@allstak/wizard 0.1.3

package/dist/credentials/encrypted-file.js

@@ -0,0 +1,139 @@
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync, } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync } from 'node:fs';
+import { homedir, hostname, platform, userInfo } from 'node:os';
+import { dirname, resolve } from 'node:path';
+import { CredentialError } from './types.js';
+/**
+ * Encrypted-file fallback. AES-256-GCM with a key derived from a stable
+ * machine identity (username + hostname + platform). This is NOT as strong as a
+ * real OS keychain — anyone with read access to the file AND knowledge of the
+ * derivation inputs can decrypt — but it does prevent casual file reads from
+ * exposing plaintext tokens.
+ *
+ * Used on:
+ *   - Windows (until native Cred Manager support lands in v0.2)
+ *   - Linux without `secret-tool` / running secret-service
+ *   - any environment where the OS keychain is broken (e.g. containers)
+ *
+ * On disk: ~/.config/allstak/credentials.enc — file mode 0600.
+ *
+ * Format:
+ *   {
+ *     v: 1,
+ *     algo: "aes-256-gcm",
+ *     entries: { "<host>": { iv, salt, authTag, ciphertext } }
+ *   }
+ */
+const FILE_NAME = 'credentials.enc';
+const ALGO = 'aes-256-gcm';
+const KEY_LEN = 32; // 256-bit
+const SALT_LEN = 16;
+const IV_LEN = 12;
+function configDir() {
+    // Follow XDG on Linux; on macOS/Windows we still keep it here for simplicity.
+    // The encrypted file is the same shape on every platform.
+    const xdg = process.env.XDG_CONFIG_HOME;
+    const base = xdg && xdg.length > 0 ? xdg : resolve(homedir(), '.config');
+    return resolve(base, 'allstak');
+}
+function filePath() {
+    return resolve(configDir(), FILE_NAME);
+}
+/**
+ * Derive a 256-bit key from machine identity. NOT a substitute for a hardware
+ * key — but stable across runs without prompting the user for a passphrase.
+ */
+function deriveKey(salt) {
+    const ident = `${userInfo().username}@${hostname()}|${platform()}`;
+    return scryptSync(ident, salt, KEY_LEN);
+}
+function readFile() {
+    const path = filePath();
+    if (!existsSync(path))
+        return { v: 1, algo: ALGO, entries: {} };
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (parsed.v !== 1 || parsed.algo !== ALGO) {
+            throw new CredentialError('E_INCOMPATIBLE', `Credential file at ${path} uses an unknown schema (v=${parsed.v}, algo=${parsed.algo}).`);
+        }
+        return parsed;
+    }
+    catch (err) {
+        if (err instanceof CredentialError)
+            throw err;
+        throw new CredentialError('E_CORRUPT', `Credential file at ${path} is corrupt — delete it and re-run \`allstak login\`.`);
+    }
+}
+function writeFile(file) {
+    const path = filePath();
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(file, null, 2) + '\n', 'utf8');
+    // Restrict to owner read/write only.
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // chmod can fail on some Windows NTFS configurations — the file is still
+        // protected by the encryption layer; we just warn rather than abort.
+    }
+}
+export const encryptedFileStore = {
+    id: 'encrypted-file',
+    label: `Encrypted file (${filePath()})`,
+    serviceName: 'allstak-wizard',
+    async load(host) {
+        const file = readFile();
+        const entry = file.entries[host];
+        if (!entry)
+            return null;
+        try {
+            const salt = Buffer.from(entry.salt, 'hex');
+            const iv = Buffer.from(entry.iv, 'hex');
+            const authTag = Buffer.from(entry.authTag, 'hex');
+            const ciphertext = Buffer.from(entry.ciphertext, 'hex');
+            const key = deriveKey(salt);
+            const decipher = createDecipheriv(ALGO, key, iv);
+            decipher.setAuthTag(authTag);
+            const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+            return JSON.parse(plain.toString('utf8'));
+        }
+        catch (err) {
+            throw new CredentialError('E_DECRYPT', `Could not decrypt credentials for ${host} (${err instanceof Error ? err.message : String(err)}). The machine identity may have changed; re-run \`allstak login\`.`);
+        }
+    },
+    async save(creds) {
+        const salt = randomBytes(SALT_LEN);
+        const iv = randomBytes(IV_LEN);
+        const key = deriveKey(salt);
+        const cipher = createCipheriv(ALGO, key, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(JSON.stringify(creds), 'utf8'),
+            cipher.final(),
+        ]);
+        const entry = {
+            iv: iv.toString('hex'),
+            salt: salt.toString('hex'),
+            authTag: cipher.getAuthTag().toString('hex'),
+            ciphertext: ciphertext.toString('hex'),
+        };
+        const file = readFile();
+        file.entries[creds.host] = entry;
+        writeFile(file);
+    },
+    async clear(host) {
+        const file = readFile();
+        if (!(host in file.entries))
+            return;
+        delete file.entries[host];
+        if (Object.keys(file.entries).length === 0) {
+            try {
+                rmSync(filePath());
+            }
+            catch { /* noop */ }
+        }
+        else {
+            writeFile(file);
+        }
+    },
+};
+//# sourceMappingURL=encrypted-file.js.map

