synorch 0.3.0 → 0.4.0-beta.0

package/dist/domain/product.js.map

@@ -1 +1 @@
-{"version":3,"file":"product.js","sourceRoot":"","sources":["../../src/domain/product.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAkB,CAAC;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,OAAgB,CAAC"}
+{"version":3,"file":"product.js","sourceRoot":"","sources":["../../src/domain/product.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAkB,CAAC;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,cAAuB,CAAC"}

package/dist/domain/suggest.d.ts

@@ -0,0 +1,5 @@
+/** Optimal string alignment distance: insertions, deletions, substitutions and adjacent transpositions cost 1. */
+export declare function editDistance(left: string, right: string): number;
+/** The closest candidate within a length-scaled distance (at most 3), or undefined when nothing is plausibly meant. */
+export declare function closestMatch(input: string, candidates: readonly string[]): string | undefined;
+//# sourceMappingURL=suggest.d.ts.map

package/dist/domain/suggest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../src/domain/suggest.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBhE;AAED,uHAAuH;AACvH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAS7F"}

package/dist/domain/suggest.js

@@ -0,0 +1,32 @@
+/** Optimal string alignment distance: insertions, deletions, substitutions and adjacent transpositions cost 1. */
+export function editDistance(left, right) {
+    const rows = left.length + 1;
+    const columns = right.length + 1;
+    const table = Array.from({ length: rows }, (_, row) => Array.from({ length: columns }, (_, column) => (row === 0 ? column : column === 0 ? row : 0)));
+    for (let row = 1; row < rows; row += 1) {
+        for (let column = 1; column < columns; column += 1) {
+            const cost = left[row - 1] === right[column - 1] ? 0 : 1;
+            const current = table[row];
+            const previous = table[row - 1];
+            let best = Math.min(previous[column] + 1, current[column - 1] + 1, previous[column - 1] + cost);
+            if (row > 1 && column > 1 && left[row - 1] === right[column - 2] && left[row - 2] === right[column - 1]) {
+                best = Math.min(best, table[row - 2][column - 2] + 1);
+            }
+            current[column] = best;
+        }
+    }
+    return table[rows - 1][columns - 1];
+}
+/** The closest candidate within a length-scaled distance (at most 3), or undefined when nothing is plausibly meant. */
+export function closestMatch(input, candidates) {
+    const needle = input.toLowerCase();
+    const limit = Math.min(3, Math.max(1, Math.ceil(needle.length / 3)));
+    let best;
+    for (const candidate of candidates) {
+        const distance = editDistance(needle, candidate.toLowerCase());
+        if (distance <= limit && (best === undefined || distance < best.distance))
+            best = { candidate, distance };
+    }
+    return best?.candidate;
+}
+//# sourceMappingURL=suggest.js.map

package/dist/domain/suggest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggest.js","sourceRoot":"","sources":["../../src/domain/suggest.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClK,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACvC,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAa,CAAC;YACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAa,CAAC;YAC5C,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,CAAE,QAAQ,CAAC,MAAM,CAAY,GAAG,CAAC,EAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAY,GAAG,CAAC,EAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAY,GAAG,IAAI,CAAC,CAAC;YACpI,IAAI,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAc,CAAC,MAAM,GAAG,CAAC,CAAY,GAAG,CAAC,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAQ,KAAK,CAAC,IAAI,GAAG,CAAC,CAAc,CAAC,OAAO,GAAG,CAAC,CAAW,CAAC;AAC9D,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,UAA6B;IACvE,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,IAA2E,CAAC;IAChF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,IAAI,QAAQ,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAAE,IAAI,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC5G,CAAC;IACD,OAAO,IAAI,EAAE,SAAS,CAAC;AACzB,CAAC"}

package/dist/harness/auth/api-key.d.ts

@@ -0,0 +1,13 @@
+import { type AuthProvider, type CredentialStore } from "../contracts/index.ts";
+export type ApiKeyProviderId = "openai" | "anthropic";
+/** Read-only environment fallback for the `default` profile; Synorch never writes it to disk. */
+export declare const API_KEY_ENV: {
+    readonly [P in ApiKeyProviderId]: string;
+};
+export interface ApiKeyAuthOptions {
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly now?: () => Date;
+}
+/** `api-key` for OpenAI Responses (`Authorization: Bearer`) and Anthropic Messages (`x-api-key`). */
+export declare function createApiKeyAuthProvider(store: CredentialStore, providerId: ApiKeyProviderId, profile: string, options?: ApiKeyAuthOptions): AuthProvider;
+//# sourceMappingURL=api-key.d.ts.map

