synorch 0.2.0 → 0.4.0-beta.0

package/dist/harness/auth/credential-store.js

@@ -0,0 +1,270 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { credentialAccountKey, credentialFileSchema, credentialRefSchema, credentialSecretSchema, HarnessError, } from "../contracts/index.js";
+import { readJsonFile, writeJsonAtomic } from "./json-file.js";
+import { defaultRunner, defaultSyncRunner, probeVault, } from "./keychain.js";
+import { acquireFileLock, KeyedMutex } from "./locks.js";
+import { plaintextCredentialNotice } from "./notices.js";
+export const CREDENTIAL_FILE_NAME = "credentials.json";
+export const DPAPI_FILE_NAME = "credentials.dpapi.json";
+const VAULT_INDEX_ACCOUNT = "synorch:index";
+/**
+ * The credential store (ADR-05): OS keychain first (macOS `security`, Linux `secret-tool`, Windows
+ * DPAPI through PowerShell), otherwise `<home>/credentials.json` with mode 0600 and a
+ * `plaintext-credential-file` notice. `home` is the Synorch home (`~/.synorch` or `$SYNORCH_HOME`).
+ * No other application's store is ever opened.
+ */
+export function createCredentialStore(home, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const requested = options.backend ?? backendFromEnv(options.env ?? process.env) ?? "auto";
+    if (requested !== "file-0600") {
+        const vault = probeVault({
+            platform,
+            run: options.run ?? defaultRunner,
+            runSync: options.runSync ?? defaultSyncRunner,
+            dpapiFile: path.join(home, DPAPI_FILE_NAME),
+        });
+        if (vault !== undefined)
+            return buildStore(vaultPersistence(vault, home), home);
+        if (requested === "os-keychain" || requested === "os-dpapi") {
+            throw new HarnessError({
+                code: "config_invalid",
+                message: "the OS keychain was requested but is not available on this system",
+                workspace_effect: "none",
+                retry_safe: false,
+                next_command: "SYNORCH_CREDENTIAL_STORE=file syn login <provider>",
+            });
+        }
+    }
+    const filePath = path.join(home, CREDENTIAL_FILE_NAME);
+    return buildStore(filePersistence(filePath, home), home, plaintextCredentialNotice(filePath));
+}
+/** A process-local store for tests and headless runs that must not persist anything. */
+export function createMemoryCredentialStore() {
+    const entries = new Map();
+    return buildStore({
+        backend: "memory",
+        location: "memory",
+        async read(account) {
+            const entry = entries.get(account);
+            return entry === undefined ? undefined : structuredClone(entry);
+        },
+        async write(ref, secret) {
+            entries.set(credentialAccountKey(ref), structuredClone({ ref, secret }));
+        },
+        async remove(account) {
+            return entries.delete(account);
+        },
+        async accounts() {
+            return [...entries.values()].map((entry) => ({ ref: entry.ref }));
+        },
+        async lock() {
+            return async () => undefined;
+        },
+    }, undefined);
+}
+function backendFromEnv(env) {
+    const value = env.SYNORCH_CREDENTIAL_STORE?.trim().toLowerCase();
+    if (value === "file" || value === "file-0600")
+        return "file-0600";
+    if (value === "keychain" || value === "os-keychain")
+        return "os-keychain";
+    if (value === "dpapi" || value === "os-dpapi")
+        return "os-dpapi";
+    if (value === "auto")
+        return "auto";
+    return undefined;
+}
+function lockPath(home, name) {
+    return path.join(home, "locks", `${name}.lock`);
+}
+function corrupt(where) {
+    return new HarnessError({
+        code: "config_invalid",
+        message: `stored credentials in ${where} are unreadable; remove the entry with \`syn logout\` and sign in again`,
+        workspace_effect: "none",
+        retry_safe: false,
+    });
+}
+function filePersistence(filePath, home) {
+    async function load() {
+        let raw;
+        try {
+            raw = await readJsonFile(filePath);
+        }
+        catch {
+            throw corrupt(filePath);
+        }
+        if (raw === undefined)
+            return { schema_version: 1, profiles: {} };
+        const parsed = credentialFileSchema.safeParse(raw);
+        if (!parsed.success)
+            throw corrupt(filePath);
+        return parsed.data;
+    }
+    return {
+        backend: "file-0600",
+        location: filePath,
+        async read(account) {
+            return (await load()).profiles[account];
+        },
+        async write(ref, secret) {
+            const file = await load();
+            file.profiles[credentialAccountKey(ref)] = { ref, secret };
+            await writeJsonAtomic(filePath, file);
+        },
+        async remove(account) {
+            const file = await load();
+            if (file.profiles[account] === undefined)
+                return false;
+            delete file.profiles[account];
+            await writeJsonAtomic(filePath, file);
+            return true;
+        },
+        async accounts() {
+            return Object.values((await load()).profiles).map((entry) => ({ ref: entry.ref }));
+        },
+        lock(name, signal) {
+            return acquireFileLock(lockPath(home, name), signal === undefined ? {} : { signal });
+        },
+    };
+}
+function encode(value) {
+    return Buffer.from(JSON.stringify(value), "utf8").toString("base64");
+}
+function decode(value) {
+    return JSON.parse(Buffer.from(value.trim(), "base64").toString("utf8"));
+}
+function vaultPersistence(vault, home) {
+    const cache = new Map();
+    async function index() {
+        const raw = await vault.get(VAULT_INDEX_ACCOUNT);
+        if (raw === undefined)
+            return [];
+        try {
+            const refs = decode(raw);
+            return Array.isArray(refs) ? refs.flatMap((ref) => (credentialRefSchema.safeParse(ref).success ? [ref] : [])) : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    async function saveIndex(refs) {
+        await vault.set(VAULT_INDEX_ACCOUNT, encode(refs));
+    }
+    const persistence = {
+        backend: vault.kind === "windows-dpapi" ? "os-dpapi" : "os-keychain",
+        location: vault.kind,
+        async read(account) {
+            if (cache.has(account))
+                return structuredCloneOrUndefined(cache.get(account));
+            const raw = await vault.get(account);
+            if (raw === undefined) {
+                cache.set(account, undefined);
+                return undefined;
+            }
+            let entry;
+            try {
+                const value = decode(raw);
+                entry = { ref: credentialRefSchema.parse(value.ref), secret: credentialSecretSchema.parse(value.secret) };
+            }
+            catch {
+                throw corrupt(vault.kind);
+            }
+            cache.set(account, entry);
+            return structuredClone(entry);
+        },
+        async write(ref, secret) {
+            const account = credentialAccountKey(ref);
+            await vault.set(account, encode({ ref, secret }));
+            cache.set(account, structuredClone({ ref, secret }));
+            const refs = await index();
+            if (!refs.some((existing) => credentialAccountKey(existing) === account))
+                await saveIndex([...refs, ref]);
+        },
+        async remove(account) {
+            const removed = await vault.delete(account);
+            cache.set(account, undefined);
+            const refs = await index();
