terminus-cloud-settings-sync-plus 0.0.0-stage → 1.0.1

package/dist/src/utils/cloud-components/gist.d.ts

@@ -0,0 +1,86 @@
+import { ConfigService, PlatformService } from 'terminus-core';
+import Logger from '../Logger';
+import { GistParams, SyncResult } from '../../interface';
+/**
+ * Base class shared by the "files map" style Gist providers (GitHub, Gitee).
+ *
+ * Both providers store one or more named files inside a single gist and expose
+ * almost identical sync flows; the only differences are the auth headers and
+ * the connection-test request, which subclasses override.
+ */
+declare class Gist {
+    protected baseRequestUrl: string;
+    protected id: string;
+    protected accessToken: string;
+    constructor(url: string, id: string, accessToken: string);
+    /**
+     * Key under which this provider's sync baseline is stored.
+     *
+     * All gist flavours share the single stored adapter id (`gists`), so the
+     * gist type is appended: switching from GitHub to GitLab keeps the same
+     * adapter and would otherwise inherit the other provider's baseline.
+     */
+    protected getAdapterId(): string;
+    /** Short provider discriminator used to key the baseline. */
+    protected getGistType(): string;
+    /** A dated description used when writing gist revisions. */
+    getSyncTextDateTime(): string;
+    /** Placeholder content used when creating an empty gist. */
+    getDummyContent(): string;
+    /** HTTP headers used to authenticate gist requests. Overridden per provider. */
+    protected getAuthHeaders(): any;
+    /** Fetch the raw gist payload, returning `{ code, data, message }`. */
+    protected fetchGist(url: string, logger: Logger): Promise<{
+        code: number;
+        data: any;
+        message: string;
+    }>;
+    /** Extract the file map and the first file's content from a gist payload. */
+    private extractFiles;
+    /**
+     * Two-way sync between the local Tabby config and a gist.
+     *
+     * @param firstInit When `true` prompts the user to choose the initial sync
+     *  direction. Otherwise {@link resolveSyncDirection} compares content
+     *  hashes against the recorded baseline to decide.
+     */
+    sync: (config: ConfigService, platform: PlatformService, params: GistParams, firstInit?: boolean) => Promise<SyncResult>;
+    /** Human readable provider name used in log output. Overridden per provider. */
+    protected getProviderLabel(): string;
+    /** Build a new instance of the concrete provider. Overridden per provider. */
+    protected createComponent(id: string, accessToken: string): Gist;
+    /**
+     * Push the local Tabby config to every file inside the gist.
+     *
+     * The `description` field is bumped on every write, and GitHub/Gitee treat
+     * that as a revision, so `updated_at` moves even when the content is
+     * unchanged. That is why the upload is skipped when the gist already holds
+     * this exact config: otherwise the remote timestamp would keep advancing and
+     * every device would believe the cloud had newer settings.
+     *
+     * @param gistFiles Known file map to overwrite; fetched from the server
+     *  when not provided (e.g. a forced upload from the UI).
+     * @param remoteContent Content already known to be on the server, used to
+     *  skip a pointless write. Fetched alongside `gistFiles` when omitted.
+     */
+    protected uploadLocalSettings(platform: PlatformService, gistFiles?: any, remoteContent?: string): Promise<boolean>;
+    /**
+     * Whether the remote copy already contains the config we are about to
+     * upload.
+     *
+     * Both sides are decrypted first: `CryptoJS.AES.encrypt` salts every call,
+     * so the ciphertext of identical input differs and comparing the encrypted
+     * payloads would always report a change.
+     */
+    protected isRemoteUpToDate(remoteContent: string, localContent: string): boolean;
+    /**
+     * Force-push the local Tabby config to the gist.
+     *
+     * Concurrency is handled by the shared lock in `SettingsHelper`, so there is
+     * no adapter-local re-entrancy flag here any more; the old per-adapter flags
+     * could silently turn a scheduled push into a no-op that still reported
+     * success.
+     */
+    syncLocalSettingsToCloud(platform: PlatformService): Promise<boolean>;
+}
+export default Gist;