package/dist/credentials/encrypted-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-file.js","sourceRoot":"","sources":["../../src/credentials/encrypted-file.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,IAAI,GAAG,aAAa,CAAC;AAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,UAAU;AAC9B,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,MAAM,GAAG,EAAE,CAAC;AAelB,SAAS,SAAS;IAChB,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,GAAG,QAAQ,EAAE,CAAC,QAAQ,IAAI,QAAQ,EAAE,IAAI,QAAQ,EAAE,EAAE,CAAC;IACnE,OAAO,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAc,CAAC;QACnE,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,sBAAsB,IAAI,8BAA8B,MAAM,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,IAAI,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe;YAAE,MAAM,GAAG,CAAC;QAC9C,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,sBAAsB,IAAI,uDAAuD,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAe;IAChC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,qCAAqC;IACrC,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,qEAAqE;IACvE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,mBAAmB,QAAQ,EAAE,GAAG;IACvC,WAAW,EAAE,gBAAgB;IAE7B,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACjD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgB,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,WAAW,EACX,qCAAqC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qEAAqE,CACpK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAkB;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAC5C,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,KAAK,GAAmB;YAC5B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC5C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;SACvC,CAAC;QACF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACjC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/credentials/error.d.ts

@@ -0,0 +1,11 @@
+import { WizardError } from '../util/errors.js';
+/**
+ * Internal credential-layer error. Always categorised as `E_PERMISSION_DENIED`
+ * at the canonical level (the OS keychain refused or returned a corrupt
+ * payload); the original `subcode` is preserved for grep-ability in debug
+ * logs and migration scenarios (e.g. `E_KEYCHAIN_NOT_FOUND` vs `E_DECRYPT`).
+ */
+export declare class CredentialError extends WizardError {
+    constructor(subcode: string, message: string);
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/credentials/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/credentials/error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,WAAW;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAI7C"}

package/dist/credentials/error.js

@@ -0,0 +1,14 @@
+import { WizardError } from '../util/errors.js';
+/**
+ * Internal credential-layer error. Always categorised as `E_PERMISSION_DENIED`
+ * at the canonical level (the OS keychain refused or returned a corrupt
+ * payload); the original `subcode` is preserved for grep-ability in debug
+ * logs and migration scenarios (e.g. `E_KEYCHAIN_NOT_FOUND` vs `E_DECRYPT`).
+ */
+export class CredentialError extends WizardError {
+    constructor(subcode, message) {
+        super('E_PERMISSION_DENIED', message, { subcode, stage: 'cli' });
+        this.name = 'CredentialError';
+    }
+}
+//# sourceMappingURL=error.js.map

package/dist/credentials/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/credentials/error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,OAAO,eAAgB,SAAQ,WAAW;IAC9C,YAAY,OAAe,EAAE,OAAe;QAC1C,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF"}