+            const remaining = refs.filter((ref) => credentialAccountKey(ref) !== account);
+            if (remaining.length !== refs.length)
+                await saveIndex(remaining);
+            return removed;
+        },
+        async accounts() {
+            return (await index()).map((ref) => ({ ref }));
+        },
+        lock(name, signal) {
+            return acquireFileLock(lockPath(home, name), signal === undefined ? {} : { signal });
+        },
+        invalidate(account) {
+            cache.delete(account);
+        },
+    };
+    return persistence;
+}
+function structuredCloneOrUndefined(value) {
+    return value === undefined ? undefined : structuredClone(value);
+}
+function buildStore(persistence, home, notice) {
+    const mutex = new KeyedMutex();
+    const invalidate = (account) => {
+        persistence.invalidate?.(account);
+    };
+    async function exclusive(task) {
+        return mutex.run("store", async () => {
+            const release = await persistence.lock("credentials", undefined);
+            try {
+                return await task();
+            }
+            finally {
+                await release();
+            }
+        });
+    }
+    return {
+        backend: persistence.backend,
+        location: persistence.location,
+        notice,
+        home,
+        async get(ref) {
+            const account = credentialAccountKey(credentialRefSchema.parse(ref));
+            return (await persistence.read(account))?.secret;
+        },
+        async set(ref, secret) {
+            const parsedRef = credentialRefSchema.parse(ref);
+            const parsedSecret = credentialSecretSchema.parse(secret);
+            if (parsedRef.method !== parsedSecret.method) {
+                throw new HarnessError({
+                    code: "internal",
+                    message: `a ${parsedSecret.method} secret cannot be stored under a ${parsedRef.method} profile`,
+                    workspace_effect: "none",
+                    retry_safe: false,
+                });
+            }
+            await exclusive(() => persistence.write(parsedRef, parsedSecret));
+        },
+        async delete(ref) {
+            const account = credentialAccountKey(credentialRefSchema.parse(ref));
+            return exclusive(() => persistence.remove(account));
+        },
+        async list() {
+            return (await persistence.accounts()).map((entry) => entry.ref);
+        },
+        async withRefreshLock(ref, refresh, signal) {
+            const account = credentialAccountKey(credentialRefSchema.parse(ref));
+            const name = `refresh-${createHash("sha256").update(account).digest("hex").slice(0, 16)}`;
+            return mutex.run(name, async () => {
+                const release = await persistence.lock(name, signal);
+                try {
+                    invalidate(account);
+                    return await refresh();
+                }
+                finally {
+                    await release();
+                }
+            });
+        },
+    };
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/harness/auth/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../../src/harness/auth/credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,YAAY,GAOb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,UAAU,GAIX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACxD,MAAM,mBAAmB,GAAG,eAAe,CAAC;AA+B5C;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,UAAkC,EAAE;IACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IAC1F,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC;YACvB,QAAQ;YACR,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,aAAa;YACjC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,iBAAiB;YAC7C,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAChF,IAAI,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,mEAAmE;gBAC5E,gBAAgB,EAAE,MAAM;gBACxB,UAAU,EAAE,KAAK;gBACjB,YAAY,EAAE,oDAAoD;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,2BAA2B;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4D,CAAC;IACpF,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,QAAQ;QAClB,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM;YACrB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;QAC/B,CAAC;KACF,EAAE,SAAS,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,GAAiD;IACvE,MAAM,KAAK,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IAClE,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IAC1E,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACjE,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yBAAyB,KAAK,yEAAyE;QAChH,gBAAgB,EAAE,MAAM;QACxB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,IAAY;IACrD,KAAK,UAAU,IAAI;QACjB,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,QAAQ;QAClB,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM;YACrB,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YAC3D,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,MAAM;YACf,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;AACrF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAkB,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwE,CAAC;IAC9F,KAAK,UAAU,KAAK;QAClB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtI,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,KAAK,UAAU,SAAS,CAAC,IAA8B;QACrD,MAAM,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,WAAW,GAAwD;QACvE,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa;QACpE,QAAQ,EAAE,KAAK,CAAC,IAAI;QACpB,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC9B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,KAAuD,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAwC,CAAC;gBACjE,KAAK,GAAG,EAAE,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5G,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM;YACrB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;gBAAE,MAAM,SAAS,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5G,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5C,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC;YAC9E,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;gBAAE,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,OAAO,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,MAAM;YACf,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,UAAU,CAAC,OAAO;YAChB,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,0BAA0B,CAAI,KAAoB;IACzD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,WAAwB,EAAE,IAAwB,EAAE,MAAmB;IACzF,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE;QACpC,WAA8D,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;IACxF,CAAC,CAAC;IACF,KAAK,UAAU,SAAS,CAAI,IAAsB;QAChD,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACnC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,MAAM;QACN,IAAI;QACJ,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,OAAO,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,OAAO,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM;YACnB,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,KAAK,YAAY,CAAC,MAAM,oCAAoC,SAAS,CAAC,MAAM,UAAU;oBAC/F,gBAAgB,EAAE,MAAM;oBACxB,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,OAAO,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM;YACxC,MAAM,OAAO,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,MAAM,IAAI,GAAG,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC1F,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;gBAChC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACrD,IAAI,CAAC;oBACH,UAAU,CAAC,OAAO,CAAC,CAAC;oBACpB,OAAO,MAAM,OAAO,EAAE,CAAC;gBACzB,CAAC;wBAAS,CAAC;oBACT,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/harness/auth/index.d.ts

