vskill 1.0.16 → 1.0.19

package/dist/lib/keychain.js

@@ -14,15 +14,38 @@
 // Tokens are NEVER logged. Callers should redact via `redactToken()` before
 // any user-facing output.
 //
-// Service identity:
-//   - service:  "vskill-github"
-//   - account:  "github_token"
+// Service identity (0836 US-006 — canonical, shared with the Rust desktop):
+//   - service:  "com.verifiedskill.desktop"   (was "vskill-github")
+//   - account:  "github-oauth-token"          (was "github_token")
+//
+// On first construction we run a one-time migration that moves any token
+// from the legacy slot into the canonical slot. The legacy fallback in
+// `getGitHubToken` covers users who haven't yet booted a process that ran
+// the migration (e.g., the Rust desktop wrote the canonical slot, but a
+// vintage CLI install reads from the old one). Both paths are scheduled
+// for removal AFTER vskill 1.1.x — see keychain-migration.ts for the
+// removal target.
 // ---------------------------------------------------------------------------
 import * as nodeFs from "node:fs";
 import * as nodePath from "node:path";
 import * as nodeOs from "node:os";
-export const SERVICE_NAME = "vskill-github";
-export const GITHUB_TOKEN_KEY = "github_token";
+import { runKeychainMigration } from "./migration/keychain-migration.js";
+export const SERVICE_NAME = "com.verifiedskill.desktop";
+export const GITHUB_TOKEN_KEY = "github-oauth-token";
+// 0839 US-005: verified-skill API token (`vsk_*`) lives in a parallel
+// keychain slot so `gho_*` (GitHub OAuth, used for direct GitHub API calls)
+// and `vsk_*` (our minted API token, used for verified-skill.com calls)
+// coexist. See ADR-001 in 0839/plan.md. Distinct slots keep keychain
+// lookups O(1) and avoid prefix-sniffing every read.
+export const VSKILL_TOKEN_SERVICE = "vskill-token";
+export const VSKILL_TOKEN_KEY = "vskill-api-token";
+// 0836 US-006: legacy slot — read-only fallback during the one-release
+// compat window. Remove after vskill 1.1.x ships.
+// TODO(0836-followup): drop LEGACY_SERVICE_NAME + LEGACY_TOKEN_KEY + the
+// fallback branch in getGitHubToken once 1.1.x has had one full release
+// cycle to migrate users.
+const LEGACY_SERVICE_NAME = "vskill-github";
+const LEGACY_TOKEN_KEY = "github_token";
 const DEFAULT_FALLBACK = nodePath.join(nodeOs.homedir(), ".vskill", "keys.env");
 const defaultFs = {
     readFileSync: (p) => nodeFs.readFileSync(p, { encoding: "utf8" }),
@@ -32,6 +55,14 @@ const defaultFs = {
     mkdirSync: (p) => nodeFs.mkdirSync(p, { recursive: true, mode: 0o700 }),
     unlinkSync: (p) => nodeFs.unlinkSync(p),
 };
+// 0836 US-006: per-process flag so the one-time migration runs exactly
+// once even if multiple keychains are constructed (the test suite does
+// this; production has a single default keychain).
+let _migrationRun = false;
+/** Test-only — reset the migration-once flag so test factories can re-run it. */
+export function _resetMigrationFlagForTests() {
+    _migrationRun = false;
+}
 function loadDefaultKeyring() {
     // The native module is loaded lazily so the CLI still boots in environments
     // where the binary isn't available (rare, since @napi-rs/keyring ships
@@ -102,6 +133,21 @@ export function createKeychain(opts = {}) {
         keyring = opts.keyring;
     else
         keyring = loadDefaultKeyring();
+    // 0836 US-006: run the one-time legacy-slot → canonical-slot migration
+    // exactly once per process. The helper is idempotent (skip-flag +
+    // mutex), so calling it on every createKeychain construction is safe;
+    // the per-process flag is only an optimization to avoid the cheap
+    // file-stat check on every test factory.
+    if (!_migrationRun) {
+        _migrationRun = true;
+        try {
+            runKeychainMigration({ keyring });
+        }
+        catch {
+            // Best-effort — migration failure leaves the legacy fallback path
+            // intact; no user-visible regression.
+        }
+    }
     let warnedFallback = false;
     let fallbackInUse = false;
     function tryKeyring(fn) {
@@ -153,18 +199,51 @@ export function createKeychain(opts = {}) {
         },
         getGitHubToken() {
             const r = tryKeyring((kr) => kr.getPassword(SERVICE_NAME, GITHUB_TOKEN_KEY));
-            if (r.ok && r.value)
+            if (r.ok && r.value) {
+                // 0836 hardening (F-008 follow-up): if BOTH the canonical and the
+                // legacy slots are populated, log a WARN. This catches the
+                // dual-writer drift case where a vintage `vskill@<old>` install
+                // wrote to legacy after migration's done-flag was set. Canonical
+                // wins (current return), but operators get a signal the user has
+                // two copies and should re-authenticate.