package/dist/harness/auth/api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/api-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,YAAY,EAIjB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAI/B,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEtD,iGAAiG;AACjG,eAAO,MAAM,WAAW,EAAE;IAAE,QAAQ,EAAE,CAAC,IAAI,gBAAgB,GAAG,MAAM;CAGnE,CAAC;AAOF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,qGAAqG;AACrG,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,gBAAgB,EAC5B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,iBAAsB,GAC9B,YAAY,CAqEd"}

package/dist/harness/auth/api-key.js

@@ -0,0 +1,87 @@
+import { HarnessError, PROVIDER_ERROR_RETRYABLE, ProviderFailure, providerIdSchema, } from "../contracts/index.js";
+import { API_KEY_BILLING_NOTICE } from "./notices.js";
+import { createResolvedCredential } from "./resolved-credential.js";
+/** Read-only environment fallback for the `default` profile; Synorch never writes it to disk. */
+export const API_KEY_ENV = {
+    openai: "OPENAI_API_KEY",
+    anthropic: "ANTHROPIC_API_KEY",
+};
+const LABELS = {
+    openai: "OpenAI API key",
+    anthropic: "Anthropic API key",
+};
+/** `api-key` for OpenAI Responses (`Authorization: Bearer`) and Anthropic Messages (`x-api-key`). */
+export function createApiKeyAuthProvider(store, providerId, profile, options = {}) {
+    const env = options.env ?? process.env;
+    const now = options.now ?? (() => new Date());
+    const ref = { provider_id: providerIdSchema.parse(providerId), method: "api-key", profile };
+    const envName = API_KEY_ENV[providerId];
+    function fromEnv() {
+        if (profile !== "default")
+            return undefined;
+        const value = env[envName]?.trim();
+        return value === undefined || value === "" ? undefined : { method: "api-key", api_key: value, created_at: new Date(0).toISOString() };
+    }
+    function apply(headers, secret) {
+        if (secret.method !== "api-key")
+            return;
+        if (providerId === "anthropic")
+            headers.set("x-api-key", secret.api_key);
+        else
+            headers.set("authorization", `Bearer ${secret.api_key}`);
+    }
+    async function status() {
+        const base = { provider_id: ref.provider_id, method: ref.method, profile, billing: "metered" };
+        let stored;
+        try {
+            stored = await store.get(ref);
+        }
+        catch {
+            return { ...base, state: "error", entitlement: "unknown", store_backend: store.backend, detail: "stored credential is unreadable" };
+        }
+        if (stored !== undefined)
+            return { ...base, state: "connected", entitlement: "unverified", store_backend: store.backend };
+        if (fromEnv() !== undefined)
+            return { ...base, state: "connected", entitlement: "unverified", detail: `from environment variable ${envName}` };
+        return { ...base, state: "disconnected", entitlement: "unknown" };
+    }
+    return {
+        providerId: ref.provider_id,
+        method: "api-key",
+        profile,
+        notices: [API_KEY_BILLING_NOTICE],
+        status: () => status(),
+        async login(interaction, signal) {
+            if (!interaction.interactive) {
+                throw new HarnessError({
+                    code: "auth_required",
+                    message: `${LABELS[providerId]} entry needs an interactive terminal; set ${envName} for headless use`,
+                    workspace_effect: "none",
+                    retry_safe: true,
+                });
+            }
+            interaction.notify(API_KEY_BILLING_NOTICE.text);
+            const value = (await interaction.promptSecret(LABELS[providerId], signal)).trim();
+            if (value === "" || /\s/.test(value)) {
+                throw new HarnessError({ code: "usage_invalid", message: "the API key is empty or contains whitespace", workspace_effect: "none", retry_safe: true });
+            }
+            await store.set(ref, { method: "api-key", api_key: value, created_at: now().toISOString() });
+            return status();
+        },
+        async logout() {
+            await store.delete(ref);
+        },
+        async resolve() {
+            const secret = (await store.get(ref)) ?? fromEnv();
+            if (secret === undefined) {
+                throw new ProviderFailure({
+                    code: "unauthenticated",
+                    message: `no ${LABELS[providerId]} for profile ${profile}; run \`syn login ${providerId} --method api-key\``,
+                    retryable: PROVIDER_ERROR_RETRYABLE.unauthenticated,
+                });
+            }
+            return createResolvedCredential(ref, secret, apply);
+        },
+    };
+}
+//# sourceMappingURL=api-key.js.map

