synorch 0.2.0 → 0.4.0-beta.0

package/dist/harness/auth/keychain.js

@@ -0,0 +1,191 @@
+import { spawn, spawnSync } from "node:child_process";
+import { CREDENTIAL_SERVICE_NAME } from "../contracts/index.js";
+import { readJsonFile, writeJsonAtomic } from "./json-file.js";
+const COMMAND_TIMEOUT_MS = 20_000;
+/**
+ * Windows PowerShell 5.1 started from PowerShell 7 (the GitHub Actions default shell, or a user's
+ * pwsh terminal) inherits a PSModulePath that lists the 7.x module folders first; autoloading
+ * `Microsoft.PowerShell.Security` (ConvertTo-SecureString) then picks the Core-only copy and fails.
+ * Without the variable, powershell.exe computes its own default module path.
+ */
+function childEnvironment(command) {
+    if (!/^powershell(?:\.exe)?$/i.test(command))
+        return undefined;
+    return Object.fromEntries(Object.entries(process.env).filter(([name]) => name.toLowerCase() !== "psmodulepath"));
+}
+export const defaultRunner = (command, args, input) => new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (result) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(result);
+    };
+    const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], windowsHide: true, env: childEnvironment(command) });
+    const timer = setTimeout(() => child.kill(), COMMAND_TIMEOUT_MS);
+    child.stdout.setEncoding("utf8").on("data", (chunk) => {
+        stdout += chunk;
+    });
+    child.stderr.setEncoding("utf8").on("data", (chunk) => {
+        stderr += chunk;
+    });
+    child.on("error", (error) => finish({ code: null, stdout, stderr, spawnError: error.message }));
+    child.on("close", (code) => finish({ code, stdout, stderr }));
+    child.stdin.on("error", () => undefined);
+    child.stdin.end(input ?? "");
+});
+export const defaultSyncRunner = (command, args, input) => {
+    const result = spawnSync(command, args, { input: input ?? "", encoding: "utf8", timeout: COMMAND_TIMEOUT_MS, windowsHide: true, env: childEnvironment(command) });
+    return {
+        code: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        ...(result.error === undefined ? {} : { spawnError: result.error.message }),
+    };
+};
+class VaultError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "VaultError";
+    }
+}
+function failed(action, result) {
+    return new VaultError(`${action} failed (${result.spawnError ?? `exit ${String(result.code)}`})`);
+}
+/** macOS: the `security` CLI. Writes go through `security -i` on stdin so the value never hits argv. */
+export function macosKeychainVault(run) {
+    const quote = (value) => `"${value.replace(/["\\]/g, "\\$&")}"`;
+    return {
+        kind: "macos-keychain",
+        async get(account) {
+            const result = await run("security", ["find-generic-password", "-a", account, "-s", CREDENTIAL_SERVICE_NAME, "-w"], undefined);
+            if (result.code === 0)
+                return result.stdout.replace(/\r?\n$/, "");
+            if (result.code === 44)
+                return undefined;
+            throw failed("keychain read", result);
+        },
+        async set(account, value) {
+            const line = `add-generic-password -U -a ${quote(account)} -s ${quote(CREDENTIAL_SERVICE_NAME)} -w ${quote(value)}\n`;
+            const result = await run("security", ["-i"], line);
+            if (result.code !== 0 || /error/i.test(result.stderr))
+                throw failed("keychain write", result);
+        },
+        async delete(account) {
+            const result = await run("security", ["delete-generic-password", "-a", account, "-s", CREDENTIAL_SERVICE_NAME], undefined);
+            if (result.code === 0)
+                return true;
+            if (result.code === 44)
+                return false;
+            throw failed("keychain delete", result);
+        },
+    };
+}
+/** Linux: libsecret's `secret-tool` (Secret Service); the value is read from stdin by `store`. */
+export function secretServiceVault(run) {
+    const attributes = (account) => ["service", CREDENTIAL_SERVICE_NAME, "account", account];
+    return {
+        kind: "secret-service",
+        async get(account) {
+            const result = await run("secret-tool", ["lookup", ...attributes(account)], undefined);
+            if (result.code === 0)
+                return result.stdout.replace(/\r?\n$/, "");
+            if (result.code === 1 && result.stderr.trim() === "")
+                return undefined;
+            throw failed("secret service read", result);
+        },
+        async set(account, value) {
+            const result = await run("secret-tool", ["store", `--label=Synorch ${account}`, ...attributes(account)], value);
