sidekick-shared 0.26.5 → 0.27.0

package/dist/codexProfiles.d.ts

@@ -1,14 +1,35 @@
 import type { AccountIdentityMetadata, ResolvedActiveAccount, SavedAccountProfile } from './accountRegistry';
 import type { AccountManagerResult } from './accounts';
+import { type AccountHealthSource } from './accountHealth';
+import { type SwitchAccountOptions, type SwitchAccountResult } from './accountSwitch';
+import { type ProviderSyncReport } from './accountSyncTypes';
+export { getCodexProfilesDir, getCodexProfileHome, getSystemCodexHome, getCodexCredentialStoreMode, } from './codexPaths';
+export type { CodexCredentialStoreMode } from './codexPaths';
 export interface CodexAccountManagerResult extends AccountManagerResult {
     needsLogin?: boolean;
     profileId?: string;
     codexHome?: string;
 }
-export declare function getSystemCodexHome(): string;
+export declare const CODEX_KEYRING_FIX_HINT = "Set `cli_auth_credentials_store = \"file\"` in ~/.codex/config.toml and run `codex login` again.";
 export declare function getCodexMonitoringHomes(): string[];
-export declare function getCodexProfilesDir(): string;
-export declare function getCodexProfileHome(profileId: string): string;
+/**
+ * The single chokepoint for storing a Codex credential in a profile: the raw
+ * `auth.json` bytes (never re-serialized), the legacy `.credentials.json`
+ * when present, and the secret-free health sidecar.
+ */
+export declare function storeCodexProfileAuth(profileId: string, authRaw: string | null, legacyRaw: string | null, source: AccountHealthSource): void;
+interface CodexLoginStatus {
+    loggedIn: boolean;
+    authMode?: 'chatgpt' | 'api-key';
+}
+export declare function parseCodexLoginStatusOutput(status: number | null, stdout: string): CodexLoginStatus;
+/**
+ * Blocks the caller's event loop for up to {@link PROBE_TIMEOUT_MS}. Async code
+ * paths must use {@link getCodexLoginStatusAsync} instead — external consumers
+ * embed this package in processes where a blocked event loop freezes all IPC.
+ */
+export declare function getCodexLoginStatus(codexHome: string): CodexLoginStatus;
+export declare function getCodexLoginStatusAsync(codexHome: string): Promise<CodexLoginStatus>;
 export declare function readCodexAccountMetadata(codexHome: string): AccountIdentityMetadata;
 /** {@link readCodexAccountMetadata} without blocking the event loop on the CLI probe. */
 export declare function readCodexAccountMetadataAsync(codexHome: string): Promise<AccountIdentityMetadata>;
@@ -45,9 +66,41 @@ export declare function finalizeCodexAccount(profileId: string, opts?: {
 export declare function finalizeCodexAccountAsync(profileId: string, opts?: {
     activate?: boolean;
 }): Promise<CodexAccountManagerResult>;
-export declare function switchToCodexAccount(profileId: string): CodexAccountManagerResult;
+/**
+ * Serializes live-auth mutations across processes. Codex rotates refresh
+ * tokens, so two interleaved swaps stashing and restoring auth.json can
+ * resurrect a stale token and permanently invalidate the login. Lock ordering:
+ * this lock is taken first and the registry lock (inside setActiveSavedAccount
+ * / upsertSavedAccountProfile) inside it — never the reverse. Never spawn a
+ * child process while holding it.
+ */
+export declare function withCodexAuthSwapLock<T>(operation: () => T): T;
+/**
+ * Merge duplicate Codex profiles (same workspace, else same email). The oldest
+ * profile keeps its id and label, receives the freshest `auth.json` and the
+ * quota snapshot, and the active pointer; losers are stashed, never deleted.
+ * Returns the removed ids. Caller holds the swap lock.
+ */
+export declare function dedupeCodexProfiles(): string[];
+/**
+ * Fold the live `auth.json` into the saved profiles: register an unknown login
+ * (label = email), refresh the matching profile's backup when the live file is
+ * newer, and re-point the active pointer at it. Caller holds the swap lock.
+ * Never throws; problems land in `warnings`.
+ */
+export declare function syncCodexLiveStateUnlocked(source?: AccountHealthSource, probes?: {
+    systemKeyringLoggedIn?: boolean;
+}): ProviderSyncReport;
+/** {@link syncCodexLiveStateUnlocked} under the swap lock. */
+export declare function syncCodexLiveState(source?: AccountHealthSource): ProviderSyncReport;
+/**
+ * Remove isolated login homes that never authenticated once they are older
+ * than `olderThanMs`. Returns the removed profile ids.
+ */
+export declare function cleanupAbandonedCodexLogins(olderThanMs?: number, now?: number): string[];
+export declare function switchToCodexAccount(profileId: string, options?: SwitchAccountOptions): SwitchAccountResult;
 /** {@link switchToCodexAccount} without blocking the event loop on CLI probes. */
-export declare function switchToCodexAccountAsync(profileId: string): Promise<CodexAccountManagerResult>;
+export declare function switchToCodexAccountAsync(profileId: string, options?: SwitchAccountOptions): Promise<SwitchAccountResult>;
 export declare function reconcileCodexAuthState(): void;
 /** {@link reconcileCodexAuthState} without blocking the event loop on CLI probes. */
 export declare function reconcileCodexAuthStateAsync(): Promise<void>;