"version": "0.2.1",

        "@atproto/oauth-client-node": "^0.3.16",

        "open": "^11.0.0",

    "@atproto-labs/did-resolver": ["@atproto-labs/did-resolver@0.2.6", "", { "dependencies": { "@atproto-labs/fetch": "0.2.3", "@atproto-labs/pipe": "0.1.1", "@atproto-labs/simple-store": "0.3.0", "@atproto-labs/simple-store-memory": "0.1.4", "@atproto/did": "0.3.0", "zod": "^3.23.8" } }, "sha512-2K1bC04nI2fmgNcvof+yA28IhGlpWn2JKYlPa7To9JTKI45FINCGkQSGiL2nyXlyzDJJ34fZ1aq6/IRFIOIiqg=="],

    "@atproto-labs/fetch": ["@atproto-labs/fetch@0.2.3", "", { "dependencies": { "@atproto-labs/pipe": "0.1.1" } }, "sha512-NZtbJOCbxKUFRFKMpamT38PUQMY0hX0p7TG5AEYOPhZKZEP7dHZ1K2s1aB8MdVH0qxmqX7nQleNrrvLf09Zfdw=="],

    "@atproto-labs/fetch-node": ["@atproto-labs/fetch-node@0.2.0", "", { "dependencies": { "@atproto-labs/fetch": "0.2.3", "@atproto-labs/pipe": "0.1.1", "ipaddr.js": "^2.1.0", "undici": "^6.14.1" } }, "sha512-Krq09nH/aeoiU2s9xdHA0FjTEFWG9B5FFenipv1iRixCcPc7V3DhTNDawxG9gI8Ny0k4dBVS9WTRN/IDzBx86Q=="],

    "@atproto-labs/handle-resolver": ["@atproto-labs/handle-resolver@0.3.6", "", { "dependencies": { "@atproto-labs/simple-store": "0.3.0", "@atproto-labs/simple-store-memory": "0.1.4", "@atproto/did": "0.3.0", "zod": "^3.23.8" } }, "sha512-qnSTXvOBNj1EHhp2qTWSX8MS5q3AwYU5LKlt5fBvSbCjgmTr2j0URHCv+ydrwO55KvsojIkTMgeMOh4YuY4fCA=="],

    "@atproto-labs/handle-resolver-node": ["@atproto-labs/handle-resolver-node@0.1.25", "", { "dependencies": { "@atproto-labs/fetch-node": "0.2.0", "@atproto-labs/handle-resolver": "0.3.6", "@atproto/did": "0.3.0" } }, "sha512-NY9WYM2VLd3IuMGRkkmvGBg8xqVEaK/fitv1vD8SMXqFTekdpjOLCCyv7EFtqVHouzmDcL83VOvWRfHVa8V9Yw=="],

    "@atproto-labs/identity-resolver": ["@atproto-labs/identity-resolver@0.3.6", "", { "dependencies": { "@atproto-labs/did-resolver": "0.2.6", "@atproto-labs/handle-resolver": "0.3.6" } }, "sha512-qoWqBDRobln0NR8L8dQjSp79E0chGkBhibEgxQa2f9WD+JbJdjQ0YvwwO5yeQn05pJoJmAwmI2wyJ45zjU7aWg=="],

    "@atproto-labs/pipe": ["@atproto-labs/pipe@0.1.1", "", {}, "sha512-hdNw2oUs2B6BN1lp+32pF7cp8EMKuIN5Qok2Vvv/aOpG/3tNSJ9YkvfI0k6Zd188LeDDYRUpYpxcoFIcGH/FNg=="],

    "@atproto-labs/simple-store": ["@atproto-labs/simple-store@0.3.0", "", {}, "sha512-nOb6ONKBRJHRlukW1sVawUkBqReLlLx6hT35VS3imaNPwiXDxLnTK7lxw3Lrl9k5yugSBDQAkZAq3MPTEFSUBQ=="],