package/dist/src/utils/cloud-components/gists/gists.d.ts

@@ -0,0 +1,15 @@
+import { ConfigService, PlatformService } from 'terminus-core';
+import { GistParams, SyncResult } from '../../../interface';
+/**
+ * Facade that dispatches gist sync operations to the correct provider based on
+ * the stored `type` (github/gitee/gitlab).
+ */
+declare class Gists {
+    private factories;
+    /** Instantiate the provider component for a given gist type. */
+    private createComponent;
+    sync: (config: ConfigService, platform: PlatformService, params: GistParams, firstInit?: boolean) => Promise<SyncResult>;
+    syncLocalSettingsToCloud: (platform: PlatformService) => Promise<boolean>;
+}
+declare const _default: Gists;
+export default _default;

package/dist/src/utils/cloud-components/gists/gitee.d.ts

@@ -0,0 +1,16 @@
+import { PlatformService } from 'terminus-core';
+import Gist from '../gist';
+declare class Gitee extends Gist {
+    constructor(id: string, accessToken: string);
+    protected getProviderLabel(): string;
+    protected getGistType(): string;
+    protected getAuthHeaders(): any;
+    protected createComponent(id: string, accessToken: string): Gist;
+    /**
+     * Verify the token, creating a new gist when no id is configured.
+     *
+     * @return `{ code: 1, data }` on success or `{ code: 0, message }`.
+     */
+    testConnection: (platform: PlatformService) => Promise<any>;
+}
+export default Gitee;

package/dist/src/utils/cloud-components/gists/github.d.ts

@@ -0,0 +1,16 @@
+import { PlatformService } from 'terminus-core';
+import Gist from '../gist';
+declare class Github extends Gist {
+    constructor(id: string, accessToken: string);
+    protected getProviderLabel(): string;
+    protected getGistType(): string;
+    protected getAuthHeaders(): any;
+    protected createComponent(id: string, accessToken: string): Gist;
+    /**
+     * Verify the token, creating a new gist when no id is configured.
+     *
+     * @return `{ code: 1, data }` on success or `{ code: 0, message }`.
+     */
+    testConnection: (platform: PlatformService) => Promise<any>;
+}
+export default Github;

package/dist/src/utils/cloud-components/gists/gitlab.d.ts

@@ -0,0 +1,44 @@
+import { ConfigService, PlatformService } from 'terminus-core';
+import Gist from '../gist';
+import { GistParams, SyncResult } from '../../../interface';
+/**
+ * GitLab snippet provider. Unlike GitHub/Gitee this stores a single raw text
+ * snippet, so it overrides the file-map based sync from {@link Gist}.
+ */
+declare class Gitlab extends Gist {
+    constructor(id: string, accessToken: string);
+    protected getProviderLabel(): string;
+    protected getGistType(): string;
+    protected getAuthHeaders(): any;
+    /**
+     * Verify the token, creating a new snippet when no id is configured.
+     *
+     * @return `{ code: 1, data }` on success or `{ code: 0, message }`.
+     */
+    testConnection: (platform: PlatformService) => Promise<any>;
+    /** Name of the single file held inside the snippet. */
+    private static readonly SNIPPET_FILE_PATH;
+    /**
+     * Two-way sync between the local Tabby config and a GitLab snippet.
+     *
+     * @param firstInit When `true` prompts the user to choose the initial sync
+     *  direction. Otherwise {@link resolveSyncDirection} compares content
+     *  hashes against the recorded baseline to decide.
+     */
+    sync: (config: ConfigService, platform: PlatformService, params: GistParams, firstInit?: boolean) => Promise<SyncResult>;
+    /**
+     * Overwrite the snippet with the local config.
+     *
+     * As with GitHub, `description` is bumped on every write and GitLab moves
+     * `updated_at` accordingly, so an unchanged config is deliberately not
+     * re-uploaded; otherwise the snippet would look permanently newer than
+     * every device's local copy.
+     *
+     * @param _gistFiles Unused here (GitLab stores a single file), accepted only
+     *  to keep the signature compatible with {@link Gist}.
+     * @param remoteContent Content already known to be on the server, fetched
+     *  when omitted so a forced upload from the UI can still skip a no-op write.
+     */
+    protected uploadLocalSettings(platform: PlatformService, _gistFiles?: any, remoteContent?: string): Promise<boolean>;
+}
+export default Gitlab;