@@ -0,0 +1,13 @@
+/** I2 — AuthProvider implementations, credential store, `syn login/logout/auth status`. */
+export type { AuthProvider, CredentialStore } from "../contracts/index.ts";
+export { API_KEY_ENV, createApiKeyAuthProvider, type ApiKeyAuthOptions, type ApiKeyProviderId } from "./api-key.ts";
+export { createClaudeBridgeAuthProvider, defaultClaudeProbe, type ClaudeBridgeAuthOptions, type ClaudeCliProbe, type ClaudeCliProbeResult, } from "./claude-bridge.ts";
+export { authCommand, createAuthCommand, resolveSynorchHome, type AuthCommandDependencies } from "./command.ts";
+export { createCredentialStore, createMemoryCredentialStore, CREDENTIAL_FILE_NAME, type CredentialStoreOptions, type SynorchCredentialStore, } from "./credential-store.ts";
+export type { CommandResult, CommandRunner, SyncCommandRunner } from "./keychain.ts";
+export { API_KEY_BILLING_NOTICE, CHATGPT_SUBSCRIPTION_NOTICE, CLAUDE_BRIDGE_NOTICE, plaintextCredentialNotice, } from "./notices.ts";
+export { CHATGPT_LOOPBACK_PORT, CHATGPT_ORIGINATOR, CODEX_PUBLIC_CLIENT_ID, createChatGPTAuthProvider, OPENAI_AUTH_ISSUER, type AuthFetch, type ChatGPTAuthOptions, } from "./openai-chatgpt.ts";
+export { ProfileStateStore } from "./profile-state.ts";
+export { authProviderFor, createAuthProviders, SUPPORTED_AUTH_METHODS, type AuthProvidersOptions } from "./providers.ts";
+export { createResolvedCredential, REDACTED } from "./resolved-credential.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/harness/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/index.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpH,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAChH,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,SAAS,EACd,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACzH,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/harness/auth/index.js