package/dist/credentials/index.d.ts

@@ -0,0 +1,20 @@
+import type { CredentialStore } from './types.js';
+/**
+ * Pick the best available credential store for the current platform.
+ *
+ * Order:
+ *   - macOS  → macOS Keychain via `security` (always available on a real Mac)
+ *   - Linux  → Secret Service via `secret-tool` if running, else encrypted-file
+ *   - Win    → Encrypted-file fallback (Cred Manager support is v0.2)
+ *   - other  → Encrypted-file fallback
+ *
+ * The choice is made once per process and cached so subsequent reads/writes hit
+ * the same backend. Override via `ALLSTAK_CREDENTIAL_STORE=encrypted-file` for
+ * tests or troubleshooting.
+ */
+export declare function getCredentialStore(): Promise<CredentialStore>;
+/** Test helper — drop the cached store so the next call re-detects. */
+export declare function resetCredentialStore(): void;
+export type { CredentialStore, Credentials } from './types.js';
+export { CredentialError } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAQlD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,eAAe,CAAC,CA+BnE;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/credentials/index.js

@@ -0,0 +1,56 @@
+import { platform } from 'node:os';
+import { darwinKeychain } from './keychain-darwin.js';
+import { linuxKeychain, isLinuxKeychainAvailable } from './keychain-linux.js';
+import { isWindowsKeychainAvailable, windowsKeychain } from './keychain-win.js';
+import { encryptedFileStore } from './encrypted-file.js';
+let resolved = null;
+/**
+ * Pick the best available credential store for the current platform.
+ *
+ * Order:
+ *   - macOS  → macOS Keychain via `security` (always available on a real Mac)
+ *   - Linux  → Secret Service via `secret-tool` if running, else encrypted-file
+ *   - Win    → Encrypted-file fallback (Cred Manager support is v0.2)
+ *   - other  → Encrypted-file fallback
+ *
+ * The choice is made once per process and cached so subsequent reads/writes hit
+ * the same backend. Override via `ALLSTAK_CREDENTIAL_STORE=encrypted-file` for
+ * tests or troubleshooting.
+ */
+export async function getCredentialStore() {
+    if (resolved)
+        return resolved;
+    const override = process.env.ALLSTAK_CREDENTIAL_STORE;
+    if (override === 'encrypted-file') {
+        resolved = encryptedFileStore;
+        return resolved;
+    }
+    if (override === 'darwin-keychain') {
+        resolved = darwinKeychain;
+        return resolved;
+    }
+    if (override === 'linux-secret-service') {
+        resolved = linuxKeychain;
+        return resolved;
+    }
+    switch (platform()) {
+        case 'darwin':
+            resolved = darwinKeychain;
+            return resolved;
+        case 'linux':
+            resolved = (await isLinuxKeychainAvailable()) ? linuxKeychain : encryptedFileStore;
+            return resolved;
+        case 'win32':
+            resolved = (await isWindowsKeychainAvailable()) ? windowsKeychain : encryptedFileStore;
+            return resolved;
+        default:
+            resolved = encryptedFileStore;
+            return resolved;
+    }
+}
+/** Test helper — drop the cached store so the next call re-detects. */
+export function resetCredentialStore() {
+    resolved = null;
+}
+export { CredentialError } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/credentials/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,IAAI,QAAQ,GAA2B,IAAI,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACtD,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,QAAQ,GAAG,kBAAkB,CAAC;QAC9B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,QAAQ,GAAG,cAAc,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,QAAQ,GAAG,aAAa,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,QAAQ,QAAQ,EAAE,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,QAAQ,GAAG,cAAc,CAAC;YAC1B,OAAO,QAAQ,CAAC;QAClB,KAAK,OAAO;YACV,QAAQ,GAAG,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACnF,OAAO,QAAQ,CAAC;QAClB,KAAK,OAAO;YACV,QAAQ,GAAG,CAAC,MAAM,0BAA0B,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACvF,OAAO,QAAQ,CAAC;QAClB;YACE,QAAQ,GAAG,kBAAkB,CAAC;YAC9B,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB;IAClC,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC;AAGD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/credentials/keychain-darwin.d.ts

