synomem 0.8.0 → 0.9.1

package/dist/configure.js

@@ -1,220 +1,79 @@
 /**
- * `synomem config` — the onboarding wizard, and its deterministic equivalent.
+ * Setup helpers shared by `connection` and `setup`.
  *
  * Two rules shape this file. Every interactive step has a non-interactive
- * counterpart, so an agent can configure a machine without a terminal. And the
- * wizard refuses to run at all when nobody is there to answer: a setup program
- * that blocks forever on a pipe is worse than one that says which flags it
- * needs.
+ * counterpart, so an agent can configure a machine without a terminal. And a
+ * secret is never accepted as a command-line argument: an argument is kept by
+ * the shell history and visible in the process list, so access keys arrive on
+ * stdin.
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { cloudApiUrl } from './cloud.js';
 import { SynomemError } from './errors.js';
-import { resolveHome } from './config.js';
-import { ask, askSecret, confirm, select } from './prompt.js';
+import { askSecret } from './prompt.js';
 /**
- * Where a credential can actually be kept on this platform.
+ * Where a credential can be kept on this platform, recommended first.
  *
- * Reported rather than assumed: offering macOS Keychain on Linux, or a Secret
- * Service that is not running, produces a setup that appears to succeed and
- * then cannot read its own credential back.
+ * Reported rather than assumed: offering the macOS Keychain on Linux, or a
+ * Secret Service that is not running, produces a setup that appears to succeed
+ * and then cannot read its own credential back.
  */
 export function credentialStoreChoices(platform = process.platform) {
     const native = platform === 'darwin'
-        ? { value: 'keychain', label: 'macOS Keychain', detail: 'Recommended.' }
-        : platform === 'win32'
-            ? /*
-               * Windows has no native option here yet, so the restricted file is
-               * the recommendation rather than Credential Manager. Offering a
-               * store the credential layer cannot actually read back would fail
-               * at the first use, after the wizard had already told the person
-               * their credential was safely stored.
-               */
+        ? [{ value: 'keychain', label: 'macOS Keychain', detail: 'Recommended.' }]
+        : platform === 'linux'
+            ? [
                 {
-                    value: 'file',
-                    label: 'A file in the Synomem home',
-                    // Not called "restricted" on Windows: `chmod` there only toggles
-                    // the read-only bit, so the protection is the user profile
-                    // directory's access control, not a mode of 0600.
-                    detail: 'Protected by your user profile. Recommended until Credential Manager lands.',
-                }
-            : {
-                value: 'keychain',
-                label: 'Secret Service (libsecret)',
-                detail: 'Recommended where a desktop keyring is running.',
-            };
-    return [
-        native,
-        ...(native.value === 'file'
-            ? []
-            : [
-                {
-                    value: 'file',
-                    label: 'A restricted file in the Synomem home',
-                    detail: 'Mode 0600. Use on headless machines with no keyring.',
+                    value: 'keychain',
+                    label: 'Secret Service (libsecret)',
+                    detail: 'Recommended where a desktop keyring is running.',
                 },
-            ]),
+            ]
+            : [];
+    return [
+        ...native,
+        {
+            value: 'file',
+            label: 'A restricted file in the Synomem home',
+            detail: 'Mode 0600. Use on headless machines with no keyring.',
+        },
         {
             value: 'environment',
-            label: 'Print environment-variable instructions',
-            detail: 'Nothing is stored. Synomem never edits your shell profile.',
+            label: 'SYNOMEM_ACCESS_TOKEN (access keys only)',
+            detail: 'Nothing is stored; the key is read from the environment each run.',
         },
     ];
 }
+/** The default store: the OS keychain where one exists, otherwise refused. */
+export function defaultCredentialBackend(platform = process.platform) {
+    if (platform === 'darwin' || platform === 'linux')
+        return 'keychain';
+    throw new SynomemError('CONFIG_INVALID', 'This platform has no supported credential store. Pass --store file (a mode-0600 file), or --store environment for an access key.');
+}
+export function parseCredentialBackend(value, platform = process.platform) {
+    if (value === undefined)
+        return defaultCredentialBackend(platform);
+    if (value === 'keychain' || value === 'file' || value === 'environment')
+        return value;
+    throw new SynomemError('INVALID_INPUT', '--store must be keychain, file, or environment.');
+}
 /** Refuses to guess when there is nobody to ask. */
-export function assertInteractive(io) {
+export function assertInteractive(io, alternative) {
     if (io.interactive)
         return;
-    throw new SynomemError('INVALID_INPUT', [
-        'synomem config needs an interactive terminal.',
-        '',
-        'For automation, use the deterministic form instead:',
-        '',
-        '  synomem config init --backend local --yes',
-        '',
-        '  synomem config init --backend remote --auth access-key \\',
-        '    --workspace <workspace-id> --access-token-stdin --yes',
-        '',
-        'Pipe the token in rather than passing it as an argument: an argument is',
-        'kept by both the shell history and the process list.',
-    ].join('\n'));
-}
-/**
- * Stores an access key in a restricted file.