    "@atproto-labs/simple-store-memory": ["@atproto-labs/simple-store-memory@0.1.4", "", { "dependencies": { "@atproto-labs/simple-store": "0.3.0", "lru-cache": "^10.2.0" } }, "sha512-3mKY4dP8I7yKPFj9VKpYyCRzGJOi5CEpOLPlRhoJyLmgs3J4RzDrjn323Oakjz2Aj2JzRU/AIvWRAZVhpYNJHw=="],

    "@atproto/did": ["@atproto/did@0.3.0", "", { "dependencies": { "zod": "^3.23.8" } }, "sha512-raUPzUGegtW/6OxwCmM8bhZvuIMzxG5t9oWsth6Tp91Kb5fTnHV2h/KKNF1C82doeA4BdXCErTyg7ISwLbQkzA=="],

    "@atproto/jwk": ["@atproto/jwk@0.6.0", "", { "dependencies": { "multiformats": "^9.9.0", "zod": "^3.23.8" } }, "sha512-bDoJPvt7TrQVi/rBfBrSSpGykhtIriKxeYCYQTiPRKFfyRhbgpElF0wPXADjIswnbzZdOwbY63az4E/CFVT3Tw=="],

    "@atproto/jwk-jose": ["@atproto/jwk-jose@0.1.11", "", { "dependencies": { "@atproto/jwk": "0.6.0", "jose": "^5.2.0" } }, "sha512-i4Fnr2sTBYmMmHXl7NJh8GrCH+tDQEVWrcDMDnV5DjJfkgT17wIqvojIw9SNbSL4Uf0OtfEv6AgG0A+mgh8b5Q=="],

    "@atproto/jwk-webcrypto": ["@atproto/jwk-webcrypto@0.2.0", "", { "dependencies": { "@atproto/jwk": "0.6.0", "@atproto/jwk-jose": "0.1.11", "zod": "^3.23.8" } }, "sha512-UmgRrrEAkWvxwhlwe30UmDOdTEFidlIzBC7C3cCbeJMcBN1x8B3KH+crXrsTqfWQBG58mXgt8wgSK3Kxs2LhFg=="],

    "@atproto/oauth-client": ["@atproto/oauth-client@0.5.14", "", { "dependencies": { "@atproto-labs/did-resolver": "0.2.6", "@atproto-labs/fetch": "0.2.3", "@atproto-labs/handle-resolver": "0.3.6", "@atproto-labs/identity-resolver": "0.3.6", "@atproto-labs/simple-store": "0.3.0", "@atproto-labs/simple-store-memory": "0.1.4", "@atproto/did": "0.3.0", "@atproto/jwk": "0.6.0", "@atproto/oauth-types": "0.6.2", "@atproto/xrpc": "0.7.7", "core-js": "^3", "multiformats": "^9.9.0", "zod": "^3.23.8" } }, "sha512-sPH+vcdq9maTEAhJI0HzmFcFAMrkCS19np+RUssNkX6kS8Xr3OYr57tvYRCbkcnIyYTfYcxKQgpwHKx3RVEaYw=="],

    "@atproto/oauth-client-node": ["@atproto/oauth-client-node@0.3.16", "", { "dependencies": { "@atproto-labs/did-resolver": "0.2.6", "@atproto-labs/handle-resolver-node": "0.1.25", "@atproto-labs/simple-store": "0.3.0", "@atproto/did": "0.3.0", "@atproto/jwk": "0.6.0", "@atproto/jwk-jose": "0.1.11", "@atproto/jwk-webcrypto": "0.2.0", "@atproto/oauth-client": "0.5.14", "@atproto/oauth-types": "0.6.2" } }, "sha512-2dooMzxAkiQ4MkOAZlEQ3iwbB9SEovrbIKMNuBbVCLQYORVNxe20tMdjs3lvhrzdpzvaHLlQnJJhw5dA9VELFw=="],