+                try {
+                    const legacy = tryKeyring((kr) => kr.getPassword(LEGACY_SERVICE_NAME, LEGACY_TOKEN_KEY));
+                    if (legacy.ok && legacy.value && legacy.value !== r.value) {
+                        // Avoid logging the token values themselves — only the fact of drift.
+                        // eslint-disable-next-line no-console
+                        console.warn("[vskill keychain] both canonical and legacy slots are populated; canonical wins. Run `vskill auth login` to clear drift.");
+                    }
+                }
+                catch {
+                    // Non-fatal: drift detection is best-effort.
+                }
                 return r.value;
+            }
             if (r.ok && r.value === null) {
+                // 0836 US-006 legacy fallback: a vintage CLI install that hasn't
+                // booted post-migration may still hold the token in the old slot.
+                // Honor it for one release window. The migration helper will move
+                // this on the next process boot; until then we read from where it
+                // lives.
+                // TODO(0836-followup): remove after vskill 1.1.x ships.
+                const legacy = tryKeyring((kr) => kr.getPassword(LEGACY_SERVICE_NAME, LEGACY_TOKEN_KEY));
+                if (legacy.ok && legacy.value)
+                    return legacy.value;
                 // keyring works but slot is empty — also peek at fallback in case the
                 // user set a token before keyring became available, but DO NOT warn
                 // because keyring is fine.
                 const map = readFallback();
-                return map.get(GITHUB_TOKEN_KEY) ?? null;
+                if (map.has(GITHUB_TOKEN_KEY))
+                    return map.get(GITHUB_TOKEN_KEY) ?? null;
+                // 0836 US-006: legacy file-fallback key, kept for the same
+                // one-release window as the legacy keyring service.
+                return map.get(LEGACY_TOKEN_KEY) ?? null;
             }
             ensureFallbackWarned();
             const map = readFallback();
-            return map.get(GITHUB_TOKEN_KEY) ?? null;
+            if (map.has(GITHUB_TOKEN_KEY))
+                return map.get(GITHUB_TOKEN_KEY) ?? null;
+            return map.get(LEGACY_TOKEN_KEY) ?? null;
         },
         clearGitHubToken() {
             let removed = false;
@@ -192,6 +271,81 @@ export function createKeychain(opts = {}) {
             }
             return removed;
         },
+        // -----------------------------------------------------------------
+        // 0839 US-005: verified-skill API token (`vsk_*`).
+        //
+        // Same storage contract as the GitHub token (keyring preferred,
+        // 0600 file fallback) but a distinct service/account so the two
+        // tokens never collide. Public surface mirrors the GitHub helpers.
+        // -----------------------------------------------------------------
+        setVskillToken(token) {
+            if (!token || typeof token !== "string") {
+                throw new Error("setVskillToken: token must be a non-empty string");
+            }
+            // 0855 — DUAL-WRITE: unlike the GitHub token, the vsk_ token must ALSO
+            // land in the keys.env fallback even when the keyring write succeeds.
+            // Rationale: a headless / CLI-spawned `vskill studio` process often
+            // cannot read the macOS login Keychain (no GUI session), so the
+            // eval-server proxy — which injects vsk_ for /api/v1/submissions —
+            // would otherwise get null and return 401. The 0600 file is readable
+            // from any spawned process, so it's the reliable cross-process channel.
+            // We attempt the keyring (best-effort, for tools that CAN read it) and
+            // unconditionally also write the fallback. Reads stay keyring-first via
+            // getVskillToken, so the keyring copy still wins when both are present.
+            const r = tryKeyring((kr) => kr.setPassword(VSKILL_TOKEN_SERVICE, VSKILL_TOKEN_KEY, token));
+            if (!r.ok) {
+                // Keyring genuinely unavailable — surface the one-time fallback warning.
+                ensureFallbackWarned();
+            }
+            else {
+                // Keyring worked, but we still mirror to the file for headless readers.
+                // Mark the fallback as in-use WITHOUT emitting the "keychain
+                // unavailable" warning, which would be misleading here.
+                fallbackInUse = true;
+            }
+            const map = readFallback();
+            map.set(VSKILL_TOKEN_KEY, token);
+            writeFallback(map);
+        },
+        getVskillToken() {
+            const r = tryKeyring((kr) => kr.getPassword(VSKILL_TOKEN_SERVICE, VSKILL_TOKEN_KEY));
+            if (r.ok && r.value)
+                return r.value;
+            if (r.ok && r.value === null) {
+                // Keyring works but slot is empty — peek at fallback in case the
+                // user wrote a token before keyring became available. Don't warn:
+                // the keyring path is healthy.