package/dist/harness/auth/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../../src/harness/auth/api-key.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,eAAe,EACf,gBAAgB,GAMjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIpE,iGAAiG;AACjG,MAAM,CAAC,MAAM,WAAW,GAAiD;IACvE,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,mBAAmB;CAC/B,CAAC;AAEF,MAAM,MAAM,GAAiD;IAC3D,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,mBAAmB;CAC/B,CAAC;AAOF,qGAAqG;AACrG,MAAM,UAAU,wBAAwB,CACtC,KAAsB,EACtB,UAA4B,EAC5B,OAAe,EACf,UAA6B,EAAE;IAE/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAkB,EAAE,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC3G,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAExC,SAAS,OAAO;QACd,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;QACnC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IACxI,CAAC;IAED,SAAS,KAAK,CAAC,OAAgB,EAAE,MAAwB;QACvD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO;QACxC,IAAI,UAAU,KAAK,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;;YACpE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,MAAM,IAAI,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAkB,EAAE,CAAC;QACxG,IAAI,MAAoC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACtI,CAAC;QACD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1H,IAAI,OAAO,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,6BAA6B,OAAO,EAAE,EAAE,CAAC;QAC/I,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;IAED,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,MAAM,EAAE,SAAS;QACjB,OAAO;QACP,OAAO,EAAE,CAAC,sBAAsB,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE;QACtB,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM;YAC7B,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,6CAA6C,OAAO,mBAAmB;oBACrG,gBAAgB,EAAE,MAAM;oBACxB,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,WAAW,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClF,IAAI,KAAK,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,6CAA6C,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACxJ,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC7F,OAAO,MAAM,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,OAAO;YACX,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;YACnD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CAAC;oBACxB,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,MAAM,MAAM,CAAC,UAAU,CAAC,gBAAgB,OAAO,qBAAqB,UAAU,qBAAqB;oBAC5G,SAAS,EAAE,wBAAwB,CAAC,eAAe;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/harness/auth/claude-bridge.d.ts

@@ -0,0 +1,22 @@
+import { type AuthProvider } from "../contracts/index.ts";
+import type { ProfileStateStore } from "./profile-state.ts";
+export interface ClaudeCliProbeResult {
+    readonly installed: boolean;
+    readonly version: string | undefined;
+}
+/** Checks the user's own `claude` install. It only runs `claude --version`; no Claude file is read. */
+export type ClaudeCliProbe = (signal: AbortSignal) => Promise<ClaudeCliProbeResult>;
+export interface ClaudeBridgeAuthOptions {
+    readonly state: ProfileStateStore;
+    readonly probe?: ClaudeCliProbe;
+    readonly now?: () => Date;
+}
+export declare const defaultClaudeProbe: ClaudeCliProbe;
+/**
+ * `anthropic` / `cli-bridge`: the Claude subscription is used only through the user's installed
+ * Claude Code. "Login" is the explicit experimental opt-in (a one-time notice); signing in to
+ * Claude itself happens inside `claude` (`/login`). No token exists on Synorch's side, so
+ * `resolve` always rejects and nothing is ever written to the credential store.
+ */
+export declare function createClaudeBridgeAuthProvider(profile: string, options: ClaudeBridgeAuthOptions): AuthProvider;
+//# sourceMappingURL=claude-bridge.d.ts.map

package/dist/harness/auth/claude-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-bridge.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/claude-bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,YAAY,EAGlB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,uGAAuG;AACvG,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEpF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,eAAO,MAAM,kBAAkB,EAAE,cAqB7B,CAAC;AAEL;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,YAAY,CA4D9G"}