package/dist/src/utils/cloud-components/sync-utils.d.ts

@@ -0,0 +1,90 @@
+import { ConfigService, PlatformService } from 'terminus-core';
+import { hashConfigContent } from '../config-hash';
+import Logger from '../Logger';
+import moment from 'moment';
+/** The concrete operation a sync cycle decided to perform. */
+export declare type SyncAction = 'noop' | 'pull' | 'push' | 'conflict' | 'abort';
+/**
+ * Options describing how a single adapter should decide its sync direction.
+ */
+export interface SyncDirectionOptions {
+    config: ConfigService;
+    platform: PlatformService;
+    logger: Logger;
+    /** Human readable adapter name used in the log output. */
+    providerLabel: string;
+    /** Stored provider id, used to key the persisted sync baseline. */
+    adapterId: string;
+    /** Remote config `moment` timestamp, or `null` when it is unknown. */
+    remoteUpdatedAt: moment.Moment | null;
+    /** Raw (still encrypted) config content downloaded from the cloud. */
+    remoteContent: string;
+    /**
+     * Callback invoked to push the local config to the cloud. May resolve to a
+     * `SyncResult`, a bare boolean, or nothing; all three are understood.
+     */
+    pushToCloud: () => any;
+}
+/** Outcome of a sync cycle, reported back to the adapter and the UI. */
+export interface SyncOutcome {
+    action: SyncAction;
+    result: boolean;
+    message: string;
+}
+/**
+ * Whether a failed remote read means "there is no config on the server yet"
+ * rather than "the server could not be reached".
+ *
+ * The adapters used to upload the local config whenever *any* read error
+ * occurred, so a transient 500 or a dropped connection silently published a
+ * possibly stale local config over a good remote one. Only a genuine
+ * not-found is safe to treat that way.
+ */
+export declare function isRemoteMissingError(error: any): boolean;
+/**
+ * Fingerprint config content so two sides can be compared by value.
+ *
+ * Re-exported from {@link hashConfigContent} so adapters only need to import
+ * from this module.
+ */
+export { hashConfigContent };
+/**
+ * Apply a validated cloud config to the local file during the interactive
+ * first-init flow, recording the baseline so the first background cycle sees
+ * both sides as already in agreement.
+ *
+ * Without this the very next cycle would compare a fresh local mtime against
+ * the older remote timestamp and immediately push back what was just pulled.
+ */
+export declare function applyRemoteConfigOnFirstInit(config: ConfigService, platform: PlatformService, adapterId: string, remoteContent: string): Promise<void>;
+/**
+ * Record the baseline after the interactive first-init flow pushed the local
+ * config to the cloud, for the same reason as
+ * {@link applyRemoteConfigOnFirstInit}.
+ */
+export declare function recordLocalBaselineOnFirstInit(platform: PlatformService, adapterId: string): void;
+/**
+ * Decide what to do when local and remote content differ.
+ *
+ * With a baseline we know which side moved, which is the only way to tell a
+ * one-sided edit from a genuine two-sided conflict. Without one we fall back to
+ * timestamps, but only when the gap is larger than the configured tolerance so
+ * that clock skew and second-granularity remote timestamps (FTP `MDTM`, WebDav
+ * `lastmod`) cannot decide the outcome on their own.
+ */
+export declare function isTrueConflict(localHash: string, remoteHash: string, baselineHash: string): boolean;
+/**
+ * Decide and perform the sync for one polling cycle.
+ *
+ * The algorithm is content-first: the decrypted cloud config is compared to the
+ * local one by hash, so an unchanged install transfers nothing at all. This is
+ * what stops the pull/push ping-pong the previous timestamp-only version was
+ * guaranteed to produce, where writing the pulled file bumped the local mtime,
+ * which made the next cycle push, which bumped the remote mtime, which made the
+ * cycle after that pull again — forever.
+ *
+ * Timestamps are now only a tiebreaker for the very first cycle on a device,
+ * and the remote payload is validated before it is ever allowed to overwrite
+ * the local config.
+ */
+export declare function resolveSyncDirection(options: SyncDirectionOptions): Promise<SyncOutcome>;