+                const map = readFallback();
+                return map.get(VSKILL_TOKEN_KEY) ?? null;
+            }
+            ensureFallbackWarned();
+            const map = readFallback();
+            return map.get(VSKILL_TOKEN_KEY) ?? null;
+        },
+        clearVskillToken() {
+            let removed = false;
+            const r = tryKeyring((kr) => kr.deletePassword(VSKILL_TOKEN_SERVICE, VSKILL_TOKEN_KEY));
+            if (r.ok && r.value)
+                removed = true;
+            if (fs.existsSync(fallbackPath)) {
+                const map = readFallback();
+                if (map.delete(VSKILL_TOKEN_KEY)) {
+                    if (map.size === 0) {
+                        try {
+                            fs.unlinkSync(fallbackPath);
+                        }
+                        catch {
+                            writeFallback(map);
+                        }
+                    }
+                    else {
+                        writeFallback(map);
+                    }
+                    removed = true;
+                }
+            }
+            return removed;
+        },
         usingFallback() {
             return fallbackInUse || keyring === null;
         },
@@ -221,6 +375,17 @@ export function setGitHubToken(token) {
 export function clearGitHubToken() {
     return getDefaultKeychain().clearGitHubToken();
 }
+// 0839 US-005: module-level convenience accessors for the verified-skill
+// API token. Mirror the GitHub helpers above for parity.
+export function getVskillToken() {
+    return getDefaultKeychain().getVskillToken();
+}
+export function setVskillToken(token) {
+    getDefaultKeychain().setVskillToken(token);
+}
+export function clearVskillToken() {
+    return getDefaultKeychain().clearVskillToken();
+}
 /** Last-4 redaction for log-safe output. */
 export function redactToken(token) {
     if (!token)

package/dist/lib/keychain.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/lib/keychain.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,gCAAgC;AAChC,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,kBAAkB;AAClB,sCAAsC;AACtC,0CAA0C;AAC1C,oEAAoE;AACpE,EAAE;AACF,4EAA4E;AAC5E,0BAA0B;AAC1B,EAAE;AACF,oBAAoB;AACpB,gCAAgC;AAChC,+BAA+B;AAC/B,8EAA8E;AAE9E,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAElC,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAoC/C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAEhF,MAAM,SAAS,GAAc;IAC3B,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACjE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAC5B,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC;IACjD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;CACxC,CAAC;AAEF,SAAS,kBAAkB;IACzB,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAMrC,CAAC;QACF,OAAO;YACL,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ;gBACpC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;YACD,WAAW,CAAC,OAAO,EAAE,OAAO;gBAC1B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC9C,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YACD,cAAc,CAAC,OAAO,EAAE,OAAO;gBAC7B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC9C,OAAO,KAAK,CAAC,cAAc,EAAE,CAAC;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAwB;IAC/C,MAAM,KAAK,GAAa;QACtB,wDAAwD;QACxD,6CAA6C;KAC9C,CAAC;IACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAwB,EAAE;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAEtE,IAAI,OAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;;QAClD,OAAO,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,SAAS,UAAU,CAAI,EAA6B;QAClD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,SAAS,oBAAoB;QAC3B,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,cAAc;YAAE,OAAO;QAC3B,cAAc,GAAG,IAAI,CAAC;QACtB,IAAI,CACF,4DAA4D,YAAY,eAAe,CACxF,CAAC;IACJ,CAAC;IAED,SAAS,YAAY;QACnB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,SAAS,aAAa,CAAC,GAAwB;QAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3C,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5D,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,OAAO;QACL,cAAc,CAAC,KAAa;YAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;YACpF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO;YACjB,oBAAoB,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACjC,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAED,cAAc;YACZ,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC7B,sEAAsE;gBACtE,oEAAoE;gBACpE,2BAA2B;gBAC3B,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;gBAC3B,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;YAC3C,CAAC;YACD,oBAAoB,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;QAC3C,CAAC;QAED,gBAAgB;YACd,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAChF,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC;YACpC,0EAA0E;YAC1E,kEAAkE;YAClE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;gBAC3B,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACjC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBACnB,IAAI,CAAC;4BACH,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;wBAC9B,CAAC;wBAAC,MAAM,CAAC;4BACP,aAAa,CAAC,GAAG,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,aAAa,CAAC,GAAG,CAAC,CAAC;oBACrB,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,aAAa;YACX,OAAO,aAAa,IAAI,OAAO,KAAK,IAAI,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,IAAI,gBAAgB,GAAoB,IAAI,CAAC;AAC7C,MAAM,UAAU,kBAAkB;IAChC,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,gBAAgB,GAAG,cAAc,EAAE,CAAC;IACpC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,6BAA6B;IAC3C,gBAAgB,GAAG,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,EAAE,CAAC,cAAc,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,kBAAkB,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,kBAAkB,EAAE,CAAC,gBAAgB,EAAE,CAAC;AACjD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/lib/keychain.