@@ -0,0 +1,11 @@
+import type { CredentialStore } from './types.js';
+/**
+ * macOS Keychain via `security` CLI. We avoid native modules (keytar/node-gyp)
+ * to keep the wizard's dep tree small and source-installable from any registry.
+ *
+ * Storage layout: one keychain entry per host. Service is `allstak-wizard`,
+ * account is the host (`https://api.allstak.sa`). Generic password (not internet
+ * password) so the entry is portable across Keychain.app views.
+ */
+export declare const darwinKeychain: CredentialStore;
+//# sourceMappingURL=keychain-darwin.d.ts.map

package/dist/credentials/keychain-darwin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-darwin.d.ts","sourceRoot":"","sources":["../../src/credentials/keychain-darwin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,YAAY,CAAC;AAK/D;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAE,eAgD5B,CAAC"}

package/dist/credentials/keychain-darwin.js

@@ -0,0 +1,88 @@
+import { spawn } from 'node:child_process';
+import { CredentialError } from './types.js';
+const SERVICE = 'allstak-wizard';
+/**
+ * macOS Keychain via `security` CLI. We avoid native modules (keytar/node-gyp)
+ * to keep the wizard's dep tree small and source-installable from any registry.
+ *
+ * Storage layout: one keychain entry per host. Service is `allstak-wizard`,
+ * account is the host (`https://api.allstak.sa`). Generic password (not internet
+ * password) so the entry is portable across Keychain.app views.
+ */
+export const darwinKeychain = {
+    id: 'darwin-keychain',
+    label: 'macOS Keychain',
+    serviceName: SERVICE,
+    async load(host) {
+        try {
+            const raw = await runSecurity([
+                'find-generic-password',
+                '-s', SERVICE,
+                '-a', host,
+                '-w',
+            ]);
+            if (!raw)
+                return null;
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            if (isNotFound(err))
+                return null;
+            throw err;
+        }
+    },
+    async save(creds) {
+        // Delete existing entry first — `security add-generic-password -U` exists
+        // but only on newer macOS; the delete-then-add pattern is portable.
+        try {
+            await runSecurity(['delete-generic-password', '-s', SERVICE, '-a', creds.host]);
+        }
+        catch (err) {
+            if (!isNotFound(err))
+                throw err;
+        }
+        await runSecurity([
+            'add-generic-password',
+            '-s', SERVICE,
+            '-a', creds.host,
+            '-w', JSON.stringify(creds),
+            '-U', // update if exists (no-op after the delete above)
+            '-T', '', // no app whitelist — caller (this CLI) reads via password
+            '-D', 'allstak-wizard credentials',
+        ]);
+    },
+    async clear(host) {
+        try {
+            await runSecurity(['delete-generic-password', '-s', SERVICE, '-a', host]);
+        }
+        catch (err) {
+            if (isNotFound(err))
+                return;
+            throw err;
+        }
+    },
+};
+function runSecurity(args) {
+    return new Promise((resolveP, reject) => {
+        const child = spawn('security', args);
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+        child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+        child.on('error', (err) => reject(err));
+        child.on('exit', (code) => {
+            if (code === 0) {
+                resolveP(stdout.replace(/\n$/, ''));
+            }
+            else {
+                reject(new CredentialError('E_KEYCHAIN', stderr.trim() || `security exited with code ${code}`));
+            }
+        });
+    });
+}
+function isNotFound(err) {
+    if (!(err instanceof CredentialError))
+        return false;
+    return /could not be found/i.test(err.message) || /SecKeychainSearchCopyNext/i.test(err.message);
+}
+//# sourceMappingURL=keychain-darwin.js.map

