sideby 0.0.0-stage → 0.2.1

package/dist/src/core/doctor.js

@@ -0,0 +1,171 @@
+import { readdir } from 'node:fs/promises';
+import { looksLikeBackup, mainDirOf } from './accounts.js';
+import { lstatOrNull, permBits, statOrNull } from './fs-safe.js';
+import { inspectSecretFile } from './secret-file.js';
+import { checkItem, credentialModeFinding, itemPaths } from './share-modes.js';
+import { checkInstalledSkills } from './skill-check.js';
+const BACKUP_ENTRY = /(\.bak|backup|\.tmp)/i;
+const BACKUP_DIRS = new Set(['backups', 'tmp', '.tmp']);
+async function countBackups(dir) {
+    try {
+        return (await readdir(dir)).filter((e) => BACKUP_ENTRY.test(e) && !BACKUP_DIRS.has(e)).length;
+    }
+    catch {
+        return 0;
+    }
+}
+function toFinding(r, account, source) {
+    return { ...r, account, source, fixable: Boolean(r.fixable && r.fix) };
+}
+async function checkAccount(input, family, account) {
+    const findings = [];
+    let okCount = 0;
+    let total = 0;
+    const mainDir = mainDirOf(family, input.home);
+    const items = [...family.sharedItems];
+    if (!account.isMain) {
+        for (const item of items) {
+            const { mainPath, accountPath } = itemPaths(input.home, mainDir, account.dir, item);
+            const res = await checkItem({
+                account,
+                item,
+                mainPath,
+                accountPath,
+                accountDir: account.dir,
+                force: Boolean(input.force),
+            });
+            if (res.counted) {
+                total++;
+                if (res.results[0]?.level === 'ok')
+                    okCount++;
+            }
+            for (const r of res.results)
+                if (r.level !== 'ok')
+                    findings.push(toFinding(r, account.ref, 'core'));
+        }
+        if (looksLikeBackup(account.name))
+            findings.push({
+                level: 'warn',
+                account: account.ref,
+                item: 'name',
+                code: 'name.backup-like',
+                message: `${account.ref} looks like a backup, not an account`,
+                hint: `if it is a backup, add "${account.ref}" to "ignore" in the sideby config`,
+                source: 'core',
+                fixable: false,
+            });
+    }
+    else {
+        // The Main Account is the source of sharing; only its credential files are checked.
+        for (const item of items.filter((i) => i.credential)) {
+            const { mainPath } = itemPaths(input.home, mainDir, account.dir, item);
+            const st = await lstatOrNull(mainPath);
+            if (st?.isFile() && permBits(st) !== 0o600)
+                findings.push(toFinding(credentialModeFinding(item.mainPath ?? item.path, mainPath, permBits(st)), account.ref, 'core'));
+        }
+    }
+    if (account.secretFile) {
+        const state = await inspectSecretFile(account.secretFile);
+        if (state.kind === 'not-file')
+            findings.push({
+                level: 'fail',
+                account: account.ref,
+                item: 'proxy.env',
+                code: 'secret.not-file',
+                message: 'proxy.env must be a regular file, not a link or directory',
+                source: 'core',
+                fixable: false,
+            });
+        else if (state.kind === 'mode')
+            findings.push(toFinding(credentialModeFinding('proxy.env', account.secretFile, state.mode), account.ref, 'core'));
+    }
+    for (const r of await input.bus.runIsolated('doctor.check', family.id, {
+        account,
+        family,
+        config: {},
+    })) {
+        if (r.error) {
+            findings.push({
+                level: 'fail',
+                account: account.ref,
+                item: 'plugin',
+                code: 'plugin.error',
+                message: r.error.message,
+                source: r.plugin,
+                fixable: false,
+            });
+            continue;
+        }
+        const results = r.result ?? [];
+        if (!Array.isArray(results)) {
+            findings.push({
+                level: 'fail',
+                account: account.ref,
+                item: 'plugin',
+                code: 'plugin.error',
+                message: `[${r.plugin}] doctor.check must return an array of findings`,
+                source: r.plugin,
+                fixable: false,
+            });
+            continue;
+        }
+        for (const c of results)
+            if (c?.level !== 'ok')
+                findings.push(toFinding(c, account.ref, r.plugin));
+    }
+    return {
+        ref: account.ref,
+        family: account.family,
+        name: account.name,
+        kind: account.kind,
+        dir: account.dir,
+        shared: { ok: okCount, total },
+        backups: await countBackups(account.dir),
+        findings,
+    };
+}
+export async function runDoctor(input) {
+    const accounts = [];
+    const general = [];
+    for (const family of input.families.values()) {
+        const list = input.accounts.filter((a) => a.family === family.id);
+        if (list.length === 0)
+            continue;
+        if (!list.some((a) => a.isMain) && !(await statOrNull(mainDirOf(family, input.home)))?.isDirectory())
+            general.push({
+                level: 'fail',
+                account: `${family.id}:main`,
+                item: 'main',
+                code: 'main.missing',
+                message: `${family.title} has accounts but no main account directory to share from`,
+                hint: `run ${family.bin} once so it creates its default directory`,
+                source: 'core',
+                fixable: false,
+            });
+        for (const account of list)
+            accounts.push(await checkAccount(input, family, account));
+    }
+    if (input.skillVersion) {
+        const checked = [...input.families.values()].filter((f) => input.accounts.some((a) => a.family === f.id));
+        general.push(...(await checkInstalledSkills(input.home, checked, input.skillVersion)));
+    }
+    const failed = [...general, ...accounts.flatMap((a) => a.findings)].some((f) => f.level === 'fail');
+    return { status: failed ? 'issues' : 'ok', accounts, general, fixes: [] };
+}
+/** Applies every fixable Finding once, in order; one failing fix never stops the others. */
+export async function applyFixes(report) {
+    const out = [];
+    for (const f of report.accounts.flatMap((a) => a.findings)) {
+        if (!f.fixable || !f.fix)
+            continue;
+        let res;
+        try {
+            res = await f.fix();
+        }
+        catch (err) {
+            res = { ok: false, message: err.message };
+        }
+        out.push({ account: f.account, item: f.item, code: f.code, ...res });
+    }
+    return out;
+}