    "@atproto/oauth-types": ["@atproto/oauth-types@0.6.2", "", { "dependencies": { "@atproto/did": "0.3.0", "@atproto/jwk": "0.6.0", "zod": "^3.23.8" } }, "sha512-2cuboM4RQBCYR8NQC5uGRkW6KgCgKyq/B5/+tnMmWZYtZGVUQvsUWQHK/ZiMCnVXbcDNtc/RIEJQJDZ8FXMoxg=="],

    "bundle-name": ["bundle-name@4.1.0", "", { "dependencies": { "run-applescript": "^7.0.0" } }, "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q=="],

    "core-js": ["core-js@3.48.0", "", {}, "sha512-zpEHTy1fjTMZCKLHUZoVeylt9XrzaIN2rbPXEt0k+q7JE5CkCZdo6bNq55bn24a69CH7ErAVLKijxJja4fw+UQ=="],

    "default-browser": ["default-browser@5.4.0", "", { "dependencies": { "bundle-name": "^4.1.0", "default-browser-id": "^5.0.0" } }, "sha512-XDuvSq38Hr1MdN47EDvYtx3U0MTqpCEn+F6ft8z2vYDzMrvQhVp0ui9oQdqW3MvK3vqUETglt1tVGgjLuJ5izg=="],

    "default-browser-id": ["default-browser-id@5.0.1", "", {}, "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q=="],

    "define-lazy-prop": ["define-lazy-prop@3.0.0", "", {}, "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg=="],

    "ipaddr.js": ["ipaddr.js@2.3.0", "", {}, "sha512-Zv/pA+ciVFbCSBBjGfaKUya/CcGmUHzTydLMaTwrUUEM2DIEO3iZvueGxmacvmN50fGpGVKeTXpb2LcYQxeVdg=="],

    "is-docker": ["is-docker@3.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ=="],

    "is-in-ssh": ["is-in-ssh@1.0.0", "", {}, "sha512-jYa6Q9rH90kR1vKB6NM7qqd1mge3Fx4Dhw5TVlK1MUBqhEOuCagrEHMevNuCcbECmXZ0ThXkRm+Ymr51HwEPAw=="],

    "is-inside-container": ["is-inside-container@1.0.0", "", { "dependencies": { "is-docker": "^3.0.0" }, "bin": { "is-inside-container": "cli.js" } }, "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA=="],

    "is-wsl": ["is-wsl@3.1.0", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-UcVfVfaK4Sc4m7X3dUSoHoozQGBEFeDC+zVo06t98xe8CzHSZZBekNXH+tu0NalHolcJ/QAGqS46Hef7QXBIMw=="],

    "jose": ["jose@5.10.0", "", {}, "sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg=="],

    "open": ["open@11.0.0", "", { "dependencies": { "default-browser": "^5.4.0", "define-lazy-prop": "^3.0.0", "is-in-ssh": "^1.0.0", "is-inside-container": "^1.0.0", "powershell-utils": "^0.1.0", "wsl-utils": "^0.3.0" } }, "sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw=="],

    "powershell-utils": ["powershell-utils@0.1.0", "", {}, "sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A=="],

    "run-applescript": ["run-applescript@7.1.0", "", {}, "sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q=="],

    "undici": ["undici@6.23.0", "", {}, "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g=="],

    "wsl-utils": ["wsl-utils@0.3.1", "", { "dependencies": { "is-wsl": "^3.1.0", "powershell-utils": "^0.1.0" } }, "sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg=="],

		"@atproto/oauth-client-node": "^0.3.16",

		"minimatch": "^10.1.1",

		"open": "^11.0.0"

				type: "app-password",

import * as http from "node:http";

import { log, note, select, spinner, text } from "@clack/prompts";

import { command, flag, option, optional, string } from "cmd-ts";

import { resolveHandleToDid } from "../lib/atproto";

import {

	getCallbackPort,

	getCallbackUrl,

	getOAuthClient,

	getOAuthScope,

} from "../lib/oauth-client";

import {

	deleteOAuthSession,

	getOAuthStorePath,

	listOAuthSessions,

} from "../lib/oauth-store";

import { exitOnCancel } from "../lib/prompts";

const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes

export const loginCommand = command({

	name: "login",

	description: "Login with OAuth (browser-based authentication)",

	args: {

		logout: option({

			long: "logout",

			description: "Remove OAuth session for a specific DID",

			type: optional(string),

		}),

		list: flag({

			long: "list",

			description: "List all stored OAuth sessions",

		}),

	},

	handler: async ({ logout, list }) => {

		// List sessions

		if (list) {

			const sessions = await listOAuthSessions();

			if (sessions.length === 0) {

				log.info("No OAuth sessions stored");