package/dist/credentials/keychain-darwin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-darwin.js","sourceRoot":"","sources":["../../src/credentials/keychain-darwin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,gBAAgB;IACvB,WAAW,EAAE,OAAO;IAEpB,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC;gBAC5B,uBAAuB;gBACvB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,IAAI;gBACV,IAAI;aACL,CAAC,CAAC;YACH,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAkB;QAC3B,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QAClC,CAAC;QACD,MAAM,WAAW,CAAC;YAChB,sBAAsB;YACtB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,IAAI,EAAE,kDAAkD;YACxD,IAAI,EAAE,EAAE,EAAE,0DAA0D;YACpE,IAAI,EAAE,4BAA4B;SACnC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC5B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF,CAAC;AAEF,SAAS,WAAW,CAAC,IAAc;IACjC,OAAO,IAAI,OAAO,CAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,eAAe,CACxB,YAAY,EACZ,MAAM,CAAC,IAAI,EAAE,IAAI,6BAA6B,IAAI,EAAE,CACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,CAAC,CAAC,GAAG,YAAY,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnG,CAAC"}

package/dist/credentials/keychain-linux.d.ts

@@ -0,0 +1,13 @@
+import type { CredentialStore } from './types.js';
+/**
+ * Linux Secret Service via `secret-tool` (libsecret). Available on most modern
+ * GNOME/KDE-based distros. If `secret-tool` is missing or the user is in a
+ * headless session without a running secret-service daemon, the store gracefully
+ * fails its `available()` check and the encrypted-file fallback is used.
+ *
+ * Schema attributes are stable across versions so users can prune entries with
+ * `secret-tool clear schema=org.allstak.wizard`.
+ */
+export declare const linuxKeychain: CredentialStore;
+export declare function isLinuxKeychainAvailable(): Promise<boolean>;
+//# sourceMappingURL=keychain-linux.d.ts.map

package/dist/credentials/keychain-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-linux.d.ts","sourceRoot":"","sources":["../../src/credentials/keychain-linux.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,YAAY,CAAC;AAM/D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,EAAE,eAwC3B,CAAC;AAEF,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,OAAO,CAAC,CAOjE"}

package/dist/credentials/keychain-linux.js

@@ -0,0 +1,88 @@
+import { spawn } from 'node:child_process';
+import { CredentialError } from './types.js';
+const SCHEMA = 'org.allstak.wizard';
+const SERVICE_LABEL = 'allstak-wizard';
+/**
+ * Linux Secret Service via `secret-tool` (libsecret). Available on most modern
+ * GNOME/KDE-based distros. If `secret-tool` is missing or the user is in a
+ * headless session without a running secret-service daemon, the store gracefully
+ * fails its `available()` check and the encrypted-file fallback is used.
+ *
+ * Schema attributes are stable across versions so users can prune entries with
+ * `secret-tool clear schema=org.allstak.wizard`.
+ */
+export const linuxKeychain = {
+    id: 'linux-secret-service',
+    label: 'Linux Secret Service (libsecret)',
+    serviceName: SERVICE_LABEL,
+    async load(host) {
+        try {
+            const raw = await runSecretTool([
+                'lookup',
+                'schema', SCHEMA,
+                'host', host,
+            ]);
+            if (!raw)
+                return null;
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            if (isMissing(err))
+                return null;
+            throw err;
+        }
+    },
+    async save(creds) {
+        await runSecretTool([
+            'store',
+            '--label', `${SERVICE_LABEL} (${creds.host})`,
+            'schema', SCHEMA,
+            'host', creds.host,
+        ], JSON.stringify(creds));
+    },
+    async clear(host) {
+        try {
+            await runSecretTool(['clear', 'schema', SCHEMA, 'host', host]);
+        }
+        catch (err) {
+            if (isMissing(err))
+                return;
+            throw err;
+        }
+    },
+};
+export async function isLinuxKeychainAvailable() {
+    try {
+        await runSecretTool(['--help']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function runSecretTool(args, stdin) {
+    return new Promise((resolveP, reject) => {
+        const child = spawn('secret-tool', args);
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+        child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+        child.on('error', (err) => reject(new CredentialError('E_SECRET_TOOL', err.message)));
+        child.on('exit', (code) => {
+            if (code === 0)
+                resolveP(stdout.replace(/\n$/, ''));
+            else
+                reject(new CredentialError('E_SECRET_TOOL', stderr.trim() || `secret-tool exited with code ${code}`));
+        });
+        if (stdin !== undefined) {
+            child.stdin.write(stdin);
+            child.stdin.end();
+        }
+    });
+}
+function isMissing(err) {
+    if (!(err instanceof CredentialError))
+        return false;
+    return /no matching/i.test(err.message);
+}
+//# sourceMappingURL=keychain-linux.js.map