+            if (result.code !== 0)
+                throw failed("secret service write", result);
+        },
+        async delete(account) {
+            const existing = await this.get(account);
+            if (existing === undefined)
+                return false;
+            const result = await run("secret-tool", ["clear", ...attributes(account)], undefined);
+            if (result.code !== 0)
+                throw failed("secret service delete", result);
+            return true;
+        },
+    };
+}
+const POWERSHELL_ARGS = ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command"];
+const DPAPI_PROTECT = "$ErrorActionPreference='Stop';$s=[Console]::In.ReadToEnd();" +
+    "$ss=ConvertTo-SecureString -String $s -AsPlainText -Force;[Console]::Out.Write((ConvertFrom-SecureString -SecureString $ss))";
+const DPAPI_UNPROTECT = "$ErrorActionPreference='Stop';$c=[Console]::In.ReadToEnd().Trim();$ss=ConvertTo-SecureString -String $c;" +
+    "$b=[Runtime.InteropServices.Marshal]::SecureStringToBSTR($ss);" +
+    "try{[Console]::Out.Write([Runtime.InteropServices.Marshal]::PtrToStringBSTR($b))}finally{[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($b)}";
+/**
+ * Windows: values are encrypted with DPAPI (bound to the current Windows user) through PowerShell's
+ * `ConvertFrom-SecureString`, and only the ciphertext is written to `credentials.dpapi.json`.
+ */
+export function windowsDpapiVault(run, filePath) {
+    async function load() {
+        const parsed = await readJsonFile(filePath);
+        if (typeof parsed === "object" && parsed !== null && parsed.schema_version === 1) {
+            const entries = parsed.entries;
+            if (typeof entries === "object" && entries !== null)
+                return { schema_version: 1, entries: { ...entries } };
+        }
+        return { schema_version: 1, entries: {} };
+    }
+    return {
+        kind: "windows-dpapi",
+        async get(account) {
+            const cipher = (await load()).entries[account];
+            if (cipher === undefined)
+                return undefined;
+            const result = await run("powershell.exe", [...POWERSHELL_ARGS, DPAPI_UNPROTECT], cipher);
+            if (result.code !== 0)
+                throw failed("DPAPI decrypt", result);
+            return result.stdout;
+        },
+        async set(account, value) {
+            const result = await run("powershell.exe", [...POWERSHELL_ARGS, DPAPI_PROTECT], value);
+            const cipher = result.stdout.trim();
+            if (result.code !== 0 || !/^[0-9a-f]+$/i.test(cipher))
+                throw failed("DPAPI encrypt", result);
+            const file = await load();
+            file.entries[account] = cipher;
+            await writeJsonAtomic(filePath, file);
+        },
+        async delete(account) {
+            const file = await load();
+            if (file.entries[account] === undefined)
+                return false;
+            delete file.entries[account];
+            await writeJsonAtomic(filePath, file);
+            return true;
+        },
+    };
+}
+/**
+ * Feature probe for an OS store, run once when the credential store is created. Anything short of
+ * a clean answer (missing CLI, no D-Bus session, locked-down PowerShell) means "unavailable".
+ */
+export function probeVault(input) {
+    if (input.platform === "darwin") {
+        const result = input.runSync("security", ["list-keychains"], undefined);
+        return result.code === 0 ? macosKeychainVault(input.run) : undefined;
+    }
+    if (input.platform === "linux") {
+        const result = input.runSync("secret-tool", ["lookup", "service", CREDENTIAL_SERVICE_NAME, "account", "synorch:probe"], undefined);
+        const reachable = result.spawnError === undefined && (result.code === 0 || result.code === 1) && result.stderr.trim() === "";
+        return reachable ? secretServiceVault(input.run) : undefined;
+    }
+    if (input.platform === "win32") {
+        const sample = "synorch-probe";
+        const encrypted = input.runSync("powershell.exe", [...POWERSHELL_ARGS, DPAPI_PROTECT], sample);
+        const cipher = encrypted.stdout.trim();
+        if (encrypted.code !== 0 || !/^[0-9a-f]+$/i.test(cipher))
+            return undefined;
+        const decrypted = input.runSync("powershell.exe", [...POWERSHELL_ARGS, DPAPI_UNPROTECT], cipher);
+        return decrypted.code === 0 && decrypted.stdout === sample ? windowsDpapiVault(input.run, input.dpapiFile) : undefined;
+    }
+    return undefined;
+}
+//# sourceMappingURL=keychain.js.map