			} else {

				log.info("OAuth sessions:");

				for (const did of sessions) {

					console.log(`  - ${did}`);

				}

			}

			return;

		}

		// Logout

		if (logout !== undefined) {

			const did = logout || undefined;

			if (!did) {

				// No DID provided - show available and prompt

				const sessions = await listOAuthSessions();

				if (sessions.length === 0) {

					log.info("No OAuth sessions found");

					return;

				}

				if (sessions.length === 1) {

					const deleted = await deleteOAuthSession(sessions[0]!);

					if (deleted) {

						log.success(`Removed OAuth session for ${sessions[0]}`);

					}

					return;

				}

				// Multiple sessions - prompt

				const selected = exitOnCancel(

					await select({

						message: "Select session to remove:",

						options: sessions.map((d) => ({ value: d, label: d })),

					}),

				);

				const deleted = await deleteOAuthSession(selected);

				if (deleted) {

					log.success(`Removed OAuth session for ${selected}`);

				}

				return;

			}

			const deleted = await deleteOAuthSession(did);

			if (deleted) {

				log.success(`Removed OAuth session for ${did}`);

			} else {

				log.info(`No OAuth session found for ${did}`);

			}

			return;

		}

		// OAuth login flow

		note(

			"OAuth login will open your browser to authenticate.\n\n" +

				"This is more secure than app passwords and tokens refresh automatically.",

			"OAuth Login",

		);

		const handle = exitOnCancel(

			await text({

				message: "Handle or DID:",

				placeholder: "yourhandle.bsky.social",

			}),

		);

		if (!handle) {

			log.error("Handle is required");

			process.exit(1);

		}

		const s = spinner();

		s.start("Resolving identity...");

		let did: string;

		try {

			did = await resolveHandleToDid(handle);

			s.stop(`Identity resolved`);

		} catch (error) {

			s.stop("Failed to resolve identity");

			if (error instanceof Error) {

				log.error(`Error: ${error.message}`);

			} else {

				log.error(`Error: ${error}`);

			}

			process.exit(1);

		}

		s.start("Initializing OAuth...");

		try {

			const client = await getOAuthClient();

			// Generate authorization URL using the resolved DID

			const authUrl = await client.authorize(did, {

				scope: getOAuthScope(),

			});

			log.info(`Login URL: ${authUrl}`);

			s.message("Opening browser...");

			// Try to open browser

			let browserOpened = true;

			try {

				const open = (await import("open")).default;

				await open(authUrl.toString());

			} catch {

				browserOpened = false;

			}

			s.message("Waiting for authentication...");

			// Show URL info

			if (!browserOpened) {

				s.stop("Could not open browser automatically");

				log.warn("Please open the following URL in your browser:");

				log.info(authUrl.toString());

				s.start("Waiting for authentication...");

			}

			// Start HTTP server to receive callback

			const result = await waitForCallback();

			if (!result.success) {

				s.stop("Authentication failed");

				log.error(result.error || "OAuth callback failed");

				process.exit(1);

			}

			s.message("Completing authentication...");

			// Exchange code for tokens

			const { session } = await client.callback(

				new URLSearchParams(result.params!),

			);

			// Try to get the handle for display (use the original handle input as fallback)

			let displayName = handle;

			try {

				// The session should have the DID, we can use the original handle they entered

				// or we could fetch the profile to get the current handle

				displayName = handle.startsWith("did:") ? session.did : handle;

			} catch {

				displayName = session.did;