package/dist/src/core/errors.d.ts

@@ -0,0 +1,12 @@
+/**
+ * An error caused by what the user asked for or has on disk (unknown account, broken config, invalid name),
+ * as opposed to a bug. Adapters map it without a stack: the CLI exits 1, the Panel answers 400.
+ * Command-line shape errors (`UsageError`, exit 2) are deliberately not UserErrors.
+ */
+export declare class UserError extends Error {
+    /** Machine-readable reason, such as `create-refused`; the Panel passes it to the page. */
+    readonly code?: string;
+    constructor(message: string, opts?: {
+        code?: string;
+    });
+}

package/dist/src/core/errors.js

@@ -0,0 +1,14 @@
+/**
+ * An error caused by what the user asked for or has on disk (unknown account, broken config, invalid name),
+ * as opposed to a bug. Adapters map it without a stack: the CLI exits 1, the Panel answers 400.
+ * Command-line shape errors (`UsageError`, exit 2) are deliberately not UserErrors.
+ */
+export class UserError extends Error {
+    /** Machine-readable reason, such as `create-refused`; the Panel passes it to the page. */
+    code;
+    constructor(message, opts = {}) {
+        super(message);
+        if (opts.code)
+            this.code = opts.code;
+    }
+}

package/dist/src/core/file-memo.d.ts

@@ -0,0 +1,24 @@
+import type { Stats } from 'node:fs';
+/** The parts of `fs.Stats` that tell whether a file changed. */
+export type FileStats = Pick<Stats, 'size' | 'mtimeMs' | 'ctimeMs' | 'ino'>;
+export declare function fileSignature(st: FileStats): string;
+/** One pass over a scope's files. Files the pass does not ask for are forgotten when it ends. */
+export interface MemoPass<T> {
+    /** The remembered value for this file version, or `parse()` (remembered unless `keep` says no). */
+    get(path: string, st: FileStats, parse: () => Promise<T>, keep?: (value: T) => boolean): Promise<T>;
+    /** Ends the pass: the scope now holds only the files this pass asked for. */
+    done(): void;
+}
+export declare class FileMemo<T> {
+    #private;
+    /** Counters for tests and timing. */
+    readonly stats: {
+        hits: number;
+        misses: number;
+    };
+    /** Starts a pass over `scope`, such as one Account's directory. */
+    pass(scope: string): MemoPass<T>;
+    /** Files remembered for a scope (for tests). */
+    size(scope: string): number;
+    clear(): void;
+}

