@amalgm/shell 0.1.116 → 0.1.118

package/README.md

@@ -29,6 +29,9 @@ credential-bearing redirects are rejected, and missing or unreadable stored
 key material fails closed rather than silently rotating a server-pinned
 identity. Recovery stages a separate candidate, requires browser approval and
 candidate-key proof, and promotes only the server-accepted key.
+macOS writes private keys through the native Security framework, Windows uses
+DPAPI, and a mode-0600 file is the verified fallback when the preferred store
+is unavailable; private key material is never placed in a process argument.
 Consumers use the contained `@amalgm/shell/authorization` export; importing
 authorization does not load unrelated native runtime adapters.
 

package/dist/authorization/key-store.d.ts

@@ -13,3 +13,4 @@ export declare function createDeviceKeyStore(input: Readonly<{
     account: string;
     platform?: NodeJS.Platform;
 }>): DeviceKeyStore;
+export declare function createPreferredDeviceKeyStore(primary: DeviceKeyStore, fallback: DeviceKeyStore): DeviceKeyStore;

package/dist/authorization/key-store.js

@@ -1,17 +1,15 @@
-import { execFile } from "node:child_process";
 import { readFileSync, rmSync } from "node:fs";
-import { promisify } from "node:util";
 import { atomicJson } from "../filesystem.js";
+import { createNativeKeyringStore } from "./native-keyring.js";
 import { runSecretProcess } from "./secret-process.js";
-const execFileAsync = promisify(execFile);
-const KEYCHAIN_SERVICE = "com.amalgm.shell.authorization";
 export function createDeviceKeyStore(input) {
     const file = fileStore(input.file);
     const platform = input.platform ?? process.platform;
-    if (platform === "darwin")
-        return preferredStore(keychainStore(input.account), file);
+    if (platform === "darwin") {
+        return createPreferredDeviceKeyStore(createNativeKeyringStore(input.account), file);
+    }
     if (platform === "win32")
-        return preferredStore(dpapiStore(input.file), file);
+        return createPreferredDeviceKeyStore(dpapiStore(input.file), file);
     return file;
 }
 function fileStore(file) {
@@ -21,44 +19,6 @@ function fileStore(file) {
         remove: async () => rmSync(file, { force: true }),
     };
 }
-function keychainStore(account) {
-    return {
-        load: async () => {
-            try {
-                const { stdout } = await execFileAsync("/usr/bin/security", [
-                    "find-generic-password", "-a", account, "-s", KEYCHAIN_SERVICE, "-w",
-                ], { encoding: "utf8", maxBuffer: 64 * 1024 });
-                return JSON.parse(stdout.trim());
-            }
-            catch (error) {
-                const message = errorText(error);
-                if (message.includes("could not be found") || message.includes("SecKeychainSearchCopyNext: -25300")) {
-                    return null;
-                }
-                throw error;
-            }
-        },
-        save: async (key) => {
-            await runSecretProcess("/usr/bin/security", [
-                "add-generic-password", "-U", "-a", account, "-s", KEYCHAIN_SERVICE,
-                "-w",
-            ], `${JSON.stringify(key)}\n`);
-        },
-        remove: async () => {
-            try {
-                await execFileAsync("/usr/bin/security", [
-                    "delete-generic-password", "-a", account, "-s", KEYCHAIN_SERVICE,
-                ], { encoding: "utf8", maxBuffer: 64 * 1024 });
-            }
-            catch (error) {
-                const message = errorText(error);
-                if (!message.includes("could not be found") && !message.includes("SecKeychainSearchCopyNext: -25300")) {
-                    throw error;
-                }
-            }
-        },
-    };
-}
 function dpapiStore(file) {
     const protect = [
         "$ErrorActionPreference='Stop'",
@@ -87,7 +47,7 @@ function dpapiStore(file) {
         remove: async () => rmSync(file, { force: true }),
     };
 }
-function preferredStore(primary, fallback) {
+export function createPreferredDeviceKeyStore(primary, fallback) {
     let selected = null;
     return {
         load: async () => {
@@ -108,9 +68,14 @@ function preferredStore(primary, fallback) {
                 return fallback.save(key);
             try {
                 await primary.save(key);
+                const stored = await primary.load();
+                if (JSON.stringify(stored) !== JSON.stringify(key)) {
+                    throw new Error("The preferred authorization key store did not preserve the key");
+                }
                 selected = "primary";
             }
             catch {
+                await primary.remove();
                 await fallback.save(key);
                 selected = "fallback";
             }
@@ -127,22 +92,30 @@ function preferredStore(primary, fallback) {
 }
 function readStoredJson(file) {
     try {
-        return JSON.parse(readFileSync(file, "utf8"));
+        return parseStoredJson(readFileSync(file, "utf8"));
     }
     catch (error) {
         if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
             return null;
         }
+        if (error && typeof error === "object" && "code" in error && error.code === "authorization_key_corrupt") {
+            throw error;
+        }
         throw Object.assign(new Error("Stored authorization key is unreadable or corrupt"), {
             code: "authorization_key_corrupt",
             cause: error,
         });
     }
 }
-function errorText(error) {
-    if (!error || typeof error !== "object")
-        return String(error);
-    const value = error;
-    return `${String(value.message ?? "")} ${String(value.stderr ?? "")}`;
+function parseStoredJson(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch (error) {
+        throw Object.assign(new Error("Stored authorization key is unreadable or corrupt"), {
+            code: "authorization_key_corrupt",
+            cause: error,
+        });
+    }
 }
 //# sourceMappingURL=key-store.js.map