package/dist/harness/auth/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/harness/auth/keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAa/D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CACnE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE;QACvC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3H,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACjE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC5D,MAAM,IAAI,KAAK,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC5D,MAAM,IAAI,KAAK,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;IAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClK,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC,CAAC;AAUF,MAAM,UAAW,SAAQ,KAAK;IAC5B,YAAmB,OAAe;QAChC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,MAAqB;IACnD,OAAO,IAAI,UAAU,CAAC,GAAG,MAAM,YAAY,MAAM,CAAC,UAAU,IAAI,QAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;AACpG,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACnD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;IACxE,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;YAC/H,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK;YACtB,MAAM,IAAI,GAAG,8BAA8B,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,uBAAuB,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;YACtH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;YAC3H,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;gBAAE,OAAO,KAAK,CAAC;YACrC,MAAM,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACnD,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACjG,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACvF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAC;YACvE,MAAM,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK;YACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,mBAAmB,OAAO,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAChH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACtF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAU,CAAC;AAC1F,MAAM,aAAa,GACjB,6DAA6D;IAC7D,8HAA8H,CAAC;AACjI,MAAM,eAAe,GACnB,0GAA0G;IAC1G,gEAAgE;IAChE,+IAA+I,CAAC;AAOlJ;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAkB,EAAE,QAAgB;IACpE,KAAK,UAAU,IAAI;QACjB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAAoB,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;YAChG,MAAM,OAAO,GAAI,MAAoB,CAAC,OAAO,CAAC;YAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;QAC7G,CAAC;QACD,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,eAAe,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1F,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK;YACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,eAAe,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,MAAM,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC7F,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;YAC/B,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACtD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,uBAAuB,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,SAAS,CAAC,CAAC;QACnI,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7H,OAAO,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,eAAe,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,eAAe,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;QACjG,OAAO,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/harness/auth/locks.d.ts

@@ -0,0 +1,19 @@
+export interface FileLockOptions {
+    /** A lock older than this is considered abandoned (crashed holder) and taken over. */
+    readonly staleMs?: number;
+    readonly timeoutMs?: number;
+    readonly pollMs?: number;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Cross-process mutual exclusion through an `O_EXCL` lock file holding the owner's pid and a random
+ * token. Release removes the file only if it still carries our token. A lock whose holder process
+ * is gone, or which is older than `staleMs`, is taken over.
+ */
+export declare function acquireFileLock(lockPath: string, options?: FileLockOptions): Promise<() => Promise<void>>;
+/** In-process, per-key serialization: callers for the same key run one after another. */
+export declare class KeyedMutex {
+    private readonly tails;
+    run<T>(key: string, task: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=locks.d.ts.map

package/dist/harness/auth/locks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locks.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/locks.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAMD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CA0CnH;AA0BD,yFAAyF;AACzF,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAEhD,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAWrE"}