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,gCAAgC;AAChC,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,kBAAkB;AAClB,sCAAsC;AACtC,0CAA0C;AAC1C,oEAAoE;AACpE,EAAE;AACF,4EAA4E;AAC5E,0BAA0B;AAC1B,EAAE;AACF,4EAA4E;AAC5E,oEAAoE;AACpE,mEAAmE;AACnE,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,kBAAkB;AAClB,8EAA8E;AAE9E,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,MAAM,CAAC,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD,sEAAsE;AACtE,4EAA4E;AAC5E,wEAAwE;AACxE,qEAAqE;AACrE,qDAAqD;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD,uEAAuE;AACvE,kDAAkD;AAClD,yEAAyE;AACzE,wEAAwE;AACxE,0BAA0B;AAC1B,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAC5C,MAAM,gBAAgB,GAAG,cAAc,CAAC;AA0CxC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAEhF,MAAM,SAAS,GAAc;IAC3B,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACjE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAC5B,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC;IACjD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;CACxC,CAAC;AAEF,uEAAuE;AACvE,uEAAuE;AACvE,mDAAmD;AACnD,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B,iFAAiF;AACjF,MAAM,UAAU,2BAA2B;IACzC,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB;IACzB,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAMrC,CAAC;QACF,OAAO;YACL,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ;gBACpC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;YACD,WAAW,CAAC,OAAO,EAAE,OAAO;gBAC1B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC9C,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YACD,cAAc,CAAC,OAAO,EAAE,OAAO;gBAC7B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC9C,OAAO,KAAK,CAAC,cAAc,EAAE,CAAC;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAwB;IAC/C,MAAM,KAAK,GAAa;QACtB,wDAAwD;QACxD,6CAA6C;KAC9C,CAAC;IACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAwB,EAAE;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAEtE,IAAI,OAA8B,CAAC;IACnC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;;QAClD,OAAO,GAAG,kBAAkB,EAAE,CAAC;IAEpC,uEAAuE;IACvE,kEAAkE;IAClE,sEAAsE;IACtE,kEAAkE;IAClE,yCAAyC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,SAAS,UAAU,CAAI,EAA6B;QAClD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,SAAS,oBAAoB;QAC3B,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,cAAc;YAAE,OAAO;QAC3B,cAAc,GAAG,IAAI,CAAC;QACtB,IAAI,CACF,4DAA4D,YAAY,eAAe,CACxF,CAAC;IACJ,CAAC;IAED,SAAS,YAAY;QACnB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,SAAS,aAAa,CAAC,GAAwB;QAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3C,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5D,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,OAAO;QACL,cAAc,CAAC,KAAa;YAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;YACpF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO;YACjB,oBAAoB,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACjC,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAED,cAAc;YACZ,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACpB,kEAAkE;gBAClE,2DAA2D;gBAC3D,gEAAgE;gBAChE,iEAAiE;gBACjE,iEAAiE;gBACjE,yCAAyC;gBACzC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAC/B,EAAE,CAAC,WAAW,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CACtD,CAAC;oBACF,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;wBAC1D,sEAAsE;wBACtE,sCAAsC;wBACtC,OAAO,CAAC,IAAI,CACV,0HAA0H,CAC3H,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,6CAA6C;gBAC/C,CAAC;gBACD,OAAO,CAAC,CAAC,KAAK,CAAC;YACjB,CAAC;YACD,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC7B,iEAAiE;gBACjE,kEAAkE;gBAClE,kEAAkE;gBAClE,kEAAkE;gBAClE,SAAS;gBACT,wDAAwD;gBACxD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAC/B,EAAE,CAAC,WAAW,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CACtD,CAAC;gBACF,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK;oBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;gBAEnD,sEAAsE;gBACtE,oEAAoE;gBACpE,2BAA2B;gBAC3B,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;gBAC3B,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAAE,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;gBACxE,2DAA2D;gBAC3D,oDAAoD;gBACpD,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;YAC3C,CAAC;YACD,oBAAoB,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAAE,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;YACxE,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;QAC3C,CAAC;QAED,gBAAgB;YACd,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAChF,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC;YACpC,0EAA0E;YAC1E,kEAAkE;YAClE,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;gBAC3B,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACjC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBACnB,IAAI,CAAC;4BACH,