package/dist/authorization/key-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../../src/authorization/key-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAa1D,MAAM,UAAU,oBAAoB,CAAC,KAInC;IACA,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,CAAkB,IAAI,CAAC;QACvD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;QAC1C,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,mBAAmB,EAAE;oBAC1D,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI;iBACrE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAoB,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;oBACpG,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,gBAAgB,CAAC,mBAAmB,EAAE;gBAC1C,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB;gBACnE,IAAI;aACL,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,mBAAmB,EAAE;oBACvC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB;iBACjE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;oBACtG,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,OAAO,GAAG;QACd,+BAA+B;QAC/B,8DAA8D;QAC9D,sHAAsH;QACtH,qDAAqD;KACtD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,SAAS,GAAG;QAChB,+BAA+B;QAC/B,kEAAkE;QAClE,wHAAwH;QACxH,2DAA2D;KAC5D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,cAAc,CAA4C,IAAI,CAAC,CAAC;YAC/E,IAAI,MAAM,EAAE,OAAO,KAAK,eAAe,IAAI,CAAC,MAAM,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC3E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAC9F,CAAC;YACF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAoB,CAAC;QAC9C,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,UAAU,GAAG,MAAM,gBAAgB,CACvC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAC9F,CAAC;YACF,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,OAAuB,EAAE,QAAwB;IACvE,IAAI,QAAQ,GAAkC,IAAI,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,SAAS,CAAC;gBACrB,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,aAAa;gBAAE,QAAQ,GAAG,UAAU,CAAC;YACzC,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,QAAQ,KAAK,UAAU;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxB,QAAQ,GAAG,SAAS,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzB,QAAQ,GAAG,UAAU,CAAC;YACxB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5D,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;YACvC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAI,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAAE;YAClF,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgD,CAAC;IAC/D,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC"}
+{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../../src/authorization/key-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAavD,MAAM,UAAU,oBAAoB,CAAC,KAInC;IACA,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,6BAA6B,CAAC,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,6BAA6B,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,CAAkB,IAAI,CAAC;QACvD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;QAC1C,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,OAAO,GAAG;QACd,+BAA+B;QAC/B,8DAA8D;QAC9D,sHAAsH;QACtH,qDAAqD;KACtD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,SAAS,GAAG;QAChB,+BAA+B;QAC/B,kEAAkE;QAClE,wHAAwH;QACxH,2DAA2D;KAC5D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,cAAc,CAA4C,IAAI,CAAC,CAAC;YAC/E,IAAI,MAAM,EAAE,OAAO,KAAK,eAAe,IAAI,CAAC,MAAM,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC3E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAC9F,CAAC;YACF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAoB,CAAC;QAC9C,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,MAAM,UAAU,GAAG,MAAM,gBAAgB,CACvC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAC9F,CAAC;YACF,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAuB,EACvB,QAAwB;IAExB,IAAI,QAAQ,GAAkC,IAAI,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,GAAG,SAAS,CAAC;gBACrB,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,aAAa;gBAAE,QAAQ,GAAG,UAAU,CAAC;YACzC,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClB,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,QAAQ,KAAK,UAAU;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;gBACpF,CAAC;gBACD,QAAQ,GAAG,SAAS,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzB,QAAQ,GAAG,UAAU,CAAC;YACxB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5D,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;YACvC,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAI,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,eAAe,CAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YACxG,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAAE;YAClF,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAI,KAAa;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAM,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAAE;YAClF,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/authorization/native-keyring.d.ts