package/dist/src/core/file-memo.js

@@ -0,0 +1,41 @@
+export function fileSignature(st) {
+    return `${st.size}:${st.mtimeMs}:${st.ctimeMs}:${st.ino}`;
+}
+export class FileMemo {
+    #scopes = new Map();
+    /** Counters for tests and timing. */
+    stats = { hits: 0, misses: 0 };
+    /** Starts a pass over `scope`, such as one Account's directory. */
+    pass(scope) {
+        const before = this.#scopes.get(scope);
+        const seen = new Map();
+        return {
+            get: async (path, st, parse, keep) => {
+                const sig = fileSignature(st);
+                const hit = seen.get(path) ?? before?.get(path);
+                if (hit && hit.sig === sig) {
+                    this.stats.hits++;
+                    seen.set(path, hit);
+                    return hit.value;
+                }
+                this.stats.misses++;
+                const value = await parse();
+                if (!keep || keep(value))
+                    seen.set(path, { sig, value });
+                return value;
+            },
+            done: () => {
+                this.#scopes.set(scope, seen);
+            },
+        };
+    }
+    /** Files remembered for a scope (for tests). */
+    size(scope) {
+        return this.#scopes.get(scope)?.size ?? 0;
+    }
+    clear() {
+        this.#scopes.clear();
+        this.stats.hits = 0;
+        this.stats.misses = 0;
+    }
+}

package/dist/src/core/fs-safe.d.ts

@@ -0,0 +1,38 @@
+import type { Stats } from 'node:fs';
+export declare function lstatOrNull(p: string): Promise<Stats | null>;
+export declare function statOrNull(p: string): Promise<Stats | null>;
+export declare function realpathOrNull(p: string): Promise<string | null>;
+/** True when `link` is a symlink whose resolved target is the same file as `target`. */
+export declare function linksTo(link: string, target: string): Promise<boolean>;
+export declare function sha256(data: string | Uint8Array): string;
+export declare function fileHash(p: string): Promise<string | null>;
+/**
+ * Writes via a temp file in the same directory, fsyncs, then renames over `path`.
+ * Refuses to write when `path` is a symlink so a write can never pass through a link into another directory.
+ */
+export declare function writeFileAtomic(path: string, data: string | Uint8Array, mode?: number, 
+/** Checked after the temp file is complete, right before the rename; false aborts and keeps `path`. */
+beforeRename?: () => Promise<boolean>): Promise<boolean>;
+/**
+ * Writes only if the file still has `expectedHash` (null = must not exist), checking both before writing and
+ * again right before the rename. This narrows, but cannot close, the window in which another program (for
+ * example the Host saving the same file) could write in between: plain files offer no compare-and-swap.
+ */
+export declare function writeIfUnchanged(path: string, expectedHash: string | null, data: string | Uint8Array, mode?: number): Promise<boolean>;
+/**
+ * Throws unless `target` stays inside `root` both by name (no `..`) and on disk (no parent directory that is a
+ * symlink leading elsewhere), so a repair can never write into another Account or the Main Account.
+ */
+export declare function assertInside(root: string, target: string): Promise<void>;
+/** JSON.parse whose error never quotes the input: parse errors from Node include a slice of the text. */
+export declare function parseJsonSafely(text: string, label: string): unknown;
+/** Recursive comparison of files, directories and symlink targets. Modes and times are ignored. */
+export declare function sameContent(a: string, b: string): Promise<boolean>;
+/**
+ * Copies `src` (resolving it if it is a symlink) to `dst`, keeping modes, hidden files and nested symlinks.
+ * Builds the copy beside `dst` and swaps it in, so a failure leaves the old `dst` untouched.
+ * Refuses when `dst` is a symlink: callers must remove links explicitly.
+ */
+export declare function replaceWithCopy(src: string, dst: string): Promise<void>;
+export declare function isEmptyDir(p: string): Promise<boolean>;
+export declare function permBits(st: Stats): number;