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;wBAC9B,CAAC;wBAAC,MAAM,CAAC;4BACP,aAAa,CAAC,GAAG,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,aAAa,CAAC,GAAG,CAAC,CAAC;oBACrB,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,oEAAoE;QACpE,mDAAmD;QACnD,EAAE;QACF,gEAAgE;QAChE,gEAAgE;QAChE,mEAAmE;QACnE,oEAAoE;QACpE,cAAc,CAAC,KAAa;YAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,gEAAgE;YAChE,mEAAmE;YACnE,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAC1B,EAAE,CAAC,WAAW,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAC9D,CAAC;YACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,yEAAyE;gBACzE,oBAAoB,EAAE,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,wEAAwE;gBACxE,6DAA6D;gBAC7D,wDAAwD;gBACxD,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACjC,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAED,cAAc;YACZ,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAC1B,EAAE,CAAC,WAAW,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CACvD,CAAC;YACF,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC7B,iEAAiE;gBACjE,kEAAkE;gBAClE,+BAA+B;gBAC/B,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;gBAC3B,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;YAC3C,CAAC;YACD,oBAAoB,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;QAC3C,CAAC;QAED,gBAAgB;YACd,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAC1B,EAAE,CAAC,cAAc,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAC1D,CAAC;YACF,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC;YACpC,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;gBAC3B,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACjC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBACnB,IAAI,CAAC;4BACH,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;wBAC9B,CAAC;wBAAC,MAAM,CAAC;4BACP,aAAa,CAAC,GAAG,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,aAAa,CAAC,GAAG,CAAC,CAAC;oBACrB,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,aAAa;YACX,OAAO,aAAa,IAAI,OAAO,KAAK,IAAI,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,IAAI,gBAAgB,GAAoB,IAAI,CAAC;AAC7C,MAAM,UAAU,kBAAkB;IAChC,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,gBAAgB,GAAG,cAAc,EAAE,CAAC;IACpC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,6BAA6B;IAC3C,gBAAgB,GAAG,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,EAAE,CAAC,cAAc,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,kBAAkB,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,kBAAkB,EAAE,CAAC,gBAAgB,EAAE,CAAC;AACjD,CAAC;AAED,yEAAyE;AACzE,yDAAyD;AACzD,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,EAAE,CAAC,cAAc,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,kBAAkB,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,kBAAkB,EAAE,CAAC,gBAAgB,EAAE,CAAC;AACjD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/migration/keychain-migration.d.ts

@@ -0,0 +1,35 @@
+export type MigrationResult = "migrated" | "noop" | "skipped";
+export interface KeyringBackend {
+    setPassword(service: string, account: string, password: string): void;
+    getPassword(service: string, account: string): string | null;
+    deletePassword(service: string, account: string): boolean;
+}
+export interface MigrationFsAdapter {
+    existsSync: (p: string) => boolean;
+    readFileSync: (p: string) => string;
+    writeFileSync: (p: string, content: string) => void;
+    mkdirSync: (p: string) => void;
+    unlinkSync: (p: string) => void;
+    statSync: (p: string) => {
+        mtimeMs: number;
+    };
+}
+export interface MigrationDeps {
+    keyring: KeyringBackend | null;
+    fs?: MigrationFsAdapter;
+    now?: () => number;
+    homeDir?: string;
+}
+/**
+ * Runs the legacy → canonical migration with mutex serialization.
+ *
+ * Returns:
+ *   - 'migrated' — token moved (or both slots cleaned up)
+ *   - 'noop'     — nothing to migrate; done flag written
+ *   - 'skipped'  — environment opt-out, missing keyring, done flag, or
+ *                  another runner holds a fresh lock
+ *
+ * Idempotent — running twice is safe (the second call sees the done flag
+ * and returns 'skipped').
+ */
+export declare function runKeychainMigration(deps: MigrationDeps): MigrationResult;

package/dist/lib/migration/keychain-migration.js

@@ -0,0 +1,189 @@
+// ---------------------------------------------------------------------------
+// 0836 US-006 — keychain migration: legacy slot → canonical slot.
+//
+// Pre-0836:  Node CLI used  `vskill-github::github_token`   (legacy)
+// Post-0836: Node CLI uses  `com.verifiedskill.desktop::github-oauth-token`
+//                            (canonical — also the Rust desktop's slot per
+//                             ADR-0836-03)
+//
+// This module runs ONCE on Node-side boot (via `keychain.ts::createKeychain`)
+// and migrates any token from the legacy slot to the canonical slot. The
+// move is idempotent + race-safe via a 5s-TTL file mutex at
+// `~/.vskill/locks/keychain-migration.lock`. A done-flag at
+// `~/.vskill/keychain-migration.done` short-circuits subsequent boots.
+//
+// Rust does NOT participate — `src-tauri/src/auth/token_store.rs` is already
+// on the canonical slot (locked by a constant test there).
+//
+// Removal target: drop this whole module + the legacy fallback in
+// keychain.ts AFTER vskill 1.1.x. Anton: remember to bump.