package/dist/harness/auth/locks.js

@@ -0,0 +1,102 @@
+import { randomBytes } from "node:crypto";
+import { mkdir, open, readFile, rm, stat } from "node:fs/promises";
+import path from "node:path";
+import { HarnessError } from "../contracts/index.js";
+const DEFAULT_STALE_MS = 60_000;
+const DEFAULT_TIMEOUT_MS = 90_000;
+const DEFAULT_POLL_MS = 25;
+/**
+ * Cross-process mutual exclusion through an `O_EXCL` lock file holding the owner's pid and a random
+ * token. Release removes the file only if it still carries our token. A lock whose holder process
+ * is gone, or which is older than `staleMs`, is taken over.
+ */
+export async function acquireFileLock(lockPath, options = {}) {
+    const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
+    const deadline = Date.now() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    const token = randomBytes(16).toString("hex");
+    await mkdir(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+    while (true) {
+        if (options.signal?.aborted === true) {
+            throw new HarnessError({ code: "cancelled", message: "lock wait aborted", workspace_effect: "none", retry_safe: true });
+        }
+        try {
+            const handle = await open(lockPath, "wx", 0o600);
+            try {
+                await handle.writeFile(JSON.stringify({ pid: process.pid, token, acquired_at: new Date().toISOString() }));
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            return async () => {
+                try {
+                    const current = JSON.parse(await readFile(lockPath, "utf8"));
+                    if (current.token === token)
+                        await rm(lockPath, { force: true });
+                }
+                catch {
+                    return;
+                }
+            };
+        }
+        catch (error) {
+            if (!isExists(error))
+                throw error;
+        }
+        if (await isAbandoned(lockPath, staleMs)) {
+            await rm(lockPath, { force: true }).catch(() => undefined);
+            continue;
+        }
+        if (Date.now() > deadline) {
+            throw new HarnessError({
+                code: "internal",
+                message: `timed out waiting for lock ${path.basename(lockPath)}`,
+                workspace_effect: "none",
+                retry_safe: true,
+            });
+        }
+        await new Promise((resolve) => setTimeout(resolve, options.pollMs ?? DEFAULT_POLL_MS));
+    }
+}
+async function isAbandoned(lockPath, staleMs) {
+    try {
+        const [info, text] = await Promise.all([stat(lockPath), readFile(lockPath, "utf8")]);
+        if (Date.now() - info.mtimeMs > staleMs)
+            return true;
+        const owner = JSON.parse(text);
+        return typeof owner.pid === "number" && owner.pid !== process.pid && !isAlive(owner.pid);
+    }
+    catch {
+        return false;
+    }
+}
+function isAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+function isExists(error) {
+    return error?.code === "EEXIST";
+}
+/** In-process, per-key serialization: callers for the same key run one after another. */
+export class KeyedMutex {
+    tails = new Map();
+    async run(key, task) {
+        const previous = this.tails.get(key) ?? Promise.resolve();
+        const current = previous.catch(() => undefined).then(task);
+        const tail = current.catch(() => undefined);
+        this.tails.set(key, tail);
+        try {
+            return await current;
+        }
+        finally {
+            if (this.tails.get(key) === tail)
+                this.tails.delete(key);
+        }
+    }
+}
+//# sourceMappingURL=locks.js.map

package/dist/harness/auth/locks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"locks.js","sourceRoot":"","sources":["../../../src/harness/auth/locks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAUrD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,UAA2B,EAAE;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC3G,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YACD,OAAO,KAAK,IAAI,EAAE;gBAChB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAwB,CAAC;oBACpF,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;wBAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO;gBACT,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,8BAA8B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBAChE,gBAAgB,EAAE,MAAM;gBACxB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,OAAe;IAC1D,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,OAAO;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;QACpD,OAAO,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAQ,KAA2C,EAAE,IAAI,KAAK,QAAQ,CAAC;AACzE,CAAC;AAED,yFAAyF;AACzF,MAAM,OAAO,UAAU;IACJ,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEtD,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,IAAsB;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF"}

package/dist/harness/auth/notices.d.ts

@@ -0,0 +1,6 @@
+import type { AuthNotice } from "../contracts/index.ts";
+export declare const CHATGPT_SUBSCRIPTION_NOTICE: AuthNotice;
+export declare const CLAUDE_BRIDGE_NOTICE: AuthNotice;
+export declare const API_KEY_BILLING_NOTICE: AuthNotice;
+export declare function plaintextCredentialNotice(filePath: string): AuthNotice;
+//# sourceMappingURL=notices.d.ts.map

package/dist/harness/auth/notices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notices.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/notices.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,eAAO,MAAM,2BAA2B,EAAE,UAOzC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,UAQlC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,UAIpC,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAQtE"}

package/dist/harness/auth/notices.js

@@ -0,0 +1,29 @@
+export const CHATGPT_SUBSCRIPTION_NOTICE = {
+    id: "chatgpt-subscription",
+    text: "You are signing in with your ChatGPT account. Synorch sends requests to OpenAI's Codex backend under your plan's " +
+        "usage limits; no API bill is created. This access relies on OpenAI's public support for third-party clients, not " +
+        "a written contract, and may change. Do not share your account and do not expose Synorch as a service to others.",
+    requiresAcknowledgement: true,
+};
+export const CLAUDE_BRIDGE_NOTICE = {
+    id: "claude-bridge-experimental",
+    text: "Experimental: Synorch will run the Claude Code installed on this computer and signed in by you. Synorch never sees, " +
+        "reads or stores your Claude credentials. Anthropic restricts subscription use by third-party products: this usage may " +
+        "draw from paid 'extra usage' instead of your plan, or be blocked by Anthropic. The definitive, supported path is a " +
+        "Claude API key (`syn login anthropic --method api-key`).",
+    requiresAcknowledgement: true,
+};
+export const API_KEY_BILLING_NOTICE = {
+    id: "api-key-billing",
+    text: "Requests made with this API key are billed to your API account. The key is kept in Synorch's credential store.",
+    requiresAcknowledgement: false,
+};
+export function plaintextCredentialNotice(filePath) {
+    return {
+        id: "plaintext-credential-file",
+        text: `No OS keychain is available, so credentials are stored unencrypted in ${filePath} (file mode 0600, directory 0700). ` +
+            "Anyone who can read files as your user can read them.",
+        requiresAcknowledgement: false,
+    };
+}
+//# sourceMappingURL=notices.js.map