@@ -0,0 +1,10 @@
+export { API_KEY_ENV, createApiKeyAuthProvider } from "./api-key.js";
+export { createClaudeBridgeAuthProvider, defaultClaudeProbe, } from "./claude-bridge.js";
+export { authCommand, createAuthCommand, resolveSynorchHome } from "./command.js";
+export { createCredentialStore, createMemoryCredentialStore, CREDENTIAL_FILE_NAME, } from "./credential-store.js";
+export { API_KEY_BILLING_NOTICE, CHATGPT_SUBSCRIPTION_NOTICE, CLAUDE_BRIDGE_NOTICE, plaintextCredentialNotice, } from "./notices.js";
+export { CHATGPT_LOOPBACK_PORT, CHATGPT_ORIGINATOR, CODEX_PUBLIC_CLIENT_ID, createChatGPTAuthProvider, OPENAI_AUTH_ISSUER, } from "./openai-chatgpt.js";
+export { ProfileStateStore } from "./profile-state.js";
+export { authProviderFor, createAuthProviders, SUPPORTED_AUTH_METHODS } from "./providers.js";
+export { createResolvedCredential, REDACTED } from "./resolved-credential.js";
+//# sourceMappingURL=index.js.map

package/dist/harness/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/harness/auth/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAiD,MAAM,cAAc,CAAC;AACpH,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,EAAgC,MAAM,cAAc,CAAC;AAChH,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,GAGrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,GAGnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAA6B,MAAM,gBAAgB,CAAC;AACzH,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/harness/auth/json-file.d.ts