package/dist/harness/auth/claude-bridge.js

@@ -0,0 +1,92 @@
+import { spawn } from "node:child_process";
+import { HarnessError, isBridgeStrippedEnvName, PROVIDER_ERROR_RETRYABLE, ProviderFailure, providerIdSchema, } from "../contracts/index.js";
+import { CLAUDE_BRIDGE_NOTICE } from "./notices.js";
+export const defaultClaudeProbe = (signal) => new Promise((resolve) => {
+    const env = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value !== undefined && !isBridgeStrippedEnvName(key))
+            env[key] = value;
+    }
+    let stdout = "";
+    const child = spawn("claude --version", { shell: true, env, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] });
+    const timer = setTimeout(() => child.kill(), 15_000);
+    const onAbort = () => child.kill();
+    signal.addEventListener("abort", onAbort, { once: true });
+    child.stdout.setEncoding("utf8").on("data", (chunk) => {
+        stdout = (stdout + chunk).slice(-4096);
+    });
+    const finish = (installed) => {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", onAbort);
+        resolve({ installed, version: /(\d+\.\d+\.\d+)/.exec(stdout)?.[1] });
+    };
+    child.on("error", () => finish(false));
+    child.on("close", (code) => finish(code === 0 && /\d+\.\d+\.\d+/.test(stdout)));
+});
+/**
+ * `anthropic` / `cli-bridge`: the Claude subscription is used only through the user's installed
+ * Claude Code. "Login" is the explicit experimental opt-in (a one-time notice); signing in to
+ * Claude itself happens inside `claude` (`/login`). No token exists on Synorch's side, so
+ * `resolve` always rejects and nothing is ever written to the credential store.
+ */
+export function createClaudeBridgeAuthProvider(profile, options) {
+    const now = options.now ?? (() => new Date());
+    const probe = options.probe ?? defaultClaudeProbe;
+    const ref = { provider_id: providerIdSchema.parse("anthropic"), method: "cli-bridge", profile };
+    async function status(signal) {
+        const base = { provider_id: ref.provider_id, method: ref.method, profile, entitlement: "unknown", billing: "unknown" };
+        const probed = await probe(signal).catch(() => ({ installed: false, version: undefined }));
+        if (!probed.installed)
+            return { ...base, state: "disconnected", detail: "claude executable not found; install Claude Code to use the bridge" };
+        const version = `Claude Code ${probed.version ?? "unknown version"}`;
+        if (!(await options.state.isAcknowledged(CLAUDE_BRIDGE_NOTICE.id, ref))) {
+            return { ...base, state: "login_required", detail: `${version}; experimental bridge not enabled (syn login anthropic --method cli-bridge)` };
+        }
+        return { ...base, state: "unknown", detail: `${version}; Claude sign-in is checked by Claude Code on first use (run \`claude\`, then /login)` };
+    }
+    return {
+        providerId: ref.provider_id,
+        method: "cli-bridge",
+        profile,
+        notices: [CLAUDE_BRIDGE_NOTICE],
+        status,
+        async login(interaction, signal) {
+            if (!interaction.interactive) {
+                throw new HarnessError({
+                    code: "auth_required",
+                    message: "enabling the experimental Claude Code bridge needs an interactive terminal",
+                    workspace_effect: "none",
+                    retry_safe: true,
+                });
+            }
+            const probed = await probe(signal);
+            if (!probed.installed) {
+                throw new ProviderFailure({
+                    code: "bridge_unavailable",
+                    message: "claude executable not found on PATH; install Claude Code and sign in with `claude` then `/login`",
+                    retryable: PROVIDER_ERROR_RETRYABLE.bridge_unavailable,
+                });
+            }
+            if (!(await options.state.isAcknowledged(CLAUDE_BRIDGE_NOTICE.id, ref))) {
+                const accepted = await interaction.acknowledge(CLAUDE_BRIDGE_NOTICE, signal);
+                if (!accepted) {
+                    throw new HarnessError({ code: "auth_required", message: "the experimental bridge notice was not accepted", workspace_effect: "none", retry_safe: true });
+                }
+                await options.state.acknowledge(CLAUDE_BRIDGE_NOTICE.id, ref, now());
+            }
+            interaction.notify("Synorch never sees your Claude credentials. If Claude Code is not signed in yet, run `claude` and then `/login`.");
+            return status(signal);
+        },
+        async logout() {
+            await options.state.revokeAcknowledgement(CLAUDE_BRIDGE_NOTICE.id, ref);
+        },
+        async resolve() {
+            throw new ProviderFailure({
+                code: "invalid_request",
+                message: "cli-bridge credentials are resolved inside the user's Claude Code, never by Synorch",
+                retryable: PROVIDER_ERROR_RETRYABLE.invalid_request,
+            });
+        },
+    };
+}
+//# sourceMappingURL=claude-bridge.js.map

package/dist/harness/auth/claude-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-bridge.js","sourceRoot":"","sources":["../../../src/harness/auth/claude-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,GAIjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAiBpD,MAAM,CAAC,MAAM,kBAAkB,GAAmB,CAAC,MAAM,EAAE,EAAE,CAC3D,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC5D,MAAM,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,SAAkB,EAAE,EAAE;QACpC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAe,EAAE,OAAgC;IAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAClD,MAAM,GAAG,GAAkB,EAAE,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAE/G,KAAK,UAAU,MAAM,CAAC,MAAmB;QACvC,MAAM,IAAI,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,SAAkB,EAAE,OAAO,EAAE,SAAkB,EAAE,CAAC;QACzI,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAyB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACjH,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,oEAAoE,EAAE,CAAC;QAC/I,MAAM,OAAO,GAAG,eAAe,MAAM,CAAC,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACrE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,OAAO,6EAA6E,EAAE,CAAC;QAC/I,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,uFAAuF,EAAE,CAAC;IAClJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,MAAM,EAAE,YAAY;QACpB,OAAO;QACP,OAAO,EAAE,CAAC,oBAAoB,CAAC;QAC/B,MAAM;QACN,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM;YAC7B,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,4EAA4E;oBACrF,gBAAgB,EAAE,MAAM;oBACxB,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,eAAe,CAAC;oBACxB,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,kGAAkG;oBAC3G,SAAS,EAAE,wBAAwB,CAAC,kBAAkB;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;gBAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iDAAiD,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5J,CAAC;gBACD,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,oBAAoB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,WAAW,CAAC,MAAM,CAAC,kHAAkH,CAAC,CAAC;YACvI,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,eAAe,CAAC;gBACxB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,qFAAqF;gBAC9F,SAAS,EAAE,wBAAwB,CAAC,eAAe;aACpD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/harness/auth/command.d.ts