package/dist/harness/auth/notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notices.js","sourceRoot":"","sources":["../../../src/harness/auth/notices.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,2BAA2B,GAAe;IACrD,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EACF,mHAAmH;QACnH,mHAAmH;QACnH,iHAAiH;IACnH,uBAAuB,EAAE,IAAI;CAC9B,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAe;IAC9C,EAAE,EAAE,4BAA4B;IAChC,IAAI,EACF,sHAAsH;QACtH,wHAAwH;QACxH,qHAAqH;QACrH,0DAA0D;IAC5D,uBAAuB,EAAE,IAAI;CAC9B,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAe;IAChD,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,gHAAgH;IACtH,uBAAuB,EAAE,KAAK;CAC/B,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,OAAO;QACL,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EACF,yEAAyE,QAAQ,qCAAqC;YACtH,uDAAuD;QACzD,uBAAuB,EAAE,KAAK;KAC/B,CAAC;AACJ,CAAC"}

package/dist/harness/auth/openai-chatgpt.d.ts

@@ -0,0 +1,32 @@
+import { type AuthProvider, type CredentialStore } from "../contracts/index.ts";
+import type { ProfileStateStore } from "./profile-state.ts";
+/** Constants verified in research/provider-auth/openai-chatgpt-oauth.md §2–§6. */
+export declare const OPENAI_AUTH_ISSUER = "https://auth.openai.com";
+export declare const CODEX_PUBLIC_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export declare const CHATGPT_LOOPBACK_PORT = 1455;
+export declare const CHATGPT_OAUTH_SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+export declare const CHATGPT_ORIGINATOR = "synorch";
+/** Refresh when fewer than five minutes remain (Codex `CHATGPT_ACCESS_TOKEN_REFRESH_WINDOW_MINUTES`). */
+export declare const REFRESH_WINDOW_MS: number;
+export type AuthFetch = (input: string, init: RequestInit) => Promise<Response>;
+export interface ChatGPTAuthOptions {
+    readonly state: ProfileStateStore;
+    readonly fetch?: AuthFetch;
+    readonly now?: () => Date;
+    readonly issuer?: string;
+    readonly clientId?: string;
+    /** Loopback port for the browser flow; tests pass 0 for an ephemeral port. */
+    readonly loopbackPort?: number;
+    /** `--device-code`: skip the browser flow. */
+    readonly deviceCode?: boolean;
+    readonly browserTimeoutMs?: number;
+    readonly deviceTimeoutMs?: number;
+    readonly sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+}
+/**
+ * `openai` / `oauth-subscription`: Synorch's own "Sign in with ChatGPT" (PKCE loopback on
+ * `localhost:1455`, device-code fallback), identifying honestly as `originator=synorch`. Tokens go
+ * only to Synorch's credential store; the Codex CLI's own token file is never read or written.
+ */
+export declare function createChatGPTAuthProvider(store: CredentialStore, profile: string, options: ChatGPTAuthOptions): AuthProvider;
+//# sourceMappingURL=openai-chatgpt.d.ts.map

package/dist/harness/auth/openai-chatgpt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-chatgpt.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/openai-chatgpt.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,YAAY,EAIjB,KAAK,eAAe,EAGrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAG5D,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAC5D,eAAO,MAAM,sBAAsB,iCAAiC,CAAC;AACrE,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAC1C,eAAO,MAAM,mBAAmB,kFAAkF,CAAC;AACnH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAC5C,yGAAyG;AACzG,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAM5C,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEhF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAoDD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,YAAY,CAqU5H"}