@@ -0,0 +1,8 @@
+/** Reads a JSON file; `undefined` when it does not exist. Malformed JSON throws so it is never overwritten blindly. */
+export declare function readJsonFile(filePath: string): Promise<unknown>;
+/**
+ * Atomic replace: a `0600` temp file in the same directory (created `0700`), fsync, rename. On
+ * Windows the mode bits are ignored and the file inherits the user profile's ACL.
+ */
+export declare function writeJsonAtomic(filePath: string, value: unknown): Promise<void>;
+//# sourceMappingURL=json-file.d.ts.map

package/dist/harness/auth/json-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-file.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/json-file.ts"],"names":[],"mappings":"AAIA,uHAAuH;AACvH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASrE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBrF"}

package/dist/harness/auth/json-file.js

@@ -0,0 +1,57 @@
+import { randomBytes } from "node:crypto";
+import { chmod, mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import path from "node:path";
+/** Reads a JSON file; `undefined` when it does not exist. Malformed JSON throws so it is never overwritten blindly. */
+export async function readJsonFile(filePath) {
+    let text;
+    try {
+        text = await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    return JSON.parse(text);
+}
+/**
+ * Atomic replace: a `0600` temp file in the same directory (created `0700`), fsync, rename. On
+ * Windows the mode bits are ignored and the file inherits the user profile's ACL.
+ */
+export async function writeJsonAtomic(filePath, value) {
+    const directory = path.dirname(filePath);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const temporary = path.join(directory, `.${path.basename(filePath)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+    const handle = await open(temporary, "wx", 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await renameWithRetry(temporary, filePath);
+    }
+    catch (error) {
+        await rm(temporary, { force: true }).catch(() => undefined);
+        throw error;
+    }
+    if (process.platform !== "win32")
+        await chmod(filePath, 0o600);
+}
+async function renameWithRetry(from, to) {
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            await rename(from, to);
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if (attempt >= 10 || (code !== "EPERM" && code !== "EACCES" && code !== "EBUSY"))
+                throw error;
+            await new Promise((resolve) => setTimeout(resolve, 20 * (attempt + 1)));
+        }
+    }
+}
+//# sourceMappingURL=json-file.js.map

package/dist/harness/auth/json-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-file.js","sourceRoot":"","sources":["../../../src/harness/auth/json-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,uHAAuH;AACvH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,KAAc;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,EAAU;IACrD,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,OAAO,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC9F,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/harness/auth/jwt.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Reads JWT claims without verifying the signature. Only used to learn display metadata (account
+ * id, plan, expiry) from tokens the issuer just handed to us over TLS; never for authorization.
+ */
+export declare function decodeJwtClaims(token: string | undefined): Record<string, unknown> | undefined;
+/** The OpenAI auth namespace claims (`chatgpt_account_id`, `chatgpt_plan_type`, …). */
+export declare function openAiAuthClaims(claims: Record<string, unknown> | undefined): Record<string, unknown>;
+export declare function claimString(claims: Record<string, unknown> | undefined, key: string): string | undefined;
+/** `t***@example.com`: enough to recognize the account, not enough to leak the address. */
+export declare function maskEmail(email: string | undefined): string | undefined;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/harness/auth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAU9F;AAED,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGrG;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxG;AAED,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAKvE"}