@@ -0,0 +1,17 @@
+import { type CommandHandler, type CommandIO } from "../contracts/index.ts";
+import { type SynorchCredentialStore } from "./credential-store.ts";
+import { type AuthProvidersOptions } from "./providers.ts";
+export interface AuthCommandDependencies {
+    readonly home?: (env: CommandIO["env"]) => string;
+    readonly store?: (home: string, env: CommandIO["env"]) => SynorchCredentialStore;
+    readonly providerOptions?: Omit<AuthProvidersOptions, "state" | "deviceCode" | "profiles">;
+}
+/** `~/.synorch` or `$SYNORCH_HOME`. */
+export declare function resolveSynorchHome(env: CommandIO["env"]): string;
+/**
+ * `syn login`, `syn logout` and `syn auth status`. `args[0]` is the command name. Output never
+ * contains a secret: statuses are schema-checked and secrets never leave the auth providers.
+ */
+export declare function createAuthCommand(deps?: AuthCommandDependencies): CommandHandler;
+export declare const authCommand: CommandHandler;
+//# sourceMappingURL=command.d.ts.map

package/dist/harness/auth/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/command.ts"],"names":[],"mappings":"AAEA,OAAO,EAUL,KAAK,cAAc,EACnB,KAAK,SAAS,EAGf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAyB,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE3F,OAAO,EAAgE,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEzH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,sBAAsB,CAAC;IACjF,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,OAAO,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC;CAC5F;AAgBD,uCAAuC;AACvC,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,MAAM,CAIhE;AAuFD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,uBAA4B,GAAG,cAAc,CAqBpF;AA+FD,eAAO,MAAM,WAAW,EAAE,cAAoC,CAAC"}