package/dist/src/utils/config-hash.d.ts

@@ -0,0 +1,21 @@
+import { PlatformService } from 'terminus-core';
+/**
+ * Fingerprint config content so two sides can be compared by value.
+ *
+ * The YAML is parsed and re-serialised in a canonical form before hashing, so
+ * two configs that mean the same thing hash the same even when their formatting
+ * differs. That matters because Tabby rewrites `config.yaml` through its own
+ * `js-yaml` dump after every change: comparing raw text would report a
+ * difference after each pull and trigger a pointless push back to the cloud.
+ * Content that is not valid YAML falls back to a whitespace-normalised text
+ * hash.
+ *
+ * Note that comparing the *encrypted* payloads would never work:
+ * `CryptoJS.AES.encrypt` salts every call, so identical input produces
+ * different ciphertext each time.
+ */
+export declare function hashConfigContent(content: string): string;
+/** Hash of the Tabby config currently on disk, or `''` when it cannot be read. */
+export declare function getLocalConfigHash(platform: PlatformService): string;
+/** First 8 characters of a hash, enough to correlate log lines. */
+export declare function shortHash(hash: string): string;

package/dist/src/utils/dev-mock-data.d.ts

@@ -0,0 +1,6 @@
+import { WebDavParams } from '../interface';
+export declare class DevMockDataClass {
+    getWebDavMockData(): WebDavParams;
+}
+declare const _default: DevMockDataClass;
+export default _default;

package/dist/src/utils/settings-crypto.d.ts

@@ -0,0 +1,53 @@
+/** The JSON envelope version used by the authenticated encryption format. */
+export declare const ENCRYPTION_VERSION = 2;
+/**
+ * The passphrase used by the original plugin encryption format.
+ *
+ * @deprecated V1 is retained only for decrypting and migrating existing data.
+ * Use a user-provided passphrase with `encryptV2` for new data.
+ */
+export declare const LEGACY_ENCRYPTION_KEY = "tp!&nc3^to8y7^3#4%2%&szufx!";
+export interface V2EncryptionEnvelope {
+    format: 'tabby-sync';
+    version: 2;
+    algorithm: 'aes-256-gcm';
+    kdf: 'scrypt';
+    salt: string;
+    iv: string;
+    authTag: string;
+    ciphertext: string;
+    keyLength: 32;
+    cost: number;
+    blockSize: number;
+    parallelization: number;
+}
+export declare type ParsedPayload = {
+    format: 'v1';
+    ciphertext: string;
+} | {
+    format: 'v2';
+    envelope: V2EncryptionEnvelope;
+};
+/**
+ * Returns true when a payload is a V2 envelope, including an envelope whose
+ * fields are malformed. This lets callers fail closed instead of trying V1.
+ */
+export declare function isV2Payload(payload: string): boolean;
+/** Detects and validates the outer payload format without decrypting it. */
+export declare function parsePayload(payload: string): ParsedPayload;
+/**
+ * Encrypts using the original CryptoJS passphrase AES format.
+ * @deprecated Use `encryptV2` for new payloads.
+ */
+export declare function encryptV1(plaintext: string): string;
+/**
+ * Decrypts the original CryptoJS passphrase AES format.
+ * @deprecated Use `decryptV2` for V2 payloads.
+ */
+export declare function decryptV1(ciphertext: string): string;
+/** Encrypts non-empty plaintext with scrypt-derived AES-256-GCM. */
+export declare function encryptV2(plaintext: string, passphrase: string): string;
+/** Decrypts and authenticates a V2 JSON envelope. */
+export declare function decryptV2(payload: string, passphrase: string): string;
+/** Decrypts V2 payloads strictly, falling back to V1 only for non-V2 data. */
+export declare function decryptPayload(payload: string, passphrase?: string): string;