package/dist/src/core/fs-safe.js

@@ -0,0 +1,205 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { cp, lstat, open, readdir, readFile, readlink, realpath, rename, rm, stat } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, sep } from 'node:path';
+export async function lstatOrNull(p) {
+    try {
+        return await lstat(p);
+    }
+    catch {
+        return null;
+    }
+}
+export async function statOrNull(p) {
+    try {
+        return await stat(p);
+    }
+    catch {
+        return null;
+    }
+}
+export async function realpathOrNull(p) {
+    try {
+        return await realpath(p);
+    }
+    catch {
+        return null;
+    }
+}
+/** True when `link` is a symlink whose resolved target is the same file as `target`. */
+export async function linksTo(link, target) {
+    const st = await lstatOrNull(link);
+    if (!st?.isSymbolicLink())
+        return false;
+    const [a, b] = await Promise.all([realpathOrNull(link), realpathOrNull(target)]);
+    return a !== null && a === b;
+}
+export function sha256(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+export async function fileHash(p) {
+    try {
+        return sha256(await readFile(p));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Writes via a temp file in the same directory, fsyncs, then renames over `path`.
+ * Refuses to write when `path` is a symlink so a write can never pass through a link into another directory.
+ */
+export async function writeFileAtomic(path, data, mode = 0o600, 
+/** Checked after the temp file is complete, right before the rename; false aborts and keeps `path`. */
+beforeRename) {
+    const existing = await lstatOrNull(path);
+    if (existing?.isSymbolicLink())
+        throw new Error(`refusing to write through a symlink: ${path}`);
+    const tmp = join(dirname(path), `.${basename(path)}.sideby-${randomBytes(6).toString('hex')}.tmp`);
+    const fh = await open(tmp, 'wx', mode);
+    try {
+        await fh.writeFile(data);
+        // Set the final mode before the rename (open's mode is reduced by the umask), so nothing can fail
+        // after the target has been replaced.
+        await fh.chmod(mode);
+        await fh.sync();
+    }
+    catch (err) {
+        await fh.close();
+        await rm(tmp, { force: true });
+        throw err;
+    }
+    await fh.close();
+    try {
+        if (beforeRename && !(await beforeRename())) {
+            await rm(tmp, { force: true });
+            return false;
+        }
+        await rename(tmp, path);
+        return true;
+    }
+    catch (err) {
+        await rm(tmp, { force: true });
+        throw err;
+    }
+}
+/**
+ * Writes only if the file still has `expectedHash` (null = must not exist), checking both before writing and
+ * again right before the rename. This narrows, but cannot close, the window in which another program (for
+ * example the Host saving the same file) could write in between: plain files offer no compare-and-swap.
+ */
+export async function writeIfUnchanged(path, expectedHash, data, mode = 0o600) {
+    if ((await fileHash(path)) !== expectedHash)
+        return false;
+    return writeFileAtomic(path, data, mode, async () => (await fileHash(path)) === expectedHash);
+}
+/**
+ * Throws unless `target` stays inside `root` both by name (no `..`) and on disk (no parent directory that is a
+ * symlink leading elsewhere), so a repair can never write into another Account or the Main Account.
+ */
+export async function assertInside(root, target) {
+    const rel = relative(root, target);
+    if (rel === '' || rel.startsWith('..') || isAbsolute(rel))
+        throw new Error(`refusing to write outside the account directory: ${target}`);
+    const rootReal = (await realpathOrNull(root)) ?? root;
+    let dir = dirname(target);
+    while (!(await lstatOrNull(dir))) {
+        const up = dirname(dir);
+        if (up === dir)
+            break;
+        dir = up;
+    }
+    const real = (await realpathOrNull(dir)) ?? dir;
+    if (real !== rootReal && !real.startsWith(`${rootReal}${sep}`))
+        throw new Error(`refusing to write outside the account directory: ${target} (a parent directory is a link)`);
+}
+/** JSON.parse whose error never quotes the input: parse errors from Node include a slice of the text. */
+export function parseJsonSafely(text, label) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${label} is not valid JSON`);
+    }
+}
+/** Recursive comparison of files, directories and symlink targets. Modes and times are ignored. */
+export async function sameContent(a, b) {
+    const [sa, sb] = await Promise.all([lstatOrNull(a), lstatOrNull(b)]);
+    if (!sa || !sb)
+        return false;
+    if (sa.isSymbolicLink() || sb.isSymbolicLink()) {
+        if (!(sa.isSymbolicLink() && sb.isSymbolicLink()))
+            return false;
+        return (await readlink(a)) === (await readlink(b));
+    }
+    if (sa.isFile() && sb.isFile()) {
+        if (sa.size !== sb.size)
+            return false;
+        const [ba, bb] = await Promise.all([readFile(a), readFile(b)]);
+        return ba.equals(bb);
+    }
+    if (sa.isDirectory() && sb.isDirectory()) {
+        const [ea, eb] = await Promise.all([readdir(a), readdir(b)]);
+        if (ea.length !== eb.length)
+            return false;
+        ea.sort();
+        eb.sort();
+        for (let i = 0; i < ea.length; i++) {
+            if (ea[i] !== eb[i])
+                return false;
+            if (!(await sameContent(join(a, ea[i]), join(b, eb[i]))))
+                return false;
+        }
+        return true;
+    }
+    return false;
+}
+/**
+ * Copies `src` (resolving it if it is a symlink) to `dst`, keeping modes, hidden files and nested symlinks.
+ * Builds the copy beside `dst` and swaps it in, so a failure leaves the old `dst` untouched.
+ * Refuses when `dst` is a symlink: callers must remove links explicitly.
+ */
+export async function replaceWithCopy(src, dst) {
+    const existing = await lstatOrNull(dst);
+    if (existing?.isSymbolicLink())
+        throw new Error(`refusing to copy over a symlink: ${dst}`);
+    const source = (await realpathOrNull(src)) ?? src;
+    const tmp = join(dirname(dst), `.${basename(dst)}.sideby-${randomBytes(6).toString('hex')}.tmp`);
+    try {
+        await cp(source, tmp, {
+            recursive: true,
+            verbatimSymlinks: true,
+            preserveTimestamps: true,
+            errorOnExist: true,
+        });
+    }
+    catch (err) {
+        await rm(tmp, { recursive: true, force: true });
+        throw err;
+    }
+    if (!existing) {
+        await rename(tmp, dst);
+        return;
+    }
+    const old = `${tmp}.old`;
+    await rename(dst, old);
+    try {
+        await rename(tmp, dst);
+    }
+    catch (err) {
+        await rename(old, dst);
+        await rm(tmp, { recursive: true, force: true });
+        throw err;
+    }
+    await rm(old, { recursive: true, force: true });
+}
+export async function isEmptyDir(p) {
+    try {
+        return (await readdir(p)).length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function permBits(st) {
+    return st.mode & 0o777;
+}