- *
- * Separate from `config.json` so a configuration file can be read, copied or
- * pasted into an issue without carrying a secret with it.
- */
-function credentialFilePath(home) {
-    return join(home, 'credentials', 'installation.json');
-}
-export function writeCredentialFile(home, token) {
-    const directory = join(home, 'credentials');
-    mkdirSync(directory, { recursive: true, mode: 0o700 });
-    chmodSync(directory, 0o700);
-    const path = credentialFilePath(home);
-    writeFileSync(path, `${JSON.stringify({ accessToken: token }, null, 2)}\n`, { mode: 0o600 });
-    chmodSync(path, 0o600);
-    return path;
+    throw new SynomemError('INVALID_INPUT', `This step needs an interactive terminal. For automation: ${alternative}`);
 }
-/**
- * Reads back what `writeCredentialFile` wrote.
- *
- * Without this, choosing the restricted-file store at `synomem config` wrote
- * a credential nothing ever read again: every later command still asked the
- * OS keychain, found nothing there, and failed with AUTH_REQUIRED even though
- * the key was sitting right there on disk.
- */
-export function readCredentialFile(home) {
-    const path = credentialFilePath(home);
-    if (!existsSync(path))
-        return undefined;
-    try {
-        const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        return typeof parsed.accessToken === 'string' ? parsed.accessToken : undefined;
-    }
-    catch {
-        return undefined;
+/** Reads an access key from stdin (or a prompt), never from an argument. */
+export async function readAccessKey(io) {
+    const key = await askSecret(io, 'Access key');
+    if (!key)
+        throw new SynomemError('INVALID_INPUT', 'No access key was provided on stdin.');
+    if (!key.startsWith('syn_')) {
+        throw new SynomemError('INVALID_INPUT', 'That does not look like a Synomem access key (syn_…).');
     }
+    return key;
 }
 /** A key's identifying prefix. Never the key. */
 export function credentialFingerprint(token) {
     const head = token.slice(0, 12);
-    return `${head}${token.length > 12 ? '\u2026' : ''}`;
-}
-export function environmentInstructions(token) {
-    return [
-        'Set this value for the current shell:',
-        '',
-        `  export SYNOMEM_ACCESS_TOKEN='${token}'`,
-        '',
-        'To persist it, add that to a secret-aware shell configuration or to your',
-        'agent runtime environment. Synomem will not edit your shell profile for',
-        'you: silently rewriting a dotfile is not a thing a setup program should do.',
-    ].join('\n');
-}
-/** The interactive flow, returning the plan it settled on. */
-export async function runConfigWizard(io, options = {}) {
-    assertInteractive(io);
-    const env = options.env ?? process.env;
-    io.output.write([
-        '',
-        'Welcome to Synomem',
-        '',
-        'Synomem gives agents durable notes, messages, tasks, todos, kudos,',
-        'and shared coordination.',
-        '',
-    ].join('\n'));
-    const backend = await select(io, 'Where should Synomem store canonical state?', [
-        {
-            value: 'local',
-            label: 'Local \u2014 SQLite on this machine',
-            detail: 'Nothing is uploaded. One implicit workspace.',
-        },
-        {
-            value: 'remote',
-            label: 'Synomem Cloud \u2014 shared across machines and agents',
-            detail: 'Organizations, workspaces, roles and administration.',
-        },
-    ]);
-    const home = await ask(io, 'Where should Synomem store its data?', resolveHome(options.home));
-    if (backend === 'local') {
-        return { backend, home };
-    }
-    const serviceUrl = cloudApiUrl(env);
-    io.output.write(`\nConnecting to Synomem Cloud at ${serviceUrl}\n`);
-    const auth = await select(io, 'How would you like to sign in?', [
-        {
-            value: 'browser',
-            label: 'Sign in with your browser',
-            detail: 'Opens the authorization server and returns through a loopback callback.',
-        },
-        {
-            value: 'access-key',
-            label: 'Use an access key',
-            detail: 'Create one at https://portal.synomem.ai/access-keys/new',
-        },
-    ]);
-    /*
-     * Deliberately no workspace prompt here.