@@ -0,0 +1,8 @@
+import type { DeviceKeyStore } from "./key-store.js";
+export interface NativeKeyringEntry {
+    getPassword(): Promise<string | undefined>;
+    setPassword(password: string): Promise<void>;
+    deleteCredential(): Promise<boolean>;
+}
+export declare function createNativeKeyringStore(account: string): DeviceKeyStore;
+export declare function createNativeKeyringStoreFromEntry(entry: NativeKeyringEntry): DeviceKeyStore;

package/dist/authorization/native-keyring.js

@@ -0,0 +1,35 @@
+const KEYRING_SERVICE = "com.amalgm.shell.authorization";
+export function createNativeKeyringStore(account) {
+    let entry = null;
+    const loadEntry = () => {
+        entry ??= import("@napi-rs/keyring")
+            .then(({ AsyncEntry }) => new AsyncEntry(KEYRING_SERVICE, account));
+        return entry;
+    };
+    return createNativeKeyringStoreFromEntry({
+        getPassword: async () => (await loadEntry()).getPassword(),
+        setPassword: async (password) => (await loadEntry()).setPassword(password),
+        deleteCredential: async () => (await loadEntry()).deleteCredential(),
+    });
+}
+export function createNativeKeyringStoreFromEntry(entry) {
+    return {
+        load: async () => {
+            const value = await entry.getPassword();
+            if (!value)
+                return null;
+            try {
+                return JSON.parse(value);
+            }
+            catch (error) {
+                throw Object.assign(new Error("Stored authorization key is unreadable or corrupt"), {
+                    code: "authorization_key_corrupt",
+                    cause: error,
+                });
+            }
+        },
+        save: async (key) => entry.setPassword(JSON.stringify(key)),
+        remove: async () => { await entry.deleteCredential(); },
+    };
+}
+//# sourceMappingURL=native-keyring.js.map

package/dist/authorization/native-keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-keyring.js","sourceRoot":"","sources":["../../src/authorization/native-keyring.ts"],"names":[],"mappings":"AAEA,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAQzD,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,IAAI,KAAK,GAAuC,IAAI,CAAC;IACrD,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,KAAK,KAAK,MAAM,CAAC,kBAAkB,CAAC;aACjC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,iCAAiC,CAAC;QACvC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,WAAW,EAAE;QAC1D,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC;QAC1E,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,gBAAgB,EAAE;KACrE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAAyB;IACzE,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAoB,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,EAAE;oBAClF,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC"}