package/dist/credentials/keychain-linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-linux.js","sourceRoot":"","sources":["../../src/credentials/keychain-linux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,GAAG,oBAAoB,CAAC;AACpC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAoB;IAC5C,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,aAAa;IAE1B,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC;gBAC9B,QAAQ;gBACR,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;YACH,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAkB;QAC3B,MAAM,aAAa,CACjB;YACE,OAAO;YACP,SAAS,EAAE,GAAG,aAAa,KAAK,KAAK,CAAC,IAAI,GAAG;YAC7C,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,KAAK,CAAC,IAAI;SACnB,EACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CACtB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAc,EAAE,KAAc;IACnD,OAAO,IAAI,OAAO,CAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;;gBAC/C,MAAM,CAAC,IAAI,eAAe,CAC7B,eAAe,EACf,MAAM,CAAC,IAAI,EAAE,IAAI,gCAAgC,IAAI,EAAE,CACxD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,CAAC,CAAC,GAAG,YAAY,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC"}

package/dist/credentials/keychain-win.d.ts

@@ -0,0 +1,13 @@
+import type { CredentialStore } from './types.js';
+/**
+ * Windows Credential Manager via PowerShell's CredentialManager module is too
+ * heavyweight for a tiny wizard. We fall back to `cmdkey` / WinAPI is non-trivial
+ * over CLI. For v0.1.2 the Windows path uses the encrypted-file fallback, which
+ * is itself secure (DPAPI-derived AES-256-GCM via crypto.scrypt + machine-bound
+ * salt). Native Credential Manager support is a v0.2 follow-up.
+ *
+ * This stub explicitly reports unavailable so the multiplexer skips it.
+ */
+export declare const windowsKeychain: CredentialStore;
+export declare function isWindowsKeychainAvailable(): Promise<boolean>;
+//# sourceMappingURL=keychain-win.d.ts.map

package/dist/credentials/keychain-win.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-win.d.ts","sourceRoot":"","sources":["../../src/credentials/keychain-win.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,YAAY,CAAC;AAK/D;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,EAAE,eAW7B,CAAC;AAEF,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,CAGnE"}

package/dist/credentials/keychain-win.js

@@ -0,0 +1,31 @@
+import { spawn } from 'node:child_process';
+import { CredentialError } from './types.js';
+const SERVICE = 'allstak-wizard';
+/**
+ * Windows Credential Manager via PowerShell's CredentialManager module is too
+ * heavyweight for a tiny wizard. We fall back to `cmdkey` / WinAPI is non-trivial
+ * over CLI. For v0.1.2 the Windows path uses the encrypted-file fallback, which
+ * is itself secure (DPAPI-derived AES-256-GCM via crypto.scrypt + machine-bound
+ * salt). Native Credential Manager support is a v0.2 follow-up.
+ *
+ * This stub explicitly reports unavailable so the multiplexer skips it.
+ */
+export const windowsKeychain = {
+    id: 'windows-cred-manager',
+    label: 'Windows Credential Manager (deferred to v0.2)',
+    serviceName: SERVICE,
+    async load() {
+        throw new CredentialError('E_NOT_IMPL', 'Windows Credential Manager not implemented in v0.1.2; using encrypted-file fallback.');
+    },
+    async save() {
+        throw new CredentialError('E_NOT_IMPL', 'Windows Credential Manager not implemented in v0.1.2.');
+    },
+    async clear() { },
+};
+export async function isWindowsKeychainAvailable() {
+    // Intentionally false in v0.1.2.
+    return false;
+}
+// Reserved for the future native implementation. Suppresses unused-import warnings.
+void spawn;
+//# sourceMappingURL=keychain-win.js.map