package/dist/src/core/handoff.d.ts

@@ -0,0 +1,41 @@
+import type { Account, LoginState, QuotaResult } from '../types.ts';
+export type HandoffState = 'ready' | 'unknown' | 'api' | 'full' | 'logged-out';
+export interface HandoffCandidate {
+    ref: string;
+    name: string;
+    isMain: boolean;
+    kind: Account['kind'];
+    login: LoginState | 'not-needed';
+    quota: QuotaResult;
+}
+export interface HandoffEntry {
+    ref: string;
+    kind: Account['kind'];
+    state: HandoffState;
+    /** Quota Pressure in percent; null when the Account has no Quota. */
+    pressure: number | null;
+    /** For `full`: when the last full window resets, so the Account is usable again. */
+    resetsAt?: string;
+    /** When the Quota was recorded; it is only as fresh as the Account's last session. */
+    observedAt?: string;
+}
+export interface HandoffPlan {
+    family: string;
+    /** The recommended Account, or null when none can be used now. */
+    pick: string | null;
+    /** Every Account, best first; the ones that cannot be picked come last. */
+    accounts: HandoffEntry[];
+    /**
+     * Whether any Account has Quota data. Without any, the pick is only a guess (often the Account that just ran
+     * out), so `sideby next` does not start it and the Panel shows no recommendation.
+     */
+    hasQuota: boolean;
+    /** Set when nothing can be picked and some Accounts are full: the first to come back. */
+    earliestReset?: {
+        ref: string;
+        at: string;
+    };
+}
+export declare function planHandoff(family: string, candidates: readonly HandoffCandidate[], now: Date, opts?: {
+    includeApi?: boolean;
+}): HandoffPlan;