package/dist/harness/auth/command.js

@@ -0,0 +1,223 @@
+import os from "node:os";
+import path from "node:path";
+import { AUTH_METHODS, authStatusSchema, credentialRefSchema, EXIT_CODES, HarnessError, profileNameSchema, ProviderFailure, } from "../contracts/index.js";
+import { createCredentialStore } from "./credential-store.js";
+import { ProfileStateStore } from "./profile-state.js";
+import { authProviderFor, createAuthProviders, SUPPORTED_AUTH_METHODS } from "./providers.js";
+const USAGE = [
+    "Usage:",
+    "  syn login <openai|anthropic> [--method oauth-subscription|api-key|cli-bridge] [--profile <name>] [--device-code]",
+    "  syn logout <openai|anthropic> [--method <method>] [--profile <name>]",
+    "  syn auth status [--json]",
+].join("\n");
+const DEFAULT_METHOD = {
+    openai: "oauth-subscription",
+    anthropic: "api-key",
+};
+const AUTH_FAILURE_CODES = ["unauthenticated", "auth_expired", "entitlement_missing", "forbidden"];
+/** `~/.synorch` or `$SYNORCH_HOME`. */
+export function resolveSynorchHome(env) {
+    const override = env.SYNORCH_HOME;
+    if (override !== undefined && override !== "")
+        return path.resolve(override);
+    return path.join(env.HOME ?? env.USERPROFILE ?? os.homedir(), ".synorch");
+}
+function parseArgs(args) {
+    const positionals = [];
+    const flags = new Map();
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index] ?? "";
+        if (!argument.startsWith("--")) {
+            positionals.push(argument);
+            continue;
+        }
+        const [name, inline] = argument.slice(2).split("=", 2);
+        if (inline !== undefined)
+            flags.set(name, inline);
+        else if (name === "method" || name === "profile") {
+            const value = args[index + 1];
+            if (value === undefined || value.startsWith("--"))
+                throw usage(`--${name} needs a value`);
+            flags.set(name, value);
+            index += 1;
+        }
+        else
+            flags.set(name, true);
+    }
+    return { positionals, flags };
+}
+function usage(message) {
+    return new HarnessError({ code: "usage_invalid", message: `${message}\n\n${USAGE}`, workspace_effect: "none", retry_safe: true });
+}
+function assertFlags(parsed, allowed) {
+    for (const flag of parsed.flags.keys())
+        if (!allowed.includes(flag))
+            throw usage(`unknown option --${flag}`);
+}
+function stringFlag(parsed, name) {
+    const value = parsed.flags.get(name);
+    if (value === true)
+        throw usage(`--${name} needs a value`);
+    return value;
+}
+function providerArg(parsed) {
+    const provider = parsed.positionals[1];
+    if (provider !== "openai" && provider !== "anthropic")
+        throw usage(`unknown provider: ${provider ?? "(missing)"}`);
+    if (parsed.positionals.length > 2)
+        throw usage(`unexpected argument: ${parsed.positionals[2] ?? ""}`);
+    return provider;
+}
+function methodArg(parsed) {
+    const method = stringFlag(parsed, "method");
+    if (method === undefined)
+        return undefined;
+    if (!AUTH_METHODS.includes(method))
+        throw usage(`unknown method: ${method}`);
+    return method;
+}
+function profileArg(parsed) {
+    const profile = stringFlag(parsed, "profile") ?? "default";
+    if (!profileNameSchema.safeParse(profile).success)
+        throw usage(`invalid profile name: ${profile} (kebab-case expected)`);
+    return profile;
+}
+function describe(status) {
+    const parts = [`${status.provider_id}/${status.method}`, `profile ${status.profile}`, status.state];
+    if (status.account_label !== undefined)
+        parts.push(status.account_label);
+    if (status.plan_label !== undefined)
+        parts.push(`plan ${status.plan_label}`);
+    if (status.store_backend !== undefined)
+        parts.push(`store ${status.store_backend}`);
+    if (status.expires_at !== undefined)
+        parts.push(`expires ${status.expires_at}`);
+    if (status.detail !== undefined)
+        parts.push(status.detail);
+    return parts.join(" · ");
+}
+function report(io, error) {
+    if (error instanceof HarnessError) {
+        io.stderr(`error: ${error.info.message}\n`);
+        if (error.info.next_command !== undefined)
+            io.stderr(`next: ${error.info.next_command}\n`);
+        return error.exitCode;
+    }
+    if (error instanceof ProviderFailure) {
+        io.stderr(`error: ${error.error.message}\n`);
+        if (error.error.code === "cancelled")
+            return EXIT_CODES.cancelled;
+        return AUTH_FAILURE_CODES.includes(error.error.code) ? EXIT_CODES.auth : EXIT_CODES.provider;
+    }
+    io.stderr(`error: ${error instanceof Error ? error.message : String(error)}\n`);
+    return EXIT_CODES.internal;
+}
+/**
+ * `syn login`, `syn logout` and `syn auth status`. `args[0]` is the command name. Output never
+ * contains a secret: statuses are schema-checked and secrets never leave the auth providers.
+ */
+export function createAuthCommand(deps = {}) {
+    return async (args, io) => {
+        try {
+            const parsed = parseArgs(args);
+            const command = parsed.positionals[0];
+            const home = (deps.home ?? resolveSynorchHome)(io.env);
+            const openStore = () => (deps.store ?? ((root, env) => createCredentialStore(root, { env })))(home, io.env);
+            switch (command) {
+                case "login":
+                    return await login(parsed, io, openStore, home, deps);
+                case "logout":
+                    return await logout(parsed, io, openStore, home, deps);
+                case "auth":
+                    return await status(parsed, io, openStore, home, deps);
+                default:
+                    throw usage(`unknown auth command: ${command ?? "(missing)"}`);
+            }
+        }
+        catch (error) {
+            return report(io, error);
+        }
+    };
+}
+async function login(parsed, io, openStore, home, deps) {
+    assertFlags(parsed, ["method", "profile", "device-code"]);
+    const provider = providerArg(parsed);
+    const method = methodArg(parsed) ?? DEFAULT_METHOD[provider];
+    const profile = profileArg(parsed);
+    if (!SUPPORTED_AUTH_METHODS.some((entry) => entry.provider === provider && entry.method === method)) {
+        throw usage(`${provider} does not support --method ${method}`);
+    }
+    if (parsed.flags.has("device-code") && method !== "oauth-subscription")
+        throw usage("--device-code applies only to oauth-subscription");
+    const interaction = io.renderer.auth;
+    if (!interaction.interactive) {
+        throw new HarnessError({
+            code: "auth_required",
+            message: `syn login needs an interactive terminal; ${provider} ${method} cannot sign in headless`,
+            workspace_effect: "none",
+            retry_safe: true,
+            ...(method === "api-key" ? { next_command: `export ${provider === "openai" ? "OPENAI_API_KEY" : "ANTHROPIC_API_KEY"}=…` } : {}),
+        });
+    }
+    const store = openStore();
+    const auth = authProviderFor(store, credentialRefSchema.parse({ provider_id: provider, method, profile }), {
+        ...deps.providerOptions,
+        state: new ProfileStateStore(home),
+        deviceCode: parsed.flags.has("device-code"),
+    });
+    if (auth === undefined)
+        throw usage(`${provider} does not support --method ${method}`);
+    if (store.notice !== undefined && method !== "cli-bridge")
+        interaction.notify(store.notice.text);
+    const result = authStatusSchema.parse(await auth.login(interaction, io.signal));
+    io.stdout(`Signed in: ${describe(result)}\n`);
+    return EXIT_CODES.success;
+}
+async function logout(parsed, io, openStore, home, deps) {
+    assertFlags(parsed, ["method", "profile"]);
+    const provider = providerArg(parsed);
+    const method = methodArg(parsed);
+    const profile = profileArg(parsed);
+    const store = openStore();
+    const state = new ProfileStateStore(home);
+    const methods = SUPPORTED_AUTH_METHODS.filter((entry) => entry.provider === provider && (method === undefined || entry.method === method));
+    if (methods.length === 0)
+        throw usage(`${provider} does not support --method ${method ?? ""}`);
+    for (const entry of methods) {
+        const auth = authProviderFor(store, credentialRefSchema.parse({ provider_id: provider, method: entry.method, profile }), {
+            ...deps.providerOptions,
+            state,
+        });
+        await auth?.logout(io.signal);
+        io.stdout(`Signed out: ${provider}/${entry.method} · profile ${profile}\n`);
+    }
+    return EXIT_CODES.success;
+}
+async function status(parsed, io, openStore, home, deps) {
+    if (parsed.positionals[1] !== "status" || parsed.positionals.length > 2)
+        throw usage("expected `syn auth status`");
+    assertFlags(parsed, ["json"]);
+    const store = openStore();
+    const state = new ProfileStateStore(home);
+    const stored = await store.list();
+    const profiles = [...new Set(stored.map((ref) => ref.profile))];
+    const providers = createAuthProviders(store, { ...deps.providerOptions, state, profiles });
+    const statuses = [];
+    for (const auth of providers) {
+        const isDefault = auth.profile === "default";
+        const hasStored = stored.some((ref) => ref.provider_id === auth.providerId && ref.method === auth.method && ref.profile === auth.profile);
+        if (!isDefault && !hasStored)
+            continue;
+        statuses.push(authStatusSchema.parse(await auth.status(io.signal)));
+    }
+    if (parsed.flags.has("json")) {
+        io.stdout(`${JSON.stringify(statuses, null, 2)}\n`);
+    }
+    else {
+        for (const entry of statuses)
+            io.stdout(`${describe(entry)}\n`);
+    }
+    return EXIT_CODES.success;
+}
+export const authCommand = createAuthCommand();
+//# sourceMappingURL=command.js.map

