        suggestions: string[];
+    };
+}
+export declare const authAdapter: AuthenticationAdapter;
+//# sourceMappingURL=auth-adapter.d.ts.map

package/dist/config/auth-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-adapter.d.ts","sourceRoot":"","sources":["../../src/config/auth-adapter.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAQpE,qBAAa,qBAAqB;IAChC,OAAO,CAAC,YAAY,CAAyB;gBAEjC,YAAY,CAAC,EAAE,sBAAsB;IAU1C,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU;IAoB5D,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAC1D,MAAM,EAAE,UAAU,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,IAAI;IAuBD,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IASrE,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAS3D,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;CAGxD;AAKD,eAAO,MAAM,WAAW,uBAA8B,CAAC"}

package/dist/config/auth-adapter.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authAdapter = exports.AuthenticationAdapter = void 0;
+const auth_provider_1 = require("./auth-provider");
+const errors_1 = require("../utils/errors");
+class AuthenticationAdapter {
+    constructor(authProvider) {
+        this.authProvider = authProvider || new auth_provider_1.DefaultAuthenticationProvider();
+    }
+    getAuthConfig(options) {
+        const credentials = this.authProvider.getCredentials(options);
+        if (!credentials) {
+            const statusMessage = this.authProvider.getStatusMessage(options);
+            throw new errors_1.ConfigurationError(statusMessage);
+        }
+        return {
+            appId: credentials.appId,
+            appSecret: credentials.appSecret,
+            ...(credentials.userId && { userId: credentials.userId }),
+        };
+    }
+    tryGetAuthConfig(options) {
+        const context = this.authProvider.getAuthenticationContext(options);
+        if (!context) {
+            return null;
+        }
+        return {
+            config: {
+                appId: context.credentials.appId,
+                appSecret: context.credentials.appSecret,
+                ...(context.credentials.userId && { userId: context.credentials.userId }),
+            },
+            source: context.source.metadata.source,
+            ...(context.source.metadata.accountName && { accountName: context.source.metadata.accountName }),
+        };
+    }
+    isAuthenticationAvailable(options) {
+        return this.authProvider.getCredentials(options) !== null;
+    }
+    getStatusMessage(options) {
+        return this.authProvider.getStatusMessage(options);
+    }
+    getDiagnostics(options) {
+        return this.authProvider.getDiagnostics(options);
+    }
+}
+exports.AuthenticationAdapter = AuthenticationAdapter;
+exports.authAdapter = new AuthenticationAdapter();
+//# sourceMappingURL=auth-adapter.js.map

package/dist/config/auth-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-adapter.js","sourceRoot":"","sources":["../../src/config/auth-adapter.ts"],"names":[],"mappings":";;;AAMA,mDAAgE;AAChE,4CAAqD;AAMrD,MAAa,qBAAqB;IAGhC,YAAY,YAAqC;QAC/C,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,6CAA6B,EAAE,CAAC;IAC1E,CAAC;IAQM,aAAa,CAAC,OAAiC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAE9D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,IAAI,2BAAkB,CAAC,aAAa,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAOM,gBAAgB,CAAC,OAAiC;QAKvD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,MAAM,EAAE;gBACN,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK;gBAChC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS;gBACxC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;aAC1E;YACD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;YACtC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;SACjG,CAAC;IACJ,CAAC;IAOM,yBAAyB,CAAC,OAAiC;QAChE,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAC5D,CAAC;IAOM,gBAAgB,CAAC,OAAiC;QACvD,OAAO,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IAOM,cAAc,CAAC,OAAiC;QACrD,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAjFD,sDAiFC;AAKY,QAAA,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC"}