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@amalgm/shell",
-  "version": "0.1.116",
+  "version": "0.1.118",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@amalgm/shell",
-      "version": "0.1.116",
+      "version": "0.1.118",
       "license": "UNLICENSED",
       "dependencies": {
         "@amalgm/agents": "0.2.0",
@@ -19,6 +19,7 @@
         "@amalgm/tools": "0.1.3",
         "@anthropic-ai/claude-agent-sdk": "^0.3.224",
         "@homebridge/node-pty-prebuilt-multiarch": "0.13.1",
+        "@napi-rs/keyring": "1.3.0",
         "better-sqlite3": "12.11.1",
         "ws": "8.21.0"
       },
@@ -470,6 +471,212 @@
         }
       }
     },
+    "node_modules/@napi-rs/keyring": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring/-/keyring-1.3.0.tgz",
+      "integrity": "sha512-WrOw/bcXm0f9qHkumlT1QlArXSTWqaY9sunsDpOk+yCCorCKMxvWT/a3xko4EYHVdeZoh00yI2TydXn6eyICDA==",
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "optionalDependencies": {
+        "@napi-rs/keyring-darwin-arm64": "1.3.0",
+        "@napi-rs/keyring-darwin-x64": "1.3.0",
+        "@napi-rs/keyring-freebsd-x64": "1.3.0",
+        "@napi-rs/keyring-linux-arm-gnueabihf": "1.3.0",
+        "@napi-rs/keyring-linux-arm64-gnu": "1.3.0",
+        "@napi-rs/keyring-linux-arm64-musl": "1.3.0",
+        "@napi-rs/keyring-linux-riscv64-gnu": "1.3.0",
+        "@napi-rs/keyring-linux-x64-gnu": "1.3.0",
+        "@napi-rs/keyring-linux-x64-musl": "1.3.0",
+        "@napi-rs/keyring-win32-arm64-msvc": "1.3.0",
+        "@napi-rs/keyring-win32-ia32-msvc": "1.3.0",
+        "@napi-rs/keyring-win32-x64-msvc": "1.3.0"
+      }
+    },
+    "node_modules/@napi-rs/keyring-darwin-arm64": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-arm64/-/keyring-darwin-arm64-1.3.0.tgz",
+      "integrity": "sha512-pl76hJvdYUBn6I24bXiOBMA9nbDapo3I5B+f3OorjDU4dUMSypXeKbOVehJe8fhgTiH24flMyTS3aAIy43xegQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-darwin-x64": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-darwin-x64/-/keyring-darwin-x64-1.3.0.tgz",
+      "integrity": "sha512-YcJtEV5LA3cvA4z3BurgxH5IhTsW1JfIvcAAcqcecwk06Si9F9NqkxbZVIfDwQ8oRHgaBmT3zZJnLAotCrVahw==",
+      "cpu": [
+        "x64"
+      ],
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-freebsd-x64": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-freebsd-x64/-/keyring-freebsd-x64-1.3.0.tgz",
+      "integrity": "sha512-vlLf31TGhfRAaxLDBhg8b89ss0HHD/lyNmL5F3UjSaz5CUXElsJmKYq9fqA/B+cZKUEUcLHHGhF0I/CqcFdaVw==",
+      "cpu": [
+        "x64"
+      ],
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-arm-gnueabihf": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm-gnueabihf/-/keyring-linux-arm-gnueabihf-1.3.0.tgz",
+      "integrity": "sha512-KiWdMMu/Inz/bHHIAGrnF7r54FZDYXuHO6UFF/rhIrshUsxbMG1Rl9lEymNtqqsVo927G0VYcb02FzWQ3iBQRQ==",
+      "cpu": [
+        "arm"
+      ],
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-arm64-gnu": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-gnu/-/keyring-linux-arm64-gnu-1.3.0.tgz",
+      "integrity": "sha512-eyKGpY40lm9Jvs1aD294XRH4y7+TlJM0YVAryZeXA6TX0mb4gMkxVXwSQv7MCwgah7raeUd0dKUb4BPAYIgcMg==",
+      "cpu": [
+        "arm64"
+      ],
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-arm64-musl": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-arm64-musl/-/keyring-linux-arm64-musl-1.3.0.tgz",
+      "integrity": "sha512-iIK6JWHXAJqDrEyLY3TmswwloVyt2vj+04TZnew+uSJ9gnDO8EwRbp3/iw3LpWaXiDO7VomGO6y8I0Id8uBZSw==",
+      "cpu": [
+        "arm64"
+      ],
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-riscv64-gnu": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-riscv64-gnu/-/keyring-linux-riscv64-gnu-1.3.0.tgz",
+      "integrity": "sha512-/PGqrwn6EwgtK6vccASSXJRfOSP4vN1F4ASsIQ+7MdrK6hNvAJ1FZPrIuD5gGGdxezo3F++To2Wq7DbuGIeuNQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-x64-gnu": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-gnu/-/keyring-linux-x64-gnu-1.3.0.tgz",
+      "integrity": "sha512-2PDK1WKWTu9lBGq9VvNEkSlQD3O7YwVpmnyN2M3cy4v7NJ/8gDMd9GXv3G+FVXN13uhp4gnnPBS+ScefmEeD2A==",
+      "cpu": [
+        "x64"
+      ],
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-linux-x64-musl": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-linux-x64-musl/-/keyring-linux-x64-musl-1.3.0.tgz",
+      "integrity": "sha512-oJ2HkX8YUo46QBkn0pG+HuIKQNqr523q6vBobCn+P95s4C4K6/kLBqHY/1bg5J4ap31DzsznhnFKcfBNBsjCnw==",
+      "cpu": [
+        "x64"
+      ],
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-win32-arm64-msvc": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-arm64-msvc/-/keyring-win32-arm64-msvc-1.3.0.tgz",
+      "integrity": "sha512-tOd3c/uAaeoE4ycVlmAdSvygz0Zt3zdca6Y7gokBeIbaRDWpjDIUOpU3MvML59XAaqyuKGsVVu0F/DZb1lHPmw==",
+      "cpu": [
+        "arm64"
+      ],
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-win32-ia32-msvc": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-ia32-msvc/-/keyring-win32-ia32-msvc-1.3.0.tgz",
+      "integrity": "sha512-sPSqeAFZMGqP1R++M2JTza7GQJJ/TpCo6JU6Vcd4jnebvOaEDs9b7eipakU1PJdSvhpC2yXMCNRk9gXfrhuwHQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/@napi-rs/keyring-win32-x64-msvc": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@napi-rs/keyring-win32-x64-msvc/-/keyring-win32-x64-msvc-1.3.0.tgz",
+      "integrity": "sha512-4DnCWXwDc0HRKwyRlG5y0VhKZW2tNRQfKKfyj6IX/KWfDNyq9hn4n+GL1auyDcOO/v8PwnhmYo2+rOOqCkvvOg==",
+      "cpu": [
+        "x64"
+      ],
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      }
+    },
     "node_modules/@openai/codex": {
       "version": "0.150.0",
       "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.150.0.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/shell",
-  "version": "0.1.116",
+  "version": "0.1.118",
   "description": "The Amalgm runtime host assembled from the published @amalgm SDK capabilities.",
   "type": "module",
   "private": false,
@@ -54,6 +54,7 @@
     "@amalgm/tools": "0.1.3",
     "@anthropic-ai/claude-agent-sdk": "^0.3.224",
     "@homebridge/node-pty-prebuilt-multiarch": "0.13.1",
+    "@napi-rs/keyring": "1.3.0",
     "better-sqlite3": "12.11.1",
     "ws": "8.21.0"
   },