package/dist/src/utils/settings-helper.d.ts

@@ -0,0 +1,177 @@
+import { ConfigService, PlatformService } from 'terminus-core';
+import { EventEmitter } from '@angular/core';
+export declare class SettingsHelperClass {
+    /**
+     * Maps a stored provider identifier to the adapter instance that knows how
+     * to talk to that cloud service.
+     */
+    private adapterHandler;
+    /**
+     * Absolute path of the encrypted plugin settings file (stored next to the
+     * Tabby config directory).
+     */
+    private getStoredSettingsPath;
+    /**
+     * Encrypt an arbitrary payload (usually the stored settings object) with
+     * the plugin header prefix so it can be recognised later.
+     */
+    private encryptPayload;
+    /**
+     * Promise wrapper around `fs.writeFile` that resolves to `true` on success
+     * and `false` on failure. Centralising this fixes the historical bug where
+     * the write callback rejected without returning, so `resolve(true)` still
+     * ran after an error.
+     */
+    private writeFileAsync;
+    /**
+     * Encrypt `payload` and persist it to `filePath`. Returns `true` when the
+     * file was written successfully.
+     */
+    private writeEncryptedConfig;
+    private writeEncryptedConfigAtomically;
+    private getSshConfigPath;
+    getSshConfigFilePath(): string;
+    private readSshConfig;
+    getLocalSshConfigContent(): string;
+    private getExcludedSshCacheKey;
+    private readExcludedSshBlocks;
+    private writeExcludedSshBlocks;
+    /** Read the combined, backward-compatible payload that is encrypted and stored in the cloud. */
+    readSyncContent(platform: PlatformService, encrypted?: boolean): string;
+    /** Fingerprint both synced files so SSH-only edits trigger the existing sync cycle. */
+    getLocalSyncHash(platform: PlatformService): string;
+    getLocalSshConfigHash(): string;
+    /** Back up the OpenSSH config before applying a cloud pull. */
+    backupSshConfigFile(): Promise<boolean>;
+    /** Replace the local OpenSSH config after the caller has created a backup. */
+    applySshConfigFromSync(cloudSshConfig: string): Promise<boolean>;
+    writeSshConflictSnapshot(content: string): Promise<string>;
+    /** Apply a cloud payload, preserving old single-file cloud content. */
+    applySyncContent(config: ConfigService, platform: PlatformService, content: string): Promise<void>;
+    /**
+     * Persist the provider configuration to disk. Existing enable/loader/
+     * interval preferences are preserved when a settings file already exists.
+     */
+    saveSettingsToFile(platform: PlatformService, adapter: string, params: any): Promise<boolean>;
+    /**
+     * Encrypt the complete local sync payload and write it to FTP's temporary file.
+     */
+    generateEncryptedTabbyFileForUpload(platform: PlatformService): Promise<boolean>;
+    /**
+     * Run the two-way sync for the currently configured adapter.
+     *
+     * Wrapped in the shared {@link SyncLock} so the periodic loop, the
+     * config-change listener and the settings UI can never overlap. When the
+     * lock is unavailable the call reports failure with an explanatory message
+     * instead of silently doing nothing.
+     *
+     * @param firstInit When `true` the adapter prompts the user to choose the
+     *  initial sync direction (cloud → local or local → cloud).
+     * @returns `{ result, message }` describing whether the sync succeeded.
+     */
+    syncWithCloud(config: ConfigService, platform: PlatformService, firstInit?: boolean, emitter?: EventEmitter<any>): Promise<any>;
+    /**
+     * Force-push the local Tabby config to the cloud using the saved adapter.
+     *
+     * Shares the same lock as {@link syncWithCloud}; when a cycle is already
+     * running the push is skipped rather than racing it.
+     */
+    syncLocalSettingsToCloud(platform: PlatformService): Promise<boolean>;
+    /**
+     * Read and decrypt the stored plugin settings file.
+     *
+     * @param isRaw When `true` returns the decrypted string instead of a parsed
+     *  object.
+     * @returns The parsed {@link StoredSettings}, the raw string, or `null`
+     *  when the file is missing or cannot be decrypted.
+     */
+    readConfigFile(platform: PlatformService, isRaw?: boolean): any;
+    /**
+     * Read the local Tabby `config.yaml`.
+     *
+     * @param isRaw When `true` returns the file content as a string.
+     * @param isEncrypt When `true` (and `isRaw` is set) returns the encrypted,
+     *  header-prefixed content ready to upload to the cloud.
+     */