			}

			s.stop(`Logged in as ${displayName}`);

			log.success(`OAuth session saved to ${getOAuthStorePath()}`);

			log.info("Your session will refresh automatically when needed.");

			// Exit cleanly - the OAuth client may have background processes

			process.exit(0);

		} catch (error) {

			s.stop("OAuth login failed");

			if (error instanceof Error) {

				log.error(`Error: ${error.message}`);

			} else {

				log.error(`Error: ${error}`);

			}

			process.exit(1);

		}

	},

});

interface CallbackResult {

	success: boolean;

	params?: Record<string, string>;

	error?: string;

}

function waitForCallback(): Promise<CallbackResult> {

	return new Promise((resolve) => {

		const port = getCallbackPort();

		let timeoutId: ReturnType<typeof setTimeout> | undefined;

		const server = http.createServer((req, res) => {

			const url = new URL(req.url || "/", `http://127.0.0.1:${port}`);

			if (url.pathname === "/oauth/callback") {

				const params: Record<string, string> = {};

				url.searchParams.forEach((value, key) => {

					params[key] = value;

				});

				// Clear the timeout

				if (timeoutId) clearTimeout(timeoutId);

				// Check for error

				if (params.error) {

					res.writeHead(200, { "Content-Type": "text/html" });

					res.end(`

						<html>

							<body style="font-family: system-ui; padding: 2rem; text-align: center;">

								<h1>Authentication Failed</h1>

								<p>${params.error_description || params.error}</p>

								<p>You can close this window.</p>

							</body>

						</html>

					`);

					server.close(() => {

						resolve({

							success: false,

							error: params.error_description || params.error,

						});

					});

					return;

				}

				// Success

				res.writeHead(200, { "Content-Type": "text/html" });

				res.end(`

					<html>

						<body style="font-family: system-ui; padding: 2rem; text-align: center;">

							<h1>Authentication Successful</h1>

							<p>You can close this window and return to the terminal.</p>

						</body>

					</html>

				`);

				server.close(() => {

					resolve({ success: true, params });

				});

				return;

			}

			// Not the callback path

			res.writeHead(404);

			res.end("Not found");

		});

		server.on("error", (err: NodeJS.ErrnoException) => {

			if (timeoutId) clearTimeout(timeoutId);

			if (err.code === "EADDRINUSE") {

				resolve({

					success: false,

					error: `Port ${port} is already in use. Please close the application using that port and try again.`,

				});

			} else {

				resolve({

					success: false,

					error: `Server error: ${err.message}`,

				});

			}

		});

		server.listen(port, "127.0.0.1");

		// Timeout after 5 minutes

		timeoutId = setTimeout(() => {

			server.close(() => {

				resolve({

					success: false,

					error: "Timeout waiting for OAuth callback. Please try again.",

				});

			});

		}, CALLBACK_TIMEOUT_MS);

	});

}

import { loginCommand } from "./commands/login";

		login: loginCommand,

import { Agent, AtpAgent } from "@atproto/api";

import { getOAuthClient } from "./oauth-client";

import { isAppPasswordCredentials, isOAuthCredentials } from "./types";

/**

 * Resolve a handle to a DID

 */

export async function resolveHandleToDid(handle: string): Promise<string> {

	if (handle.startsWith("did:")) {

		return handle;

	}

	// Try to resolve handle via Bluesky API

	const resolveUrl = `https://public.api.bsky.app/xrpc/com.atproto.identity.resolveHandle?handle=${encodeURIComponent(handle)}`;

	const resolveResponse = await fetch(resolveUrl);

	if (!resolveResponse.ok) {

		throw new Error("Could not resolve handle");

	}

	const resolveData = (await resolveResponse.json()) as { did: string };

	return resolveData.did;

}

	const did = await resolveHandleToDid(handle);

	if (isOAuthCredentials(credentials)) {

		// OAuth flow - restore session from stored tokens

		const client = await getOAuthClient();

		try {

			const oauthSession = await client.restore(credentials.did);