+import * as nodeFs from "node:fs";
+import * as nodePath from "node:path";
+import * as nodeOs from "node:os";
+const LEGACY_SERVICE = "vskill-github";
+const LEGACY_ACCOUNT = "github_token";
+const CANONICAL_SERVICE = "com.verifiedskill.desktop";
+const CANONICAL_ACCOUNT = "github-oauth-token";
+const LOCK_TTL_MS = 5_000;
+const defaultFs = {
+    existsSync: (p) => nodeFs.existsSync(p),
+    readFileSync: (p) => nodeFs.readFileSync(p, { encoding: "utf8" }),
+    writeFileSync: (p, c) => nodeFs.writeFileSync(p, c, { encoding: "utf8", mode: 0o600 }),
+    mkdirSync: (p) => {
+        nodeFs.mkdirSync(p, { recursive: true, mode: 0o700 });
+    },
+    unlinkSync: (p) => nodeFs.unlinkSync(p),
+    statSync: (p) => {
+        const s = nodeFs.statSync(p);
+        return { mtimeMs: s.mtimeMs };
+    },
+};
+function paths(homeDir) {
+    const root = nodePath.join(homeDir, ".vskill");
+    return {
+        doneFlag: nodePath.join(root, "keychain-migration.done"),
+        lockFile: nodePath.join(root, "locks", "keychain-migration.lock"),
+        lockDir: nodePath.join(root, "locks"),
+    };
+}
+/**
+ * Runs the legacy → canonical migration with mutex serialization.
+ *
+ * Returns:
+ *   - 'migrated' — token moved (or both slots cleaned up)
+ *   - 'noop'     — nothing to migrate; done flag written
+ *   - 'skipped'  — environment opt-out, missing keyring, done flag, or
+ *                  another runner holds a fresh lock
+ *
+ * Idempotent — running twice is safe (the second call sees the done flag
+ * and returns 'skipped').
+ */
+export function runKeychainMigration(deps) {
+    // Env opt-out — power users / CI can set VSKILL_KEYCHAIN_MIGRATE=0.
+    if (process.env.VSKILL_KEYCHAIN_MIGRATE === "0") {
+        return "skipped";
+    }
+    if (!deps.keyring)
+        return "skipped";
+    const fs = deps.fs ?? defaultFs;
+    const now = deps.now ?? Date.now;
+    const home = deps.homeDir ?? nodeOs.homedir();
+    const p = paths(home);
+    // Done-flag short-circuit — prior boot already migrated.
+    if (fs.existsSync(p.doneFlag))
+        return "skipped";
+    // Acquire lock.
+    if (!acquireLock(fs, p, now)) {
+        return "skipped";
+    }
+    try {
+        return migrateUnderLock(deps.keyring, fs, p, now);
+    }
+    finally {
+        releaseLock(fs, p);
+    }
+}
+function acquireLock(fs, p, now) {
+    // Ensure parent dir exists.
+    try {
+        fs.mkdirSync(p.lockDir);
+    }
+    catch {
+        // ignore — parent may already exist
+    }
+    if (fs.existsSync(p.lockFile)) {
+        // Check staleness.
+        let stale = false;
+        try {
+            const stat = fs.statSync(p.lockFile);
+            stale = now() - stat.mtimeMs > LOCK_TTL_MS;
+        }
+        catch {
+            stale = true; // can't stat → treat as stale and steal
+        }
+        if (!stale) {
+            // Another runner holds a fresh lock — back off.
+            return false;
+        }
+        // Steal.
+        try {
+            fs.unlinkSync(p.lockFile);
+        }
+        catch {
+            // ignore — race with the other runner releasing it
+        }
+    }
+    try {
+        fs.writeFileSync(p.lockFile, String(process.pid));
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+function releaseLock(fs, p) {
+    try {
+        fs.unlinkSync(p.lockFile);
+    }
+    catch {
+        // ignore
+    }
+}
+function migrateUnderLock(keyring, fs, p, _now) {
+    const old = safeGet(keyring, LEGACY_SERVICE, LEGACY_ACCOUNT);
+    const canonical = safeGet(keyring, CANONICAL_SERVICE, CANONICAL_ACCOUNT);
+    if (old == null && canonical == null) {
+        writeDoneFlag(fs, p);
+        return "noop";
+    }
+    if (old != null && canonical == null) {
+        // Promote old → canonical, then drop old.
+        safeSet(keyring, CANONICAL_SERVICE, CANONICAL_ACCOUNT, old);
+        safeDelete(keyring, LEGACY_SERVICE, LEGACY_ACCOUNT);
+        writeDoneFlag(fs, p);
+        return "migrated";
+    }
+    if (old != null && canonical != null) {
+        // Both populated — keep canonical (newer), delete old.