package/dist/config/auth-provider.d.ts

@@ -0,0 +1,27 @@
+import { AuthenticationProvider, AuthenticationContext, AuthenticationSource } from '../types/auth-source.types';
+import { SessionStateManager } from './session-state';
+import { AccountConfigManager } from './account-config';
+export declare class DefaultAuthenticationProvider implements AuthenticationProvider {
+    private sourceManager;
+    constructor(sessionManager?: SessionStateManager, accountManager?: AccountConfigManager);
+    getAuthenticationContext(options?: Record<string, unknown>): AuthenticationContext | null;
+    getCredentials(options?: Record<string, unknown>): {
+        appId: string;
+        appSecret: string;
+        userId?: string;
+    } | null;
+    getCurrentSource(options?: Record<string, unknown>): AuthenticationSource | null;
+    validateAuthentication(source: AuthenticationSource): boolean;
+    getStatusMessage(options?: Record<string, unknown>): string;
+    getDiagnostics(options?: Record<string, unknown>): {
+        availableSources: AuthenticationSource[];
+        selectedSource?: AuthenticationSource;
+        errors: string[];
+        warnings: string[];
+        suggestions: string[];
+    };
+    getSourceByType(type: string, options?: Record<string, unknown>): AuthenticationSource | null;
+    isSourceAvailable(type: string, options?: Record<string, unknown>): boolean;
+}
+export declare const authProvider: DefaultAuthenticationProvider;
+//# sourceMappingURL=auth-provider.d.ts.map

package/dist/config/auth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../../src/config/auth-provider.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAKxD,qBAAa,6BAA8B,YAAW,sBAAsB;IAC1E,OAAO,CAAC,aAAa,CAA8B;gBAGjD,cAAc,CAAC,EAAE,mBAAmB,EACpC,cAAc,CAAC,EAAE,oBAAoB;IAUhC,wBAAwB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,qBAAqB,GAAG,IAAI;IA6BzF,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QACxD,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI;IASD,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,oBAAoB,GAAG,IAAI;IAShF,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO;IAS7D,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAS3D,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QACxD,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;QACzC,cAAc,CAAC,EAAE,oBAAoB,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB;IAUM,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,oBAAoB,GAAG,IAAI;IAU7F,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;CAGnF;AAKD,eAAO,MAAM,YAAY,+BAAsC,CAAC"}

package/dist/config/auth-provider.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authProvider = exports.DefaultAuthenticationProvider = void 0;
+const auth_source_manager_1 = require("./auth-source-manager");
+class DefaultAuthenticationProvider {
+    constructor(sessionManager, accountManager) {
+        this.sourceManager = new auth_source_manager_1.AuthenticationSourceManager(sessionManager, accountManager);
+    }
+    getAuthenticationContext(options) {
+        const diagnostics = this.sourceManager.getDiagnostics(options);
+        const selectedSource = diagnostics.selectedSource;
+        if (!selectedSource || !this.sourceManager.isCompleteAuthentication(selectedSource)) {
+            return null;
+        }
+        return {
+            source: selectedSource,
+            credentials: {
+                appId: selectedSource.appId,
+                appSecret: selectedSource.appSecret,
+                ...(selectedSource.userId && { userId: selectedSource.userId }),
+            },
+            diagnostics: {
+                attemptedSources: diagnostics.availableSources.map(s => s.metadata.source),
+                selectedReason: `优先级最高的完整认证源 (优先级 ${selectedSource.priority})`,
+                warnings: diagnostics.warnings,
+                isComplete: true,
+            },
+        };
+    }
+    getCredentials(options) {
+        return this.sourceManager.getCredentials(options);
+    }
+    getCurrentSource(options) {
+        return this.sourceManager.getAuthenticationSource(options);
+    }
+    validateAuthentication(source) {
+        return this.sourceManager.isCompleteAuthentication(source);
+    }
+    getStatusMessage(options) {
+        return this.sourceManager.getStatusMessage(options);
+    }
+    getDiagnostics(options) {
+        return this.sourceManager.getDiagnostics(options);
+    }
+    getSourceByType(type, options) {
+        return this.sourceManager.getSourceByType(type, options);
+    }
+    isSourceAvailable(type, options) {
+        return this.sourceManager.isSourceAvailable(type, options);
+    }
+}
+exports.DefaultAuthenticationProvider = DefaultAuthenticationProvider;
+exports.authProvider = new DefaultAuthenticationProvider();
+//# sourceMappingURL=auth-provider.js.map