			// Wrap the OAuth session in an Agent which provides the atproto API

			const agent = new Agent(oauthSession) as unknown as AtpAgent;

			// The Agent class doesn't have session.did like AtpAgent does

			// We need to set up a compatible session object for the rest of our code

			agent.session = {

				did: oauthSession.did,

				handle: credentials.handle,

				accessJwt: "",

				refreshJwt: "",

				active: true,

			};

			return agent;

		} catch (error) {

			if (error instanceof Error) {

				// Check for common OAuth errors

				if (

					error.message.includes("expired") ||

					error.message.includes("revoked")

				) {

					throw new Error(

						`OAuth session expired or revoked. Please run 'sequoia login' to re-authenticate.`,

					);

				}

			}

			throw error;

		}

	}

	// App password flow

	if (!isAppPasswordCredentials(credentials)) {

		throw new Error("Invalid credential type");

	}

import { getOAuthSession, listOAuthSessions } from "./oauth-store";

import type {

	AppPasswordCredentials,

	Credentials,

	LegacyCredentials,

	OAuthCredentials,

} from "./types";

// Stored credentials keyed by identifier (can be legacy or typed)

type CredentialsStore = Record<

	string,

	AppPasswordCredentials | LegacyCredentials

>;

 * Normalize credentials to have explicit type

function normalizeCredentials(

	creds: AppPasswordCredentials | LegacyCredentials,

): AppPasswordCredentials {

	// If it already has type, return as-is

	if ("type" in creds && creds.type === "app-password") {

		return creds;

	}

	// Migrate legacy format

	return {

		type: "app-password",

		pdsUrl: creds.pdsUrl,

		identifier: creds.identifier,

		password: creds.password,

	};

}

			const legacy = parsed as LegacyCredentials;

 * Try to load OAuth credentials for a given profile (DID or handle)

 */

async function tryLoadOAuthCredentials(

	profile: string,

): Promise<OAuthCredentials | null> {

	// If it looks like a DID, try to get the session directly

	if (profile.startsWith("did:")) {

		const session = await getOAuthSession(profile);

		if (session) {

			return {

				type: "oauth",

				did: profile,

				handle: profile, // We don't have the handle stored, use DID

				pdsUrl: "https://bsky.social", // Will be resolved from DID doc

			};

		}

	}

	// Otherwise, check all OAuth sessions to find a matching handle

	// (This is a fallback - handle matching isn't perfect without storing handles)

	const sessions = await listOAuthSessions();

	for (const did of sessions) {

		// Could enhance this by storing handle with session, but for now

		// just return null if profile isn't a DID

	}

	return null;

}

/**

 * 2. SEQUOIA_PROFILE env var - selects from stored credentials (app-password or OAuth DID)

 * 4. If only one identity stored (app-password or OAuth), use it

			type: "app-password",

	const appPasswordIds = Object.keys(store);

	const oauthDids = await listOAuthSessions();

	if (profileEnv) {

		// Try app-password credentials first

		if (store[profileEnv]) {

			return normalizeCredentials(store[profileEnv]);

		}

		// Try OAuth session (profile could be a DID)

		const oauth = await tryLoadOAuthCredentials(profileEnv);

		if (oauth) {

			return oauth;

		}

	if (projectIdentity) {

		if (store[projectIdentity]) {

			return normalizeCredentials(store[projectIdentity]);

		}

		const oauth = await tryLoadOAuthCredentials(projectIdentity);

		if (oauth) {

			return oauth;

		}

	// 4. If only one identity total, use it

	const totalIdentities = appPasswordIds.length + oauthDids.length;

	if (totalIdentities === 1) {

		if (appPasswordIds.length === 1 && appPasswordIds[0]) {

			return normalizeCredentials(store[appPasswordIds[0]]!);

		}

		if (oauthDids.length === 1 && oauthDids[0]) {

			const session = await getOAuthSession(oauthDids[0]);

			if (session) {

				return {

					type: "oauth",

					did: oauthDids[0],

					handle: oauthDids[0],

					pdsUrl: "https://bsky.social",

				};