+    readTabbyConfigFile(platform: PlatformService, isRaw?: boolean, isEncrypt?: boolean): any;
+    /**
+     * Create a `.backup` copy of the local Tabby config before it is
+     * overwritten by a cloud pull.
+     */
+    backupTabbyConfigFile(platform: PlatformService): Promise<boolean>;
+    /**
+     * Overwrite the local Tabby `config.yaml` with plain (already decrypted)
+     * YAML content.
+     *
+     * Used before handing the same content to `ConfigService.writeRaw`, which
+     * kicks off a `save()` and a `load()` concurrently without awaiting either.
+     * If the `load()` wins the race it reads the *old* file and reverts Tabby's
+     * in-memory store, silently undoing the pull. Writing the file first makes
+     * both orderings produce the same result.
+     */
+    writeTabbyConfigFile(platform: PlatformService, content: string): Promise<boolean>;
+    /**
+     * Save the cloud version of the config next to the local one when both sides
+     * changed, so a conflict never destroys data.
+     *
+     * @returns The path written, or `null` when the write failed.
+     */
+    writeConflictSnapshot(platform: PlatformService, content: string): Promise<string>;
+    /**
+     * Write a timestamped recovery snapshot and retain only the newest entries.
+     * The existing `config.yaml.backup` file is intentionally left untouched.
+     */
+    writeSnapshot(platform: PlatformService, content: string, kind?: string, retention?: number): Promise<string>;
+    /** List newest-to-oldest timestamped snapshots for the local config. */
+    listSnapshots(platform: PlatformService, kind?: string): string[];
+    /** Restore a selected snapshot into `config.yaml`, preserving `.backup`. */
+    restoreSnapshot(platform: PlatformService, snapshotPath: string): Promise<boolean>;
+    private pruneSnapshots;
+    /**
+     * Patch one or more fields of the stored settings file and persist it,
+     * surfacing a success/error toast. Shared by the interval and toggle
+     * setters.
+     */
+    private updateSavedConfig;
+    /** Persist the auto-sync interval (in seconds). */
+    saveIntervalSync(value: number, platform: PlatformService): Promise<boolean>;
+    /** Enable or disable the auto-sync feature. */
+    toggleEnabledPlugin(value: boolean, platform: PlatformService): Promise<boolean>;
+    /** Show or hide the syncing loader indicator. */
+    toggleEnabledShowLoader(value: boolean, platform: PlatformService): Promise<boolean>;
+    /**
+     * Remove the saved plugin settings file, optionally prompting the user for
+     * confirmation first.
+     */
+    removeConfirmFile(platform: PlatformService, needConfirm?: boolean, showSuccess?: boolean): Promise<boolean>;
+    /** Delete the stored settings file from disk. */
+    _removeSavedConfig(platform: PlatformService): boolean;
+    /** Remove local encrypted artifacts that belong to the disconnected provider. */
+    private removeDisconnectedProviderArtifacts;
+    /** Return the encrypted payload after removing the plugin file header. */
+    private getEncryptedPayload;
+    /** Decrypt a header-prefixed cloud config string back to plain text. */
+    doDescryption(content: string): string;
+    /** Detect whether a downloaded plugin config uses the authenticated V2 envelope. */
+    isV2EncryptedConfig(content: string): boolean;
+    /** Return whether the current keychain secret can decrypt this config. */
+    canDecryptConfig(content: string): boolean;
+    /** Verify a candidate secret without storing it or modifying local configuration. */
+    verifyCustomEncryptionSecret(content: string, secret: string): boolean;
+    /** Verify and persist the secret needed to unlock an existing remote V2 config. */
+    unlockCustomEncryptionSecret(platform: PlatformService, content: string, secret: string): Promise<boolean>;
+    /** Check whether a downloaded config was produced by this plugin. */
+    verifyServerConfigIsValid(configRawData: string): boolean;
+    /** Clear the persisted `lastErrorMessage` for the given adapter config. */
+    clearLastErrorMessage(platform: PlatformService, adapter: string, params: any): void;
+    /**
+     * Fetch remote plugin settings (currently the Dropbox API credentials) on
+     * startup and merge them into the in-memory form data.
+     */
+    loadEncryptionSecret(): Promise<void>;
+    hasCustomEncryptionSecret(): boolean;
+    setCustomEncryptionSecret(platform: PlatformService, secret: string): Promise<boolean>;
+    clearCustomEncryptionSecret(): Promise<boolean>;
+}
+declare const _default: SettingsHelperClass;
+export default _default;