package/dist/harness/auth/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../src/harness/auth/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,eAAe,GAOhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAA+B,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAA6B,MAAM,gBAAgB,CAAC;AAQzH,MAAM,KAAK,GAAG;IACZ,QAAQ;IACR,oHAAoH;IACpH,wEAAwE;IACxE,4BAA4B;CAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,cAAc,GAA+D;IACjF,MAAM,EAAE,oBAAoB;IAC5B,SAAS,EAAE,SAAS;CACrB,CAAC;AAEF,MAAM,kBAAkB,GAAiC,CAAC,iBAAiB,EAAE,cAAc,EAAE,qBAAqB,EAAE,WAAW,CAAC,CAAC;AAEjI,uCAAuC;AACvC,MAAM,UAAU,kBAAkB,CAAC,GAAqB;IACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC5E,CAAC;AAOD,SAAS,SAAS,CAAC,IAAuB;IACxC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAiC,CAAC;QACvF,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;aAC7C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,KAAK,CAAC,KAAK,IAAI,gBAAgB,CAAC,CAAC;YAC1F,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;;YAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,OAAO,OAAO,KAAK,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACpI,CAAC;AAED,SAAS,WAAW,CAAC,MAAkB,EAAE,OAA0B;IACjE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,UAAU,CAAC,MAAkB,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,KAAK,CAAC,KAAK,IAAI,gBAAgB,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,MAAkB;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW;QAAE,MAAM,KAAK,CAAC,qBAAqB,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;IACnH,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,wBAAwB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,MAAkB;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACpG,OAAO,MAAwB,CAAC;AAClC,CAAC;AAED,SAAS,UAAU,CAAC,MAAkB;IACpC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IAC3D,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO;QAAE,MAAM,KAAK,CAAC,yBAAyB,OAAO,wBAAwB,CAAC,CAAC;IACzH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,MAAkB;IAClC,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,WAAW,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,EAAa,EAAE,KAAc;IAC3C,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,UAAU,CAAC,SAAS,CAAC;QAClE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;IAC/F,CAAC;IACD,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,UAAU,CAAC,QAAQ,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgC,EAAE;IAClE,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YAC5G,QAAQ,OAAO,EAAE,CAAC;gBAChB,KAAK,OAAO;oBACV,OAAO,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACxD,KAAK,QAAQ;oBACX,OAAO,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzD,KAAK,MAAM;oBACT,OAAO,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzD;oBACE,MAAM,KAAK,CAAC,yBAAyB,OAAO,IAAI,WAAW,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,KAAK,CAClB,MAAkB,EAClB,EAAa,EACb,SAAuC,EACvC,IAAY,EACZ,IAA6B;IAE7B,WAAW,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;QACpG,MAAM,KAAK,CAAC,GAAG,QAAQ,8BAA8B,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,MAAM,KAAK,oBAAoB;QAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxI,MAAM,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;IACrC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4CAA4C,QAAQ,IAAI,MAAM,0BAA0B;YACjG,gBAAgB,EAAE,MAAM;YACxB,UAAU,EAAE,IAAI;YAChB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChI,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;QACzG,GAAG,IAAI,CAAC,eAAe;QACvB,KAAK,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;KAC5C,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,KAAK,CAAC,GAAG,QAAQ,8BAA8B,MAAM,EAAE,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY;QAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,EAAE,CAAC,MAAM,CAAC,cAAc,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,UAAU,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,MAAkB,EAClB,EAAa,EACb,SAAuC,EACvC,IAAY,EACZ,IAA6B;IAE7B,WAAW,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;IAC3I,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,GAAG,QAAQ,8BAA8B,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/F,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;YACvH,GAAG,IAAI,CAAC,eAAe;YACvB,KAAK;SACN,CAAC,CAAC;QACH,MAAM,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9B,EAAE,CAAC,MAAM,CAAC,eAAe,QAAQ,IAAI,KAAK,CAAC,MAAM,cAAc,OAAO,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,MAAkB,EAClB,EAAa,EACb,SAAuC,EACvC,IAAY,EACZ,IAA6B;IAE7B,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACnH,WAAW,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1I,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;YAAE,SAAS;QACvC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAmB,iBAAiB,EAAE,CAAC"}