			}

		}

	// Multiple identities exist but none selected, or no identities

 * Get a specific identity by identifier (app-password only)

): Promise<AppPasswordCredentials | null> {

	const creds = store[identifier];

	if (!creds) return null;

	return normalizeCredentials(creds);

 * List all stored app-password identities

 * List all credentials (both app-password and OAuth)

 */

export async function listAllCredentials(): Promise<

	Array<{ id: string; type: "app-password" | "oauth" }>

> {

	const store = await loadCredentialsStore();

	const oauthDids = await listOAuthSessions();

	const result: Array<{ id: string; type: "app-password" | "oauth" }> = [];

	for (const id of Object.keys(store)) {

		result.push({ id, type: "app-password" });

	}

	for (const did of oauthDids) {

		result.push({ id: did, type: "oauth" });

	}

	return result;

}

/**

 * Save app-password credentials for an identity (adds or updates)

export async function saveCredentials(

	credentials: AppPasswordCredentials,

): Promise<void> {

import {

	NodeOAuthClient,

	type NodeOAuthClientOptions,

} from "@atproto/oauth-client-node";

import { sessionStore, stateStore } from "./oauth-store";

const CALLBACK_PORT = 4000;

const CALLBACK_HOST = "127.0.0.1";

const CALLBACK_URL = `http://${CALLBACK_HOST}:${CALLBACK_PORT}/oauth/callback`;

// OAuth scope for Sequoia CLI - includes atproto base scope plus our collections

const OAUTH_SCOPE =

	"atproto repo:site.standard.document repo:site.standard.publication repo:app.bsky.feed.post blob:*/*";

let oauthClient: NodeOAuthClient | null = null;

// Simple lock implementation for CLI (single process, no contention)

// This prevents the "No lock mechanism provided" warning

const locks = new Map<string, Promise<void>>();

async function requestLock(key: string, fn: () => Promise<void>): Promise<void> {

	// Wait for any existing lock on this key

	while (locks.has(key)) {

		await locks.get(key);

	}

	// Create our lock

	let resolve: () => void;

	const lockPromise = new Promise<void>((r) => {

		resolve = r;

	});

	locks.set(key, lockPromise);

	try {

		await fn();

	} finally {

		locks.delete(key);

		resolve!();

	}

}

/**

 * Get or create the OAuth client singleton

 */

export async function getOAuthClient(): Promise<NodeOAuthClient> {

	if (oauthClient) {

		return oauthClient;

	}

	// Build client_id with required parameters

	const clientIdParams = new URLSearchParams();

	clientIdParams.append("redirect_uri", CALLBACK_URL);

	clientIdParams.append("scope", OAUTH_SCOPE);

	const clientOptions: NodeOAuthClientOptions = {

		clientMetadata: {

			client_id: `http://localhost?${clientIdParams.toString()}`,

			client_name: "Sequoia CLI",

			client_uri: "https://github.com/stevedylandev/sequoia",

			redirect_uris: [CALLBACK_URL],

			grant_types: ["authorization_code", "refresh_token"],

			response_types: ["code"],

			token_endpoint_auth_method: "none",

			application_type: "web",

			scope: OAUTH_SCOPE,

			dpop_bound_access_tokens: false,

		},

		stateStore,

		sessionStore,

		// Configure identity resolution

		plcDirectoryUrl: "https://plc.directory",

		// Provide lock mechanism to prevent warning

		requestLock,

	};

	oauthClient = new NodeOAuthClient(clientOptions);

	return oauthClient;

}

export function getOAuthScope(): string {

	return OAUTH_SCOPE;

}

export function getCallbackUrl(): string {

	return CALLBACK_URL;

}

export function getCallbackPort(): number {

	return CALLBACK_PORT;