package/dist/harness/auth/jwt.js

@@ -0,0 +1,37 @@
+/**
+ * Reads JWT claims without verifying the signature. Only used to learn display metadata (account
+ * id, plan, expiry) from tokens the issuer just handed to us over TLS; never for authorization.
+ */
+export function decodeJwtClaims(token) {
+    if (token === undefined)
+        return undefined;
+    const parts = token.split(".");
+    if (parts.length !== 3 || parts[1] === undefined)
+        return undefined;
+    try {
+        const value = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The OpenAI auth namespace claims (`chatgpt_account_id`, `chatgpt_plan_type`, …). */
+export function openAiAuthClaims(claims) {
+    const namespace = claims?.["https://api.openai.com/auth"];
+    return typeof namespace === "object" && namespace !== null ? namespace : {};
+}
+export function claimString(claims, key) {
+    const value = claims?.[key];
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+/** `t***@example.com`: enough to recognize the account, not enough to leak the address. */
+export function maskEmail(email) {
+    if (email === undefined)
+        return undefined;
+    const at = email.indexOf("@");
+    if (at <= 0)
+        return undefined;
+    return `${email[0]}***${email.slice(at)}`.slice(0, 200);
+}
+//# sourceMappingURL=jwt.js.map

package/dist/harness/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/harness/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAyB;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,gBAAgB,CAAC,MAA2C;IAC1E,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,CAAC;IAC1D,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC,CAAE,SAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA2C,EAAE,GAAW;IAClF,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,SAAS,CAAC,KAAyB;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/harness/auth/keychain.d.ts

@@ -0,0 +1,39 @@
+export interface CommandResult {
+    readonly code: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly spawnError?: string;
+}
+/** Runs an OS credential CLI. Secrets travel through `input` (stdin), never through argv. */
+export type CommandRunner = (command: string, args: readonly string[], input: string | undefined) => Promise<CommandResult>;
+export type SyncCommandRunner = (command: string, args: readonly string[], input: string | undefined) => CommandResult;
+export declare const defaultRunner: CommandRunner;
+export declare const defaultSyncRunner: SyncCommandRunner;
+/** A per-account secret slot in an OS-protected store. Values are opaque ASCII strings. */
+export interface SecretVault {
+    readonly kind: "macos-keychain" | "secret-service" | "windows-dpapi";
+    get(account: string): Promise<string | undefined>;
+    set(account: string, value: string): Promise<void>;
+    delete(account: string): Promise<boolean>;
+}
+/** macOS: the `security` CLI. Writes go through `security -i` on stdin so the value never hits argv. */
+export declare function macosKeychainVault(run: CommandRunner): SecretVault;
+/** Linux: libsecret's `secret-tool` (Secret Service); the value is read from stdin by `store`. */
+export declare function secretServiceVault(run: CommandRunner): SecretVault;
+/**
+ * Windows: values are encrypted with DPAPI (bound to the current Windows user) through PowerShell's
+ * `ConvertFrom-SecureString`, and only the ciphertext is written to `credentials.dpapi.json`.
+ */
+export declare function windowsDpapiVault(run: CommandRunner, filePath: string): SecretVault;
+export interface VaultProbe {
+    readonly platform: NodeJS.Platform;
+    readonly runSync: SyncCommandRunner;
+    readonly run: CommandRunner;
+    readonly dpapiFile: string;
+}
+/**
+ * Feature probe for an OS store, run once when the credential store is created. Anything short of
+ * a clean answer (missing CLI, no D-Bus session, locked-down PowerShell) means "unavailable".
+ */
+export declare function probeVault(input: VaultProbe): SecretVault | undefined;
+//# sourceMappingURL=keychain.d.ts.map

package/dist/harness/auth/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/keychain.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAC5H,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,aAAa,CAAC;AAevH,eAAO,MAAM,aAAa,EAAE,aAuBxB,CAAC;AAEL,eAAO,MAAM,iBAAiB,EAAE,iBAQ/B,CAAC;AAEF,2FAA2F;AAC3F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CAAC;IACrE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAClD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAaD,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,WAAW,CAsBlE;AAED,kGAAkG;AAClG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,WAAW,CAsBlE;AAgBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAkCnF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAmBrE"}