package/dist/src/core/handoff.js

@@ -0,0 +1,54 @@
+import { QUOTA_FAIL_PERCENT, quotaPressure, windowReset } from './quota-levels.js';
+const ORDER = { ready: 0, unknown: 1, api: 2, full: 3, 'logged-out': 4 };
+/** A full Account without a readable reset time sorts after every one that has one. */
+const resetTime = (e) => (e.resetsAt ? Date.parse(e.resetsAt) : Number.POSITIVE_INFINITY);
+function entry(c, now) {
+    const pressure = quotaPressure(c.quota, now);
+    const base = {
+        ref: c.ref,
+        kind: c.kind,
+        pressure,
+        ...(c.quota.status === 'ok' ? { observedAt: c.quota.observedAt } : {}),
+    };
+    if (c.kind === 'api')
+        return { ...base, state: 'api' };
+    if (c.login === 'logged-out')
+        return { ...base, state: 'logged-out' };
+    if (pressure === null)
+        return { ...base, state: 'unknown' };
+    if (pressure < QUOTA_FAIL_PERCENT)
+        return { ...base, state: 'ready' };
+    // Usable again only when every full window has reset: the latest of their reset times.
+    let last;
+    if (c.quota.status === 'ok')
+        for (const w of c.quota.windows) {
+            const t = Date.parse(w.resetsAt);
+            if (w.usedPercent >= QUOTA_FAIL_PERCENT && !windowReset(w.resetsAt, now) && Number.isFinite(t))
+                last = Math.max(last ?? t, t);
+        }
+    return { ...base, state: 'full', ...(last === undefined ? {} : { resetsAt: new Date(last).toISOString() }) };
+}
+export function planHandoff(family, candidates, now, opts = {}) {
+    const byRef = new Map(candidates.map((c) => [c.ref, c]));
+    const tie = (a, b) => {
+        const x = byRef.get(a.ref);
+        const y = byRef.get(b.ref);
+        return Number(y.isMain) - Number(x.isMain) || x.name.localeCompare(y.name, undefined, { numeric: true });
+    };
+    const accounts = candidates
+        .map((c) => entry(c, now))
+        .sort((a, b) => ORDER[a.state] - ORDER[b.state] ||
+        (a.state === 'ready' ? a.pressure - b.pressure : 0) ||
+        (a.state === 'full' ? resetTime(a) - resetTime(b) || 0 : 0) ||
+        tie(a, b));
+    const usable = (e) => e.state === 'ready' || e.state === 'unknown' || (e.state === 'api' && Boolean(opts.includeApi));
+    const pick = accounts.find(usable)?.ref ?? null;
+    const hasQuota = accounts.some((e) => e.state === 'ready' || e.state === 'full');
+    const plan = { family, pick, accounts, hasQuota };
+    if (pick === null) {
+        const first = accounts.find((e) => e.state === 'full' && e.resetsAt);
+        if (first?.resetsAt)
+            plan.earliestReset = { ref: first.ref, at: first.resetsAt };
+    }
+    return plan;
+}

package/dist/src/core/identity.d.ts

@@ -0,0 +1,23 @@
+import type { AccountIdentity } from '../types.ts';
+/** The email when `v` looks like one address, else undefined. */
+export declare function cleanEmail(v: unknown): string | undefined;
+/** A short single-line organization name, else undefined. */
+export declare function cleanOrg(v: unknown): string | undefined;
+/** `{ email?, org? }` without empty fields, or undefined when both are missing. */
+export declare function identityOf(email: unknown, org?: unknown): AccountIdentity | undefined;
+/**
+ * The email claim of a JWT such as Codex's `id_token`: the payload segment is base64url-decoded and parsed, and only
+ * `email` is kept. The signature is not checked (the token is the Host's own file, read for display only); the
+ * token itself and every other claim are dropped.
+ */
+export declare function jwtEmail(token: unknown): string | undefined;
+/** Counters of the identity cache, for tests. */
+export declare const identityMemoStats: {
+    hits: number;
+    misses: number;
+};
+/**
+ * Reads one JSON login file and keeps only what `pick` returns from it. Undefined when the file is missing, is not
+ * JSON or holds no identity. `pick` must return identity fields only (identityOf builds one).
+ */
+export declare function identityFromJsonFile(path: string, pick: (data: unknown) => AccountIdentity | undefined): Promise<AccountIdentity | undefined>;