}

import * as fs from "node:fs/promises";

import * as os from "node:os";

import * as path from "node:path";

import type {

	NodeSavedSession,

	NodeSavedSessionStore,

	NodeSavedState,

	NodeSavedStateStore,

} from "@atproto/oauth-client-node";

const CONFIG_DIR = path.join(os.homedir(), ".config", "sequoia");

const OAUTH_FILE = path.join(CONFIG_DIR, "oauth.json");

interface OAuthStore {

	states: Record<string, NodeSavedState>;

	sessions: Record<string, NodeSavedSession>;

}

async function fileExists(filePath: string): Promise<boolean> {

	try {

		await fs.access(filePath);

		return true;

	} catch {

		return false;

	}

}

async function loadOAuthStore(): Promise<OAuthStore> {

	if (!(await fileExists(OAUTH_FILE))) {

		return { states: {}, sessions: {} };

	}

	try {

		const content = await fs.readFile(OAUTH_FILE, "utf-8");

		return JSON.parse(content) as OAuthStore;

	} catch {

		return { states: {}, sessions: {} };

	}

}

async function saveOAuthStore(store: OAuthStore): Promise<void> {

	await fs.mkdir(CONFIG_DIR, { recursive: true });

	await fs.writeFile(OAUTH_FILE, JSON.stringify(store, null, 2));

	await fs.chmod(OAUTH_FILE, 0o600);

}

/**

 * State store for PKCE flow (temporary, used during auth)

 */

export const stateStore: NodeSavedStateStore = {

	async set(key: string, state: NodeSavedState): Promise<void> {

		const store = await loadOAuthStore();

		store.states[key] = state;

		await saveOAuthStore(store);

	},

	async get(key: string): Promise<NodeSavedState | undefined> {

		const store = await loadOAuthStore();

		return store.states[key];

	},

	async del(key: string): Promise<void> {

		const store = await loadOAuthStore();

		delete store.states[key];

		await saveOAuthStore(store);

	},

};

/**

 * Session store for OAuth tokens (persistent)

 */

export const sessionStore: NodeSavedSessionStore = {

	async set(sub: string, session: NodeSavedSession): Promise<void> {

		const store = await loadOAuthStore();

		store.sessions[sub] = session;

		await saveOAuthStore(store);

	},

	async get(sub: string): Promise<NodeSavedSession | undefined> {

		const store = await loadOAuthStore();

		return store.sessions[sub];

	},

	async del(sub: string): Promise<void> {

		const store = await loadOAuthStore();

		delete store.sessions[sub];

		await saveOAuthStore(store);

	},

};

/**

 * List all stored OAuth session DIDs

 */

export async function listOAuthSessions(): Promise<string[]> {

	const store = await loadOAuthStore();

	return Object.keys(store.sessions);

}

/**

 * Get an OAuth session by DID

 */

export async function getOAuthSession(

	did: string,

): Promise<NodeSavedSession | undefined> {

	const store = await loadOAuthStore();

	return store.sessions[did];

}

/**

 * Delete an OAuth session by DID

 */

export async function deleteOAuthSession(did: string): Promise<boolean> {

	const store = await loadOAuthStore();

	if (!store.sessions[did]) {

		return false;

	}

	delete store.sessions[did];

	await saveOAuthStore(store);

	return true;

}

export function getOAuthStorePath(): string {

	return OAUTH_FILE;

}

// Legacy credentials format (for backward compatibility during migration)

export interface LegacyCredentials {

}

// App password credentials (explicit type)

export interface AppPasswordCredentials {

	type: "app-password";

	pdsUrl: string;

	identifier: string;

	password: string;

}

// OAuth credentials (references stored OAuth session)

export interface OAuthCredentials {

	type: "oauth";

	did: string;

	handle: string;

	pdsUrl: string;

}

// Union type for all credential types

export type Credentials = AppPasswordCredentials | OAuthCredentials;

// Helper to check credential type

export function isOAuthCredentials(

	creds: Credentials,

): creds is OAuthCredentials {

	return creds.type === "oauth";

}

export function isAppPasswordCredentials(

	creds: Credentials,

): creds is AppPasswordCredentials {

	return creds.type === "app-password";