package/dist/config/auth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/config/auth-provider.ts"],"names":[],"mappings":";;;AASA,+DAAoE;AAOpE,MAAa,6BAA6B;IAGxC,YACE,cAAoC,EACpC,cAAqC;QAErC,IAAI,CAAC,aAAa,GAAG,IAAI,iDAA2B,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACvF,CAAC;IAOM,wBAAwB,CAAC,OAAiC;QAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,WAAW,CAAC,cAAc,CAAC;QAElD,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,WAAW,EAAE;gBACX,KAAK,EAAE,cAAc,CAAC,KAAM;gBAC5B,SAAS,EAAE,cAAc,CAAC,SAAU;gBACpC,GAAG,CAAC,cAAc,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;aAChE;YACD,WAAW,EAAE;gBACX,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC1E,cAAc,EAAE,oBAAoB,cAAc,CAAC,QAAQ,GAAG;gBAC9D,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,UAAU,EAAE,IAAI;aACjB;SACF,CAAC;IACJ,CAAC;IAOM,cAAc,CAAC,OAAiC;QAKrD,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAOM,gBAAgB,CAAC,OAAiC;QACvD,OAAO,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAOM,sBAAsB,CAAC,MAA4B;QACxD,OAAO,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IAOM,gBAAgB,CAAC,OAAiC;QACvD,OAAO,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAOM,cAAc,CAAC,OAAiC;QAOrD,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAQM,eAAe,CAAC,IAAY,EAAE,OAAiC;QACpE,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAW,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAQM,iBAAiB,CAAC,IAAY,EAAE,OAAiC;QACtE,OAAO,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAW,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;CACF;AAjHD,sEAiHC;AAKY,QAAA,YAAY,GAAG,IAAI,6BAA6B,EAAE,CAAC"}

package/dist/config/auth-source-manager.d.ts

@@ -0,0 +1,61 @@
+import { AuthenticationSource, AuthenticationSourceType, AuthenticationSourceDetector } from '../types/auth-source.types';
+import { SessionStateManager } from './session-state';
+import { AccountConfigManager } from './account-config';
+export declare class CommandLineAuthDetector implements AuthenticationSourceDetector {
+    readonly type: AuthenticationSourceType;
+    readonly priority: number;
+    detect(options?: Record<string, unknown>): AuthenticationSource | null;
+    isAvailable(options?: Record<string, unknown>): boolean;
+}
+export declare class SessionAuthDetector implements AuthenticationSourceDetector {
+    readonly type: AuthenticationSourceType;
+    readonly priority: number;
+    private sessionManager;
+    private accountManager;
+    constructor(sessionManager?: SessionStateManager, accountManager?: AccountConfigManager);
+    detect(_options?: Record<string, unknown>): AuthenticationSource | null;
+    isAvailable(options?: Record<string, unknown>): boolean;
+}
+export declare class DefaultAccountAuthDetector implements AuthenticationSourceDetector {
+    readonly type: AuthenticationSourceType;
+    readonly priority: number;
+    private accountManager;
+    constructor(accountManager?: AccountConfigManager);
+    detect(_options?: Record<string, unknown>): AuthenticationSource | null;
+    isAvailable(options?: Record<string, unknown>): boolean;
+}
+export declare class EnvironmentAuthDetector implements AuthenticationSourceDetector {
+    readonly type: AuthenticationSourceType;
+    readonly priority: number;
+    detect(_options?: Record<string, unknown>): AuthenticationSource | null;
+    isAvailable(options?: Record<string, unknown>): boolean;
+}
+export declare class ConfigAuthDetector implements AuthenticationSourceDetector {
+    readonly type: AuthenticationSourceType;
+    readonly priority: number;
+    detect(_options?: Record<string, unknown>): AuthenticationSource | null;
+    isAvailable(options?: Record<string, unknown>): boolean;
+}
+export declare class AuthenticationSourceManager {
+    private detectors;
+    constructor(sessionManager?: SessionStateManager, accountManager?: AccountConfigManager);
+    getAvailableSources(options?: Record<string, unknown>): AuthenticationSource[];
+    getAuthenticationSource(options?: Record<string, unknown>): AuthenticationSource | null;
+    isCompleteAuthentication(source: AuthenticationSource): boolean;
+    getCredentials(options?: Record<string, unknown>): {
+        appId: string;
+        appSecret: string;
+        userId?: string;
+    } | null;
+    getDiagnostics(options?: Record<string, unknown>): {
+        availableSources: AuthenticationSource[];
+        selectedSource?: AuthenticationSource;
+        errors: string[];
+        warnings: string[];
+        suggestions: string[];
+    };
+    getStatusMessage(options?: Record<string, unknown>): string;
+    getSourceByType(type: AuthenticationSourceType, options?: Record<string, unknown>): AuthenticationSource | null;
+    isSourceAvailable(type: AuthenticationSourceType, options?: Record<string, unknown>): boolean;
+}
+//# sourceMappingURL=auth-source-manager.d.ts.map