package/dist/credentials/keychain-win.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain-win.js","sourceRoot":"","sources":["../../src/credentials/keychain-win.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,OAAO,GAAG,gBAAgB,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,+CAA+C;IACtD,WAAW,EAAE,OAAO;IACpB,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,sFAAsF,CAAC,CAAC;IAClI,CAAC;IACD,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,uDAAuD,CAAC,CAAC;IACnG,CAAC;IACD,KAAK,CAAC,KAAK,KAAwC,CAAC;CACrD,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,iCAAiC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,KAAK,KAAK,CAAC"}

package/dist/credentials/types.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Credential persistence layer.
+ *
+ * Stored shape (the entire `Credentials` object is serialised as JSON and
+ * encrypted in the keychain or fallback file):
+ */
+export interface Credentials {
+    /** Schema version — bump if the on-disk format changes incompatibly. */
+    schemaVersion: 1;
+    /** Tenant host this credential set is bound to. */
+    host: string;
+    /** Bearer JWT issued by /api/v1/auth/verify-otp (or /refresh). */
+    accessToken: string;
+    /** Refresh token used to mint new access tokens. */
+    refreshToken: string;
+    /** Absolute UTC time (ms) the access token expires. */
+    accessExpiresAt: number;
+    /** User snapshot returned by the backend at login time. */
+    user: {
+        id: string;
+        email: string;
+        name?: string;
+    };
+    /** ms timestamp when this record was written. */
+    storedAt: number;
+}
+export interface CredentialStore {
+    readonly id: string;
+    /** Human label shown in `whoami` so the user knows where their token lives. */
+    readonly label: string;
+    load(host: string): Promise<Credentials | null>;
+    save(creds: Credentials): Promise<void>;
+    clear(host: string): Promise<void>;
+    /** Unique service account name (used by macOS Keychain / libsecret / wincred). */
+    readonly serviceName: string;
+}
+export { CredentialError } from './error.js';
+//# sourceMappingURL=types.d.ts.map

package/dist/credentials/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/credentials/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,aAAa,EAAE,CAAC,CAAC;IACjB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAKD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/credentials/types.js

@@ -0,0 +1,5 @@
+// CredentialError is exported from a separate module to avoid a circular import
+// (errors.ts → error-codes.ts; this file is imported by errors.ts indirectly
+// via the encrypted-file/keychain modules, so we keep it pure-data here).
+export { CredentialError } from './error.js';
+//# sourceMappingURL=types.js.map

package/dist/credentials/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/credentials/types.ts"],"names":[],"mappings":"AAsCA,gFAAgF;AAChF,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/detect/framework.d.ts

@@ -0,0 +1,28 @@
+import { type PackageManager } from './package-manager.js';
+import { type MonorepoInfo } from './monorepo.js';
+export type IntegrationId = 'react' | 'next' | 'js' | 'react-native' | 'expo' | 'nestjs' | 'fastify' | 'otel' | 'python' | 'go' | 'java' | 'php' | 'ruby' | 'dotnet' | 'flutter';
+export interface DetectedFramework {
+    candidates: IntegrationId[];
+    evidence: Record<IntegrationId, string[]>;
+    packageJson: PackageJsonShape | null;
+    pm: PackageManager;
+    monorepo: MonorepoInfo;
+    /** True when the project root has the file (we still defer to the integration's detector). */
+    hasNextConfig: boolean;
+    hasViteConfig: boolean;
+    hasWebpackConfig: boolean;
+    hasMetroConfig: boolean;
+    hasExpoConfig: boolean;
+    hasAppRouter: boolean;
+    hasPagesRouter: boolean;
+}
+export interface PackageJsonShape {
+    name?: string;
+    version?: string;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    scripts?: Record<string, string>;
+}
+export declare function detectFramework(projectRoot: string): DetectedFramework;
+//# sourceMappingURL=framework.d.ts.map

package/dist/detect/framework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../src/detect/framework.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAElE,MAAM,MAAM,aAAa,GACrB,OAAO,GACP,MAAM,GACN,IAAI,GACJ,cAAc,GACd,MAAM,GACN,QAAQ,GACR,SAAS,GACT,MAAM,GACN,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,KAAK,GACL,MAAM,GACN,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACrC,EAAE,EAAE,cAAc,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,8FAA8F;IAC9F,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CAgItE"}