package/dist/src/utils/settings-secret.d.ts

@@ -0,0 +1,16 @@
+export declare const SYNC_SECRET_SERVICE = "tabby-cloud-sync-settings";
+export declare const SYNC_SECRET_ACCOUNT = "encryption-passphrase";
+/** OS keychain storage for the optional V2 sync passphrase. */
+declare class SettingsSecretStore {
+    private cachedSecret;
+    private loaded;
+    private loadPromise;
+    load(): Promise<string>;
+    private readFromKeychain;
+    get(): string;
+    set(secret: string): Promise<boolean>;
+    clear(): Promise<boolean>;
+    hasSecret(): boolean;
+}
+declare const _default: SettingsSecretStore;
+export default _default;

package/dist/src/utils/sync-lock.d.ts

@@ -0,0 +1,44 @@
+/**
+ * A single process-wide lock shared by the auto-sync loop, the config-change
+ * listener and every cloud adapter.
+ *
+ * Previously each adapter kept its own module-level `isSyncingInProgress`
+ * boolean and `index.ts` kept a separate `autoSynInProgress` flag. Because they
+ * were independent, a scheduled push could silently no-op while the cycle still
+ * reported success. One lock removes that class of bug.
+ */
+declare class SyncLock {
+    private locked;
+    private owner;
+    private acquiredAt;
+    /**
+     * Safety valve: if a lock is somehow never released (an adapter throwing
+     * outside its `try`, a hung socket) we would stop syncing forever. After
+     * this many milliseconds the lock is considered stale and can be taken.
+     */
+    private static readonly STALE_AFTER_MS;
+    /** Whether a sync is currently running. */
+    get isLocked(): boolean;
+    /** Name of the operation currently holding the lock, if any. */
+    get currentOwner(): string;
+    /** True when the current holder has held the lock beyond the stale timeout. */
+    private isStale;
+    /**
+     * Try to take the lock.
+     *
+     * @param owner Label describing the caller, used in log output.
+     * @returns `true` when the lock was acquired, `false` when a sync is
+     *  already running and the caller should back off.
+     */
+    acquire(owner: string): boolean;
+    /** Release the lock. Safe to call when not held. */
+    release(): void;
+    /**
+     * Run `fn` while holding the lock, releasing it even if `fn` throws.
+     *
+     * @returns The result of `fn`, or `fallback` when the lock was unavailable.
+     */
+    runExclusive<T>(owner: string, fn: () => Promise<T>, fallback: T): Promise<T>;
+}
+declare const _default: SyncLock;
+export default _default;

package/dist/src/utils/sync-payload.d.ts

@@ -0,0 +1,38 @@
+export interface SyncPayload {
+    tabbyConfig: string;
+    sshConfig: string;
+    valid: boolean;
+}
+export interface SshConfigBlock {
+    key: string;
+    lines: string[];
+}
+/** Make Tabby SSH profile key paths portable before uploading. */
+export declare function normaliseTabbyConfigPaths(content: string): string;
+/** Expand portable key paths for the local operating system after pulling. */
+export declare function expandTabbyConfigPaths(content: string): string;
+/** Make IdentityFile/CertificateFile paths portable in OpenSSH config. */
+export declare function normaliseSshConfigPaths(content: string): string;
+/** Expand `~` key paths for the local operating system before writing OpenSSH config. */
+export declare function expandSshConfigPaths(content: string): string;
+/** Addresses and names that identify this computer rather than a remote host. */
+export declare function getLocalHostIdentifiers(): Set<string>;
+/** Remove cloud Host blocks that point at this computer; return them for re-uploading. */
+export declare function excludeSelfReferencingSshConfig(cloudConfig: string, identifiers?: Set<string>): {
+    config: string;
+    excluded: SshConfigBlock[];
+};
+/** Put excluded cloud blocks back when uploading so other devices keep their connections. */
+export declare function restoreExcludedSshBlocks(localConfig: string, excluded: SshConfigBlock[]): string;
+/** Exclude machine-specific local-shell profiles from the cloud copy. */
+export declare function stripLocalProfiles(content: string): string;
+/** Apply cloud settings while retaining this device's own local-shell profiles. */
+export declare function mergeLocalProfiles(localContent: string, cloudContent: string): string;
+/** Resolve the OpenSSH config used by Tabby's built-in OpenSSH importer. */
+export declare function getOpenSshConfigPath(): string;
+/** Append the OpenSSH config as YAML comments, keeping legacy cloud files valid YAML. */
+export declare function createSyncPayload(tabbyConfig: string, sshConfig?: string): string;
+/** Separate the Tabby YAML from the optional SSH payload; old cloud YAML has no marker. */
+export declare function splitSyncPayload(content: string): SyncPayload;
+/** Include the SSH sidecar in the existing canonical config fingerprint. */
+export declare function hashSyncContent(content: string): string;