-     *
-     * A hosted workspace ID looks like `ws-04psqx2rkt8ttft7a1t2z69r97`, and the
-     * credential authorized in the next step already knows the answer -- an
-     * access key can list every workspace its organization has, and a browser
-     * sign-in can list the ones the account belongs to across every
-     * organization. Asking first means asking a person to go and look something
-     * up that we are about to be told.
-     */
-    const credentialStore = auth === 'access-key'
-        ? await select(io, 'Where should Synomem store this credential?', credentialStoreChoices())
-        : 'auto';
-    return { backend, home, serviceUrl, auth, credentialStore };
-}
-/** Reads an access key without ever accepting it as an argument. */
-export async function readAccessToken(io) {
-    const token = await askSecret(io, 'Access key');
-    if (!token)
-        throw new SynomemError('INVALID_INPUT', 'No access key was provided.');
-    return token;
-}
-export async function confirmPlan(io, plan) {
-    io.output.write([
-        '',
-        'Synomem will be configured as:',
-        '',
-        `  Backend:   ${plan.backend === 'local' ? 'Local SQLite' : 'Synomem Cloud'}`,
-        `  Home:      ${plan.home}`,
-        ...(plan.serviceUrl ? [`  Service:   ${plan.serviceUrl}`] : []),
-        ...(plan.workspaceId ? [`  Workspace: ${plan.workspaceId}`] : []),
-        ...(plan.credentialStore && plan.credentialStore !== 'auto'
-            ? [`  Credential: ${plan.credentialStore}`]
-            : []),
-        '',
-    ].join('\n'));
-    return await confirm(io, 'Apply this?');
-}
-export function homeExists(home) {
-    return existsSync(home);
+    return `${head}${token.length > 12 ? '…' : ''}`;
 }
 //# sourceMappingURL=configure.js.map

package/dist/configure.js.map

@@ -1 +1 @@
-{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAiB,MAAM,aAAa,CAAC;AAyB7E;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,MAAM,GACV,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,EAAE,KAAK,EAAE,UAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,EAAE;QACjF,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC;;;;;;iBAMG;gBACH;oBACE,KAAK,EAAE,MAAe;oBACtB,KAAK,EAAE,4BAA4B;oBACnC,iEAAiE;oBACjE,2DAA2D;oBAC3D,kDAAkD;oBAClD,MAAM,EAAE,6EAA6E;iBACtF;YACH,CAAC,CAAC;gBACE,KAAK,EAAE,UAAmB;gBAC1B,KAAK,EAAE,4BAA4B;gBACnC,MAAM,EAAE,iDAAiD;aAC1D,CAAC;IACV,OAAO;QACL,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,KAAK,EAAE,MAAe;oBACtB,KAAK,EAAE,uCAAuC;oBAC9C,MAAM,EAAE,sDAAsD;iBAC/D;aACF,CAAC;QACN;YACE,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,yCAAyC;YAChD,MAAM,EAAE,4DAA4D;SACrE;KACF,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,iBAAiB,CAAC,EAAY;IAC5C,IAAI,EAAE,CAAC,WAAW;QAAE,OAAO;IAC3B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf;QACE,+CAA+C;QAC/C,EAAE;QACF,qDAAqD;QACrD,EAAE;QACF,6CAA6C;QAC7C,EAAE;QACF,6DAA6D;QAC7D,2DAA2D;QAC3D,EAAE;QACF,yEAAyE;QACzE,sDAAsD;KACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAa;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA8B,CAAC;QACnF,OAAO,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO;QACL,uCAAuC;QACvC,EAAE;QACF,kCAAkC,KAAK,GAAG;QAC1C,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,6EAA6E;KAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAY,EACZ,UAAsD,EAAE;IAExD,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,EAAE,CAAC,MAAM,CAAC,KAAK,CACb;QACE,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,oEAAoE;QACpE,0BAA0B;QAC1B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAgB,EAAE,EAAE,6CAA6C,EAAE;QAC7F;YACE,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,qCAAqC;YAC5C,MAAM,EAAE,8CAA8C;SACvD;QACD;YACE,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,wDAAwD;YAC/D,MAAM,EAAE,sDAAsD;SAC/D;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,sCAAsC,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9F,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,UAAU,IAAI,CAAC,CAAC;IAEpE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAa,EAAE,EAAE,gCAAgC,EAAE;QAC1E;YACE,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,2BAA2B;YAClC,MAAM,EAAE,yEAAyE;SAClF;QACD;YACE,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,yDAAyD;SAClE;KACF,CAAC,CAAC;IAEH;;;;;;;;;OASG;IAEH,MAAM,eAAe,GACnB,IAAI,KAAK,YAAY;QACnB,CAAC,CAAC,MAAM,MAAM,CACV,EAAE,EACF,6CAA6C,EAC7C,sBAAsB,EAAE,CACzB;QACH,CAAC,CAAC,MAAM,CAAC;IAEb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AAC9D,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAY;IAChD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAY,EAAE,IAAgB;IAC9D,EAAE,CAAC,MAAM,CAAC,KAAK,CACb;QACE,EAAE;QACF,gCAAgC;QAChC,EAAE;QACF,gBAAgB,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