package/dist/harness/auth/credential-store.d.ts

@@ -0,0 +1,30 @@
+import { type AuthNotice, type CredentialStore, type CredentialStoreBackend } from "../contracts/index.ts";
+import { type CommandRunner, type SyncCommandRunner } from "./keychain.ts";
+export declare const CREDENTIAL_FILE_NAME = "credentials.json";
+export declare const DPAPI_FILE_NAME = "credentials.dpapi.json";
+export interface CredentialStoreOptions {
+    /** `auto` probes the OS store and falls back to the 0600 file; `os-keychain`/`os-dpapi` require an OS store (whichever the platform has). `SYNORCH_CREDENTIAL_STORE` may set it. */
+    readonly backend?: "auto" | Exclude<CredentialStoreBackend, "memory">;
+    readonly platform?: NodeJS.Platform;
+    readonly run?: CommandRunner;
+    readonly runSync?: SyncCommandRunner;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+}
+export interface SynorchCredentialStore extends CredentialStore {
+    /** Where secrets live: the file path, or the OS store kind. Never a secret. */
+    readonly location: string;
+    /** Set when secrets are kept in plain text; the login flow shows it. */
+    readonly notice: AuthNotice | undefined;
+    /** The Synorch home that holds non-secret auth state; `undefined` for the memory store. */
+    readonly home: string | undefined;
+}
+/**
+ * The credential store (ADR-05): OS keychain first (macOS `security`, Linux `secret-tool`, Windows
+ * DPAPI through PowerShell), otherwise `<home>/credentials.json` with mode 0600 and a
+ * `plaintext-credential-file` notice. `home` is the Synorch home (`~/.synorch` or `$SYNORCH_HOME`).
+ * No other application's store is ever opened.
+ */
+export declare function createCredentialStore(home: string, options?: CredentialStoreOptions): SynorchCredentialStore;
+/** A process-local store for tests and headless runs that must not persist anything. */
+export declare function createMemoryCredentialStore(): SynorchCredentialStore;
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/harness/auth/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/credential-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAML,KAAK,UAAU,EAIf,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAIL,KAAK,aAAa,EAElB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAC;AAIvB,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAGxD,MAAM,WAAW,sBAAsB;IACrC,oLAAoL;IACpL,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IACxC,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAaD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B,GAAG,sBAAsB,CAuBhH;AAED,wFAAwF;AACxF,wBAAgB,2BAA2B,IAAI,sBAAsB,CAsBpE"}