+        safeDelete(keyring, LEGACY_SERVICE, LEGACY_ACCOUNT);
+        writeDoneFlag(fs, p);
+        return "migrated";
+    }
+    // canonical-only: nothing to do; mark done so we don't re-check.
+    writeDoneFlag(fs, p);
+    return "noop";
+}
+function writeDoneFlag(fs, p) {
+    try {
+        fs.writeFileSync(p.doneFlag, "1");
+    }
+    catch {
+        // Best-effort — if the flag can't be written, the migration just
+        // re-runs next boot; harmless because each step is idempotent.
+    }
+}
+function safeGet(kr, service, account) {
+    try {
+        return kr.getPassword(service, account);
+    }
+    catch {
+        return null;
+    }
+}
+function safeSet(kr, service, account, value) {
+    try {
+        kr.setPassword(service, account, value);
+    }
+    catch {
+        // ignore — failure is logged elsewhere; migration continues
+    }
+}
+function safeDelete(kr, service, account) {
+    try {
+        kr.deletePassword(service, account);
+    }
+    catch {
+        // ignore
+    }
+}
+//# sourceMappingURL=keychain-migration.js.map

package/dist/lib/migration/keychain-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-migration.js","sourceRoot":"","sources":["../../../src/lib/migration/keychain-migration.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,kEAAkE;AAClE,EAAE;AACF,qEAAqE;AACrE,4EAA4E;AAC5E,2EAA2E;AAC3E,2CAA2C;AAC3C,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,4DAA4D;AAC5D,4DAA4D;AAC5D,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,2DAA2D;AAC3D,EAAE;AACF,kEAAkE;AAClE,2DAA2D;AAE3D,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAElC,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AACtD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAE/C,MAAM,WAAW,GAAG,KAAK,CAAC;AA0B1B,MAAM,SAAS,GAAuB;IACpC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACjE,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtB,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/D,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACf,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QACd,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;CACF,CAAC;AAQF,SAAS,KAAK,CAAC,OAAe;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/C,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC;QACxD,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,yBAAyB,CAAC;QACjE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,oEAAoE;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,GAAG,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAEpC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAEtB,yDAAyD;IACzD,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,gBAAgB;IAChB,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,EAAsB,EACtB,CAAiB,EACjB,GAAiB;IAEjB,4BAA4B;IAC5B,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,mBAAmB;QACnB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrC,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,IAAI,CAAC,CAAC,wCAAwC;QACxD,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,gDAAgD;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS;QACT,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,EAAsB,EAAE,CAAiB;IAC5D,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAuB,EACvB,EAAsB,EACtB,CAAiB,EACjB,IAAkB;IAElB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAEzE,IAAI,GAAG,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACrC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,GAAG,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACrC,0CAA0C;QAC1C,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC5D,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QACpD,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,GAAG,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACrC,uDAAuD;QACvD,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QACpD,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,iEAAiE;IACjE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,EAAsB,EAAE,CAAiB;IAC9D,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,+DAA+D;IACjE,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CACd,EAAkB,EAClB,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CACd,EAAkB,EAClB,OAAe,EACf,OAAe,EACf,KAAa;IAEb,IAAI,CAAC;QACH,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,EAAkB,EAClB,OAAe,EACf,OAAe;IAEf,IAAI,CAAC;QACH,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC"}

package/dist/lib/tenant-resolver.d.ts

@@ -0,0 +1,38 @@
+import { type ActiveTenantOptions } from "./active-tenant.js";
+import { type TenantSummary } from "../api/client.js";
+export interface ResolveTenantOptions {
+    /** Highest priority — usually the CLI `--tenant` flag. */
+    flag?: string | null;
+    /** Override env reader (tests). Defaults to `process.env.VSKILL_TENANT`. */
+    envValue?: string | null;
+    /** Override config-dir resolution (tests). */
+    activeTenantOptions?: ActiveTenantOptions;
+    /** Override tenants fetcher (tests / offline mode). */
+    listTenants?: () => Promise<TenantSummary[]>;
+    /**
+     * When true, the resolver may make a network call to /account/tenants for
+     * the N=1 auto-pick fallback. Defaults to true. Setting false skips
+     * step (4) — useful for offline-first commands where the caller would
+     * rather error than block on the network.
+     */
+    enableAutoPick?: boolean;
+}
+export type ResolvedTenant = {
+    kind: "flag" | "env" | "config" | "auto-pick";
+    slug: string;
+} | {
+    kind: "none";
+    /** Why no tenant was resolved (for caller-side messaging). */
+    reason: "anonymous" | "no-tenants" | "multiple-tenants-no-default" | "fetch-failed";
+    /** Available tenants when reason === "multiple-tenants-no-default". */
+    tenants?: TenantSummary[];
+    /** Network error string when reason === "fetch-failed". */
+    error?: string;
+};
+export declare function resolveTenant(opts?: ResolveTenantOptions): Promise<ResolvedTenant>;
+/**
+ * Helper for callers that just want the slug (or null) without inspecting
+ * the resolution kind. The caller is responsible for handling the null
+ * case (typically by surfacing a clear error message).