7E,gBAAgB,IAAI,CAAC,IAAI,EAAE;QAC3B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,KAAK,MAAM;YACzD,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,MAAM,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAiB,MAAM,aAAa,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,MAAM,GACV,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACnF,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC;gBACE;oBACE,KAAK,EAAE,UAAmB;oBAC1B,KAAK,EAAE,4BAA4B;oBACnC,MAAM,EAAE,iDAAiD;iBAC1D;aACF;YACH,CAAC,CAAC,EAAE,CAAC;IACX,OAAO;QACL,GAAG,MAAM;QACT;YACE,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,uCAAuC;YAC9C,MAAM,EAAE,sDAAsD;SAC/D;QACD;YACE,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,yCAAyC;YAChD,MAAM,EAAE,mEAAmE;SAC5E;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,wBAAwB,CACtC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC;IACrE,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,kIAAkI,CACnI,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAyB,EACzB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,iDAAiD,CAAC,CAAC;AAC7F,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,iBAAiB,CAAC,EAAY,EAAE,WAAmB;IACjE,IAAI,EAAE,CAAC,WAAW;QAAE,OAAO;IAC3B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,4DAA4D,WAAW,EAAE,CAC1E,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAY;IAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAClD,CAAC"}

package/dist/credentials.d.ts

@@ -1,45 +1,55 @@
-import type { ActorIdentity } from './types.js';
-/**
- * A member-owned access key.
- *
- * Not an OAuth credential: it has no refresh, no token endpoint and no
- * client, and it authorizes the MEMBER who created it, reaching every
- * workspace their organization membership allows -- never a single machine
- * or a single workspace. Keeping it a distinct shape stops code treating it
- * as refreshable, which would mean silently failing to renew something that
- * never expires that way.
- *
- * The `kind` value and this type's own name predate member-owned access
- * keys; both still say "installation" because renaming either changes the
- * shape already written to disk and the OS keychain on every machine that
- * has run `synomem config`, for no behavioral gain.
- */
-export interface StoredInstallationKey {
-    kind: 'installation-key';
-    accessToken: string;
-}
-export type StoredCredential = StoredOAuthCredential | StoredInstallationKey;
-export interface StoredOAuthCredential {
-    accessToken: string;
-    refreshToken?: string;
-    expiresAt?: number;
-    tokenEndpoint: string;
-    clientId: string;
-    resource: string;
-    scope: string;
-}
+import { z } from 'zod';
+export declare const storedOAuthCredentialSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"oauth">;
+    issuer: z.ZodString;
+    resource: z.ZodString;
+    clientId: z.ZodString;
+    tokenEndpoint: z.ZodString;
+    scope: z.ZodString;
+    accessToken: z.ZodString;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodNumber;
+    generation: z.ZodNumber;
+}, z.core.$strip>;
+export declare const storedAccessKeySchema: z.ZodObject<{
+    kind: z.ZodLiteral<"access-key">;
+    secret: z.ZodString;
+}, z.core.$strip>;
+export declare const storedCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"oauth">;
+    issuer: z.ZodString;
+    resource: z.ZodString;
+    clientId: z.ZodString;
+    tokenEndpoint: z.ZodString;
+    scope: z.ZodString;
+    accessToken: z.ZodString;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodNumber;
+    generation: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"access-key">;
+    secret: z.ZodString;
+}, z.core.$strip>], "kind">;
+export type StoredOAuthCredential = z.infer<typeof storedOAuthCredentialSchema>;
+export type StoredAccessKey = z.infer<typeof storedAccessKeySchema>;
+export type StoredCredential = z.infer<typeof storedCredentialSchema>;
+/** Where a connection's secret lives. `environment` stores nothing. */
+export type CredentialBackendKind = 'keychain' | 'file' | 'environment';
 export interface CredentialStore {
     get(reference: string): Promise<StoredCredential | undefined>;
     set(reference: string, credential: StoredCredential): Promise<void>;
     delete(reference: string): Promise<boolean>;
 }
-export declare function credentialReference(baseUrl: string, workspaceId: string, actor: ActorIdentity): string;
+/** An opaque, non-secret handle for a stored secret. Never derived from names. */
+export declare function newSecretReference(): string;
+export declare function parseStoredCredential(value: string): StoredCredential;
 interface CommandResult {
     stdout: string;
     stderr: string;
     code: number;
 }
 export type CredentialCommandRunner = (executable: string, arguments_: string[], input?: string) => Promise<CommandResult>;
+/** macOS Keychain or Linux Secret Service. */
 export declare class OsCredentialStore implements CredentialStore {
     private readonly platform;
     private readonly run;
@@ -47,10 +57,49 @@ export declare class OsCredentialStore implements CredentialStore {
         platform?: NodeJS.Platform;
         run?: CredentialCommandRunner;
     });
-    get(reference: string): Promise<StoredOAuthCredential | undefined>;
-    set(reference: string, credential: StoredOAuthCredential): Promise<void>;
+    get(reference: string): Promise<StoredCredential | undefined>;
+    set(reference: string, credential: StoredCredential): Promise<void>;
     delete(reference: string): Promise<boolean>;
     private unsupported;
 }
+/**
+ * One restricted file per secret under `<home>/credentials/`, mode 0600 in a
+ * 0700 directory. Chosen explicitly (`--store file`), never as a fallback.
+ */
+export declare class FileCredentialStore implements CredentialStore {
+    private readonly directory;
+    constructor(home: string);
+    private path;
+    get(reference: string): Promise<StoredCredential | undefined>;
+    set(reference: string, credential: StoredCredential): Promise<void>;
+    delete(reference: string): Promise<boolean>;
+}
+export interface CredentialStores {
+    keychain: CredentialStore;
+    file: CredentialStore;
+}
+export declare function defaultCredentialStores(home: string): CredentialStores;
+/**
+ * A cross-process lock around one credential's refresh.
+ *
+ * `O_EXCL` creation is the mutual exclusion. The lock file records its owner
+ * (pid, host) and a random token. A lock is broken only when its owner is
+ * provably gone — a dead pid on this host — or, for an owner on another host
+ * or an unreadable file, once it is older than `staleMs`. A live owner is never
+ * preempted however long its refresh takes (the refresh request itself times
+ * out well inside `staleMs`).
+ *
+ * Breaking renames the file aside first and checks the token: if another
+ * process already broke and re-acquired it in between, the fresh lock is put
+ * back rather than deleted. Correctness against a concurrent writer is still
+ * the generation compare-and-swap in the refresh path; the lock exists so that
+ * only one process ever spends a given refresh token. Locks assume one host's
+ * filesystem; a home shared over a network filesystem is not supported.
+ */
+export declare function withCredentialLock<T>(home: string, name: string, operation: () => Promise<T>, options?: {
+    staleMs?: number;
+    timeoutMs?: number;
+    pollMs?: number;
+}): Promise<T>;
 export {};
 //# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,kBAAkB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAC9D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,GACnB,MAAM,CAUR;AAED,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,CAAC,EAAE,MAAM,KACX,OAAO,CAAC,aAAa,CAAC,CAAC;AAqD5B,qBAAa,iBAAkB,YAAW,eAAe;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;gBAElC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;QAAC,GAAG,CAAC,EAAE,uBAAuB,CAAA;KAAO;IAKjF,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAkBlE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCxE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBjD,OAAO,CAAC,WAAW;CAQpB"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,2BAA2B;;;;;;;;;;;iBAatC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;2BAGjC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,uEAAuE;AACvE,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,MAAM,GAAG,aAAa,CAAC;AAExE,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAC9D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAerE;AAED,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,CAAC,EAAE,MAAM,KACX,OAAO,CAAC,aAAa,CAAC,CAAC;AAmC5B,8CAA8C;AAC9C,qBAAa,iBAAkB,YAAW,eAAe;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;gBAElC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;QAAC,GAAG,CAAC,EAAE,uBAAuB,CAAA;KAAO;IAgBjF,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAkB7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCnE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBjD,OAAO,CAAC,WAAW;CAQpB;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,EAAE,MAAM;IAIxB,OAAO,CAAC,IAAI;IAON,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAQ7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAMlD;AA2BD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,eAAe,CAAC;CACvB;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAEtE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,OAAO,CAAC,CAAC,CAAC,CAoCZ"}