+ */
+export declare function resolveTenantSlug(opts?: ResolveTenantOptions): Promise<string | null>;

package/dist/lib/tenant-resolver.js

@@ -0,0 +1,79 @@
+// ---------------------------------------------------------------------------
+// tenant-resolver.ts — 0839 ADR-002 priority-ordered resolution.
+//
+// Order:
+//   1. Explicit --tenant flag (highest)
+//   2. VSKILL_TENANT env var
+//   3. ~/.vskill/config.json `currentTenant`
+//   4. Auto-pick when the user has exactly N=1 tenant
+//   5. Error — caller decides whether to surface a multi-tenant prompt
+//
+// `resolveTenant` is intentionally async: step (4) requires a network
+// call to /api/v1/account/tenants. We short-circuit before that for the
+// common-case (flag/env/config). The fetcher is dependency-injected so
+// tests don't hit the network.
+//
+// The resolver does NOT mutate any state (no env writes, no config
+// writes). Callers pass the result to subsequent API calls via
+// `apiRequest({ tenantOverride })` or by calling the returned context.
+// ---------------------------------------------------------------------------
+import { getActiveTenant, } from "./active-tenant.js";
+import { listTenants as defaultListTenants, } from "../api/client.js";
+export async function resolveTenant(opts = {}) {
+    // 1. Explicit flag.
+    if (opts.flag && opts.flag.length > 0) {
+        return { kind: "flag", slug: opts.flag };
+    }
+    // 2. Env var.
+    const env = opts.envValue !== undefined ? opts.envValue : process.env.VSKILL_TENANT;
+    if (env && env.length > 0) {
+        return { kind: "env", slug: env };
+    }
+    // 3. Config file.
+    const fromConfig = getActiveTenant(opts.activeTenantOptions);
+    if (fromConfig) {
+        return { kind: "config", slug: fromConfig };
+    }
+    // 4. Auto-pick when N=1 — only if the caller opted in.
+    if (opts.enableAutoPick === false) {
+        return { kind: "none", reason: "multiple-tenants-no-default" };
+    }
+    let tenants;
+    try {
+        tenants = await (opts.listTenants ?? defaultListTenants)();
+    }
+    catch (err) {
+        const e = err;
+        // 401 → caller is anonymous — bubble that up so the CLI can hint
+        // `vskill auth login` instead of "no tenants".
+        if (e.status === 401) {
+            return { kind: "none", reason: "anonymous" };
+        }
+        return {
+            kind: "none",
+            reason: "fetch-failed",
+            error: e.message ?? String(err),
+        };
+    }
+    if (tenants.length === 0) {
+        return { kind: "none", reason: "no-tenants" };
+    }
+    if (tenants.length === 1) {
+        return { kind: "auto-pick", slug: tenants[0].slug };
+    }
+    return {
+        kind: "none",
+        reason: "multiple-tenants-no-default",
+        tenants,
+    };
+}
+/**
+ * Helper for callers that just want the slug (or null) without inspecting
+ * the resolution kind. The caller is responsible for handling the null
+ * case (typically by surfacing a clear error message).
+ */
+export async function resolveTenantSlug(opts = {}) {
+    const r = await resolveTenant(opts);
+    return r.kind === "none" ? null : r.slug;
+}
+//# sourceMappingURL=tenant-resolver.js.map

package/dist/lib/tenant-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-resolver.js","sourceRoot":"","sources":["../../src/lib/tenant-resolver.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,iEAAiE;AACjE,EAAE;AACF,SAAS;AACT,wCAAwC;AACxC,6BAA6B;AAC7B,6CAA6C;AAC7C,sDAAsD;AACtD,uEAAuE;AACvE,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,+BAA+B;AAC/B,EAAE;AACF,mEAAmE;AACnE,+DAA+D;AAC/D,uEAAuE;AACvE,8EAA8E;AAE9E,OAAO,EACL,eAAe,GAEhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,IAAI,kBAAkB,GAElC,MAAM,kBAAkB,CAAC;AAuC1B,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA6B,EAAE;IAE/B,oBAAoB;IACpB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,cAAc;IACd,MAAM,GAAG,GACP,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC1E,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACpC,CAAC;IAED,kBAAkB;IAClB,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,uDAAuD;IACvD,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAkC,CAAC;QAC7C,iEAAiE;QACjE,+CAA+C;QAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,6BAA6B;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA6B,EAAE;IAE/B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC"}